# Nginx as an AUTH + proxy\_pass in front of a mail server on the LAN; I'm missing something about pass

**URL:** <https://www.ruby-forum.com/t/nginx-as-an-auth-proxy-pass-in-front-of-a-mail-server-on-the-lan-im-missing-something-about-pass/246236>\
**Category:** NGINX\
**Created:** [September 22, 2013, 7:12pm UTC](https://www.ruby-forum.com/t/nginx-as-an-auth-proxy-pass-in-front-of-a-mail-server-on-the-lan-im-missing-something-about-pass/246236 "2013-09-22T19:12:40Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sadaf\_N](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/858c86/32.png) [@Sadaf\_N](https://www.ruby-forum.com/u/Sadaf_N)\
**Post date:** [September 22, 2013, 7:12pm UTC](https://www.ruby-forum.com/t/nginx-as-an-auth-proxy-pass-in-front-of-a-mail-server-on-the-lan-im-missing-something-about-pass/246236/1 "2013-09-22T19:12:40Z")

</div>

I have a mail server on my lan. It exposes a WebUI over SSL on  
port:443.

It currently only has 1-step, password authentication. I want to add a  
2nd layer of authentication, and put that mailserver behind an nginx  
server that:

(1) adds BASIC authentication,  
and  
(2) after OK auth, transparently passes traffic to/from the mail  
server

Here’s the nginx config I use to do this:

* * *

upstream mail-secure {  
server [mail.mydomain.com:443](http://mail.mydomain.com:443);  
}

server {  
server\_name [passthru.mydomain.com](http://passthru.mydomain.com);  
more\_set\_headers “Server: Secure WebMail”;  
listen 1.2.3.4:12345 ssl spdy default\_server;

```
    root /svr/data/passthru.mydomain.com;
    access_log
    /var/log/nginx/passthru.mydomain.com.12345.access.log main;
    error_log
    /var/log/nginx/passthru.mydomain.com.12345.error.log error;
    rewrite_log on;
    ssl on; include
    includes/ssl_protocol.conf;
    ssl_verify_client off;
    ssl_certificate
    "/svr/sec/ssl/ComodoCert/mydomain.crt";
    ssl_certificate_key
    "/svr/sec/ssl/ComodoCert/mydomain.key";
    add_header Strict-Transport-Security "max-age=315360000;
    includeSubdomains";

    gzip on;
    gzip_http_version 1.0;
    gzip_comp_level 6;
    gzip_proxied any;
    gzip_min_length 1100;
    gzip_buffers 16 8k;
    gzip_types text/plain text/css application/x-javascript
    text/xml application/xml application/xml+rss text/javascript;
    gzip_disable "MSIE [1-6].(?!.*SV1)";
    gzip_vary on;

    add_header Vary "Accept-Encoding";

    location / {
            auth_basic "Restricted Remote";
            auth_basic_user_file /svr/sec/auth/passwd.basic;
            proxy_pass https://mail-secure;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For
            $proxy_add_x_forwarded_for;
    }

```

}------------------------------------

This works – mostly.

If I visit [https://passthru.mydomain.com:12345](https://passthru.mydomain.com:12345), I get the Nginx BASIC  
auth dialog, like you’d expect.

If I enter OK credentials, thru to the mail server. Except that the 1st  
redirection from the server I get is to

[https://passthru.mydomain.com/h/search?mesg=welcome&init=true](https://passthru.mydomain.com/h/search?mesg=welcome&init=true)

which fails because it’s at the wrong port. NOTE that there’s no  
“:12345” in the URL.

If I simply mod that URL

- 

## [https://passthru.mydomain.com/h/search?mesg=welcome&init=true](https://passthru.mydomain.com/h/search?mesg=welcome&init=true)

[https://passthru.mydomain.com:12345/h/search?mesg=welcome&init=true](https://passthru.mydomain.com:12345/h/search?mesg=welcome&init=true)

, adding the port, everything works after that. I can interact with &  
use the mail server’s UI no problem.

I suspect I need to pass an additional header, proxy parameter, etc –  
but have no clue yet what/which.

Any ideas/suggestions what’s missing or wrong here?

Thanks,

Jen

---

<div class="post-metadata">

**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\
**Post date:** [September 22, 2013, 10:14pm UTC](https://www.ruby-forum.com/t/nginx-as-an-auth-proxy-pass-in-front-of-a-mail-server-on-the-lan-im-missing-something-about-pass/246236/2 "2013-09-22T22:14:23Z")

</div>

On Sun, Sep 22, 2013 at 10:11:50AM -0700, [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

Hi there,

untested; and it may depend on exactly who is doing the redirecting,  
but does replacing this line:

> ```
> proxy_set_header Host $host;
> 
> ```

with

proxy\_set\_header Host $host:12345;

change how it responds?

## f

Francis D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\
**Post date:** [September 22, 2013, 10:28pm UTC](https://www.ruby-forum.com/t/nginx-as-an-auth-proxy-pass-in-front-of-a-mail-server-on-the-lan-im-missing-something-about-pass/246236/3 "2013-09-22T22:28:24Z")

</div>

Hi Francis,

On Sun, Sep 22, 2013, at 01:13 PM, Francis D. wrote:

> untested; and it may depend on exactly who is doing the redirecting,  
> but does replacing this line:
> 
> > ```
> > proxy_set_header Host $host;
> > 
> > ```
> 
> with
> 
> proxy\_set\_header Host $host:12345;
> 
> change how it responds?

That sounded promising, but, unfortunately … no.

Same beahvior – initial reponse is without the portnum; add it  
manually, and all’s well.

Jen

---

<div class="post-metadata">

**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\
**Post date:** [September 22, 2013, 10:33pm UTC](https://www.ruby-forum.com/t/nginx-as-an-auth-proxy-pass-in-front-of-a-mail-server-on-the-lan-im-missing-something-about-pass/246236/4 "2013-09-22T22:33:05Z")

</div>

I lied! Sort of …

After making your suggested change, and restarting nginx, no change.

BUT, after a machine reboot – it now works as expected. Actis like  
something got stuck in some cache …

thanks a lot!

---

<div class="post-metadata">

**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\
**Post date:** [September 22, 2013, 10:36pm UTC](https://www.ruby-forum.com/t/nginx-as-an-auth-proxy-pass-in-front-of-a-mail-server-on-the-lan-im-missing-something-about-pass/246236/5 "2013-09-22T22:36:35Z")

</div>

On Sun, Sep 22, 2013 at 01:28:02PM -0700, [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> On Sun, Sep 22, 2013, at 01:13 PM, Francis D. wrote:

Hi there,

> > proxy\_set\_header Host $host:12345;

> That sounded promising, but, unfortunately … no.
> 
> Same beahvior – initial reponse is without the portnum; add it  
> manually, and all’s well.

Fair enough.

Can you learn which part of the system creates the initial response? And  
from what does it create it?

With that information, you may be able to learn what needs changing to  
get the result you want.

What is the output of

curl -i [https://passthru.mydomain.com:12345/](https://passthru.mydomain.com:12345/)

(possibly with a “-k” in there, if the cert is a problem)?

## f

Francis D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\
**Post date:** [September 22, 2013, 11:16pm UTC](https://www.ruby-forum.com/t/nginx-as-an-auth-proxy-pass-in-front-of-a-mail-server-on-the-lan-im-missing-something-about-pass/246236/6 "2013-09-22T23:16:19Z")

</div>

> Fair enough.

Our responses “crossed in the mail”! 🙂

Thanks,

Jen