Skip to main content
ram76
ram76
Silver ⭐️⭐️⭐️
March 22, 2022
Question

Preserve Source client IP address when use Load Balancer to connect to CM console

Hello All,

 

We are connecting to CM console via F5 Load Balancer (Reverse Proxy). We are trying to enable X-Forwarded-For (XFF) in HTTP header, to get actual source client IP address from the CM Audits log.

 

How can I enable CM server to read XFF HTTP header for the source client IP address instead of reading source IP address from layer 3?

 

Thank you in advance.

3 replies

mszurap
Platinum ⭐️
mszurap
Platinum ⭐️
March 24, 2022

Hello @ram76 ,

 

You can configure Hue to use the XFF header:

[desktop]
use_x_forwarded_host=true

See hue.ini reference:

https://github.com/cloudera/hue/blob/master/desktop/conf.dist/hue.ini

If not already done, besides using an external load-balancer (like F5 - to let the end users remember only a single Hue login URL) please consider to add "Hue Load Balaner" role in CM > Hue service  (which sets up an Apache httpd) to serve the static contents.

See the following for more:

https://docs.cloudera.com/documentation/enterprise/6/6.3/topics/hue_use_add_lb.html#hue_use_add_lb 

Hope this helps. Best regards, Miklos

Translate
    ram76
    ram76Author
    Silver ⭐️⭐️⭐️
    March 25, 2022

    Hi @mszurap ,

     

    Thank you for the solution, I guess this would help to audit HUE access, though I was I looking for CM Audits.

     

    For HUE I assume I need to add the parameter you mentioned in the following HUE configuration item.

    Hue Service Advanced Configuration Snippet (Safety Valve) for hue_safety_valve.ini

     

    Regarding to the preserve source client IP when login into CM console. I did log a ticket Cloudera Support and apparently there is JIRA OPSAPS-41615 was raised for this enhancement for CM server able to read XFF header. I don't have the access to the JIRA. I am not sure if you do.

     

    Thanks again for the solution for HUE. I will try to test it my environment and I will update you.

     

    Kind regards,

    Rama.

    Translate
    mszurap
    Platinum ⭐️
    mszurap
    Platinum ⭐️
    March 25, 2022

    Hi Rama, yes, you can configure that in the "Hue Service Advanced Configuration Snippet (Safety Valve) for hue_safety_valve.ini".

    OPSAPS-41615 is still open, in the future you can ask the status from any of your account team contacts. If you don't know who are those contacts, please ask/clarify that through the already open support case.

    Best regards,  Miklos

    Translate
    Terms & ConditionsAccessibility statement