mod_proxy.html.en

Apache 2.0.63 is the current stable version of the 2.0 series, and is recommended over any previous

      arbitrary hosts while hiding his or her true identity.  This is
      dangerous both for your network and for the Internet at large.
      When using a reverse proxy (using the <code class="directive"><a href="#proxypass">ProxyPass</a></code> directive with
      <code>ProxyRequests Off</code>), access control is less
      critical because clients can only contact the hosts that you
      have specifically configured.</p>

    </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
<div class="section">
<h2><a name="ftp-proxy" id="ftp-proxy">FTP Proxy</a></h2>


    <h3><a name="mimetypes" id="mimetypes">Why doesn't file type <var>xxx</var>
    download via FTP?</a></h3>
      <p>You probably don't have that particular file type defined as
      <code>application/octet-stream</code> in your proxy's mime.types
      configuration file. A useful line can be</p>

      <div class="example"><pre>application/octet-stream   bin dms lha lzh exe class tgz taz</pre></div>
     

    <h3><a name="type" id="type">How can I force an FTP ASCII download of
    File <var>xxx</var>?</a></h3>
      <p>In the rare situation where you must download a specific file using the
      FTP <code>ASCII</code> transfer method (while the default transfer is in
      <code>binary</code> mode), you can override <code class="module"><a href="../mod/mod_proxy.html">mod_proxy</a></code>'s
      default by suffixing the request with <code>;type=a</code> to force an
      ASCII transfer. (FTP Directory listings are always executed in ASCII mode,
      however.)</p>
     

    <h3><a name="percent2fhck" id="percent2fhck">How can I access FTP files outside
    of my home directory?</a></h3>
      <p>An FTP URI is interpreted relative to the home directory of the user
      who is logging in. Alas, to reach higher directory levels you cannot
      use /../, as the dots are interpreted by the browser and not actually
      sent to the FTP server. To address this problem, the so called <dfn>Squid
      %2f hack</dfn> was implemented in the Apache FTP proxy; it is a
      solution which is also used by other popular proxy servers like the <a href="http://www.squid-cache.org/">Squid Proxy Cache</a>. By
      prepending <code>/%2f</code> to the path of your request, you can make
      such a proxy change the FTP starting directory to <code>/</code> (instead
      of the home directory). For example, to retrieve the file
      <code>/etc/motd</code>, you would use the URL:</p>

      <div class="example"><p><code>
        ftp://<var>user</var>@<var>host</var>/%2f/etc/motd
      </code></p></div>
     

    <h3><a name="ftppass" id="ftppass">How can I hide the FTP cleartext password
    in my browser's URL line?</a></h3>
      <p>To log in to an FTP server by username and password, Apache uses
      different strategies. In absense of a user name and password in the URL
      altogether, Apache sends an anonymous login to the FTP server,
      <em>i.e.</em>,</p>

      <div class="example"><p><code>
        user: anonymous<br />
        password: apache_proxy@
      </code></p></div>

      <p>This works for all popular FTP servers which are configured for
      anonymous access.</p>

      <p>For a personal login with a specific username, you can embed the user
      name into the URL, like in:</p>

      <div class="example"><p><code>
        ftp://<var>username</var>@<var>host</var>/myfile
      </code></p></div>

      <p>If the FTP server asks for a password when given this username (which
      it should), then Apache will reply with a <code>401</code> (Authorization
      required) response, which causes the Browser to pop up the
      username/password dialog. Upon entering the password, the connection
      attempt is retried, and if successful, the requested resource is
      presented. The advantage of this procedure is that your browser does not
      display the password in cleartext (which it would if you had used</p>

      <div class="example"><p><code>
        ftp://<var>username</var>:<var>password</var>@<var>host</var>/myfile
      </code></p></div>

      <p>in the first place).</p>

      <div class="note"><h3>Note</h3>
        <p>The password which is transmitted in such a way is not encrypted on
        its way. It travels between your browser and the Apache proxy server in
        a base64-encoded cleartext string, and between the Apache proxy and the
        FTP server as plaintext. You should therefore think twice before
        accessing your FTP server via HTTP (or before accessing your personal
        files via FTP at all!) When using unsecure channels, an eavesdropper
        might intercept your password on its way.</p>
      </div>
     
   </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
<div class="section">
<h2><a name="startup" id="startup">Slow Startup</a></h2>
      <p>If you're using the <code class="directive"><a href="#proxyblock">ProxyBlock</a></code> directive, hostnames' IP addresses are looked up
      and cached during startup for later match test. This may take a few
      seconds (or more) depending on the speed with which the hostname lookups
      occur.</p>
    </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
<div class="section">
<h2><a name="intranet" id="intranet">Intranet Proxy</a></h2>
      <p>An Apache proxy server situated in an intranet needs to forward
      external requests through the company's firewall (for this, configure
      the <code class="directive"><a href="#proxyremote">ProxyRemote</a></code> directive
      to forward the respective <var>scheme</var> to the firewall proxy).
      However, when it has to
      access resources within the intranet, it can bypass the firewall when
      accessing hosts. The <code class="directive"><a href="#noproxy">NoProxy</a></code>
      directive is useful for specifying which hosts belong to the intranet and
      should be accessed directly.</p>

      <p>Users within an intranet tend to omit the local domain name from their
      WWW requests, thus requesting "http://somehost/" instead of
      <code>http://somehost.example.com/</code>. Some commercial proxy servers
      let them get away with this and simply serve the request, implying a
      configured local domain. When the <code class="directive"><a href="#proxydomain">ProxyDomain</a></code> directive is used and the server is <a href="#proxyrequests">configured for proxy service</a>, Apache can return
      a redirect response and send the client to the correct, fully qualified,
      server address. This is the preferred method since the user's bookmark
      files will then contain fully qualified hosts.</p>
    </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
<div class="section">
<h2><a name="envsettings" id="envsettings">Protocol Adjustments</a></h2>
      <p>For circumstances where you have a application server which doesn't
      implement keepalives or HTTP/1.1 properly, there are 2 environment
      variables which when set send a HTTP/1.0 with no keepalive. These are set
      via the  <code class="directive"><a href="../mod/mod_env.html#setenv">SetEnv</a></code> directive.</p>

      <p>These are the <code>force-proxy-request-1.0</code> and
      <code>proxy-nokeepalive</code> notes.</p>

      <div class="example"><p><code>
        &lt;Location /buggyappserver/&gt;<br />
        <span class="indent">
          ProxyPass http://buggyappserver:7001/foo/<br />
          SetEnv force-proxy-request-1.0 1<br />
          SetEnv proxy-nokeepalive 1<br />
        </span>
        &lt;/Location&gt;
      </code></p></div>
    </div>
<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
<div class="directive-section"><h2><a name="AllowCONNECT" id="AllowCONNECT">AllowCONNECT</a> <a name="allowconnect" id="allowconnect">Directive</a></h2>
<table class="directive">
<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Ports that are allowed to <code>CONNECT</code> through the
proxy</td></tr>
<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AllowCONNECT <var>port</var> [<var>port</var>] ...</code></td></tr>
<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>AllowCONNECT 443 563</code></td></tr>
<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr>
<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_proxy</td></tr>
</table>
    <p>The <code class="directive">AllowCONNECT</code> directive specifies a list
    of port numbers to which the proxy <code>CONNECT</code> method may
    connect.  Today's browsers use this method when a <code>https</code>
    connection is requested and proxy tunneling over HTTP is in effect.</p>

    <p>By default, only the default https port (<code>443</code>) and the
    default snews port (<code>563</code>) are enabled. Use the
    <code class="directive">AllowCONNECT</code> directive to override this default and
    allow connections to the listed ports only.</p>

    <p>Note that you'll need to have <code class="module"><a href="../mod/mod_proxy_connect.html">mod_proxy_connect</a></code> present
    in the server in order to get the support for the <code>CONNECT</code> at
    all.</p>

</div>
<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
<div class="directive-section"><h2><a name="NoProxy" id="NoProxy">NoProxy</a> <a name="noproxy" id="noproxy">Directive</a></h2>
<table class="directive">
<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Hosts, domains, or networks that will be connected to
directly</td></tr>
<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>NoProxy <var>host</var> [<var>host</var>] ...</code></td></tr>
<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr>
<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_proxy</td></tr>
</table>
    <p>This directive is only useful for Apache proxy servers within
    intranets.  The <code class="directive">NoProxy</code> directive specifies a
    list of subnets, IP addresses, hosts and/or domains, separated by
    spaces. A request to a host which matches one or more of these is
    always served directly, without forwarding to the configured
    <code class="directive"><a href="#proxyremote">ProxyRemote</a></code> proxy server(s).</p>

    <div class="example"><h3>Example</h3><p><code>
      ProxyRemote  *  http://firewall.mycompany.com:81<br />
      NoProxy         .mycompany.com 192.168.112.0/21
    </code></p></div>

    <p>The <var>host</var> arguments to the <code class="directive">NoProxy</code>
    directive are one of the following type list:</p>

    <dl>
    
    <dt><var><a name="domain" id="domain">Domain</a></var></dt>
    <dd>
    <p>A <dfn>Domain</dfn> is a partially qualified DNS domain name, preceded
    by a period. It represents a list of hosts which logically belong to the
    same DNS domain or zone (<em>i.e.</em>, the suffixes of the hostnames are
    all ending in <var>Domain</var>).</p>