[SOLVED] zimbraHttpThrottleSafeIPs and proxy

[axslingr]

Hey guys, I'm having an issue where my users are getting the 'network service error' periodically due to authentication failures against the web client. The problem is that the ip address of the proxy server in front of the mailbox server is the ip that's getting suspended:

Code: Select all

2018-01-03 16:26:23,835 INFO  [qtp1595953398-1805:http://localhost:8080/service/soap/AuthRequest] [] misc - Access from IP 192.168.100.11 suspended, for repeated failed login.

192.168.100.11 is the proxy ip. Should I add this ip to the safe list or no? If no, what is the best way to get around this? I keep having to restart the mailbox service as a workaround.

Thanks!
Lance

Release 8.8.5.GA.1894.UBUNTU14.64 UBUNTU14_64 FOSS edition.

[axslingr]

I think I may have stumbled onto the answer:

https://wiki.zimbra.com/wiki/Log_Files# ... inating_IP

i've added my proxy ip to zimbraMailTrustedIP and restarted mailbox service. zimbra_http_originating_ip_header = X-Forwarded-For was already set.

Will post back results.

Lance

[axslingr]

Well, as luck would have it, I haven't had any other break-in attempts yet. Still waiting...

Lance

[axslingr]

Finally got some break-in attempts and following the wiki link above worked.

Lance

[L. Mark Stone]

Finally got some break-in attempts and following the wiki link above worked.

Lance

Good to hear! For others who may come across this thread, 8.7 and above allows CIDR addressing for safe IP addresses, as documented here:
https://wiki.zimbra.com/wiki/DoSFilter

All the best,
Mark