Squid is an open Open Source full-featured web proxy cache server application which provides proxy and cache services for Hyper Text Transport Protocol (HTTP), File Transfer Protocol (FTP), and other popular network protocols. Squid can implement caching and proxying of Secure Sockets Layer (SSL) requests and caching of Domain Name Server (DNS) lookups, and perform transparent caching. It reduces bandwidth and improves response times by caching and reusing frequently-requested web pages. It has extensive access controls and makes a great server accelerator. A Squid proxy server is generally installed on a separate server than the Web server with the original files that works by tracking object use over the network. Squid will initially act as an intermediary, simply passing the client’s request on to the server and saving a copy of the requested object. If the same client or multiple clients request the same object before it expires from Squid’s cache, Squid can then immediately serve it, accelerating the download and saving bandwidth.

Squid is used by hundreds of Internet Providers in the World to provide their users with the best possible web access. It runs on most available operating systems, including Windows and is licensed under the GNU GPL. Let’s see how you can setup your Squid Proxy Server to create your own proxies on Ubuntu 16.04 by following the instructions in this article.

In order to setup your own Squid proxy server on Ubuntu 16.04. You need to login on your system with sudo or root user credentials. To do so connect to your Ubuntu serer using Putty or with ssh.

The next you need to set up an alternative user account with a reduced scope of influence for day-to-day work.

You will be asked few questions, starting with the 

 password and fill in any of the additional information if you would like as its optional.

Next allow this user to root user privileges adding it to sudoers group.

Now you can run commands with superuser privileges with sudo commands.

Once you have created your general user with sudo privileges, then update your system software for missing security patches and latest version updates available by using below command.

# sudo apt-get update && sudo apt-get -y upgrade

Once the your system is back with all updates and security patches, then move to the next step.

Step 2 : How to install Squid on Ubuntu 16

The installation of Squid proxy server on an Ubuntu server is pretty straightforward as its available in the Ubuntu repositories. Run the command below to install squid on your system as shown.

Type ‘Y’ for yes and hit ‘Enter’ key to continue installing the squid package along with its required dependencies.

Step 3: How to Configure Squid Proxy Server

The default configuration file for squid is located under ‘/etc/squid/squid.conf‘ which contains some configuration directives that needs to be configured to affect the behavior of the Squid. To edit the configuration file, first take the backup of the original file so that we can revert any changes that goes wrong.

# cp /etc/squid/squid.conf /etc/squid/squid.conf.org

Squid listens on port 3128 by default and if you would like to change the default listening port you can do by to editing the ‘http_port’ directive in the configuration file.

Next to allow access to the HTTP proxy server from all IP addresses, you need to edit the ‘http_access’ directive as by default, the HTTP proxy server will not allow access to anybody.

Save and close the configuration file and make sure to restart squid server service to impact the changes.

To use Squid as an HTTP proxy, let’s configure it to use only the client IP address for authentication and restrict all other access.

Open the configuration file using any of your favourite editor to add a new ACL in it.

acl k_vm src 111.11.11.11  # Your Servers IP 
 http_access allow k_vm

Here k_vm is a name identifying the connection to our VM and ‘111.11.11.11’ is our local IP address, so you can replace this with your own IP and Hostname.

Save and close the using using ‘:wq!’ and restart squid service by issuing below command.

Next, we are going test our proxy server functionality if its working fine or not. To do so open your favourite web browser, like if you are using 

Options > Advanced > Network > Connection Settings

 provided by the IP address of your squid server and its port as shown.

That’s it, now click on ‘OK’ key to continue working under the limits of your squid proxy server and like the same way you can do the same settings for any other web browser.

Now you may check the logs files if you faced any errors or if you want to know which websites are being visited by people using Squid proxy settings using squid logs files located in ‘/var/log/squid/’ directory.

You can also change the default location of your logs files by making changes in the Squid configuration file.

Step 5: Setup Basic User and Password Authentication in Squid

Now let’s see how we can configure Squid Proxy server that allows authenticated access to the Squid service using usernames and passwords. We are going to use “ncsa_auth” that allows Squid to read and authenticate user and password information from an NCSA httpd-style password file when using basic HTTP authentication.

Open the squid configuration file to add following line

auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/passwd
auth_param basic realm proxy
acl authenticated proxy_auth REQUIRED
http_access allow authenticated

Save and close the configuration file and then run below command to create a new empty file for storing squid credentials.

Next we will be using below command to generate password for a user like ‘kash’ that will going to access the squid proxy server. You will be required to type the password for this as shown.

The ‘-c’ argument in this command will 

 the “htpasswd” to use CRYPT encryption of the password. After this restart your squid service so that the configuration can be updated.

When you open your web browser followed the FQDN or IP address of your squid proxy server, a popup will be opened for authentication. You need to provide the user and name and its password that we have created earlier.

Step 6: IP Whitelisting from Authentication

In this section we are going to configure Squid IP whitelist, to limit connections to Squid proxy server only from particular IPs and to to allow specific ip address to be exempted from all the restriction.

For this purpose we have to configure ACLs matching our desired IPs and use them together with 

 directive. Open the Squid configuration file to add following line to allow an IP address to connect to the Squid proxy.

# Allowed clients
 acl white_list src xx.xx.xx.xx
 http_access allow white_list
 http_access deny all

You can add multiple IPs to whitelist and make sure that the last entry, always below ALLOW entries. For multiple IPs whitelisting you will create list of ip address in a file then point this file in acl by giving path.

xx.xx.xx.1
xx.xx.xx.2
xx.xx.xx.3
xx.xx.xx.4

Save and close the file and then put the following two lines in ‘squid.conf’ file but make sure to add this ACL above to any restricted Access List.

acl allowed_ips src “/etc/squid/allowed_ips.txt”
http_access allow allowed_ips


That’s it, save and close the configuration file and restart your squid service to make your whitelisted IPs working.

In this article you have learnt about the basic server setup for Ubuntu, and the installation and configuration of Squid Proxy server on Ubuntu 16.04. At the end this article you will be able to use Squid for caching. This means the contents of site A are saved locally at your Squid. When a second user requests site A Squid will deliver the content. So the user has it some what faster. You can control the traffic for malicious content and if found, remove it. You can restrict the access to certain websites. Of course there are some „bad“ things Squid allows you to do (Control your users, record which sites they visit etc.).

How to create your own HTTP Proxies using Squid Proxy on Ubuntu 16.04

HTTPoxy also known has CGI application vulnerability has been uncovered on July eighteenth, 2016. When reaching backing services, an attacker can trigger vulnerable deployments by passing an HTTP Proxy header with their demand, which will modify the URL utilized by the application.

The CGI speciation requested for client-provided headers to be passed to the environment with an HTTP_ prefix for namespacing. The vulnerability is caused by what is known as a collision between the HTTP_PROXY environmental variable, continually used to indicate the location of a backend proxy service, and the Proxy HTTP client header. In the event that a CGI application or a library uses this variable without extra processing, it could end up utilizing the esteem gave by the client when attempting to connect to the proxy service and this may clash with configuration variables such as HTTP_PROXY which begin with HTTP_.

Since 2001, the HTTPoxy vulnerability has been known in some forms yet never perceive as a cross board issue until recently. Various security vulnerability identifiers have been generated: CVE-2016-5386, CVE-2016-53887, CVE-2016-5388, CVE-2016-1000109, and CVE-2016-1000110 (At the time of this writing, these are reserved, but not filled out) as this vulnerability impacts an assortment of CGI-like implementations. In spite of the fact that it may impact many deployments, relief is quite straight forward and simple.

HTTPoxy is found by numerous CGI implementations and is generally vulnerability. A server or application can effectively execute the CGI specification and still be vulnerable.

In order for a deployment to be vulnerable, it must:

To know if your deployment is been affected, Luke Rehmann has developed a simple site to check publicly accessible sites for vulnerability. As you can see, combinations of deployment- and application- particular variables are vital for a deployment to be vulnerable.

Since CGI-like deployments are substantially more regular in the PHP ecosystem than in other languages, then PHP applications, in particular, ought to be reviewed. Moreover, the widespread usage of the getenv strategy in popular libraries intensifies this issue, as it is not instantly clear that these will not just configuration variables but will likewise return unsanitized client input. Specific libraries that are as of now influence are Artax, Guzzle (version 4.0.0rc2 and greater), and Composer’s Stream Context Builder class.

If CGI is been used, libraries that naively read the HTTP_PROXY variable without stabilizing their behavior are vulnerable. However, some other languages that are believed to be vulnerable when deployed utilizing CGI were Go and 

 and these languages are commonly deployed utilizing other, non-vulnerable strategies

Step by Step Instruction to Defeat the Vulnerability

The vulnerability can be managed by the web server layer or the library or application and luckily, HTTPoxy is generally easy to fix:

Consider using an alternative variable that will not crash when running in a CGI-like environment if you are a library or application author and your project relies on the HTTP_PROXY variable to configure a proxy backend. Ruby and some other projects use CGI_HTTP_PROXY for this purpose. If you are using a vulnerable library, you ought to ease the risk on the server end until patches are accessible to address the issue.

It’s safe to ignore in most cases if the Proxy header is not a standard HTTP header because the Proxy HTTP header does not have any standard legal purpose, this should be possible in the load balancer or web server used to direct demands to the application itself.

Cut off the HTTP Proxy Header with Apache

The mod_headers module can be used to unset the header for all requests on the off chance that you are running the Apache HTTP web server.

To allow mod_headers in Ubuntu or Debian servers, type:

Thereafter, open the worldwide configuration file:

Check the configuration for syntax errors:

If there are no syntax errors reported, restart the service\

By default for conventional installations, the mod_headers module should be enabled. Open the global configuration files to unset the Proxy header:

Save and close the file when you are done.

If there are no syntax errors found, restart the service by typing:

Removing the HTTP Proxy Header with Nginx

In Nginx, you can easily sanitize the environment for any CGI-like environment running on the server or upstream. Moderation is likewise trifling.

FastCGI parameters are usually included from either the fastcgi.conf or fastcgi_params files when setting up a FastCGI proxy on Ubuntu and Debian servers. You can unset the HTTP_PROXYheader in both of these records::

echo 'fastcgi_param HTTP_PROXY "";' | sudo tee –a /etc/nginx/fastcgi.conf

echo 'fastcgi_param HTTP_PROXY "";' | sudo tee -a  /etc/nginx/fastcgi_params

When configuring your FastCGI proxies, if you are not sourcing one of these files, then be sure to add this same line in the proxy location itself:

. . .
    location ~ \.php$ {
        . . .
        fastcgi_param HTTP_PROXY "";
        . . .
}
}

If there are no errors found, restart the service:

 and Fedora also make use of the same fastcgi.conf and fastcgi_params files to configure FastCGI proxying. In both of these files unset the HTTP_PROXY header by typing:

$ echo 'fastcgi_param HTTP_PROXY "";' | sudo tee -a /etc/nginx/fastcgi.conf

$ echo 'fastcgi_param HTTP_PROXY "";' | sudo tee -a  /etc/nginx/fastcgi_params

. . .
    location ~ \.php$ {
        . . .
        fastcgi_param HTTP_PROXY "";
        . . .
    }
}

You should clear the HTTP Proxy header if you make use of Nginx for conventional HTTP proxying. All you need is to add a rule to unset the Proxy header in any location where you are implementing a proxy_pass. You can easily search your configuration directory if you are not sure where proxy_pass is being used:

/etc/nginx/nginx.conf.default:        #    proxy_pass   http://127.0.0.1;

Like the example above, any results that are not commented should be edited to include proxy_set_header Proxy “”;:

. . .
location / application / {
        . . .
        proxy_pass http://127.0.0.1;
    proxy_set_header Proxy "";
        . . .
    }
}

If no errors are found, restart the service:

Removing the HTTP Proxy Header with HAProxy

You can drop Proxy header before forwarding traffic if you are using HAProxy to direct traffic to your application servers.

Open up the /etc/haproxy/haproxy.cfg file for editing:

In the backend, frontend, or listen sections of your configuration, you can set the http-request directive.

frontend www
http - request del - header Proxy
  . . .
backend web - backend
http - request del - header Proxy
  . . .
listen appname 0.0.0.0: 80
http - request del - header Proxy
  . . .

Save and close the file when you are done. These do not need to be set in each of the sections, though it won’t hurt to include them.

$ sudo haproxy -c -f /etc/haproxy/haproxy.cfg

If you found no problems, restart the service by typing:

The HTTPoxy vulnerability has been in existence for a long time and may influence a vast set of applications deployed on the web. Fortunately, it can without much stress easy to fix using the header-altsering capabilities local to any web server.

Defend Yourself Against HTTProxy Exploit

osquery is an open source tool created by Facebook for querying various information about the state of your machines. The tools make low-level operating system analytics and monitoring both performant and intuitive. This includes information like running processes, kernel modules loaded, active user accounts and active network connections. osquery is a flexible tool and can be used for a variety of use cases to troubleshoot performance and operational issues. From a security perspective, it can be used to query your endpoints to detect, investigate, and proactively hunt for various types of threats. For example, if you suspect a malicious process is running on a system, you can query for the process by name or even a filename it has open. osquery exposes an operating system as a high-performance relational database.

In this article we will cover the installation of osquery and detailed instruction to use it for monitoring our system’s security and analytics on Ubuntu 16.04.

The basic requirement that we need to complete this article is to have an Ubuntu 16,04 server root or sudo privileged user to perform system level tasks.

Supported distributions for osquery package installs are:

Now follow the step by step instructions to install and use osquery on Ubuntu 16.04.

Step 1 – Installing osquery on Ubuntu 16.04

osquery can installed through OS package management and standalone installers. In Ubuntu 16.04 osquery is available in an apt repository which can be installed by using below commands.

Let’s add the public key of osquery repository in Ubuntu 16.04 by using below command.

# apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 1484120AC4E9F8A1A577AEEE97A80C63C9D8B80B

Next add the repository by issuing command below.

# add-apt-repository "deb [arch=amd64] https://osquery-packages.s3.amazonaws.com/xenial xenial main"

Then update your system with latest updates and security patches, so that the newly added repository should be available to install osquery package.

Once your system is back with latest updates, use below command to install osquery on Ubuntu 16.04 as shown.

Osquery has been successfully installed with the following directory structure.

/etc/osquery/
/usr/share/osquery/osquery.example.conf
/usr/share/osquery/packs/{*}.conf
/var/log/osquery/
/usr/lib/osquery/
/usr/bin/osqueryctl
/usr/bin/osqueryd
/usr/bin/osqueryi

After installation of osquery, we will have access to its three useful components, that is osqueryi, osqueryd and osqueryctl. Whereas 

 is the osquery interactive query console/shell. It is completely standalone and does not communicate with a daemon and does not need to run as an administrator. Use the shell to prototype queries and explore the current state of your operating system.

To find all command-line options and flags available to the interactive shell, type below command.

 is the host monitoring daemon that allows you to 

 queries and record OS state changes. The daemon aggregates query results over time and generates logs, which indicate state change according to each query. The daemon also uses OS eventing APIs to record monitored file and directory changes, hardware events, network events, and more. To view all its available command line options use below command.

 which is a helper script for testing a deployment or configuration of osquery. It can also be used instead of the operating system’s service manager to start/stop/restart osqueryd.

The osquery “configuration” is read from a config plugin. This plugin is a data retrieval method and is set to 

 by default. The default config plugin, filesystem, reads from a file and optional directory “.d” based on the filename. The included init scripts set the default config path in Linux as follows.

/etc/osquery/osquery.conf and /etc/osquery/osquery.conf.d/

By default osquery doesn’t come with a configuration file, but there’s a sample configuration file that you may copy over to /etc/osquery and modify. However, that file does not have all the options you need to run it on a 

 distribution like Ubuntu, so we’ll create our own.

In an osquery configuration JSON, packs are defined as a top-level-key and consist of pack name to pack content JSON data structures. Run the command below to open a new file and put the following contents in it.

{
   "options": {
     "config_plugin": "filesystem",
     "logger_plugin": "filesystem",
     "logger_path": "/var/log/osquery",
     "disable_logging": "false",
     "log_result_events": "true",
     "schedule_splay_percent": "10",
     "pidfile": "/var/osquery/osquery.pidfile",
     "events_expiry": "3600",
     "database_path": "/var/osquery/osquery.db",
     "verbose": "false",
     "worker_threads": "2",
     "enable_monitor": "true",
     "disable_events": "false",
     "disable_audit": "false",
     "audit_allow_config": "true",
     "host_identifier": "hostname",
     "enable_syslog": "true",
     "audit_allow_sockets": "true",
     "schedule_default_interval": "3600" 
   },

Next is the scheduling section of the configuration file . Each query is identified by a key or name, which must be unique in the file, followed by the query to run and the interval, in seconds, to run the query.

Add below lines to the configuration file to add a scheduled query that looks at the crontab table every 300 seconds along with system profile and system information. You can add as many queries as you want by keeping the same format, so that it may not fail.

"schedule": {
     "crontab": {
       "query": "SELECT * FROM crontab;",
       "interval": 300
     },
     "system_profile": {
       "query": "SELECT * FROM osquery_schedule;"
     }, 
     "system_info": {
       "query": "SELECT hostname, cpu_brand, physical_memory FROM system_info;",
       "interval": 3600
     }
   },

, which are queries that prepend data to other scheduled queries.

"decorators": {
     "load": [
       "SELECT uuid AS host_uuid FROM system_info;",
       "SELECT user AS username FROM logged_in_users ORDER BY time DESC LIMIT 1;"
     ]
   },

Now come to the final configurations section that is query packs. Configuration supports sets, called packs, of queries that help define your schedule. Packs are distributed with osquery and labeled based on broad categories of information and visibility. Every installation of osquery comes with a default set of packs located in the /usr/share/osquery/packs directory. Though you can use the packs from their default location, you may also copy them to the /etc/osquery directory. Let’s add below lines to the file to complete the osquery configurations.

"packs": {
      "osquery-monitoring": "/usr/share/osquery/packs/osquery-monitoring.conf",
      "incident-response": "/usr/share/osquery/packs/incident-response.conf",
      "it-compliance": "/usr/share/osquery/packs/it-compliance.conf",
      "vuln-management": "/usr/share/osquery/packs/vuln-management.conf"
   }
 }

That’s it, save and close the configuration file. You complete configurations should be look like as shown in the image below.

To make sure that configuration file is all good, check by using below command.

# osqueryctl config-check
I0218 16:59:17.279341 33681 rocksdb.cpp:195] Opening RocksDB handle: /var/osquery/osquery.db

The output shows that our configuration file is fine and we can move to the next step.

Each query represents a monitored view of your operating system. The first time a scheduled query runs it logs every row in the resulting table with the “added” action. So, we need to modify the operating system’s syslog application to allow osquery to consume and query the system log by adding some lines of configuration that tell Rsyslog what pipe to write to, and which syslog parameters to write to that pipe.

By default, the pipe is in ‘/var/osquery/syslog_pipe’ file, osquery then populates its syslog table from information written to that pipe. Let’s add below the following lines to the file:

template(
   name="OsqueryCsvFormat"
   type="string"
   string="%timestamp:::date-rfc3339,csv%,%hostname:::csv%,%syslogseverity:::csv%,%syslogfacility-text:::csv%,%syslogtag:::csv%,%msg:::csv%\n"
 )
 *.* action(type="ompipe" Pipe="/var/osquery/syslog_pipe" template="OsqueryCsvFormat")

Save and close the configuration file and restart rsyslog service to apply changes using below command.

Step 5 – osquery File Integrity Monitoring Pack

In this section, we’ll add one more pack to the list, which will contain the query and directives that will be used for file integrity monitoring.The pack that will monitor for file events in the /home, /etc, and /tmp directories every 300 seconds.

To do so, create a new file and put the following contents in it using any of your command line editor.

{
   "queries": {
     "file_events": {
       "query": "select * from file_events;",
       "removed": false,
       "interval": 300
     }
   },
   "file_paths": {
     "homes": [
       "/root/.ssh/%%",
       "/home/%/.ssh/%%"
     ],
       "etc": [
       "/etc/%%"
     ],
       "home": [
       "/home/%%"
     ],
       "tmp": [
       "/tmp/%%"
     ]
   }
 }

Save and close the file, and then open the ‘osquery.conf’ once again to add the new pack section for monitoring file integrity.

"packs": {
      "fim": "/usr/share/osquery/packs/fim.conf",
      "osquery-monitoring": "/usr/share/osquery/packs/osquery-monitoring.conf",
      "incident-response": "/usr/share/osquery/packs/incident-response.conf",
      "it-compliance": "/usr/share/osquery/packs/it-compliance.conf",
      "vuln-management": "/usr/share/osquery/packs/vuln-management.conf"
   }

Save and close the file and run below command to validate configuration changes.

osquery provides two main interfaces to the user, that is osqueryi and osqueryd. osqueryi is a REPL (Read-Evaluate-Print Loop) similar to ‘$ irb’ or ‘$ python’. This lets you input a command and get back an immediate response. We can use this for following few things.

You can run queries using ‘osqueryi’ command even if the daemon is not active, while still using the configuration file we built to configure the environment by using below command.

# osqueryi --config_path /etc/osquery/osquery.conf --verbose

Using ‘–verbose’ at the end of the command is good practice as it will you the detailed logs and warnings, if there is any issue with osquery.

osquery uses the sqlite query language for simplicity and descriptiveness. Now we will use some of the following useful commands to check our system’s basic security using its most basic query format as shown below.

Run below command to find the last command logs.

To see what type of crontab jobs are scheduled and who has created that. The following query will help you find malware that have been scheduled to run at specific intervals.

osquery> select command, path from crontab ;

Run below command to find all files which has been setui-enabled on the system while they are not supposed to be on the system to detect backdoored binaries.

Run another command to find the backdoors, by finding all listening ports using below query.

To check all file events on your system by using following command.

osquery> select target_path, action, uid from file_events ;

This will help you to identify that which services are running in your system and which are not and you can easily identify any abnormal activity on your system.

There are many other queries and examples , that you can follow and use to find your system security issues and also analyse the performance of your system by viewing the information you gain using osquery stats.

Osqueryd is a daemon that allows osquery to run queries at set intervals. To start ‘osquerd’ daemon we can use systemctl or osqueryctl command. While the results generated by osqueryd are written to a file called ‘osqueryd.results.log’ in the /var/log/osquery directory after starting its daemon.

After starting its daemon, you can see that its log file has been created in the ‘/var/log/osquer’ directory and you can see its logs, continuously growing.

How to install and use osquery for monitoring and system security on Ubuntu 16.04

Do you know what a reverse proxy is? If you don’t, let’s take a minute to explain…

This type of proxy receives requests from HTTP(s) and then openly offers them to one or multiple servers of the back-end type. In terms of usefulness, these proxies are valued because an array of ultra-modern Web apps receive HTTP requests via app servers of the back-end variety! These servers aren’t designed to be accessible to users in a direct way and they are meant to support only the most basic features of HTTP. If you want more performance, the key is discovering the best way to turn Apache into a reverse proxy system. It’s really a lot easier than you think and we want to walk you through the process today.

You may utilize reverse proxies to stop app servers from being accessed in a direct manner. As well, you may utilize reverse proxies in order to scatter the load from new requests to an assortment of separate app servers. This will help you to boost performance “at scale” and to provide fail-safe service. Basically, when you opt for a reverse proxy, you’ll have more control over how your app servers operate. As well, if you wish to, you’ll be able to fill in gaps with your preferred features, such as SSL encryption, caching and compression. As you can see, personalization will be at your fingertips when you follow our simple steps.

Today, we’re going to share clear and detailed instructions on how to set up Apache in order to make it a reverse proxy system, by utilizing the extension known as mod_proxy. It redirects connections that come into a single back-end server (or more back-end servers) which run via the same network. Our tutorial utilizes an easy back-end which is designed via the Web framework known as Flask. However, you may feel free to utilize your preferred back-end server. Note: don’t add the quote marks outside of the commands. Just add what’s inside!

Before you get started, let’s discuss prerequisites…

You will need a 16.04 Ubuntu server which includes the first server setup instructions. These tutorial-style instructions must include a “sudo” user of the non-root type, as well as a firewall. As well, you’ll need to ensure that Apache 2 has been installed on the server.

Now, you’ll need to enable the right modules for Apache.

Step One – Enable The Correct Modules for Apache

Apache features a host of modules which are grouped together. However, although they are grouped together, they aren’t enabled. This means that you’ll need to do some enabling in order to get them up and running. The first module to enable is mod_proxy, as well as some mod_proxy module add-ons which contribute to superior functionality among a variety of network protocols. Here are the right things to enable…

Mod_proxy is the primary proxy module for Apache and it’s utilized in order to redirect connections. It gives Apache the power to function as a gateway for application servers which are underlying.

Also, you’ll need to enable mod_proxy_http, which gives support for the proxying of connections of the HTTP type.

As well, you’ll need to enable both mod_Ibmethod_byrequests, in addition to mod_proxy_balancer. Enabling them will add load-balancing elements for a group of back-end servers.

To get these modules enabled, you’ll need to execute the commands below, in the same order that they appear.

After you put in these commands, reboot Apache. This will activate the changes.

You may restart Apache by adding this command,

At this point, Apache is primed to function as an HTTP request reverse proxy. During the following step, we’re going to make a couple of standard servers of the back-end type. This will give us the power to see if our new setup is working the way that it should. If you have an app for back-end in place already, just skip this and move onto the following step.

Step Two – Make Testing Servers for the Back-end

Back-end servers may be run in order to see if the new setup in Apache is working well. To make a couple of servers of this type, which react to single lines of printed text, you’ll need to follow our instructions. One of these severs is going to respond with the words, “hello world!”. The other server will send out this message: “howdy world”.

They send unique messages in order to let users know that the load is balanced.

Flask functions as a micro-framework within Python and it’s used to built Web apps. We’re utilizing Flash to make test servers, as standard applications only need some code lines. You won’t have to familiar with Python to get these test servers created. There are tutorials for

After this, perform installation of Pip, which is the package manager for Python.

Next, utilize Pip in order to get Flask installed.

After these commands are processed, you’ll need to make a file which contains coding for the first back-end server which is found in the directory called, “home”. The command for this is

Next, paste the code below into your file. After you do so, save it and then close the file.

~/backend1.py
from flask import Flask
app = Flask(__name__)

@app.route('/')
def home():
return 'Hello world!

The first coupe of codes will start the framework for Flask. There is a single function, called home, which provokes the return of a text line, which is “hello world!”. The line over the function for home (@app.route(“/”) instructs the program to utilize home’s return value when it received requests of the HTTP type, which are directed towards the “/root url” part of the app.

It’s the same thing with the second back-end server. It just returns a line of text which is different from the first.

To look at the file that you just copied, type:

To alter your message return from “hello world!” to “howdy world”, add this command:

After you do so, save your file and close your file.

~/backend2.py
from flask import Flask
app = Flask(__name__)

Then, use this command in order to get the first server running via the port, 8080. It will additionally do a redirect of the output of Flask to a section known as /dev/null.

@app.route('/')
def home():
return 'Howdy world!'

Now, you’ll need to enter this command: