Apache ProxyPass Issue

[rbdevr]

Hi all,

Im trying to configure BitWarden to run behind an Apache server as a subpath

https://myserver/bitwarden

The service is running as localhost:3743

I followed the proxy example in the wiki but I keep getting proxy error:

502 Proxy Error
The proxy server received an invalid response from an upstream server.
The proxy server could not handle the request GET /bitwarden .

Reason: Error reading from remote server

I have tried the following setting:

environment variable:
DOMAIN=https://myserver/bitwarden
ROCKET_PORT=3743
ROCKET_TLS='{certs="",key=""}

apache config:
<Location /bitwarden>
RewriteEngine On
RewriteCond %{HTTP:Upgrade} =websocket [NC]
RewriteRule /notifications/hub(.*) ws://localhost:3012/$1 [P,L]
ProxyPass http://localhost:3743

ProxyPreserveHost On
RequestHeader set X-Real-IP %{REMOTE_ADDR}s
</Location

Any assistance would be appreciated

Cheers

[BlackDex]

Hello @rbdevr,

502 Proxy Error indicates that you probably are not running bitwarden, or not running it on port 3743 (and 3012 for the websockets) or not on localhost but on an other IP.

When you start bitwarden you should see which port it run's on, and also which IP.
If it states it's running on 127.0.0.1 on the same host as where apache httpd is running it should work, or if it states 0.0.0.0, that should also work on the localhost at least.

[rbdevr]

I did manage to get the error sorted by turning off SSL on bitwarden service.

Now I dont get an error from apache but the website still isnt working.

I'm getting a small box written “bitwarden”. It seems not all resources are coming with the correct URL.

GET http://myserver/app/main.cd3fdd91e1a63cf3ead5.css [HTTP/1.1 404 Not Found 7ms]
GET http://myserver/images/logo-dark@2x.png [HTTP/1.1 404 Not Found 1ms]
GET http://myserver/app/polyfills.cd3fdd91e1a63cf3ead5.js [HTTP/1.1 404 Not Found 5ms]
GET http://myserver/app/vendor.cd3fdd91e1a63cf3ead5.js [HTTP/1.1 404 Not Found 4ms]
GET http://myserver/app/main.cd3fdd91e1a63cf3ead5.js [HTTP/1.1 404 Not Found 3ms]

This shouldnt be happening because of the DOMAIN variable correct? Anyone facing this issue?

Cheers

[o2droid]

I have similar setup, but I configured DOMAIN variable to https://mydomain/bitwardendir/.
In apache I have Location configured similar as yours. What I can tell - in browser I have to add trailing / at the end of address, but addons and application works fine (haven't time to write RewriteRule).

        <Location /bitwardendir>
        SecRuleRemoveById 911100 //modsecurity remove blocking of PUT requests
        RewriteEngine On
        RewriteCond %{HTTP:Upgrade} =websocket [NC]
        RewriteRule /notifications/hub(.*) ws://127.0.0.1:3012/$1 [P,L]
        ProxyPass http://localhost:880
        ProxyPreserveHost On
        RequestHeader set X-Real-IP %{REMOTE_ADDR}s
        </Location>

Only thing which doesn't work is notifications hub - getting 502 error.

[BlackDex]

Remember to enable mod_proxy_wstunnel and mod_proxy_http, for example with: a2enmod proxy_wstunnel and a2enmod proxy_http. Else some items like the ws:// will not work.

Regarding the 404 Not Found, i think those items arn't even sent to bitwarden_rs it self but trapped by the reverse proxy.
But please post the bitwarden.log part if that is not the case, so that we can try to figure this out. But i think it's more of an reverse proxy issue then it is bitwarden_rs. Also, i just have also tested Apache HTTPD with the example from the wiki, and that works great. Same goes for the NGINX and HaProxy ones.

[zibous]

Same problem here, I always get a 502 error. When I call https://server: 8243 in the desktop browser.

Proxy Error
The proxy server received an invalid response from an upstream server.
The proxy server could not handle the request
Reason: Error reading from remote server

If I use https: // server: 8000, then it works with the desktop browser.

With the mobile app (Android version 2.6.1) I always get for both urls the error:

"Exeption Message: java.security.cert. CertPathValitatorExeption: Trust anchor for certification path not found"

Too bad, would like to use Bitwarden, but can't find a solution.
Any assistance would be appreciated

Installed bitwarden_rs without Docker on Linux Ubuntu 20.10
bitwarden_rs 1.17.0-175f2aea
Frontend: bw_web_v2.17.1, Version 2.12.0

.env settings

## Enables websocket notifications
WEBSOCKET_ENABLED=true
## Controls the WebSocket server address and port
WEBSOCKET_ADDRESS=10.1.1.219
WEBSOCKET_PORT=3012

ROCKET_ADDRESS=10.1.1.219
ROCKET_PORT=8000
ROCKET_TLS={certs="/etc/ssl/letsencrypt/live/***/cert.pem",key="/etc/ssl/letsencrypt/live/***/privkey.pem"}
ROCKET_CLI_COLORS=off
ROCKET_LIMITS={json=10485760}

bitwarden_rs start info

Jan 03 11:17:21 bitwarden_rs[4057939]: Configured for production.
Jan 03 11:17:21 bitwarden_rs[4057939]:     => address: 10.1.1.219
Jan 03 11:17:21 bitwarden_rs[4057939]:     => port: 8000
Jan 03 11:17:21 bitwarden_rs[4057939]:     => log: critical
Jan 03 11:17:21 bitwarden_rs[4057939]:     => workers: 4
Jan 03 11:17:21 bitwarden_rs[4057939]:     => secret key: private-cookies disabled
Jan 03 11:17:21 bitwarden_rs[4057939]:     => limits: forms = 32KiB, json* = 10MiB
Jan 03 11:17:21 bitwarden_rs[4057939]:     => keep-alive: 5s
Jan 03 11:17:21 bitwarden_rs[4057939]:     => tls: enabled
Jan 03 11:17:21 bitwarden_rs[4057939]: Rocket has launched from https://10.1.1.219:8000

<VirtualHost *:8243>

    ServerName <reacted>
    
    ServerSignature Off
    ServerAdmin webmaster@<reacted>
    Protocols h2 http/1.1

    SSLEngine on
    SSLCertificateFile         /etc/ssl/letsencrypt/live<reacted>cert.pem
    SSLCertificateKeyFile      /etc/ssl/letsencrypt/live<reacted>privkey.pem
    SSLCertificateChainFile    /etc/ssl/letsencrypt/live/<reacted>/chain.pem


    RewriteEngine On
    RewriteCond %{HTTP:Upgrade} =websocket [NC]
    RewriteRule /notifications/hub(.*) ws://10.1.1.219:3012/ [P,L]
    ProxyPass / http://10.1.1.219:8000/
    ProxyPreserveHost On
    ProxyRequests Off
    RequestHeader set X-Real-IP %{REMOTE_ADDR}s

    ErrorLog   ${APACHE_LOG_DIR}/bitwarden-error.log
    CustomLog  ${APACHE_LOG_DIR}/bitwarden-access.log combined

</VirtualHost>

[rbdevr]

can we have some assistance from the team?

maybe a template to setup Apache and BitWarden via subpath?

it's been 4 months and this issue is still happening......

[BlackDex]

We are no Apache HTTPD experts.

Please read the wiki https://github.com/dani-garcia/bitwarden_rs/wiki/Proxy-examples , and if you have any reason to deviate from those examples go visit a forum or chat where there are Apache HTTPD experts.

[jjlin]

You might be improperly configuring bitwarden_rs to expect HTTPS connections. If you're running behind a reverse proxy, the reverse proxy should be handling SSL/TLS termination, so bitwarden_rs should not have the ROCKET_TLS env var set. I've added some more explanation at https://github.com/dani-garcia/bitwarden_rs/wiki/Proxy-examples.

BTW, if there's a "team" at bitwarden_rs, it's very small and basically unpaid, so there's just not enough people to handhold users through every configuration they might want to use. People who want to self-host do need to take responsibility for learning about the systems they're using to do that.

[rbdevr]

I've tried using your proxy example, it was the first thing I did and it didn't work.

I've added all the details here so that others could replicate and help fix this and others with the same issue could find a solution.

Thats what a forum is for.

In regards to apache, most linux users will be using it, so have some support for it makes sense.

hopefully we can find a way to sort it out.

cheers

[o2droid]

I have following setup - seems to be working:
Bitwarden RS (config.js):

  "domain": "https://_cut_",
  "disable_icon_download": false,
  "signups_allowed": true,
  "signups_verify": true,
  "signups_verify_resend_time": 3600,
  "signups_verify_resend_limit": 6,
  "invitations_allowed": true,
  "password_iterations": 100000,
  "show_password_hint": true,
  "admin_token": "_cut_",
  "invitation_org_name": "Bitwarden_RS",
  "ip_header": "X-Real-IP",
  "icon_cache_ttl": 2592000,
  "icon_cache_negttl": 259200,
  "icon_download_timeout": 10,
  "icon_blacklist_non_global_ips": true,
  "disable_2fa_remember": false,
  "authenticator_disable_time_drift": false,
  "require_device_email": false,
  "reload_templates": false,
  "log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f",
  "disable_admin_token": false,
  "_enable_yubico": true,
  "yubico_client_id": "_cut_",
  "yubico_secret_key": "_cut_",
  "_enable_duo": false,
  "_enable_smtp": true,
  "smtp_host": "_cut_",
  "smtp_ssl": true,
  "smtp_explicit_tls": false,
  "smtp_port": 587,
  "smtp_from": "_cut_",
  "smtp_from_name": "Bitwarden_RS",
  "smtp_username": "_cut_",
  "smtp_password": "_cut_",
  "smtp_auth_mechanism": "Plain,Login,Xoauth2",
  "smtp_timeout": 15,
  "_enable_email_2fa": true,
  "email_token_size": 6,
  "email_expiration_time": 600,
  "email_attempts_limit": 3

Apache (virtualserver conf):

       ServerName _cut_
        SSLEngine on
        SSLProtocol         all -SSLv3 -TLSv1 -TLSv1.1
        SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256
        SSLHonorCipherOrder on
        SSLCompression      off
        SSLSessionTickets   off
        SSLCertificateKeyFile ""
        SSLCertificateFile ""
        SSLCACertificateFile ""
        SSLOpenSSLConfCmd DHParameters ""
        Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains;"
        Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure

        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined
        RemoteIPHeader X-Forwarded-For

        SSLProxyEngine On
        SSLProxyVerify none
        SSLProxyCheckPeerName off
        SSLProxyCheckPeerExpire off
        SSLProxyCheckPeerExpire off
        ProxyPreserveHost On

        <Location /bw>
        #Rules for modsecurity to allow upload to BW
        SecRuleRemoveById 911100 949110
        RewriteEngine On
        RewriteCond %{HTTP:Upgrade} =websocket [NC]
        RewriteRule /notifications/hub(.*) ws://127.0.0.1:3012/$1 [P,L]
        ProxyPass http://localhost:880
        ProxyPreserveHost On
        RequestHeader set X-Real-IP %{REMOTE_ADDR}s
        </Location>

[swstim]

Now with send support, the Apache reverse proxy suggested setup should be updated.
I have tested and now use the following mod_rewrite config:

    RewriteEngine On
    RewriteCond %{HTTP:Upgrade} websocket [NC]
    RewriteCond %{HTTP:Connection} upgrade [NC]
    RewriteRule ^/?(.*) "ws://127.0.0.1:3012/$1" [P,L]

This should also be more future proof then specifying a specific path eg /notifications/hub(.*).