Zwangsproxy: lokale Anfragen daran vorbei, und ein Pruefpunkt dafuer
Steht in der Umgebung ein HTTP-Proxy und nimmt no_proxy die lokalen
Adressen nicht aus, schickt curl selbst eine Anfrage an 127.0.0.1
dorthin. Der Proxy kennt die Adresse nicht, und die Meldung landet an
einer Stelle, die nichts dafuer kann: "Anmeldung am Proxy Manager
fehlgeschlagen". Danach sucht man an den Zugangsdaten statt am Netz.
Zwei Teile:
1. Die eigenen Aufrufe gehen jetzt grundsaetzlich am Proxy vorbei, wenn
das Ziel auf diesem Rechner liegt - erkannt an der Adresse
(127.0.0.0/8, localhost, ::1, eigene IP). Anfragen ins Internet
(Registry, Downloadportal) bleiben unberuehrt. Schlaegt die Anmeldung
trotzdem fehl und steht ein Proxy in der Umgebung, nennt die Meldung
diese Moeglichkeit jetzt ausdruecklich.
2. "noproxy" prueft und richtet ein. Erkannt wird nicht geraten, sondern
an dem, was curl selbst sagt ("Uses proxy env variable http_proxy") -
dafuer muss auf der Zieladresse nichts laufen. "--fix" schreibt
/etc/profile.d/cmk-noproxy.sh, "--fix --user" die ~/.bashrc.
Menuepunkt unter Einstellungen > Runtime und Zeitzone.
Beim Schreiben des Eintrags war der erste Entwurf falsch: er las nur
no_proxy in Kleinschreibung und haette ein vorhandenes NO_PROXY
weggeworfen. Jetzt werden beide Schreibweisen eingesammelt, Vorhandenes
steht vorn, unsere Adressen kommen dahinter, Doppelte fallen heraus.
Durchgespielt fuer: beide leer, nur klein, nur gross, beide verschieden,
127.0.0.1 schon vorhanden, Liste bereits vollstaendig.
Nachgemessen und vermerkt: no_proxy/NO_PROXY und https_proxy/HTTPS_PROXY
gelten bei curl in beiden Schreibweisen, HTTP_PROXY in Grossschreibung
dagegen nicht - das ignoriert curl absichtlich. Ist nur die gesetzt,
sagt der Bericht das dazu, statt einen Proxy zu melden, den curl gar
nicht benutzt.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Claude Opus 5
@@ -2615,6 +2615,75 @@ readable by compose, systemd **and** the shell. When you change
|
||||
values that only take effect once the containers are recreated, the menu says
|
||||
so explicitly.
|
||||
|
||||
### 14.6 Networks with a mandatory proxy: an `API error` that is none
|
||||
|
||||
In customer networks an HTTP proxy is often present in the environment
|
||||
(`http_proxy`, `https_proxy`). If `no_proxy` does **not** exclude local
|
||||
addresses, `curl` sends even a request to `127.0.0.1` there. The proxy does not
|
||||
know that address – and the error surfaces somewhere entirely innocent:
|
||||
|
||||
```
|
||||
[FEHLER] Anmeldung am Proxy Manager fehlgeschlagen.
|
||||
```
|
||||
|
||||
That looks like wrong credentials or a broken API. It is neither. To check:
|
||||
|
||||
```bash
|
||||
./scripts/cmk-manage.sh noproxy
|
||||
```
|
||||
|
||||
```
|
||||
HTTP-Proxy in der Umgebung
|
||||
http_proxy http://proxy.customer.local:3128
|
||||
no_proxy <leer>
|
||||
|
||||
Geht http://127.0.0.1:81/ daran vorbei?
|
||||
[FEHLER] Nein - curl schickt auch diese Anfrage an den Proxy.
|
||||
|
||||
Einzutragen
|
||||
no_proxy=localhost,127.0.0.1,::1,checkmk-host,172.0.250.82
|
||||
```
|
||||
|
||||
This is not guessed but read from what `curl -v` reports itself
|
||||
(`Uses proxy env variable http_proxy == …`) – nothing needs to be listening on
|
||||
the target address for that.
|
||||
|
||||
To make it permanent:
|
||||
|
||||
```bash
|
||||
sudo ./scripts/cmk-manage.sh noproxy --fix # /etc/profile.d/cmk-noproxy.sh
|
||||
./scripts/cmk-manage.sh noproxy --fix --user # ~/.bashrc
|
||||
```
|
||||
|
||||
**Whatever is already there stays – and stays first.** The entry collects both
|
||||
spellings (`no_proxy` *and* `NO_PROXY`; some systems only set the uppercase
|
||||
one), appends the local addresses and drops duplicates:
|
||||
|
||||
| before | after |
|
||||
|---|---|
|
||||
| *(empty)* | `localhost,127.0.0.1,::1,host,172.0.250.82` |
|
||||
| `no_proxy=company.internal,10.0.0.0/8` | `company.internal,10.0.0.0/8,localhost,127.0.0.1,…` |
|
||||
| only `NO_PROXY=company.internal` | `company.internal,localhost,127.0.0.1,…` |
|
||||
| both set, different | both kept, then ours |
|
||||
| `127.0.0.1` already present | kept, only what is missing is added |
|
||||
|
||||
A second call writes nothing twice. The GUI has it under **Einstellungen →
|
||||
Runtime und Zeitzone → Lokale Verbindungen prüfen**.
|
||||
|
||||
> **This tool's own calls are unaffected.** Requests to local addresses always
|
||||
> use `curl --noproxy`, requests to the internet (registry, download portal)
|
||||
> keep using the proxy. The command exists for everything else: your own `curl`
|
||||
> tests, the terminal browser, other scripts.
|
||||
|
||||
> **A curl quirk:** `no_proxy`/`NO_PROXY` and `https_proxy`/`HTTPS_PROXY` are
|
||||
> honoured in both spellings, uppercase `HTTP_PROXY` is **not** – curl ignores
|
||||
> it deliberately, because in CGI environments an incoming `Proxy:` header
|
||||
> could set it. The report points this out when only that one is set.
|
||||
|
||||
> **Services do not read profile files.** If the stack runs under systemd and a
|
||||
> proxy is configured there, the exception also belongs in `/etc/environment`
|
||||
> or in the unit: `Environment=no_proxy=localhost,127.0.0.1,…`
|
||||
|
||||
---
|
||||
|
||||
## 15. Backup
|
||||
@@ -3151,6 +3220,7 @@ release notes beforehand.
|
||||
| `ERR_SSL_UNRECOGNIZED_NAME_ALERT` when opening `https://<IP>/` | browsers send no SNI for an IP, nginx falls back to its default server and rejects. `cmk-manage.sh proxy default --domain <name>` – see [chapter 10.8](#108-https-on-the-bare-ip) |
|
||||
| `omd restore`: *apache user www-data must be member of group `<site>`* | the container was recreated while the site lives in the bind mount. `cmk-manage.sh` repairs this on restore and on `up` – see [chapter 16.1](#161-why-a-restore-failed-after-recreating-the-container) |
|
||||
| `omd restore`: *fstab entry for /omd/sites/…/tmp does not exist* | same cause, same fix |
|
||||
| `Anmeldung am Proxy Manager fehlgeschlagen` despite correct credentials | mandatory proxy in the network: `no_proxy` does not exclude `127.0.0.1`. `cmk-manage.sh noproxy` – see [chapter 14.6](#146-networks-with-a-mandatory-proxy-an-api-error-that-is-none) |
|
||||
| `Port 80/443 already in use` | a web server is already running on the host: `ss -tlnp \| grep ':80'` → `systemctl disable --now apache2 nginx httpd` |
|
||||
| Containers do not run after a reboot (Podman) | systemd unit missing: `./install.sh --with-systemd` or `--quadlet`, then `systemctl is-enabled checkmk-stack` |
|
||||
| `omd restore`: *version is not installed* | fetch the matching image: `cmk-manage.sh image pull --edition <ed> --version <v>`, then `up` |
|
||||
|
||||
Reference in New Issue
Block a user