MeshCentral reverse proxy

[christoph-wijns]

Hello,

Meshcentral won't start and hangs on

{
    "$schema": "https://raw.githubusercontent.com/Ylianst/MeshCentral/master/meshcentral-config-schema.json",
    "__comment1__": "This is a simple configuration file, all values and sections that start with underscore (_) are ignored. Edit a section and remove the _ in front of the name. Refer to the user's guide for details.",
    "__comment2__": "See node_modules/meshcentral/sample-config-advanced.json for a more advanced example.",
    "settings": {
        "cert": "servicedesk.abc.be",
        "mongodb": "mongodb://127.0.0.1:27017/meshcentral",
        "mongodbcol": "meshcentral",
		"AgentPong": 300,
		"BrowserPong": 120,
		"WANonly": true,
		"_LANonly": true,
		"TlsOffload": "REVERSE_PROXY_IP",
		"trustedProxy": "REVERSE_PROXY_IP",
		"_AgentPortTls": true,
		"CookieIpCheck": false,
		"CookieEncoding": "hex",
        "sessionKey": "PASSWORD",     
		"cleanNpmCacheOnUpdate": true,
        "AutoBackup": {
            "mongoDumpPath": "D:/MongoDB/mongodump.exe",
            "backupIntervalHours": 24,
            "keepLastDaysBackup": 10,
            "backupPath": "D:/backups"
        },
		"Port": 3443,
		"AliasPort": 443,
		"_agentPort": 443,
		"_AgentPort": 4000,
		"_AgentAliasPort": 4000,
        "_redirPort": 80,
        "_redirAliasPort": 80,
        "agentTimeStampServer": "http://timestamp.digicert.com",
        "agentTimeStampProxy": "http://abc.be:8080",
		"meshErrorLogPath": "D:\\logs",
		"log": "main,web,webrequest,cert",
        "debug": "main,web,webrequest,cert",
        "syslog": "meshcentral-syslog",
        "syslogauth": "meshcentral-auth",
        "syslogjson": "meshcentral-json",
        "welcomePicture": "background.png",
        "welcomePictureFullScreen": true,
        "desktopMultiplex": true,
		"NpmProxy": "http://abc.be:8080",
        "allowHighQualityDesktop": true,
        "__maxInvalid2fa": "Time in minutes, max amount of bad two-factor authentication from a source IP in the time before 2FA's are rejected.",
        "maxInvalid2fa": {
            "time": 10,
            "count": 10,
            "coolofftime": 10
        },

    "domains": {
        "": {
			"certUrl": "https://REVERSE_PROXY_IP:443/",
            "siteStyle": 2,
			"allowedOrigin": true,
            "showModernUIToggle": true,
            "title": "Remote Assistance",
            "title2": "abc",
            "_loginPicture": "welcomescreen.png",
            "welcomeText": "Welcome to Remote Connect.",
            "welcomePicture": "background.png",
            "welcomePictureFullscreen": true,
            "minify": true,
            "newAccounts": true,
            "userNameIsEmail": true,
            "agentInviteCodes": true,
            "agentConfig": [
                "skipmaccheck=1"
            ],
            "AutoRemoveInactiveDevices": 7,
            "geoLocation": true,
            "ipkvm": false,
            "localSessionRecording": true,
            "sessionRecording": {
                "_onlySelectedUsers": true,
                "_onlySelectedUserGroups": true,
                "_onlySelectedDeviceGroups": true,
                "filepath": "D:\\sessionRecording",
                "index": true,
                "maxRecordings": 10,
                "maxRecordingDays": 15,
                "maxRecordingSizeMegabytes": 30,
                "__protocols__": "Is an array: 1 = Terminal, 2 = Desktop, 5 = Files, 100 = Intel AMT WSMAN, 101 = Intel AMT Redirection, 200 = Messenger",
                "protocols": [
                    1,
                    2,
                    100,
                    101
                ]
            },
            "mobileSite": true,
            "mstsc": true,
            "myServer": {
                "Backup": true,
                "Console": true,
                "ErrorLog": true,
                "Restore": true,
                "Trace": true,
                "Upgrade": false
            },
            "_userAllowedIP": [
                "127.0.0.1,::1"
            ],
            "_userBlockedIP": [
                "127.0.0.1,::1"
            ],
            "_agentAllowedIP": "127.0.0.1,::1",
            "_agentBlockedIP": "127.0.0.1,::1",
            "___userSessionIdleTimeout__": "Number of user idle minutes before auto-disconnect",
            "_userSessionIdleTimeout": 30,
            "___logoutOnIdleSessionTimeout": "Determines whether MeshCentral should logout after the session idle timeout elapsed or should just disconnect remote desktop, terminal and files.",
            "_logoutOnIdleSessionTimeout": false,
			"agentCustomization": {
				"backgroundColor": "40,40,40",
				"companyName": "abc Mesh Agent",
				"description": "abc Mesh Agent Background Service",
				"displayName": "abc MeshCentral Agent",
				"fileName": "meshagent",
				"foregroundColor": "0,149,213",
				"serviceName": "abc Mesh Agent"
			},
			"consentMessages": {
				"title": "MeshCentral",
				"desktop": "{0} requesting remote desktop access. Grant access?",
				"terminal": "{0} requesting remote terminal access. Grant access?",
				"files": "{0} requesting remote files access. Grant access?",
				"consentTimeout": 30,
				"autoAcceptOnTimeout": true,
				"autoAcceptIfNoUser": true,
				"oldStyle": true
				},
			"notificationMessages": {
				"title": "MeshCentral",
				"desktop": "{0} started a remote desktop session.",
				"terminal": "{0} started a remote terminal session.",
				"files": "{0} started a remote files session."
			},
            "userConsentFlags": {
                "desktopnotify": true,
                "terminalnotify": false,
                "filenotify": false,
                "desktopprompt": true,
                "terminalprompt": false,
                "fileprompt": false,
                "desktopprivacybar": false
            },			
			"auth": "ldap",
				"ldapUserName": "{{{givenName}}} {{{sn}}}",
				"LDAPUserKey": "objectSid",
				"LDAPUserbinaryKey": "objectSid",
				"ldapUserEmail": "mail",
				"ldapUserRealname": "{{{givenName}}} {{{sn}}}",
				"ldapUserGroups": "memberOf",
				"ldapUserPhoneNumber": "telephoneNumber",
				"LDAPSiteAdminGroups": [ "CN=MeshCentralAdmin,OU=Security,OU=Groups,OU=Internal,DC=smals-mvm,DC=be" ],
				"ldapUserRequiredGroupMembership": [ "CN=MeshCentralUsers,OU=Security,OU=Groups,OU=Internal,DC=smals-mvm,DC=be" ],
				"ldapsyncWithUserGroups": {
					"filter": [ "CN=MeshCentral" ]
					},
				"ldapOptions": {
					"url": "ldaps://abc.be:636/",
					"tlsOptions": { "rejectUnauthorized": false },
					"bindDN": "CN=abc,DC=be",
					"bindCredentials": "abc123456",
					"_bindDN": "CN=abc,DC=be",
					"_bindCredentials": "xxx,Azerty123456",
					"searchBase": "abc,DC=be",
					"_searchFilter": "(sAMAccountName={{username}})",
					"searchFilter": "(userPrincipalName={{username}})",
					"reconnect": true
					},
            "passwordRequirements": {
                "min": 15,
                "max": 128,
                "upper": 1,
                "lower": 1,
                "numeric": 1,
                "nonalpha": 1,
                "reset": 90,
                "force2factor": true,
                "_email2factor": true,
                "_sms2factor": true,
                "_push2factor": true,
                "skip2factor": "127.0.0.1,::1,85.91.181.211",
                "loginTokens": true,
                "twoFactorTimeout": 300,
                "oldPasswordBan": 5,
                "banCommonPasswords": false
            }
        }
    },
    "_letsencrypt": {
        "__comment__": "Requires NodeJS 8.x or better, Go to https://letsdebug.net/ first before trying Let's Encrypt.",
        "email": "[email protected]",
        "names": "myserver.mydomain.com",
        "skipChallengeVerification": true,
        "production": false
    }
}

I've put

		"TlsOffload": "REVERSE_PROXY_IP",
		"trustedProxy": "REVERSE_PROXY_IP",

Can somebody please help me

Thanks,

Christoph

[si458]

if you copy+paste your config into the new sanitizer https://melo-professional.github.io/MeshCentral-config-sanitizer/
then press remove irrelevant you can see you get a JSON phase error
you are missing a } at the very end to begin with
and if you pop in the missing } at then end and press the button again
you will get what meshcentral reads
but your config all looks correct so meshcentral isnt HANGING, its started up as expected based on the pictures u sent
so now you need explain what you mean by HANGS,
does the web ui never load?
have you checked the reverse proxy config is correct and talking to http://meshcentral.ip.goes.here:3443 (in your case)

[christoph-wijns]

I can't thank you enough @si458 - got it working with reverse proxy !!!

Thanks

Christoph