Red Hat and CentOS Linux Load Balancer

Configuring a load balancer in Red Hat or CentOS Linux for PAM deployments.

Objective

The objective of this guide is to configure a HTTPS enabled load balancer for a single server PAM system on a Linux host computer.

This guide will describe one of the methods to illustrate components and files required in the process.

Pre-requisites

• OS Red Hat / CentOS with Apache HTTP Server installed.

• URI for PAM setup that might be used as a managed path for PAM SSO Server (such as https://pam.company.com) so that an external computer can access the PAM server using this URL.

• SSL certificate from a trusted Certificate Authority. Note that the certificate should be trusted by all client and server side system components (browsers and WEB containers) in order for the SSO server to work. The certificate contains the following files:

• The certificate (the guide assumes the name cert.crt)
• Server private Key (the guide assumes the name private.key)
• Optional: CA bundle certificate (the guide assumes the name ca-bundle.crt)
• Optional: Certificate chain file (the guide assumes the name server-ca.crt).

Configuration

1. Check httpd and mod_ssl packages are installed and enabled in the Apache HTTP Server. They are enabled in the default CentOS setup but this should be confirmed.

To do that, check the file /etc/httpd/conf.modules.d/00-proxy.conf and uncomment the following lines:

Copy

1
2
3
LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_http_module modules/mod_proxy_http.so
LoadModule proxy_wstunnel_module modules/mod_proxy_wstunnel.so

If these lines are not present then install httpd and mod_ssl with the following command:

Copy

1
yum install httpd mod_ssl

 

2. Copy the certificate files into the /etc/pki/tls/certs/ directory and change permissions of the private key so only root can access it using these commands:
Copy

1
2
chown root /etc/pki/tls/private/private.key
chmod 600 /etc/pki/tls/private/private.key

3. Add the SSL and Load Balancer configuration to the Apache HTTP Server.

Edit the file /etc/httpd/conf.d/ssl.conf and locate the line:

Copy

1
VirtualHost _default_:443

1. Add the load balancer configuration after this line:
Copy

1
2
3
4
5
6
7
8
ProxyPass /xtam/websocket-tunnel ws://127.0.0.1:8080/xtam/websocket-tunnel
ProxyPassReverse /xtam/websocket-tunnel ws://127.0.0.1:8080/xtam/websocket-tunnel

ProxyPass /xtam/ http://127.0.0.1:8080/xtam/
ProxyPassReverse /xtam/ http://127.0.0.1:8080/xtam/

ProxyPass /cas/ http://127.0.0.1:8080/cas/
ProxyPassReverse /cas/ http://127.0.0.1:8080/cas/

2. Add the SSL certificates to the same file:

Locate the line starting with SSLCertificateFile, uncomment it and add the path to the certificate:

Copy

1
SSLCertificateFile /etc/pki/tls/certs/cert.crt

Locate the line starting with SSLCertificateKeyFile, uncomment it and add the path to the private key:

Copy

1
SSLCertificateKeyFile /etc/pki/tls/private/private.key

Optionally, locate the line starting with SSLCACertificateFile, uncomment it and add the path to the chain file:

Copy

1
SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt

Optionally, locate the line starting with SSLCertificateChainFile, uncomment it and add the path to the chain file:

Copy

1
SSLCertificateChainFile /etc/pki/tls/certs/server-ca.crt

3. Save and close the file.
4. Change the setting for the Apache HTTP Server by issuing this command:
Copy

1
/usr/sbin/setsebool -P httpd_can_network_connect 1

5. Restart the Apache HTTP Server:
Copy

1
service httpd restart