Graylog 3.0 API Error / Return to referrer page infinite loop + SSL Offloading

[BlueTeamNinja (aBe)]

Hey All,

I have a single Graylog 3.0 server, freshly built on ubuntu 18.04 LTS:
IP: 10.10.10.10
HWLB: 10.10.10.20 (Kemp, using Graylog Admin template)
http_bind_address = 10.10.10.10
#http_publish_uri
http_external_url = https://logs.domain.local/

Kemp provides certificate. I can VIEW api browser, I can add inputs, search etc.
If I click on System -> Configuration I end up with a web browser doing a CRAZY fast loop between the graylog interface “Connection Reset” error page and reloading the Configuration page. It says it is going to “send me back to the page I came from” and it just loops really fast.

Also notable - if I go to api-browser, I can click ‘Raw’ on any entry and see the data - but none of the lists expand. Clicking on literally anything else on that page does nothing. Nothing displayed, dropped down etc.

Where do I even look for this? Nearly everything I can think of changing results in a white browser page, with the Titlebar indicating Graylog Web UI but a blank page.

[BlueTeamNinja (aBe)]

To add an update.
If I don’t terminate the SSL on the HWLB - I have no issues.

I believe the mixed-content error is at stake here, and the API call was being blocked - and when trying to return to the referring page - it was reloading the same page that caused the error.

I think that you have to enable TLS AND include certificates on the node and re-encrypt the traffic on teh HWLB to do it this way - which defeats the purpose of SSL offloading to me. Anyone else ran solely plaintext nodes and fully offloaded the SSL (particularly to Kemp Loadmasters?).

Cheers.

[jan (Jan Doberstein)]

Anyone else ran solely plaintext nodes and fully offloaded the SSL (particularly to Kemp Loadmasters?).

I do not have that with a KEMP - but with NGINX running without a problem in my lab. My NGINX config is like that one in the documentation.