<html><head><title></title></head><body><div class="rte-style-maintainer rte-pre-wrap" data-color="global-default" bbg-color="default" data-bb-font-size="medium"bbg-font-size="medium" style="white-space: pre-wrap; font-size: small; font-family: "Courier New", Courier, "BB.FixedWidth";"style="white-space: pre-wrap; font-size: small; font-family: "Courier New", Courier, "BB.FixedWidth"; color: rgb(0, 0, 0);"><div>Hi Mike,</div><div>Here is the output from my host</div><div><br></div><div><br></div><div># netstat -lntp |grep -E ":248|:80"</div><div>tcp 0 0 0.0.0.0:24816 0.0.0.0:* LISTEN 3356/python3 </div><div>tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 3085/nginx: master </div><div>tcp 0 0 127.0.0.1:24817 0.0.0.0:* LISTEN 3353/python3 </div><br><div><br></div><div>Below is what we have tried. Both port 80 and 24817 works on localhost but not on the ip.</div><div><br></div><div>Creating a repo on localhost:80 works.</div><div>http -a admin:admin POST <a spellcheck="false"bbg-destination="rte:bind" data-destination="rte:bind" href="http://localhost:80/pulp/api/v3/repositories/">http://localhost:80/pulp/api/v3/repositories/</a> name=testrepo</div><div><br></div><div>Use ip address instead of localhost got 403 error.</div><div>http -a admin:admin POST <a spellcheck="false"bbg-destination="rte:bind" data-destination="rte:bind" href="http://<ipaddress>:80/pulp/api/v3/repositories/">http://<ipaddress>:80/pulp/api/v3/repositories/</a> name=testrepo1</div><div>HTTP/1.1 403 Forbidden</div><div><br></div><div>Creating a repo on localhost:24817 works also.</div><div>http -a admin:admin POST <a spellcheck="false"bbg-destination="rte:bind" data-destination="rte:bind" href="http://localhost:24817/pulp/api/v3/repositories/">http://localhost:24817/pulp/api/v3/repositories/</a> name=testrepo1</div><div><br></div><div>Got 403 error again user ip on port 24817</div><div>http -a admin:admin POST <a spellcheck="false"bbg-destination="rte:bind" data-destination="rte:bind" href="http://<ipaddress>:24817/pulp/api/v3/repositories/">http://<ipaddress>:24817/pulp/api/v3/repositories/</a> name=testrepo1</div><div>HTTP/1.1 403 Forbidden</div><div><br></div><div>We do have ALLOWED_HOSTS = '*' in /etc/pulp/settings.py</div><div><br></div><div>Thanks</div><div><br><br><div class="rte-style-maintainer" data-color="global-default"bbg-color="default" data-bb-font-size="medium" bbg-font-size="medium" style="font-size: small; font-family: "Courier New", Courier, "BB.FixedWidth";"style="font-size: small; font-family: "Courier New", Courier, "BB.FixedWidth"; color: rgb(0, 0, 0);"><div><div class="bbg-rte-fold-content" data-header="From: mikedep333@redhat.com At: 09/27/19 10:04:05" data-digest="From: mikedep333@redhat.com At: 09/27/19 10:04:05" style=""><div class="bbg-rte-fold-summary">From: mikedep333@redhat.com At: 09/27/19 10:04:05</div>To: <a spellcheck="false" bbg-destination="mailto:bli111@bloomberg.net" href="mailto:bli111@bloomberg.net"> Bin Li (BLOOMBERG/ 120 PARK ) </a><br>Cc: <a spellcheck="false"bbg-destination="mailto:pulp-list@redhat.com" href="mailto:pulp-list@redhat.com"> pulp-list@redhat.com</a><br>Subject: Re: [Pulp-list] Access Pulp 3 Api from a remote machine</div><br></div><div class="rte-internet-block-wrapper" style="background: white; color: black; font-family: Arial, "BB.Proportional"; font-size: small; white-space: normal;"><div class="rte-internet-block"><blockquote><div dir="ltr"><div>Hi Bin,</div><div><br></div><div>In pulplift, which probably uses the default values for these settings in ansible-pulp, this is how the servers listen by default:<br></div><div><font face="monospace">[vagrant@pulp3-source-fedora30 ~]$ sudo netstat -lntp | grep -E ":248|:80"<br>tcp 0 0 <a spellcheck="false"bbg-destination="rte:bind" class="" href="127.0.0.1:24816"data-destination="rte:bind">127.0.0.1:24816</a> 0.0.0.0:* LISTEN 11871/python3 <br>tcp 0 0 <a spellcheck="false"bbg-destination="rte:bind" class="" href="0.0.0.0:80"data-destination="rte:bind">0.0.0.0:80</a> 0.0.0.0:* LISTEN 594/nginx: master p <br>tcp 0 0 <a spellcheck="false"bbg-destination="rte:bind" class="" href="127.0.0.1:24817"data-destination="rte:bind">127.0.0.1:24817</a> 0.0.0.0:* LISTEN 12007/python3 </font><br></div><div><br></div><div>So when I tried to connect to <ipaddress>:24817 rather than <ipaddress>:80, I got "connection refused" / "no route to host", not HTTP 403.</div><div><br></div><div>And note that under such a setup (with nginx in front), port 80 is the preferred way to access both pulp-api and pulp-content.</div><div><br></div><div>Can you confirm that your netstat looks similar to that? If so, then let's start looking for reasons why it would differ based on <ipaddress> vs localhost.</div><div><br></div><div>Also, you can run:</div><div>sudo journalctl -u pulp-api.service</div><div><br></div><div>-Mike</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Sep 26, 2019 at 1:48 PM Bin Li (BLOOMBERG/ 120 PARK) <<a spellcheck="false"bbg-destination="mailto:rte:bind" class="" href="mailto:bli111@bloomberg.net" data-destination="mailto:rte:bind">bli111@bloomberg.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div><div class="gmail-m_7356182847814103678rte-style-maintainer gmail-m_7356182847814103678rte-pre-wrap"style="white-space: pre-wrap; font-size: small; font-family: "Courier New", Courier, "BB.FixedWidth";">Mike, we have the .netrc configured. On the pulp server, it works if we use localhost:24817 but got 403 error when use <ipaddress>:24817. It looks like the Django only allows connection to localhost. We are looking for a way to connect from a different host.<br><br><div class="gmail-m_7356182847814103678rte-style-maintainer" style="font-size: small; font-family: "Courier New", Courier, "BB.FixedWidth";"><div><div class="gmail-m_7356182847814103678bbg-rte-fold-content"><div class="gmail-m_7356182847814103678bbg-rte-fold-summary">From: <a spellcheck="false"bbg-destination="mailto:rte:bind" class="" href="mailto:mikedep333@redhat.com" data-destination="mailto:rte:bind">mikedep333@redhat.com</a> At: 09/25/19 19:21:51</div>To: <a spellcheck="false" bbg-destination="mailto:bli111@bloomberg.net" class="" href="mailto:bli111@bloomberg.net" data-destination="mailto:bli111@bloomberg.net"> Bin Li (BLOOMBERG/ 120 PARK ) </a><br>Cc: <a spellcheck="false"bbg-destination="mailto:pulp-list@redhat.com" class="" href="mailto:pulp-list@redhat.com" data-destination="mailto:pulp-list@redhat.com"> pulp-list@redhat.com</a><br>Subject: Re: [Pulp-list] Access Pulp 3 Api from a remote machine</div><br></div><div class="gmail-m_7356182847814103678rte-internet-block-wrapper"style="background: white; color: black; font-family: Arial, "BB.Proportional"; font-size: small; white-space: normal;"><div class="gmail-m_7356182847814103678rte-internet-block"><blockquote><div dir="auto">The http client needs to authenticate with username (default: "admin") and password (default: "password" or "admin").<div dir="auto"><br></div><div dir="auto">On Linux, Mac and Windows, you can create a ~/.netrc (Windows: %HOME%\_netrc ) file that httpie, curl, etc will use:</div><div dir="auto"><a spellcheck="false" bbg-destination="rte:bind"class="" href="https://github.com/bagder/everything-curl/blob/master/usingcurl-netrc.md"data-destination="rte:bind">https://github.com/bagder/everything-curl/blob/master/usingcurl-netrc.md</a></div><div dir="auto"><br></div>-Mike<br><br><div class="gmail_quote" dir="auto"><div dir="ltr" class="gmail_attr">On Wed, Sep 25, 2019, 4:35 PM Bin Li (BLOOMBERG/ 120 PARK) <<a spellcheck="false"bbg-destination="mailto:rte:bind" class="" href="mailto:bli111@bloomberg.net" data-destination="mailto:rte:bind">bli111@bloomberg.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div><div class="gmail-m_7356182847814103678m_-4920962077604235447rte-style-maintainer gmail-m_7356182847814103678m_-4920962077604235447rte-pre-wrap"style="white-space: pre-wrap; font-size: small; font-family: "Courier New", Courier, "BB.FixedWidth";">Hi, We are trying to access the api on :24817 from remote server. We have add ALLOWED_HOSTS = ['*'] to settings.py and update the gunicorn to bind <a spellcheck="false"class="">0.0.0.0:24817</a>. Still getting a 403 Forbidden error. What else should we update to enable the remote api access?<div><br></div><div>Thanks</div></div></div>_______________________________________________<br>Pulp-list mailing list<br><a spellcheck="false"bbg-destination="mailto:rte:bind" class="" href="mailto:Pulp-list@redhat.com" data-destination="mailto:rte:bind">Pulp-list@redhat.com</a><br><a spellcheck="false"bbg-destination="rte:bind" class="" href="https://www.redhat.com/mailman/listinfo/pulp-list"data-destination="rte:bind">https://www.redhat.com/mailman/listinfo/pulp-list</a></blockquote></div></div></blockquote><br></div></div></div></div></div></blockquote></div><br><div><br></div>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr"><p style="color:rgb(0,0,0);font-family:RedHatText,sans-serif;font-weight:bold;margin:0px;padding:0px;font-size:14px;text-transform:capitalize"><span>Mike</span> <span>DePaulo</span></p><p style="color:rgb(0,0,0);font-family:RedHatText,sans-serif;font-size:12px;margin:0px 0px 4px;text-transform:capitalize">He / Him / His</p><p style="color:rgb(0,0,0);font-family:RedHatText,sans-serif;font-size:12px;margin:0px;text-transform:capitalize"><span>Service Reliability Engineer, Pulp</span></p><p style="color:rgb(0,0,0);font-family:RedHatText,sans-serif;margin:0px 0px 4px;font-size:12px"><a style="margin: 0px;"spellcheck="false" bbg-destination="https://www.redhat.com/" class="" href="https://www.redhat.com/" data-destination="https://www.redhat.com/">Red Hat</a></p><div style="color:rgb(0,0,0);font-family:RedHatText,sans-serif;font-size:medium;margin-bottom:4px"></div><p style="color:rgb(0,0,0);font-family:RedHatText,sans-serif;margin:0px;font-size:12px"><span>IM: <span>mikedep333</span></span></p><p style="color:rgb(0,0,0);font-family:RedHatText,sans-serif;font-size:12px;margin:0px"><span>GPG: 51745404</span></p><div style="color:rgb(0,0,0);font-family:RedHatText,sans-serif;font-size:medium;margin-top:12px"><table border="0"><tbody><tr><td width="100px"><a spellcheck="false" bbg-destination="https://www.redhat.com/" class="" href="https://www.redhat.com/"data-destination="https://www.redhat.com/"><img src="https://marketing-outfit-prod-images.s3-us-west-2.amazonaws.com/f5445ae0c9ddafd5b2f1836854d7416a/Logo-RedHat-Email.png"style="width: 90px;" width="90"></a></td></tr></tbody></table></div></div></div></blockquote><br></div></div></div></div></div></body></html>