3. Enable Reverse Proxy

The reverse proxy will proxy a request to any specified host and port through IP sockets. This can be used to connect to Jupyter notebook servers, RStudio servers, VNC servers, and more… This is disabled by default as it can be a security risk if not properly setup using a good host_regex.

You can read more about how this works in Open OnDemand under Configure Reverse Proxy.

3.1. Requirements

  • a regular expression that best describes all the hosts that you would want a user to connect to through the proxy (e.g., [\w.-]+\.osc\.edu)

  • confirm that if you run the command hostname from a compute node it will return a string that matches the above regular expression

    $ hostname


    If the hostname command gives you a value that cannot be used to connect to the compute node from the OnDemand host, then you can override it in the cluster config with a bash command that will work, e.g.:

    # /etc/ood/config/clusters.d/cluster1.yml
        title: "Cluster 1"
        host: "cluster1.my_center.edu"
        adapter: "..."
          script_wrapper: |
            module purge
          set_host: "host=$(hostname -A | awk '{print $1}')"
          script_wrapper: |
            module purge
            export PATH="/usr/local/turbovnc/bin:$PATH"
            export WEBSOCKIFY_CMD="/usr/local/websockify/run"
          set_host: "host=$(hostname -A | awk '{print $1}')"

3.2. Steps to Enable in Apache

  1. This requires modifying the YAML configuration file for ood-portal-generator located at /etc/ood/config/ood_portal.yml as such:

    # /etc/ood/config/ood_portal.yml
    servername: ondemand.my_center.edu
      - 'SSLCertificateFile "/etc/pki/tls/certs/ondemand.my_center.edu.crt"'
      - 'SSLCertificateKeyFile "/etc/pki/tls/private/ondemand.my_center.edu.key"'
      - 'SSLCertificateChainFile "/etc/pki/tls/certs/ondemand.my_center.edu-interm.crt"'
      - 'AuthType Basic'
      - 'AuthName "private"'
      - 'AuthBasicProvider ldap'
      - 'AuthLDAPURL "ldaps://openldap.my_center.edu:636/ou=People,ou=hpc,o=my_center?uid"'
      - 'AuthLDAPGroupAttribute memberUid'
      - 'AuthLDAPGroupAttributeIsDN off'
      - 'RequestHeader unset Authorization'
      - 'Require valid-user'
    host_regex: '[\w.-]+\.my_center\.edu'
    node_uri: '/node'
    rnode_uri: '/rnode'

    You can read more about these options under Configure Reverse Proxy.


    What if my site foregos the FQDN in the host names for compute nodes, and we have compute names that give their hosts as:

    • ab001ab100 (for the AB cluster)
    • pn001pn500 (for the PN cluster)
    • xy001xy125 (for the XY cluster)

    You could then use the following regular expression in your configuration file:

    host_regex: '(ab|pn|xy)\d+'
    node_uri: '/node'
    rnode_uri: '/rnode'


    Do not add start (^, A) or end ($, Z) of string/line anchors as this regular expression will be inserted into another regular expression.


    Failing to add an appropriate regular expression to the Reverse Proxy opens you up to possible phishing attacks. As a malicious party could send links to unsuspecting users as:


    And users will implicitly trust the link since it points to the trusting domain of ondemand.my_center.edu.

  2. Build/install the updated Apache configuration file:

    $ sudo /opt/ood/ood-portal-generator/sbin/update_ood_portal
  3. Restart the Apache server to have the changes take effect:

    CentOS/RHEL 6:
    $ sudo service httpd24-httpd condrestart
    Stopping httpd:                                            [  OK  ]
    Starting httpd:                                            [  OK  ]
    $ sudo service httpd24-htcacheclean condrestart
    CentOS/RHEL 7:
    $ sudo systemctl try-restart httpd24-httpd.service httpd24-htcacheclean.service

3.3. Verify it Works

We can test that the reverse proxy is now functional by starting up a simple server on a compute node and connecting to it through the proxy with our browser.

  1. SSH to any compute node that matches the regular expression above:

    $ ssh n0001.ten.osc.edu
  2. Start up a very simple listening server on a high number port:

    $ nc -l 5432
  3. In your browser navigate to this server using the Apache reverse proxy with the following URL format:


    So for our simplified case lets use:

  4. Go back to your SSH session and verify that it received the browser request:

    $ nc -l 5432
    GET /node/n0691.ten.osc.edu/5432/ HTTP/1.1
    Host: n0691.ten.osc.edu:5432
    Upgrade-Insecure-Requests: 1


    As we don’t have the simple server return anything to the browser, you can ignore any errors or warnings you see in your browser.