topic Re: How to limit Qlik Replicate UI Server IP address binding in Qlik Replicate

How to limit Qlik Replicate UI Server IP address binding

joekhoo — Thu, 14 Dec 2023 07:17:14 GMT

I am running Qlik Replicate Server and Qlik Replicate UI Server in a Windows 2019 server.

I noticed that the Qlik Replicate UI Server is configured to bind to all IPs on the server.

This is confirmed by the netstat command output below.

C:\>netstat -ano | findstr LISTENING | findstr 443
TCP 0.0.0.0:443 0.0.0.0:0 LISTENING 4
TCP [::]:443 [::]:0 LISTENING 4

How can I configure Qlik Replicate UI server to only bind to a specific IP address instead of all IP addresses on the server.

I am able to do this for Qlik Replicate server by adding an entry for "address": "127.0.0.1" in the repctl.cfg file. So the output for 3552 is as per below:

C:\>netstat -ano | findstr LISTENING | findstr 3552
TCP 127.0.0.1:3552 0.0.0.0:0 LISTENING 3252

Prior to this, it was also binding to all IPs

C:\>netstat -ano | findstr LISTENING | findstr 3552
TCP 0.0.0.0:3552 0.0.0.0:0 LISTENING 3252

Re: How to limit Qlik Replicate UI Server IP address binding

avidary_qlik — Tue, 19 Dec 2023 09:06:47 GMT

Hi @joekhoo
Thank you for your comments.

From the description, it looks like you were able to set only one IP for Replicate.

Do you have specific questions that we can help with?
Thank you
Avidar

Re: How to limit Qlik Replicate UI Server IP address binding

DesmondWOO — Thu, 21 Dec 2023 12:18:53 GMT

Hi @joekhoo ,

PID 4 a System process, I think it may be related to http.sys and it should be Windows issue.

Regards,
Desmond

Re: How to limit Qlik Replicate UI Server IP address binding

shashi_holla — Wed, 27 Dec 2023 23:22:58 GMT

@joekhoo

By running following command, you are searching on 443 port, which is for https (secure layer) and it's applicable for all connections. This is not specific to Replicate.

C:\>netstat -ano | findstr LISTENING | findstr 443

Replicate server runs on port 3550 and if you run the following command, it will show pointing to localhost 127.0.0.1

C:\>netstat -ano | findstr LISTENING | findstr 3550

TCP 127.0.0.1:3550 0.0.0.0:0 LISTENING 5600

Replicate UI (3552) doesn't have that restriction as it needs to be accessed not just from the server where Replicate is installed but from outside as well.

Thank you,

Re: How to limit Qlik Replicate UI Server IP address binding

joekhoo — Mon, 01 Jan 2024 23:24:36 GMT

Hi @shashi_holla , @avidary_qlik and @DesmondWOO

3552 and 443 were both binded to 0.0.0.0 , meaning both was listening to all IP interfaces on the server.

For 3552, i was able to do this for Qlik Replicate server (3552) by adding an entry for "address": "127.0.0.1" in the repctl.cfg file. So the output for 3552 is as per below after i made the change:

C:\>netstat -ano | findstr LISTENING | findstr 3552
TCP 127.0.0.1:3552 0.0.0.0:0 LISTENING 3252

I am trying to find out how to do that for 443 , the Qlik Replicate UI server.
The network interfaces that the services bind to is managed by the services and not Windows since it is not running under Windows IIS. Windows IIS service was not installed on this server.

best regards,

Joe Khoo

Re: How to limit Qlik Replicate UI Server IP address binding

DesmondWOO — Thu, 04 Jan 2024 05:46:08 GMT

Hi @joekhoo ,

Replicate UI server is using the Microsoft HTTP.SYS subsystem, offered on port 443. I've tried but cannot find a way to specify IP address for the port 443 and port 3552.

I would suggest to submit a new ticket to our support system and let us check with the internal team.

Regards,
Desmond

Re: How to limit Qlik Replicate UI Server IP address binding

joekhoo — Thu, 04 Jan 2024 09:38:24 GMT

Hi @DesmondWOO ,

Thanks.

May I also check with you. For Replicate Server, is it also using HTTP.SYS subsystem ?

best regards,

Joe Khoo

Re: How to limit Qlik Replicate UI Server IP address binding

sureshkumar — Thu, 04 Jan 2024 14:10:19 GMT

Hello @joekhoo

Response from R&D in the case

----------------------------

The Qlik Replicate, Compose and Enterprise Manager products offer a web interface implemented using Microsoft's WCF framework which is a layer on top of the Windows HTTP subsystem (a.k.a HTTP.SYS). Every Windows machine has this HTTP.SYS subsystem and it handles all incoming HTTP/HTTPS requests, allowing multiple services on the Windows box to offer their web service via a single port 443 (without using HTTP.SYS, only one program can use port 443).

--------------------

Same thing is communicated to Kavitha as well

Regards,

Suresh

Re: How to limit Qlik Replicate UI Server IP address binding

joekhoo — Fri, 05 Jan 2024 04:41:09 GMT

Hi @sureshkumar ,

I noticed that the R&D reply was focused on Qlik Replicate UI service which is using port 443. And that is using Windows HTTP subsystem (HTTP.SYS).

But how about the Qlik Replicate service (that is running on Port 3552).
Does that also use the Microsoft Windows HTTP subsystem (HTTP.SYS)? Or does it use something else ?

I am guessing it uses something else because Qlik Replicate service (3552) is also available for RHEL distributions.
I hope Qlik R&D will be able to clarify this.

Thank you.

best regards,

Joe Khoo

Re: How to limit Qlik Replicate UI Server IP address binding

DesmondWOO — Fri, 05 Jan 2024 11:34:29 GMT

Hi @joekhoo ,

You are right. The Qlik Replicate Server (repctl.exe) does not use HTTP.SYS. It is a native C program that serves as a web server on port 3552.

Regards,
Desmond

Re: How to limit Qlik Replicate UI Server IP address binding

joekhoo — Sun, 07 Jan 2024 14:34:54 GMT

Hi @DesmondWOO ,

Great. Thanks for that confirmation.

A bit off topic from this thread, but for the benefit of anyone else also following this thread, we also have a case open with Qlik Support team on why the cipher configuration done at Windows level did not take effect for Qlik Replicate. It worked for Qlik Replicate UI but not Qlik Replicate. Case details below:

Case Details - Qlik Community (menlosecurity.com)

Hi @sureshkumar ,

As per Desmond's explanation, the Qlik Replicate Server (repctl.exe) does not use HTTP.SYS and it is a native C program that serves as a web server on port 3552.

That should explain why the configuration at Windows to disable the non-compliant ciphers did not take effect for Qlik Replicate Server.

In that case, we will need input from R&D, for Qlik Replicate Server, since it is serving as a web server itself on port 3552 and does not leverage on HTTP.SYS, then how would the OS level cipher configuration take effect on Qlik Replicate Server. And how do we disable the weak cipher for Qlik Replicate Server.

best regards,

Joe Khoo

Re: How to limit Qlik Replicate UI Server IP address binding

deepaksahirwar — Mon, 08 Jan 2024 02:58:28 GMT

Hi @joekhoo ,

It seems that the Qlik Replicate UI Server (running on port 443) is designed to bind to all IP addresses on the server1. This is because the UI needs to be accessed not just from the server where Replicate is installed but from outside as well1.

You were able to limit the IP address binding for the Qlik Replicate Server (running on port 3552) by adding an entry for “address”: “127.0.0.1” in the repctl.cfg file1. However, this method may not apply to the Qlik Replicate UI Server.

As per my experience, the issue might be related to http.sys and it could be a Windows issue. You might want to look into that.

I recommend reaching out to Qlik Support or consulting the official Qlik documentation. They might be able to provide more specific guidance or a workaround for your situation.

Hope this helps.

Deepak

Help users find answers! Do not forget to mark a solution that worked for you! If already marked, give it a thumbs up!

#Qlik Replicate

Re: How to limit Qlik Replicate UI Server IP address binding

DesmondWOO — Mon, 08 Jan 2024 02:58:40 GMT

Hi @joekhoo ,

There is no configuration for setting cipher on Replicate. Replicate checks which cipher can be used at the OS level. If you remove cipher at OS level, it will be applied the same on the Replicate because OS is a higher layer than the application layer.

Regards,
Desmond

Re: How to limit Qlik Replicate UI Server IP address binding

joekhoo — Mon, 08 Jan 2024 03:05:24 GMT

Hi @DesmondWOO ,

We have already removed the weak ciphers at the OS level and even got Microsoft Premium Support services to look into it and verify this.

Furthermore, the ciphers did get removed for Replicate UI (443). But it is still not removed for Replicate Server (3552). Since Replicate Server does not use HTTP.SYS, that is why I suspect there may be another configuration that handles the ciphers for Replicate Server.

best regards,

Joe Khoo

Re: How to limit Qlik Replicate UI Server IP address binding

DesmondWOO — Mon, 08 Jan 2024 05:09:55 GMT

Hi @joekhoo ,

As cipher is not relevant to this thread, please create a new post in the forum for further discussion.

Thanks,
Desmond