apache server-status is open on almost all http openstack services

I did a quick fix by adding a rule in haproxy public horizon :

frontend horizon_external_front
    mode http
    http-request del-header X-Forwarded-Proto
    use_backend acme_client_back if { path_reg ^/.well-known/acme-challenge/.+ }
    option httplog
    option forwardfor
    http-request set-header X-Forwarded-Proto https if { ssl_fc }
    bind XXXXXXXX:443 ssl crt /etc/haproxy/haproxy.pem
    default_backend horizon_external_back
+ http-request deny if { path -i -m beg /server-status }

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/kolla-ansible/+/888943

Setting to public security since a patch has been submitted to gerrit.

I did a quick check and I was not able to use horizon/server-status with victoria and yoga kayobe/kolla-ansible deployments:

curl https://openstack/server-status

404:
...
<h2 id="page_heading">Sorry, the page you were looking for does not exist</h2>
...

Bartosz, your deployments maybe don't have external backend in haproxy for horizon? check configuration.
I my case 3 controller nodes with an external public endpoint is affected in Xena, so Yoga is affected too atleast. Victoria EOL so not interested.

Maksim, of course we have external backend in haproxy for horizon, still we get 404 - it's Yoga.
I'd need steps to reproduce - even the internal backend does not respond to /server-status.

As discussed in the review, this is an issue with Ubuntu/Debian only, where mod_status installed and enabled by default.

Reviewed: https://review.opendev.org/c/openstack/kolla-ansible/+/888943
Committed: https://opendev.org/openstack/kolla-ansible/commit/e365f4b70dc9d4871c8dfbab3c0f1fee50d6fee9
Submitter: "Zuul (22348)"
Branch: master

commit e365f4b70dc9d4871c8dfbab3c0f1fee50d6fee9
Author: Maksim Malchuk <email address hidden>
Date: Tue Aug 8 11:35:55 2023 +0300

    Deny access to public /server-status in http Openstack services

    This change block access to the public /server-status url on all
    http services exposed by HAProxy, also fixes an issue with Horizon
    where 'Require all granted' open access to the /server-status in
    the HAProxy-less configurations. Without this change the issue
    affects only Ubuntu/Debian installations where mod_status in Apache2
    enabled by default.

    Closes-Bug: #1996913
    Change-Id: I3ec1af6353c3ecc64589599abe375b0ae9b14d5c
    Signed-off-by: Maksim Malchuk <email address hidden>

Fix proposed to branch: stable/2023.1
Review: https://review.opendev.org/c/openstack/kolla-ansible/+/890857

Fix proposed to branch: stable/zed
Review: https://review.opendev.org/c/openstack/kolla-ansible/+/890858

Fix proposed to branch: stable/yoga
Review: https://review.opendev.org/c/openstack/kolla-ansible/+/890859

Fix proposed to branch: stable/xena
Review: https://review.opendev.org/c/openstack/kolla-ansible/+/890860

Reviewed: https://review.opendev.org/c/openstack/kolla-ansible/+/890857
Committed: https://opendev.org/openstack/kolla-ansible/commit/817d92fa387ccaf2393392a1bf05cf86461fc612
Submitter: "Zuul (22348)"
Branch: stable/2023.1

commit 817d92fa387ccaf2393392a1bf05cf86461fc612
Author: Maksim Malchuk <email address hidden>
Date: Tue Aug 8 11:35:55 2023 +0300

    Deny access to public /server-status in http Openstack services

    This change block access to the public /server-status url on all
    http services exposed by HAProxy, also fixes an issue with Horizon
    where 'Require all granted' open access to the /server-status in
    the HAProxy-less configurations. Without this change the issue
    affects only Ubuntu/Debian installations where mod_status in Apache2
    enabled by default.

    Closes-Bug: #1996913
    Change-Id: I3ec1af6353c3ecc64589599abe375b0ae9b14d5c
    Signed-off-by: Maksim Malchuk <email address hidden>
    (cherry picked from commit e365f4b70dc9d4871c8dfbab3c0f1fee50d6fee9)

Reviewed: https://review.opendev.org/c/openstack/kolla-ansible/+/890858
Committed: https://opendev.org/openstack/kolla-ansible/commit/f381fb54886aa6da94a4fc858b8bd8ec266d214a
Submitter: "Zuul (22348)"
Branch: stable/zed

commit f381fb54886aa6da94a4fc858b8bd8ec266d214a
Author: Maksim Malchuk <email address hidden>
Date: Tue Aug 8 11:35:55 2023 +0300

    Deny access to public /server-status in http Openstack services

    This change block access to the public /server-status url on all
    http services exposed by HAProxy, also fixes an issue with Horizon
    where 'Require all granted' open access to the /server-status in
    the HAProxy-less configurations. Without this change the issue
    affects only Ubuntu/Debian installations where mod_status in Apache2
    enabled by default.

    Closes-Bug: #1996913
    Change-Id: I3ec1af6353c3ecc64589599abe375b0ae9b14d5c
    Signed-off-by: Maksim Malchuk <email address hidden>
    (cherry picked from commit e365f4b70dc9d4871c8dfbab3c0f1fee50d6fee9)

Reviewed: https://review.opendev.org/c/openstack/kolla-ansible/+/890860
Committed: https://opendev.org/openstack/kolla-ansible/commit/b037e7f9c7672aa75373724bf84cfc3c8f6277b6
Submitter: "Zuul (22348)"
Branch: stable/xena

commit b037e7f9c7672aa75373724bf84cfc3c8f6277b6
Author: Maksim Malchuk <email address hidden>
Date: Tue Aug 8 11:35:55 2023 +0300

    Deny access to public /server-status in http Openstack services

    This change block access to the public /server-status url on all
    http services exposed by HAProxy, also fixes an issue with Horizon
    where 'Require all granted' open access to the /server-status in
    the HAProxy-less configurations. Without this change the issue
    affects only Ubuntu/Debian installations where mod_status in Apache2
    enabled by default.

    Closes-Bug: #1996913
    Change-Id: I3ec1af6353c3ecc64589599abe375b0ae9b14d5c
    Signed-off-by: Maksim Malchuk <email address hidden>
    (cherry picked from commit e365f4b70dc9d4871c8dfbab3c0f1fee50d6fee9)

Reviewed: https://review.opendev.org/c/openstack/kolla-ansible/+/890859
Committed: https://opendev.org/openstack/kolla-ansible/commit/893b806279fa01ee0515e0aa5ab9329dd1d11f30
Submitter: "Zuul (22348)"
Branch: stable/yoga

commit 893b806279fa01ee0515e0aa5ab9329dd1d11f30
Author: Maksim Malchuk <email address hidden>
Date: Tue Aug 8 11:35:55 2023 +0300

    Deny access to public /server-status in http Openstack services

    This change block access to the public /server-status url on all
    http services exposed by HAProxy, also fixes an issue with Horizon
    where 'Require all granted' open access to the /server-status in
    the HAProxy-less configurations. Without this change the issue
    affects only Ubuntu/Debian installations where mod_status in Apache2
    enabled by default.

    Closes-Bug: #1996913
    Change-Id: I3ec1af6353c3ecc64589599abe375b0ae9b14d5c
    Signed-off-by: Maksim Malchuk <email address hidden>
    (cherry picked from commit e365f4b70dc9d4871c8dfbab3c0f1fee50d6fee9)

This issue was fixed in the openstack/kolla-ansible xena-eol release.