Subject: Re: SSL tunneling

From: Michel Bardiaux <[email-masked]>
Date: Wed, 31 May 2000 11:39:11 +0200

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Mikes Roman wrote:
> 
> Hi,
> i have just a problem. I need to connect external users to internal S-HTTP
> server.

I assume by "external" you mean "on the big bad Internet" and by
"internal"
you mean your truly internal (corporate or whatever) network, not your
DMZ?
Well, one should not do that, because although SSL provides session
encryption
and authenticates the server to the client, AFAIK it does *NOT*
authenticate
the client to the server (anyone on the list knows how to use
client-side
certificates?) Since the incoming SSL traffic is not authenticated, it
should
not be tunnelled through the firewall. If the HHTPS server really has to
be on
your internal net rather than the DMZ, consider using SSH (H, not L!)
with
forwarding of port 443. Note that it is a requirement that the clients
are
trusted, so they must be properly protected and administered machines
with trusted
users at the keyboard!

> Could you recommend me any solution. Now i use plug-gw whithout
> option -ssl:
> 
> running daemon: plug-gw -daemon https
> netperm-table: plug-gw:         port https -plug-to w.x.y.z

Should work (except for the security problems above!)

> 
> with option -ssl it doesn't work:  plug-gw:     port https -plug-to w.x.y.z
> -ssl

The -ssl option is actually a misnomer. What it does is to force plug-gw
to
expect an HTTP request of the form "CONNECT host:port HTTP/1.0" and then
establish the connection. After that, it does not care at all what goes
on.
It is called "-ssl" because it was created specifically to allow
*outgoing*
HTTPS requests, but it does not know anything about SSL. As a matter of
fact,
NETSCAPE 4 abuses the security proxy to pass ICQ through the firewall!

Since your external clients consider you as a server, not as a "security
proxy",
they come with an HTTP "GET", not "CONNECT", which is why it does not
work.

Besides, unless you have ipchains, ipfwadm, ipfilter, iptables or netacl
rules that you
did not quote, "plug-gw -ssl" is bloody dangerous: it allows anyone to
bounce a
connection from your site, hence to perform attacks (DoS, spam, mail
relay or whatever)
as if it came from you!
> 
> 1. What is proper configuration of plug-gw or http-gw for tunneling https ?

Either you put your server in the DMZ, in which case plug-gw works fine
to
relay HTTPS; we do not use http-gw here so I can't comment on its use as
proxy for
incoming traffic.

Or you have to have your server in your intranet, in which case HTTPS
over SSH
over plug-gw is the only solution.

> 2. Does any special ssl gateway like fwtk extension exist ?

An "SSL aware" gateway is 'ex hypothesis' impossible, since the traffic
is encrypted.
Actually, it would be nice if "plug-gw -ssl" were able to *recognize*
SSL traffic and 
reject other protocols like ICQ, IRC,...

> 3. Whitch solution of 1. and 2. is better ?
> 
> Thanks Roman

-- 
Michel Bardiaux
Peaktime Belgium S.A.  Rue Margot, 37  B-1457 Nil St Vincent
Tel : +32 10 65.44.15  Fax : +32 10 65.44.10

---

From: Martin Machacek <[email-masked]>
Date: Thu, 01 Jun 2000 17:30:47 +0200 (MET DST)

On 31-May-00 Michel Bardiaux wrote:
> "internal" you mean your truly internal (corporate or whatever) network, not
> your DMZ?
> encryption and authenticates the server to the client, AFAIK it does *NOT*
> authenticate the client to the server (anyone on the list knows how to use
> client-side certificates?)

It depends in which application. It is quite easy in WWW browsers. Both
Netscape and MSIE allow to use client certificate for authentication. All WWW
servers worth their names support client authentication in SSL. There are
OpenSource SSL proxies supporting client authentication (e.g. stunnel).

> Since the incoming SSL traffic is not authenticated, it should
> be on your internal net rather than the DMZ, consider using SSH (H, not L!)
> with forwarding of port 443. Note that it is a requirement that the clients
> are trusted, so they must be properly protected and administered machines
> with trusted users at the keyboard!

Or use ssl proxy on the firewall.

> to expect an HTTP request of the form "CONNECT host:port HTTP/1.0" and then

It even cannot care what goes on, because the rest of the communication is
encrypted :-).

> proxy", they come with an HTTP "GET", not "CONNECT", which is why it does not
> work.

You can try stunnel, see: http://mike.daewoo.com.pl/computer/stunnel
It should work in theis scenario and it will allow you to do client
authetication is SSL at the firewall. The other possibility is to use simple
plug-gw (without -ssl) and plug the incoming HTTPS connection directly to the
internal server. This is doable only if you trust the internal server and there
is potential risk of denial of service attacks. 

> An "SSL aware" gateway is 'ex hypothesis' impossible, since the traffic

However, the gateway can serve as the endpoint of the SSL connection from
client and establish another one (of course with different certificate) to the
inside and realy all data between those two.

        Martin 

---
[PGP KeyID F3F409C4]