Subject: Re: inbound http proxy (was: http-gw slow with IE but not NS)

From: "T. Esting" <[email-masked]>
Date: Thu, 19 Oct 2000 10:35:54 -0700 (PDT)

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

  A proxy, or application-level gateway, usually implies a program that has
knowledge of the application streams being forwarded.  A plug will just
blindly forward all network traffic.  For instance, a snapshot of a web
request might look like this, from an OSI layer perspective:

App GET /scripts/..%c1%1c../winnt/system32/cmd.exe HTTP/1.0
Pre
Ses
Tra Src port: 36021 Dst port: 80
Net Src ip: 1.2.3.4 Dst ip: 2.3.4.5
Dat you get the picture...
Phy

An application-level gateway understands the semantics of HTTP requests and
can inspect /scripts/..%c1%1c../winnt/system32/cmd.exe in order to decide,
individually for this particular request, whether or not it is valid (as
opposed to, for instance /index.html), whether to forward it, and to where. 
A plug will forward requests for both /index.html and
scripts/..%c1%1c../winnt/system32/cmd.exe, no questions asked.

On Thu, 19 Oct 2000 09:31:48 -0600, Luis Fernando Barrera wrote:

>  [To be removed from this list send the message "unsubscribe fwtk-users"
in the
>  BODY of a mail message to [email-masked].]
>  
>  So...what's the difference,
>   security-wise, between using a proxy and using port
>   forwarding?
>  
>  Luis
>  
>  -----Original Message-----
>  From: [email-masked] [mailto:[email-masked]]On
>  Behalf Of Keith Young
>  Sent: Thursday, October 19, 2000 6:41 AM
>  To: Keith V. Olson
>  Cc: Rick Murphy; [email-masked]
>  Subject: Re: inbound http proxy (was: http-gw slow with IE but not NS)
>  
>  
>  [To be removed from this list send the message "unsubscribe fwtk-users"
in the
>  BODY of a mail message to [email-masked].]
>  
>  "Keith V. Olson" wrote:
>  > 
>  > One more question.  About that faq item (2.4.13), there is a
>  > statement... "Your best bet for this is to use a plug-gw;
>  > however, that will not protect the web server from penetration
>  > attempts."  I had thought the purpose of proxy-ing an inbound
>  > connection was to 'plug' a hole in the firewall and prevent a
>  > root access type attack against the internal server running
>  > the webserver?  If not then what's the difference,
>  > security-wise, between using a proxy and using port
>  > forwarding?
>  
>  What I was trying to say in the FAQ is that if someone finds a hole in
>  your web server and it is on your inside network, then they will have
>  access to your network. The plug proxy cannot protect against bugs in
>  web servers or CGI scripts.
>  
>  You may want to consider putting the web server in a DMZ (third network
>  interface of your firewall box). This will have the firewall protect the
>  server from the Internet, and will also force attackers to break through
>  the firewall in order to get to the inside network.
>  
>  -- 
>  --Keith Young
>  -Director of Customer Care/Support, V-ONE Corp.
>  [email-masked]
>

_______________________________________________________
Say Bye to Slow Internet!
http://www.home.com/xinbox/signup.html

---

From: Michel Bardiaux <[email-masked]>
Date: Fri, 20 Oct 2000 08:54:35 +0200

"T. Esting" wrote:

[snipped very good explanation of application-level proxies]

Still, there *is* a difference between using packet-level filtering and
forwarding (a la ipfwadm and ipchains), and using a content-insensitive
application-level proxy (like FWTK plug-gw): although the *contents* may
be "hostile", at least no *packets* from the Internet will be seen
except by the FW machine itself. That will contain *some* forms of
attack, like flooding and spoofing, to the firewall. Right?

Cheers.
-- 
Michel Bardiaux
Peaktime Belgium S.A.  Rue Margot, 37  B-1457 Nil St Vincent
Tel : +32 10 65.44.15  Fax : +32 10 65.44.10

---

From: Joseph S D Yao <[email-masked]>
Date: Fri, 20 Oct 2000 14:14:50 -0400

On Fri, Oct 20, 2000 at 08:54:35AM +0200, Michel Bardiaux wrote:
...
> attack, like flooding and spoofing, to the firewall. Right?

Quite right.

-- 
Joe Yao				[email-masked] - Joseph S. D. Yao
COSPO/OSIS Computer Support					EMT-B
-----------------------------------------------------------------------
This message is not an official statement of COSPO policies.

---

From: "Keith V. Olson" <[email-masked]>
Date: Sun, 22 Oct 2000 12:57:31 -0700

Thanks for all of the information and answers.  I discovered
that apache itself installed on the FW machine can proxy to
an internal webserver.  What apache calls 'reverse' proxy.
This should work for me since this is for my home DSL
connection that I also use from work, etc.  I'll just have to
make sure apache is secure and everything the proxy feature
doesn't need is disabled.

Thanks again,
Keith

-- 
                             ///\\
                             (O O)
                +--------oOO--(_)-------------+
                | Keith V. Olson              |
                | [email-masked] |
                | http://www.digmanolson.com/ |
                +------------------oOO--------+
                  Portland  |__|__|        <*>
                  Oregon     || ||      MTFBWY
                            ooO Ooo

---

From: Joseph S D Yao <[email-masked]>
Date: Mon, 23 Oct 2000 12:41:49 -0400

> doesn't need is disabled.

This may work.  Generally, you want proxies to be much more simply
written than the Apache Web server.  But I believe that some are using
it for something similar.