Subject: [fwtk-users] Reverse-Proxy witch apache

From: Markus Schreier <[email-masked]>
Date: Mon, 14 Jan 2002 15:04:52 +0100

Hello all,
please excuse me asking this question again. It is important to me.
i've asked this question on the first working day in this year. I
believe, that most people where still on holiday or had to work up all
things which have piled up.
Any answer would be welcome.

Thanks a lot

Markus

-------- Original Message --------
Betreff: [fwtk-users] Reverse-Proxy witch apache
Datum: Wed, 02 Jan 2002 13:21:33 +0100
Von: Markus Schreier <[email-masked]>
Rückantwort: "fwtk-users" <[email-masked]>
Firma: ORDIX AG
An: "fwtk-users" <[email-masked]>

Hello all,
and happy new year to all of you.

I'd like to setup some way to provide Services from the inner network to
people on the internet.
This setup should 
* only allow authorized people
* be secure

I've been playing with the following setup and would like you to provide
me whith any thoughts to that subject, which come to your mind.

                                           |
internal network                          
|                                         internet
                                           |
                                           
http-service      -------------------  fw-gateway   
----------+--------/\/\/\------ client
(e.g. webfrontend                     running fwtk             |
for mailserver)                                            webserver
                                                           running
apache 1.3.20

<-------------SSL-------------------------      
<------SSL-------             
http-service     <-<-<-<-<-<-<-<-<-<-<-< plug-gw -<-<-<-<-<-< apache 
-<-<-<-<--<-<-< browser
                                                           reverse-proxy

The client connects via https to a certain URL on the webserver.
The webserver is configured as reverse-Proxy. It passes the request of
this url to fw-gateway Port XY.
On the fw-gateway plug-gw passes connects on Port XY to the inner
http-service port 443.

The url on the webserver is configured with password-Protection. Since
this is ssl-connection i believe it is secure?
I believe the mod_proxy opens a new ssl-connection through plug-gw.
Plug-gw is configured to allow connects from the webserver only.
------------

Do i open some unwanted holes by this configuration? Are there drawbacks
you can warn me from? Any ideas and suggestions are appreciated.

Greetings from Wiesbaden, Germany

Markus

-- 
-------------------------------------------------------------------------
Dipl.-Inform. (FH)    ORDIX AG                                 \\|||//
Markus Schreier       Kreuzberger Ring 13   mailto:[email-masked]  o   ô
Consultant            D-65205 Wiesbaden     Tel:0611/77840-00     ^
Systeme & Netze       http://www.ordix.de   Fax:0611/77840-11   `---´
-------------------------------------------------------------------------

---
You are currently subscribed to fwtk-users as: [email-masked]
To unsubscribe send a blank email to
[email-masked]

---
You are currently subscribed to fwtk-users as: [email-masked]
To unsubscribe send a blank email to [email-masked]

---

From: "Luis Fernando Barrera" <[email-masked]>
Date: Mon, 14 Jan 2002 08:55:35 -0600

I have a fw configured in a similar way...

I'd like to ask you some questions:

1) do you have a full web server running at your firewall?
2) If not, what piece of software do you use to provide the reverse proxy?
Plug-gw?

Regards,

Luis Fernando Barrera
[email-masked]

-----Original Message-----
From: Markus Schreier [mailto:[email-masked]]
Sent: Monday, January 14, 2002 08:05
To: fwtk-users
Subject: [fwtk-users] Reverse-Proxy witch apache

Hello all,

Thanks a lot

Markus

-------- Original Message --------
Betreff: [fwtk-users] Reverse-Proxy witch apache
Datum: Wed, 02 Jan 2002 13:21:33 +0100
Von: Markus Schreier <[email-masked]>
Rückantwort: "fwtk-users" <[email-masked]>
Firma: ORDIX AG
An: "fwtk-users" <[email-masked]>

Hello all,

                                           |internal network
|                                         internet
                                           |

http-service      -------------------
w-gateway   ----------+--------/\/\/\------ client(e.g. webfrontend
running fwtk             |for mailserver)
webserver                                                           running
apache 1.3.20

Markus

---

---
You are currently subscribed to fwtk-users as: [email-masked]
To unsubscribe send a blank email to [email-masked]

---

---

From: Markus Schreier <[email-masked]>
Date: Mon, 14 Jan 2002 16:16:14 +0100

Hello,

> 1) do you have a full web server running at your firewall?
Well it runn's on a seperate Linux-System outside the firewall. First of
all it is meant 
to provide Webservice.
It ist an self-compiled apache server on security- updated RedHat Linux
6.2

Regards,

Markus

---

---

From: Markus Schreier <[email-masked]>
Date: Mon, 14 Jan 2002 19:13:59 +0100

Hello Luis, 
thanks for your responses, I'm including the list, perhaps someone else
is interested 
in our talk.

Luis Fernando Barrera schrieb:
> 
> Hi,
> 
> So, you have a web server outside the firewall, that forwards
> all the incomming connections on port 443 to a plug-gw at the
> firewall, which redirects the connections to the internal web server, right?

yes, that's it. The internal webserver is being connected via ssl as
well.

> First, I think there's too much overhead having an external web server. Why
> don't
> you redirect all the requests from the clients, directly to the firewall?

The Web-Server is given anyway. It is used for being webserver first of
all. I only use one URL-Path inside the webserver for redirecting. I
believe useing apache for redirecting, gives me two seperate
ssl-Connections: One from Client to external Apache Server the other
from the external server through the firewall to the internal server. I
thought that's cute. I hope, apache doesen't do the redirecting job
blindly and only redirects requests which are somewhat http-alike. Which
may be better than no filtering at all?
 
> Another point, which is worth to talk about, is that maybe you should
> consider
> putting the internal web server in a separate segment, besides the internal
> network. Remember that most of the attacks to the web servers, are based
> on the http protocol, so in case the web server is compromised, it remains
> isolated from the other internal servers.
That is a good point. The draw back is, the internal server does not
only have 
static pages. But it helps, having a mail to show up with, which argues
in that direction.
> 
> Also, there is a program called http-in, which is "part" of the
> fwtk, which has the function of redirecting external http requests to
> an internal web server. I don't remember if it can redirect SSL connections,
> but you can take a look at it. It's located
> http://www.fwtk.org/fwtk/patches/patches.html#3.9

That realy is a good information too. I didn't know of that proxy and
will have a look at it in near future.

Regards,

Markus 

---