Subject: [fwtk-users] problem with ssl and fwtk

From: "Don" <[email-masked]>
Date: Fri, 14 Jun 2002 16:10:31 -0400

Well, I've d/l and installed a test certificate from Thawte. I had already set up apache to work with ssl by installing OpenSSL and ModSSL.  When I try to connect to my site via https://, I get the I.E. "The page cannot be displayed" message.

Looking at my logs show no apparent error.  All I see are the following lines (xxx = IP):

permit host=me.lclcan.com/xxx.xxx.xxx.xxx service=ssl execute=/usr/local/etc/ssl-gw
permit host=lclcan.com/216.94.98.2 service=ssl  execute=/usr/local/etc/ssl-gw

The engineer at Thawte is convinced it's my firewall causing the problem.  I'm stumped. Anyone have an idea?

Don

==============================

Well, traffic has fallen off dramatically over the last year or so (I wonder
why that is).  There are occasional bursts of activity however.  Do you have
a question or problem?

--
Michael St. Laurent
Hartwell Corporation 

-----Original Message-----
From: Don [mailto:[email-masked]] 
Sent: Friday, June 14, 2002 12:33 PM
To: fwtk-users
Subject: [fwtk-users] This list

Is it still active?

---
You are currently subscribed to fwtk-users as: [email-masked]
To unsubscribe send a blank email to [email-masked]

---

From: "Michael St. Laurent" <[email-masked]>
Date: Fri, 14 Jun 2002 13:15:38 -0700

Hmmm, I connect to SSL sites all the time through our firewall.  You are
using FWTK version 2.1?  What patches have you applied if any?

--
Michael St. Laurent
Hartwell Corporation 

-----Original Message-----
From: Don [mailto:[email-masked]] 
Sent: Friday, June 14, 2002 1:11 PM
To: fwtk-users
Subject: [fwtk-users] problem with ssl and fwtk

Well, I've d/l and installed a test certificate from Thawte. I had already
set up apache to work with ssl by installing OpenSSL and ModSSL.  When I try
to connect to my site via https://, I get the I.E. "The page cannot be
displayed" message.
 
Looking at my logs show no apparent error.  All I see are the following
lines (xxx = IP):
 
permit host=me.lclcan.com/xxx.xxx.xxx.xxx service=ssl
execute=/usr/local/etc/ssl-gw
permit host=lclcan.com/216.94.98.2 service=ssl execute=/usr/local/etc/ssl-gw
 
The engineer at Thawte is convinced it's my firewall causing the problem.
I'm stumped. Anyone have an idea?
 
Don

--
Michael St. Laurent
Hartwell Corporation 

-----Original Message-----
From: Don [mailto:[email-masked]] 
Sent: Friday, June 14, 2002 12:33 PM
To: fwtk-users
Subject: [fwtk-users] This list

Is it still active?

---
You are currently subscribed to fwtk-users as: [email-masked]
To unsubscribe send a blank email to [email-masked] 

---

---

From: Keith Young <[email-masked]>
Date: Fri, 14 Jun 2002 16:14:04 -0400

Don wrote:
> Well, I've d/l and installed a test certificate from Thawte. I had 
> already set up apache to work with ssl by installing OpenSSL and 
> ModSSL.  When I try to connect to my site via https://, I get the I.E. 
> "The page cannot be displayed" message.
>  
> The engineer at Thawte is convinced it's my firewall causing the 
> problem.  I'm stumped. Anyone have an idea?
>  

Don,

Are you using the FWTK? Unless someone renamed the plug-gw proxy, or you 
are running Gauntlet, I don't know where you got the "ssl-gw" proxy from...

-- 

-- 
--Keith Young
[email-masked]

---

---

From: "Don" <[email-masked]>
Date: Fri, 14 Jun 2002 16:53:22 -0400

Don,

================================

Yes I'm using the FWTK.  I'm thinking there's a config problem.

The line in my netperm-table file reads:
  netacl-ssl: permit-hosts * -exec /usr/local/etc/ssl-gw
But this is only for outbound ssl so users from the outside should be able to load my site secure, no?

Further down in netperm-table, I see:
  ssl-gw:         denial-msg /usr/local/etc/http-deny.html
  ssl-gw:         timeout 36000
  ssl-gw:         permit-hosts *

The line in my /etc/inetd.conf file reads:
   ssl             stream  tcp     nowait  root    /usr/local/etc/netacl ssl

/etc/services is set up as such:
  https           443/tcp
  https           443/udp
  ssl              443/tcp

---

---

From: Rick Murphy <[email-masked]>
Date: Fri, 14 Jun 2002 16:47:24 -0400

At 04:10 PM 6/14/02 -0400, Don wrote:
>set up apache to work with ssl by installing OpenSSL and ModSSL.  When I 
>try to connect to my site via https://, I get the I.E. "The page cannot be 
>displayed" message.
>

I think you're running things backwards - VERY backwards.
The ssl-gw, if I remember right, is a SSL proxy. You can't front-end a web 
server with a SSL proxy. Just use plug-gw to forward the incoming traffic 
to your web server.

Running ssl-gw inbound this way is opening you to a huge security hole - 
anyone can telnet to your firewall on port 443, then use a "connect" verb 
to bypass your firewall.

>problem.  I'm stumped. Anyone have an idea?

Of course - it's always the firewall :-)
         -Rick

---

---

From: Rick Murphy <[email-masked]>
Date: Fri, 14 Jun 2002 16:50:47 -0400

>are running Gauntlet, I don't know where you got the "ssl-gw" proxy from...

That's one of the contributed proxies.
         -Rick

---

---

From: "Don" <[email-masked]>
Date: Tue, 18 Jun 2002 09:17:21 -0400

Sorry for the HTML post.  Yes, I am running my web server and firewall on the same machine.  At this time,this is my only option.

If I understand, I should assign different ports to https and ssl in /etc/services and then have Apache listening on port 444?  I
already have apache listening on my external I.P.

e.g.
==
https           443/tcp
https           443/udp
ssl               444/tcp

Note: It's possible that my problem is related to something else.  I ran the following script on the server:  openssl
s_client -connect 216.94.98.2:443 -debug -state

and received the following error:

SSL_connect:before/connect initialization
write to 08146430 [08146A78] (130 bytes => 130 (0x82))
0000 - 80 80 01 03 01 00 57 00-00 00 20 00 00 16 00 00   ......W... .....
0010 - 13 00 00 0a 07 00 c0 00-00 66 00 00 07 00 00 05   .........f......
0020 - 00 00 04 05 00 80 03 00-80 01 00 80 08 00 80 00   ................
0030 - 00 65 00 00 64 00 00 63-00 00 62 00 00 61 00 00   .e..d..c..b..a..
0040 - 60 00 00 15 00 00 12 00-00 09 06 00 40 00 00 14   `...........@...
0050 - 00 00 11 00 00 08 00 00-06 00 00 03 04 00 80 02   ................
0060 - 00 80 55 b6 1e 51 9a a0-cf 3f cb de da f6 28 29   ..U..Q...?....()
0070 - 9b 8d 74 62 80 67 d3 d7-f8 c8 bf ed 84 d3 fc 6c   ..tb.g.........l
0080 - 8a 42                                             .B
SSL_connect:SSLv2/v3 write client hello A
read from 08146430 [0814BFD8] (7 bytes => -1 (0xFFFFFFFF))
SSL_connect:error in SSLv2/v3 read server hello A
write:errno=104

===========================

At 09:03 AM 6/17/02 -0400, Don wrote:
Please post in plain text - that makes it easier for us with text-mode mail
readers to follow. HTML also looks bad in the archives.

>Well, if I am front-ending it, it's not on purpose.  The begets the
>question.  How do I configure it so that the proxy is only for outgoing
>while all incoming requests just use regular apache?

OK, I guess I'm not sure I understand what you're doing.
If you're running Apache on your firewall, don't. A basic tenet of firewall
design is to minimize what's installed so that you're less likely to be
exploited due to a bug. Apache is far too large and complex to run on a
firewall.

Assuming you're running it all on one box, set up Apache to only listen on
your external IP address. Then, anyone from the inside will get the proxy
and outside people will get the web server.

If you're running Apache on a separate internal system, then what you want
to do is to get the bind-address patch for plug-gw. Use that plug-gw on the
firewall, bound to the outside IP address only. Plug from that address on
port 443 to the web server on port 443.

If you don't use the bind-address patch, you could use netacl. Have
internal hosts exec  ssl-gw and external hosts exec plug-gw.
         -Rick

---
You are currently subscribed to fwtk-users as: [email-masked]
To unsubscribe send a blank email to [email-masked]

---

---

From: "Don" <[email-masked]>
Date: Wed, 19 Jun 2002 09:47:24 -0400

Ok.  I think I have a better idea.  In my /etc/inetd.conf file, ther'sa line that says:

I think the above is the reason that ssl requests inbound are being intercepted.  So...., how do I make the above outbound only?

==============

---

---

---

From: Rick Murphy <[email-masked]>
Date: Wed, 19 Jun 2002 16:49:29 -0400

At 09:47 AM 6/19/02 -0400, Don wrote:
>I think the above is the reason that ssl requests inbound are being 
>intercepted.  So...., how do I make the above outbound only?

Yes, that's true - that will cause inetd to capture all traffic to port 443.
Remove that from inetd, then kill and restart inetd. That should allow you 
to connect to your web server using SSL. If that's not working, it's not 
the firewall and you should investigate further.

Then, set up a copy of ssl-gw listening to some other port. Don't use 
netacl to front end it - that's an unnecessary complication. Tell your 
internal users to use that port as their SSL proxy.

To reiterate, I don't recommend running your web server and your firewall 
on the same machine. In the configuration you're using, if your web server 
is compromised it can be used as a stepping stone to bypass the firewall 
and access your internal network. You really should find a separate machine 
to use as a web server.
         -Rick

---