Subject: [fwtk-users] Re: problem with ssl and fwtk

From: "Don" <[email-masked]>
Date: Mon, 17 Jun 2002 09:03:26 -0400

Well, if I am front-ending it, it's not on purpose.  The begets the question.  How do I configure it so that the proxy is only for outgoing while all incoming requests just use regular apache?
  At 04:10 PM 6/14/02 -0400, Don wrote:
  >Well, I've d/l and installed a test certificate from Thawte. I had already 
  >set up apache to work with ssl by installing OpenSSL and ModSSL.  When I 
  >try to connect to my site via https://, I get the I.E. "The page cannot be 
  >displayed" message.
  >
  >Looking at my logs show no apparent error.  All I see are the following 
  >lines (xxx = IP):
  >
  >permit host=me.lclcan.com/xxx.xxx.xxx.xxx service=ssl 
  >execute=/usr/local/etc/ssl-gw
  >permit host=lclcan.com/216.94.98.2 service=ssl execute=/usr/local/etc/ssl-gw

  I think you're running things backwards - VERY backwards.
  The ssl-gw, if I remember right, is a SSL proxy. You can't front-end a web 
  server with a SSL proxy. Just use plug-gw to forward the incoming traffic 
  to your web server.

  Running ssl-gw inbound this way is opening you to a huge security hole - 
  anyone can telnet to your firewall on port 443, then use a "connect" verb 
  to bypass your firewall.

  >The engineer at Thawte is convinced it's my firewall causing the 
  >problem.  I'm stumped. Anyone have an idea?

  Of course - it's always the firewall :-)
           -Rick

---
You are currently subscribed to fwtk-users as: [email-masked]
To unsubscribe send a blank email to [email-masked]

---

From: Rick Murphy <[email-masked]>
Date: Mon, 17 Jun 2002 16:59:16 -0400

At 09:03 AM 6/17/02 -0400, Don wrote:
Please post in plain text - that makes it easier for us with text-mode mail 
readers to follow. HTML also looks bad in the archives.

>Well, if I am front-ending it, it's not on purpose.  The begets the 
>question.  How do I configure it so that the proxy is only for outgoing 
>while all incoming requests just use regular apache?

OK, I guess I'm not sure I understand what you're doing.
If you're running Apache on your firewall, don't. A basic tenet of firewall 
design is to minimize what's installed so that you're less likely to be 
exploited due to a bug. Apache is far too large and complex to run on a 
firewall.

Assuming you're running it all on one box, set up Apache to only listen on 
your external IP address. Then, anyone from the inside will get the proxy 
and outside people will get the web server.

If you're running Apache on a separate internal system, then what you want 
to do is to get the bind-address patch for plug-gw. Use that plug-gw on the 
firewall, bound to the outside IP address only. Plug from that address on 
port 443 to the web server on port 443.

If you don't use the bind-address patch, you could use netacl. Have 
internal hosts exec  ssl-gw and external hosts exec plug-gw.
         -Rick

---