Re: ssl forward / proxy question

["Garcia Ruiz" <gar_ruiz@teleline.es>]

I can tell you that squid 2.5 supports reverse proxying and it works this
way: Client -> SSL -> Squid (with certificates) -> No SSL -> Internal
Server. I think that HTTP proxying supports reverse proxying for more than 1
server but I don't know if it's the same for SSL. In this case your only
problem is that the internal network donn't have encryption (Is it fine for
you¿?). If reverse proxy works for you, you can get an extra: The load of
you web servers will be much lower (you won't probably get cached SSL pages
but as you know, when requesting a page there are a lot of requests -images
among other- and these kind of requests can be cached and also are very
heavy. The load of your servers would be also lower due to the lack of
encryption-decryption inside them).

Squid 3.0 supports Client -> SSL -> Squid (with certificates) -> SSL ->
Internal Server but it is in developement state (I wouldn't use in
production mode).


Here you have some interesting links:
http://squid.bilkent.edu.tr/mail-archive/squid-users/200102/0714.html
http://www.squid-cache.org/mail-archive/squid-users/200303/1040.html
http://squid.visolve.com/white_papers/reverseproxy.htm

Regards,

JBGR

----- Original Message ----- 
From: "Ramin Dousti" <ramin@cannon.eng.us.uu.net>
To: "Garcia Ruiz" <gar_ruiz@teleline.es>
Cc: <jen@saturn5.com>; <netfilter@lists.netfilter.org>
Sent: Friday, July 25, 2003 9:33 PM
Subject: Re: ssl forward / proxy question


> You mean squid is going to handle the "get" requests for https??????
> Meaning it's terminating SSL, sending the right cert, negotiating a
> session key with the client, getting the request and fetching the
> contents based on the "get" request from the right web server on the
> LAN????
>
> Can you confirm all the above? If so, squid is a big security hole,
> but I'm sure it's not:
>
> http://www.squid-cache.org/Doc/FAQ/FAQ-1.html#ss1.12
>
> Ramin
>
> On Fri, Jul 25, 2003 at 08:38:14PM +0200, Garcia Ruiz wrote:
>
> > Have a look at Squid proxy. The last releases admit SSL reverse
proxying. If
> > it would be capable of handling different servers your problem would be
> > solved. You could have it inside of the firewall (but be careful with
> > security issues).
> >
> > Regards.
> >
> > BGR
>