ssl forward / proxy question

ssl forward / proxy question

[jen]

hi, 

i have a NAT set up via an iptables firewall on RHAS. i have various webservers 
behind it (and other stuff), but now i'm required by marketing (sigh) to set 
up loads of SSL certificates. since apache/apache2 still requires one ip 
address per SSL certificate, and they mean to do lots of these, i'm wondering
how to set it up in such a way that all DNS points to one external IP address
such as 234.56.78.90. when the packet hits the firewall, something proxies it 
so that it will see the *name* address, and forward it on to a virtual IP. for
example:

there are 3 domains all belonging to the same "real" IP address. 

234.56.78.90 -> www.guinness.com
234.56.78.90 -> www.kicks.com
234.56.78.90 -> www.butt.com

so a user wants to go to www.guinness.com, the IP takes the packet to the fire
wall/proxy/whatever, notices that it's "www.guinness.com" and and will forward t
he packet on to the internal address of 10.31.1.44

user goes to www.kicks.com, and the packet goes to 10.31.1.45

www.butt.com will get forwarded to 10.31.1.46

is there something like this that is possible? 

thanks!!

-\jen

RE: ssl forward / proxy question

[George Vieira]

You cannot do this as SSL by default will connect, negotiate a certificate and the DISCONNECT AND RECONNECT using the encryption.. which by then it's too late to know the virtual site it's for..

on the first connection it's fine but second connection is impossible to determine which virtual host it's for..

My only solution was to use different ports for SSL ie. 443 is not used, 444-500 for each site.. or setup a common domain for all sites to use.. ie. www.paysafe.com/domain1 www.paysafe.com/domain2 etc.etc...

Thanks,
____________________________________________
George Vieira
Systems Manager
georgev@citadelcomputer.com.au

Citadel Computer Systems Pty Ltd
http://www.citadelcomputer.com.au

Phone   : +61 2 9955 2644
HelpDesk: +61 2 9955 2698
 

-----Original Message-----
From: jen@saturn5.com [mailto:jen@saturn5.com]
Sent: None
To: netfilter@lists.netfilter.org
Subject: ssl forward / proxy question



hi, 

i have a NAT set up via an iptables firewall on RHAS. i have various webservers 
behind it (and other stuff), but now i'm required by marketing (sigh) to set 
up loads of SSL certificates. since apache/apache2 still requires one ip 
address per SSL certificate, and they mean to do lots of these, i'm wondering
how to set it up in such a way that all DNS points to one external IP address
such as 234.56.78.90. when the packet hits the firewall, something proxies it 
so that it will see the *name* address, and forward it on to a virtual IP. for
example:

there are 3 domains all belonging to the same "real" IP address. 

234.56.78.90 -> www.guinness.com
234.56.78.90 -> www.kicks.com
234.56.78.90 -> www.butt.com

so a user wants to go to www.guinness.com, the IP takes the packet to the fire
wall/proxy/whatever, notices that it's "www.guinness.com" and and will forward t
he packet on to the internal address of 10.31.1.44

user goes to www.kicks.com, and the packet goes to 10.31.1.45

www.butt.com will get forwarded to 10.31.1.46

is there something like this that is possible? 

thanks!!

-\jen

Re: ssl forward / proxy question

[Garcia Ruiz]

Have a look at Squid proxy. The last releases admit SSL reverse proxying. If
it would be capable of handling different servers your problem would be
solved. You could have it inside of the firewall (but be careful with
security issues).

Regards.

BGR


----- Original Message ----- 
From: <jen@saturn5.com>
To: <netfilter@lists.netfilter.org>
Sent: Friday, July 25, 2003 2:17 AM
Subject: ssl forward / proxy question


>
> hi,
>
> i have a NAT set up via an iptables firewall on RHAS. i have various
webservers
> behind it (and other stuff), but now i'm required by marketing (sigh) to
set
> up loads of SSL certificates. since apache/apache2 still requires one ip
> address per SSL certificate, and they mean to do lots of these, i'm
wondering
> how to set it up in such a way that all DNS points to one external IP
address
> such as 234.56.78.90. when the packet hits the firewall, something proxies
it
> so that it will see the *name* address, and forward it on to a virtual IP.
for
> example:
>
> there are 3 domains all belonging to the same "real" IP address.
>
> 234.56.78.90 -> www.guinness.com
> 234.56.78.90 -> www.kicks.com
> 234.56.78.90 -> www.butt.com
>
> so a user wants to go to www.guinness.com, the IP takes the packet to the
fire
> wall/proxy/whatever, notices that it's "www.guinness.com" and and will
forward t
> he packet on to the internal address of 10.31.1.44
>
> user goes to www.kicks.com, and the packet goes to 10.31.1.45
>
> www.butt.com will get forwarded to 10.31.1.46
>
> is there something like this that is possible?
>
> thanks!!
>
> -\jen
>
>

Re: ssl forward / proxy question

[Ramin Dousti]

You mean squid is going to handle the "get" requests for https??????
Meaning it's terminating SSL, sending the right cert, negotiating a
session key with the client, getting the request and fetching the
contents based on the "get" request from the right web server on the
LAN????

Can you confirm all the above? If so, squid is a big security hole,
but I'm sure it's not:

http://www.squid-cache.org/Doc/FAQ/FAQ-1.html#ss1.12

Ramin

On Fri, Jul 25, 2003 at 08:38:14PM +0200, Garcia Ruiz wrote:

> Have a look at Squid proxy. The last releases admit SSL reverse proxying. If
> it would be capable of handling different servers your problem would be
> solved. You could have it inside of the firewall (but be careful with
> security issues).
> 
> Regards.
> 
> BGR

Re: ssl forward / proxy question

[Garcia Ruiz]

I can tell you that squid 2.5 supports reverse proxying and it works this
way: Client -> SSL -> Squid (with certificates) -> No SSL -> Internal
Server. I think that HTTP proxying supports reverse proxying for more than 1
server but I don't know if it's the same for SSL. In this case your only
problem is that the internal network donn't have encryption (Is it fine for
you¿?). If reverse proxy works for you, you can get an extra: The load of
you web servers will be much lower (you won't probably get cached SSL pages
but as you know, when requesting a page there are a lot of requests -images
among other- and these kind of requests can be cached and also are very
heavy. The load of your servers would be also lower due to the lack of
encryption-decryption inside them).

Squid 3.0 supports Client -> SSL -> Squid (with certificates) -> SSL ->
Internal Server but it is in developement state (I wouldn't use in
production mode).


Here you have some interesting links:
http://squid.bilkent.edu.tr/mail-archive/squid-users/200102/0714.html
http://www.squid-cache.org/mail-archive/squid-users/200303/1040.html
http://squid.visolve.com/white_papers/reverseproxy.htm

Regards,

JBGR

----- Original Message ----- 
From: "Ramin Dousti" <ramin@cannon.eng.us.uu.net>
To: "Garcia Ruiz" <gar_ruiz@teleline.es>
Cc: <jen@saturn5.com>; <netfilter@lists.netfilter.org>
Sent: Friday, July 25, 2003 9:33 PM
Subject: Re: ssl forward / proxy question


> You mean squid is going to handle the "get" requests for https??????
> Meaning it's terminating SSL, sending the right cert, negotiating a
> session key with the client, getting the request and fetching the
> contents based on the "get" request from the right web server on the
> LAN????
>
> Can you confirm all the above? If so, squid is a big security hole,
> but I'm sure it's not:
>
> http://www.squid-cache.org/Doc/FAQ/FAQ-1.html#ss1.12
>
> Ramin
>
> On Fri, Jul 25, 2003 at 08:38:14PM +0200, Garcia Ruiz wrote:
>
> > Have a look at Squid proxy. The last releases admit SSL reverse
proxying. If
> > it would be capable of handling different servers your problem would be
> > solved. You could have it inside of the firewall (but be careful with
> > security issues).
> >
> > Regards.
> >
> > BGR
>

Re: ssl forward / proxy question

[Ramin Dousti]

THe original poster has three web servers with three certs (I think). The
reverse proxy you are explaining below can only hold one cert (this is the
nature of SSL). 

Ramin

On Sat, Jul 26, 2003 at 12:03:27AM +0200, Garcia Ruiz wrote:

> I can tell you that squid 2.5 supports reverse proxying and it works this
> way: Client -> SSL -> Squid (with certificates) -> No SSL -> Internal
> Server. I think that HTTP proxying supports reverse proxying for more than 1
> server but I don't know if it's the same for SSL. In this case your only
> problem is that the internal network donn't have encryption (Is it fine for
> you¿?). If reverse proxy works for you, you can get an extra: The load of
> you web servers will be much lower (you won't probably get cached SSL pages
> but as you know, when requesting a page there are a lot of requests -images
> among other- and these kind of requests can be cached and also are very
> heavy. The load of your servers would be also lower due to the lack of
> encryption-decryption inside them).
> 
> Squid 3.0 supports Client -> SSL -> Squid (with certificates) -> SSL ->
> Internal Server but it is in developement state (I wouldn't use in
> production mode).
> 
> 
> Here you have some interesting links:
> http://squid.bilkent.edu.tr/mail-archive/squid-users/200102/0714.html
> http://www.squid-cache.org/mail-archive/squid-users/200303/1040.html
> http://squid.visolve.com/white_papers/reverseproxy.htm
> 
> Regards,
> 
> JBGR
> 
> ----- Original Message ----- 
> From: "Ramin Dousti" <ramin@cannon.eng.us.uu.net>
> To: "Garcia Ruiz" <gar_ruiz@teleline.es>
> Cc: <jen@saturn5.com>; <netfilter@lists.netfilter.org>
> Sent: Friday, July 25, 2003 9:33 PM
> Subject: Re: ssl forward / proxy question
> 
> 
> > You mean squid is going to handle the "get" requests for https??????
> > Meaning it's terminating SSL, sending the right cert, negotiating a
> > session key with the client, getting the request and fetching the
> > contents based on the "get" request from the right web server on the
> > LAN????
> >
> > Can you confirm all the above? If so, squid is a big security hole,
> > but I'm sure it's not:
> >
> > http://www.squid-cache.org/Doc/FAQ/FAQ-1.html#ss1.12
> >
> > Ramin
> >
> > On Fri, Jul 25, 2003 at 08:38:14PM +0200, Garcia Ruiz wrote:
> >
> > > Have a look at Squid proxy. The last releases admit SSL reverse
> proxying. If
> > > it would be capable of handling different servers your problem would be
> > > solved. You could have it inside of the firewall (but be careful with
> > > security issues).
> > >
> > > Regards.
> > >
> > > BGR
> >
> 

RE: ssl forward / proxy question

[Hulsman, MJ (Mike)]

If you have three ip addresses on the squid proxy, you can have three ssl certs.

Mike Hulsman.

> -----Oorspronkelijk bericht-----
> Van: Ramin Dousti [mailto:ramin@cannon.eng.us.uu.net]
> Verzonden: zaterdag 26 juli 2003 3:46
> Aan: Garcia Ruiz
> CC: Ramin Dousti; jen@saturn5.com; netfilter@lists.netfilter.org
> Onderwerp: Re: ssl forward / proxy question
> 
> 
> THe original poster has three web servers with three certs (I 
> think). The
> reverse proxy you are explaining below can only hold one cert 
> (this is the
> nature of SSL). 
> 
> Ramin
> 
> On Sat, Jul 26, 2003 at 12:03:27AM +0200, Garcia Ruiz wrote:
> 
> > I can tell you that squid 2.5 supports reverse proxying and 
> it works this
> > way: Client -> SSL -> Squid (with certificates) -> No SSL 
> -> Internal
> > Server. I think that HTTP proxying supports reverse 
> proxying for more than 1
> > server but I don't know if it's the same for SSL. In this 
> case your only
> > problem is that the internal network donn't have encryption 
> (Is it fine for
> > you¿?). If reverse proxy works for you, you can get an 
> extra: The load of
> > you web servers will be much lower (you won't probably get 
> cached SSL pages
> > but as you know, when requesting a page there are a lot of 
> requests -images
> > among other- and these kind of requests can be cached and 
> also are very
> > heavy. The load of your servers would be also lower due to 
> the lack of
> > encryption-decryption inside them).
> > 
> > Squid 3.0 supports Client -> SSL -> Squid (with 
> certificates) -> SSL ->
> > Internal Server but it is in developement state (I wouldn't use in
> > production mode).
> > 
> > 
> > Here you have some interesting links:
> > 
> http://squid.bilkent.edu.tr/mail-archive/squid-users/200102/0714.html
> > http://www.squid-cache.org/mail-archive/squid-users/200303/1040.html
> > http://squid.visolve.com/white_papers/reverseproxy.htm
> > 
> > Regards,
> > 
> > JBGR
> > 
> > ----- Original Message ----- 
> > From: "Ramin Dousti" <ramin@cannon.eng.us.uu.net>
> > To: "Garcia Ruiz" <gar_ruiz@teleline.es>
> > Cc: <jen@saturn5.com>; <netfilter@lists.netfilter.org>
> > Sent: Friday, July 25, 2003 9:33 PM
> > Subject: Re: ssl forward / proxy question
> > 
> > 
> > > You mean squid is going to handle the "get" requests for 
> https??????
> > > Meaning it's terminating SSL, sending the right cert, 
> negotiating a
> > > session key with the client, getting the request and fetching the
> > > contents based on the "get" request from the right web 
> server on the
> > > LAN????
> > >
> > > Can you confirm all the above? If so, squid is a big 
> security hole,
> > > but I'm sure it's not:
> > >
> > > http://www.squid-cache.org/Doc/FAQ/FAQ-1.html#ss1.12
> > >
> > > Ramin
> > >
> > > On Fri, Jul 25, 2003 at 08:38:14PM +0200, Garcia Ruiz wrote:
> > >
> > > > Have a look at Squid proxy. The last releases admit SSL reverse
> > proxying. If
> > > > it would be capable of handling different servers your 
> problem would be
> > > > solved. You could have it inside of the firewall (but 
> be careful with
> > > > security issues).
> > > >
> > > > Regards.
> > > >
> > > > BGR
> > >
> > 
> 
> 
> 
> 


================================================
De informatie opgenomen in dit bericht kan vertrouwelijk zijn en 
is uitsluitend bestemd voor de geadresseerde. Indien u dit bericht 
onterecht ontvangt, wordt u verzocht de inhoud niet te gebruiken en 
de afzender direct te informeren door het bericht te retourneren. 
================================================
The information contained in this message may be confidential 
and is intended to be exclusively for the addressee. Should you 
receive this message unintentionally, please do not use the contents 
herein and notify the sender immediately by return e-mail.

Re: ssl forward / proxy question

[Ramin Dousti]

On Mon, Jul 28, 2003 at 05:05:56PM +0200, Hulsman, MJ (Mike) wrote:

> If you have three ip addresses on the squid proxy, you can have three ssl certs.

Yes. But if he'd had three IP's then the whole issue was non-existent.

Ramin

> 
> Mike Hulsman.

Re: ssl forward / proxy question

[jen]

i actually have 3 load-balanced webservers, and another lone one with virtual 
IPs. there are 5 SSL certificates at this time (some clients insist on having 
their own domain name), and it appears we are going to have more. i am trying 
to keep this as limited as possible, but there's only so much i can do since 
we only get 32 IPs from our co-lo facility. 

since i have, logically, 2 different webservers, would this work (barring squid
or any proxies)? $EXTERNAL_IP1 and 2 are 2 different external IPs, whereas 
$WEBSERVER1 and 2 are the 2 different webservers.

iptables -A FORWARD -p tcp -s $EXTERNAL_IP1 -d $WEBSERVER1 --dport 443 -j ACCEPT
iptables -A FORWARD -p tcp -s $EXTERNAL_IP2 -d $WEBSERVER2 --dport 443 -j ACCEPT 
thanks!

-\jen

 
> THe original poster has three web servers with three certs (I think). The
> reverse proxy you are explaining below can only hold one cert (this is the
> nature of SSL). 
> 
> Ramin
> 
> On Sat, Jul 26, 2003 at 12:03:27AM +0200, Garcia Ruiz wrote:
> 
> > I can tell you that squid 2.5 supports reverse proxying and it works this
> > way: Client -> SSL -> Squid (with certificates) -> No SSL -> Internal
> > Server. I think that HTTP proxying supports reverse proxying for more than 1
> > server but I don't know if it's the same for SSL. In this case your only
> > problem is that the internal network donn't have encryption (Is it fine for
> > you¿?). If reverse proxy works for you, you can get an extra: The load of
> > you web servers will be much lower (you won't probably get cached SSL pages
> > but as you know, when requesting a page there are a lot of requests -images
> > among other- and these kind of requests can be cached and also are very
> > heavy. The load of your servers would be also lower due to the lack of
> > encryption-decryption inside them).
> > 
> > Squid 3.0 supports Client -> SSL -> Squid (with certificates) -> SSL ->
> > Internal Server but it is in developement state (I wouldn't use in
> > production mode).
> > 
> > 
> > Here you have some interesting links:
> > http://squid.bilkent.edu.tr/mail-archive/squid-users/200102/0714.html
> > http://www.squid-cache.org/mail-archive/squid-users/200303/1040.html
> > http://squid.visolve.com/white_papers/reverseproxy.htm
> > 
> > Regards,
> > 
> > JBGR
> > 
> > ----- Original Message ----- 
> > From: "Ramin Dousti" <ramin@cannon.eng.us.uu.net>
> > To: "Garcia Ruiz" <gar_ruiz@teleline.es>
> > Cc: <jen@saturn5.com>; <netfilter@lists.netfilter.org>
> > Sent: Friday, July 25, 2003 9:33 PM
> > Subject: Re: ssl forward / proxy question
> > 
> > 
> > > You mean squid is going to handle the "get" requests for https??????
> > > Meaning it's terminating SSL, sending the right cert, negotiating a
> > > session key with the client, getting the request and fetching the
> > > contents based on the "get" request from the right web server on the
> > > LAN????
> > >
> > > Can you confirm all the above? If so, squid is a big security hole,
> > > but I'm sure it's not:
> > >
> > > http://www.squid-cache.org/Doc/FAQ/FAQ-1.html#ss1.12
> > >
> > > Ramin
> > >
> > > On Fri, Jul 25, 2003 at 08:38:14PM +0200, Garcia Ruiz wrote:
> > >
> > > > Have a look at Squid proxy. The last releases admit SSL reverse
> > proxying. If
> > > > it would be capable of handling different servers your problem would be
> > > > solved. You could have it inside of the firewall (but be careful with
> > > > security issues).
> > > >
> > > > Regards.
> > > >
> > > > BGR
> > >
> > 
>