Mailing List Archive: Apache: Users

Reverse SSL proxy with NULL cipher on backend?

Index | Next | Previous | View Threaded

Josh.Wyatt at hcssystems

Sep 16, 2006, 5:53 AM

Post #1 of 5 (664 views)
Permalink

Reverse SSL proxy with NULL cipher on backend?

I have a situation in which I must run an old, insecure Apache (1.3.19, don't ask...). The application that runs with this webserver requires SSL from the client. Let's call this oapache.

To help secure this situation, I have built a 2.0.59 with openssl configuration on this same host. Let's call this proxyapache.

The intent is to configure oapache to listen on the loopback only, and use proxyapache as the user-facing frontend. For the SSL requirement reason, I use 'SSLProxyEngine on' on proxyapache. This works fine. I've done some trickery using /etc/hosts for hostnames so that I can even use the same certificate/key with both apaches.

Here's the request.

The above configuration uses twice the CPU that the old (using only oapache, listening to the public interface) because it's doing double the SSL work:

User <-> proxyapache
proxyapache <-> oapache

I'd like to use NULL authentication, ciphers, etc to reduce the proxyapache <-> oapache SSL overhead. How can I configure oapache and proxyapache to use NULL for authentication, ciphers, etc?

I tried the obvious:
'SSLProxyCipherSuite NULL' on proxyapache, and 'SSLCipherSuite NULL' on oapache. In oapache's logfiles I get:

[Fri Sep 15 22:00:51 2006] [error] mod_ssl: SSL handshake failed (server oapache:8888, client proxyapache) (OpenSSL library error follows)
[Fri Sep 15 22:00:51 2006] [error] OpenSSL: error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher [Hint: Too restrictive SSLCipherSuite or using DSA server certificate?]

This seems to hint that I need a different kind of certificate/key file. I tried not specifying a key/certificate file (why would I need one, for NULL everywhere?) but oapache will not start. I also tried using /dev/null for the cert and keyfiles, oapache complains that they are empty and will not start.

So my question:
How to configure oapache and proxyapache to use SSL, with no encryption/authentication/etc?

Thanks,
Josh

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe [at] httpd
" from the digest: users-digest-unsubscribe [at] httpd
For additional commands, e-mail: users-help [at] httpd

joshua at slive

Sep 17, 2006, 8:03 AM

Post #2 of 5 (615 views)
Permalink

Re: Reverse SSL proxy with NULL cipher on backend? [In reply to]

On 9/16/06, Josh Wyatt <Josh.Wyatt [at] hcssystems> wrote:
> I have a situation in which I must run an old, insecure Apache (1.3.19, don't ask...). The application that runs with this webserver requires SSL from the client. Let's call this oapache.
>
> To help secure this situation, I have built a 2.0.59 with openssl configuration on this same host. Let's call this proxyapache.
>
> The intent is to configure oapache to listen on the loopback only, and use proxyapache as the user-facing frontend. For the SSL requirement reason, I use 'SSLProxyEngine on' on proxyapache. This works fine. I've done some trickery using /etc/hosts for hostnames so that I can even use the same certificate/key with both apaches.
>
> Here's the request.
>
> The above configuration uses twice the CPU that the old (using only oapache, listening to the public interface) because it's doing double the SSL work:
>
> User <-> proxyapache
> proxyapache <-> oapache
>
> I'd like to use NULL authentication, ciphers, etc to reduce the proxyapache <-> oapache SSL overhead. How can I configure oapache and proxyapache to use NULL for authentication, ciphers, etc?

I don't know the answer to that. I suspect it is impossible without
modifying the configuratio n of oapache to accept null ciphers.

But in any case, this is silly. Why no just configure oapache to use
ordinary http instead?

Joshua.

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe [at] httpd
" from the digest: users-digest-unsubscribe [at] httpd
For additional commands, e-mail: users-help [at] httpd

Josh.Wyatt at hcssystems

Sep 17, 2006, 4:49 PM

Post #3 of 5 (625 views)
Permalink

Re: Reverse SSL proxy with NULL cipher on backend? [In reply to]

Joshua Slive wrote:
> On 9/16/06, Josh Wyatt <Josh.Wyatt [at] hcssystems> wrote:
>> I'd like to use NULL authentication, ciphers, etc to reduce the
>> proxyapache <-> oapache SSL overhead. How can I configure oapache and
>> proxyapache to use NULL for authentication, ciphers, etc?
>
>
> I don't know the answer to that. I suspect it is impossible without
> modifying the configuratio n of oapache to accept null ciphers.
>
> But in any case, this is silly. Why no just configure oapache to use
> ordinary http instead?
>
> Joshua.

I agree it's silly that SSL is required. But it truly is for this application (https is hard-coded as the beginning of all URLs), and it's a COTS application, so we can't change that bit.

Now, I absolutely DO have control over oapache's configuration. And as I stated in my initial post, I already tried specifying NULL ciphers with. Quoting my initial post:

'SSLProxyCipherSuite NULL' on proxyapache, and 'SSLCipherSuite NULL' on oapache. In oapache's logfiles I get:

[Fri Sep 15 22:00:51 2006] [error] mod_ssl: SSL handshake failed (server oapache:8888, client proxyapache) (OpenSSL library error follows)
[Fri Sep 15 22:00:51 2006] [error] OpenSSL: error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher [Hint: Too restrictive SSLCipherSuite or using DSA server certificate?]

Any help you can provide would be greatly appreciated.

Thanks,
Josh

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe [at] httpd
" from the digest: users-digest-unsubscribe [at] httpd
For additional commands, e-mail: users-help [at] httpd

spil.oss at googlemail

Sep 18, 2006, 5:28 AM

Post #4 of 5 (595 views)
Permalink

Re: Reverse SSL proxy with NULL cipher on backend? [In reply to]

Hi Josh,

When you say "https is hard-coded as the beginning of all URLs" you
mean that that is done in all pages that the webserver generates? In
that case you might just address oapache using http, and in apache2's
config ProxyPass / http://localhost/.

Kind Regards,

Spil
On 18/09/06, Josh Wyatt <Josh.Wyatt [at] hcssystems> wrote:
> Joshua Slive wrote:
> > On 9/16/06, Josh Wyatt <Josh.Wyatt [at] hcssystems> wrote:
> >> I'd like to use NULL authentication, ciphers, etc to reduce the
> >> proxyapache <-> oapache SSL overhead. How can I configure oapache and
> >> proxyapache to use NULL for authentication, ciphers, etc?
> >
> >
> > I don't know the answer to that. I suspect it is impossible without
> > modifying the configuratio n of oapache to accept null ciphers.
> >
> > But in any case, this is silly. Why no just configure oapache to use
> > ordinary http instead?
> >
> > Joshua.
>
> I agree it's silly that SSL is required. But it truly is for this application (https is hard-coded as the beginning of all URLs), and it's a COTS application, so we can't change that bit.
>
> Now, I absolutely DO have control over oapache's configuration. And as I stated in my initial post, I already tried specifying NULL ciphers with. Quoting my initial post:
>
> 'SSLProxyCipherSuite NULL' on proxyapache, and 'SSLCipherSuite NULL' on oapache. In oapache's logfiles I get:
>
> [Fri Sep 15 22:00:51 2006] [error] mod_ssl: SSL handshake failed (server oapache:8888, client proxyapache) (OpenSSL library error follows)
> [Fri Sep 15 22:00:51 2006] [error] OpenSSL: error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher [Hint: Too restrictive SSLCipherSuite or using DSA server certificate?]
>
> Any help you can provide would be greatly appreciated.
>
> Thanks,
> Josh
>
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe [at] httpd
> " from the digest: users-digest-unsubscribe [at] httpd
> For additional commands, e-mail: users-help [at] httpd
>
>

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe [at] httpd
" from the digest: users-digest-unsubscribe [at] httpd
For additional commands, e-mail: users-help [at] httpd

Josh.Wyatt at hcssystems

Sep 18, 2006, 9:10 AM

Post #5 of 5 (606 views)
Permalink

Re: Reverse SSL proxy with NULL cipher on backend? [In reply to]

Spil Oss wrote:
> Hi Josh,
>
> When you say "https is hard-coded as the beginning of all URLs" you
> mean that that is done in all pages that the webserver generates? In
> that case you might just address oapache using http, and in apache2's
> config ProxyPass / http://localhost/.
>
> Kind Regards,
>
> Spil

Hi Spil,

Thank you for your response.

Actually, the logic goes something like this:
1. End-human requests a report from the application server.
2. The request is handed off to a report server;
3. the report server generates the report himself via a special URL on the webserver;
4. The report retrieval URL is then mangled for security reasons, and sent back to the end-human
5. a new browser window pops up for the end-human, and retrieves the report via mangled URL.

Now, step 3 uses a "hidden" internal URL which gets mangled later on in step 4. This mangling action doesn't happen unless SSL is enabled on on oapache.

Sounds complicated, and I'm sure R. Goldberg had a hand in this. But stage 3 requires SSL.

Thanks,
Josh

> On 18/09/06, Josh Wyatt <Josh.Wyatt [at] hcssystems> wrote:
>
>> Joshua Slive wrote:
>> > On 9/16/06, Josh Wyatt <Josh.Wyatt [at] hcssystems> wrote:
>> >> I'd like to use NULL authentication, ciphers, etc to reduce the
>> >> proxyapache <-> oapache SSL overhead. How can I configure oapache and
>> >> proxyapache to use NULL for authentication, ciphers, etc?
>> >
>> >
>> > I don't know the answer to that. I suspect it is impossible without
>> > modifying the configuratio n of oapache to accept null ciphers.
>> >
>> > But in any case, this is silly. Why no just configure oapache to use
>> > ordinary http instead?
>> >
>> > Joshua.
>>
>> I agree it's silly that SSL is required. But it truly is for this
>> application (https is hard-coded as the beginning of all URLs), and
>> it's a COTS application, so we can't change that bit.
>>
>> Now, I absolutely DO have control over oapache's configuration. And
>> as I stated in my initial post, I already tried specifying NULL
>> ciphers with. Quoting my initial post:
>>
>> 'SSLProxyCipherSuite NULL' on proxyapache, and 'SSLCipherSuite NULL'
>> on oapache. In oapache's logfiles I get:
>>
>> [Fri Sep 15 22:00:51 2006] [error] mod_ssl: SSL handshake failed
>> (server oapache:8888, client proxyapache) (OpenSSL library error follows)
>> [Fri Sep 15 22:00:51 2006] [error] OpenSSL: error:1408A0C1:SSL
>> routines:SSL3_GET_CLIENT_HELLO:no shared cipher [Hint: Too restrictive
>> SSLCipherSuite or using DSA server certificate?]
>>
>> Any help you can provide would be greatly appreciated.
>>
>> Thanks,
>> Josh
>>
>>
>> ---------------------------------------------------------------------
>> The official User-To-User support forum of the Apache HTTP Server
>> Project.
>> See <URL:http://httpd.apache.org/userslist.html> for more info.
>> To unsubscribe, e-mail: users-unsubscribe [at] httpd
>> " from the digest: users-digest-unsubscribe [at] httpd
>> For additional commands, e-mail: users-help [at] httpd
>>
>>
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe [at] httpd
> " from the digest: users-digest-unsubscribe [at] httpd
> For additional commands, e-mail: users-help [at] httpd

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe [at] httpd
" from the digest: users-digest-unsubscribe [at] httpd
For additional commands, e-mail: users-help [at] httpd

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads