[no subject]

I don't see this as breaking the SSL security since the original packet
is unchanged except for the DNAT. However, the big headache is the
apache mod that needs to be able to send the needed info to the router.
That is a chunk of code that is, by necessity, hardened to prevent
security leaks in apache. 


Hmm. The initial https request is NOT encrypted. Maybe a way to do the
tracking through SNAT/DNAT with the connection tables...

research ensues....

On Fri, 2005-08-26 at 23:36 -0400, Allan Neal wrote:
> Unfortunatly the user tool would not work.  SSL will not allow you to do
> hostname based hosting.  Each site has to have it's own IP address.  The
> reason for this is that the url is encoded in the SSL portion of the packet.
> The only part that IPTables can see it the IP address.  So in order to get
> IPTables to do what you are talking about here, you would have to decrypt the
> packet at the firewall to see (name1|name2).  
> 
&gt; You could do one base site with different contexts i.e. <a  rel="nofollow" href="https://sitename/name1";>https://sitename/name1</a>
&gt; and <a  rel="nofollow" href="https://sitename/name2";>https://sitename/name2</a>.  Then you only have to have one Cert.  I suspect
&gt; this is not what you are looking for though.
&gt; 
&gt; Sorry I can't be of more help.  This is how it has worked for me in my job
&gt; though.  I run several SSL sites for my company.   We haven't found a way
&gt; around this and it even caused us to recently purchase ARIN space to get
&gt; enough IP addresses to handle our growth.
&gt; 
&gt; Allan
&gt; 
&gt; On Wed, Aug 24, 2005 at 06:15:53PM -0400, James P. Kinney III wrote:
&gt; &gt; I am looking at setting up an ssl-enabled web server in the dmz. As I
&gt; &gt; only have a few real IP addresses, I am looking at using internal IP
&gt; &gt; (10.0.*) addresses to handle the ssl-cert requirements of unique IP for
&gt; &gt; each namespace.
&gt; &gt; 
&gt; &gt; What I'm stumped on is how to get <a  rel="nofollow" href="https://name1";>https://name1</a> AND <a  rel="nofollow" href="https://name2";>https://name2</a> to
&gt; &gt; both get through the firewall and point to the correct virtual interface
&gt; &gt; IP address on the DMX server. Do I need to write a userspace tool that
&gt; &gt; interfaces with iptables to read the server name from the IP stack?
&gt; &gt; 
&gt; &gt; Can this be done with an apache proxy on the firewall?
&gt; &gt; -- 
&gt; &gt; James P. Kinney III          \Changing the mobile computing world/
&gt; &gt; CEO &amp; Director of Engineering \          one Linux user         /
&gt; &gt; Local Net Solutions,LLC        \           at a time.          /
&gt; &gt; 770-493-8244                    \.___________________________./
&gt; &gt; <a  rel="nofollow" href="http://www.localnetsolutions.com";>http://www.localnetsolutions.com</a>
&gt; &gt; 
&gt; &gt; GPG ID: 829C6CA7 James P. Kinney III (M.S. Physics)
&gt; &gt; &lt;jkinney at localnetsolutions.com&gt;
&gt; &gt; Fingerprint = 3C9E 6366 54FC A3FE BA4D 0659 6190 ADC3 829C 6CA7
&gt; 
&gt; 
&gt; 
&gt; &gt; _______________________________________________
&gt; &gt; Ale mailing list
&gt; &gt; Ale at ale.org
&gt; &gt; <a  rel="nofollow" href="http://www.ale.org/mailman/listinfo/ale";>http://www.ale.org/mailman/listinfo/ale</a>
&gt; 
&gt; 
&gt; _______________________________________________
&gt; Ale mailing list
&gt; Ale at ale.org
&gt; <a  rel="nofollow" href="http://www.ale.org/mailman/listinfo/ale";>http://www.ale.org/mailman/listinfo/ale</a>
-- 
James P. Kinney III          \Changing the mobile computing world/
CEO &amp; Director of Engineering \          one Linux user         /
Local Net Solutions,LLC        \           at a time.          /
770-493-8244                    \.___________________________./
<a  rel="nofollow" href="http://www.localnetsolutions.com";>http://www.localnetsolutions.com</a>

GPG ID: 829C6CA7 James P. Kinney III (M.S. Physics)
&lt;jkinney at localnetsolutions.com&gt;
Fingerprint = 3C9E 6366 54FC A3FE BA4D 0659 6190 ADC3 829C 6CA7
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part



</pre>
<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->
<hr>
<!--X-Follow-Ups-End-->
<!--X-References-->
<ul><li><strong>References</strong>:
<ul>
<li><strong><a name="00404" href="msg00404.html">[ale] apache, ssl, DMZ, brain calcification</a></strong>
<ul><li><em>From:</em> jkinney at localnetsolutions.com (James P. Kinney III)</li></ul></li>
<li><strong><a name="00474" href="msg00474.html">[ale] apache, ssl, DMZ, brain calcification</a></strong>
<ul><li><em>From:</em> allanneal at comcast.net (Allan Neal)</li></ul></li>
</ul></li></ul>
<!--X-References-End-->
<!--X-BotPNI-->
<ul>
<li>Prev by Date:
<strong><a href="msg00475.html">[ale] Gizmo for Linux</a></strong>
</li>
<li>Next by Date:
<strong><a href="msg00477.html">[ale] Syntax problem</a></strong>
</li>
<li>Previous by thread:
<strong><a href="msg00474.html">[ale] apache, ssl, DMZ, brain calcification</a></strong>
</li>
<li>Next by thread:
<strong><a href="msg00408.html">[ale] OT: Seeking consultant with cross-compiling experience</a></strong>
</li>
<li>Index(es):
<ul>
<li><a href="maillist.html#00476"><strong>Date</strong></a></li>
<li><a href="threads.html#00476"><strong>Thread</strong></a></li>
</ul>
</li>
</ul>

<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->
</body>
</html>