2

I realize there is already a question similar to this one, but this is somewhat of a follow-up.

I understand that a reverse proxy server by itself is hardly useful as a web app security measure because it just kind of "hides" the server behind it, protecting it from fingerprinting, DDoS possibly, yada yada. However, I believe that implementing say snort + squid might accomplish some application-level security because you could analyze traffic for common attack patterns. But I have not seen very much info on the net about what products, open source projects, or even just recipes for this type of system are available.

The motivation for this question is that I support an OLD legacy app that is based on a heavily modded, insecure, and un-upgradable version of Apache2. I CANNOT just place mod_security2 in the conf, it will not work (I can't get the sources to this messed up old distribution of apache to compile mod_security2). So, I thought the next best thing would be to implement a reverse proxy type of solution, since then not only could this solve my immediate problem for this legacy app, but also if set up correctly I could see it being used for future apps as well - central web app security.

Is my mode of thinking incorrect? If it is not totally off-base, there must be some existing solutions, products, projects, recipes, etc out there. Is squid+snort all I need?

EDIT: And how does this all work when I need to do this with encrypted traffic as well?

Improve this question

1 Answer 1

Reset to default
3

Using mod_security as a reverse proxy is common, especially in the IIS world where only recently has a free WAF has become available. Apache running as a reverse proxy will handle your SSL handshakes, so this won't be a problem.

However it sounds like you have a MUCH BIGGER PROBLEM on your hands. If you can't update Apache you are completely and totally lost. I guarantee you that there are publicly available exploits for your system. There are new security systems available for Linux such as AppArmor and SELinux, not having these is a fatal mistake.

I am not sure why you think it's okay to have an extremely old system and that putting a band-aid over it is acceptable behavior. If a security expert sees this they are going to be very concerned. A WAF is in no way shape or form a substitute for fixing known vulnerabilities in your system (period). A WAF is just another layer, and you must plan on failure. (And a WAF will be the first to fall because it is usually the weakest.)

Improve this answer
2
  • Rook, thank you for an insightful and frank answer. Of course I do not want to run a deprecated version of anything public-facing, but these were the cards I was dealt. I deal more in systems than in development, and to fix this software would be a major development project because of the tight coupling of the original software to some features in that version of Apache. You must agree, a WAF is better than nothing?
    – tacos_tacos_tacos
    Sep 25, 2012 at 2:55
  • @jshin47 Getting hacked is never an option, I'm sure you understand. I only hope that others around you understand this.
    – rook
    Sep 25, 2012 at 3:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .