Skip to main content

Questions tagged [haproxy]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
1 answer
111 views

Can a Reverse Proxy be used instead of port filtering?

I want to limit access from the Internet to my Web server but the clients will have a dynamic IP address so the best I can do is to whitelist all addresses belonging to that specific mobile carrier ...
mfloris's user avatar
  • 101
1 vote
1 answer
772 views

HAProxy Trust only specific client certs for mutual

I am using HAProxy to perform Mutual TLS termination for my API. HAProxy has Mutual TLS enabled with "verify required" and a cert-auth file to restrict access to the Apache service that ...
ProfessorQuirrellsEarSweat's user avatar
0 votes
2 answers
707 views

How does my HTTPS POST get blocked based on XML content?

There's a web application on a server which I have full access to which accepts POST requests on a REST endpoint. The request payload is expected to be an XML document. For request routing and load ...
G_H's user avatar
  • 121
1 vote
1 answer
1k views

Adding a self-signed client certificate to HAProxy for mutual-tls?

I added the client cert into ca.pem as in bind 0.0.0.0:443 ssl crt /etc/ssl/private/asdf.hdavid.io.pem verify optional ca-file /etc/ssl/certs/ca.pem http-request set-header X-SSL-Client-Verify %...
David Hofmann's user avatar
0 votes
0 answers
274 views

rkhunter reports numerous warnings on haproxy open ports

Recently I have installed RKhunter (v1.4.2) on a couple of loadbalancers ( Haproxy 2.0.14 ) running on Debian 9. Stretch. While performing a full system check I'm getting a lot or warnings about tcp ...
cparfon's user avatar
3 votes
1 answer
1k views

Correctly configuring load balancing for TLS session resumption

Consider the following network topology: There are exactly two HTTPS servers, S1 and S2. There are exactly two HTTPS clients, C1 and C2. Notice this, as there are often many more clients for two ...
Sadeq Dousti's user avatar
  • 1,514
1 vote
0 answers
341 views

health check to test haproxy -- request deny with 200. good idea?

I have been working on a multi-provider redundant load balancing solution using HAProxy, AWS, and Cloudflare. I have a solution, and I believe it will be secure, but I am looking for further ...
Muradin007's user avatar
3 votes
2 answers
2k views

Should we enable TLS on backend connection after reverse proxy? [duplicate]

I have a reverse proxy (e.g. nginx, nghttpx, haproxy) that proxies connection to a service running on the same physical server. I think the most common way to configure this setup is to enable TSL ...
leopoodle's user avatar
  • 151
2 votes
0 answers
635 views

Mitigating reverse DNS lookup danger / exploitation

I have read several posts indicating that reverse dns lookup cannot be trusted, as someone can spoof DNS -- so when a rule is made that allows traffic through dns, its possible to exploit. However, ...
Muradin007's user avatar
4 votes
2 answers
1k views

Do browsers and tools send `SNI` field by default connecting to https endpoints?

I am setting up HaProxy for https in passthrough (tcp) mode without SSL/TLS termination. I want to be able to route traffic to different backends based on hostname requested by a client. From HaProxy ...
Kirill's user avatar
  • 143
2 votes
1 answer
763 views

Oracle (CVE-2016-2107) vulnerability on haproxy + Apache + (AWS vs private hosting)

We have a privately hosted production system and an AWS machine we use for testing. Both systems have the same structure: SSL termination with haproxy, passing to an Apache server hosting a rails ...
rwold's user avatar
  • 131