Re: SSL with metuxmpm (was Re: Metuxmpm test failed)

-                                                 [email protected]
---------------------------------------------------------------------

On Mon, Oct 06, 2003 at 04:47:21PM +0200, Christian Skarby wrote:

Hi,

<snip>
> I think the most common way to solve this is to have a different
> ip-address for each vhost that have an ssl-certificate, of course a
IP addresses are quite rare.
I personally have an Class C on one box which is only rarely used
(but its not my primary webserver, since traffic is quite expensive there :()
But others dont have this.

> different port will work, but the visitors would then have to specify the
> port because it is non-standard, aka https://www.example.org:4430/ ,
> wouldn't they?
Normally an redirection from an plain HTTP website should be enough.
In most cases you only want this when transmitting critical data
(i.e. authentication or confidential material).

btw: is there any signature support for websites ? (i.e. S/MIME or PGP/GPG)

> Anyway, If I have understood the concepts right, we need a way for the
> multiplexer to differensiate between ssl and non-ssl ip/ports. For ssl
> ip/ports we could probably forward the connection right away to the right
> ssl-processor, whereas we'll have to do the normal peeking in the
> http-header in order to decide which non-ssl-processor that should serve
> the request.
Hmm, when a connection comes in, we see what port it is. A simple table 
lookup should be enough (for a quite small amount of different ports, 
an seq scan should be enough)

> Would this lead us in the right direction?
Yes, its probably better than having the ssl handled in the processor.
Since the mux runs under its own unprivileged user, it would help preventing
some attacks when openssl is exploitable.

But it has the flaw that all certs must be accessible for the mux user
(or is it enought, when the master process loads them into memory before
forking the mux ?)


cu
-- 
---------------------------------------------------------------------
 Enrico Weigelt    ==   metux IT services

 phone:     +49 36207 519931         www:       http://www.metux.de/     
 fax:       +49 36207 519932         email:     [email protected]
 cellphone: +49 174 7066481	     
---------------------------------------------------------------------
 Diese Mail wurde mit UUCP versandt.      http://www.metux.de/uucp/