Re: [Pound Mailing List] Confuring Pound to work with seperate Keys/Certificate pairs

Hey everyone,

Sorry I have been gone a while. We had a huge change in software and hardware and upgraded to all new versions of firmware and now I am having problems configuring Pound for uClinux system. Would you all be able to help me. I am in the source bf-2012R1.env environment and had no problem running the configure before. So I was wondering if you all could help me with this. It is setup for Cross Compiling because I just configured and built OpenSSL 1.1.0e and several other CGIs. Below are the commands and thew results I get. I am trying to configure Pound to run on uClinux 0.9.4 and use OpenSSL 1.1.0e with thread support so that I can limit the amount of threads Pound allows.

<uClinux-New> Pound-2.7$ ./configure 
checking for gcc... bfin-uclinux-gcc
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
checking for suffix of executables... 
checking whether we are cross compiling... configure: error: in `/home/warren/Desktop/signuClinux/Pound-2.7':
configure: error: cannot run C compiled programs.
If you meant to cross compile, use `--host'.
See `config.log' for more details


Pound-2.7$ ./configure --with-ssl=/lib/libssl/openssl-1.1.0e/
checking for gcc... bfin-uclinux-gcc
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
checking for suffix of executables... 
checking whether we are cross compiling... configure: error: in `/home/warren/Desktop/signuClinux/Pound-2.7':
configure: error: cannot run C compiled programs.
If you meant to cross compile, use `--host'.
See `config.log' for more details

<uClinux-New> Pound-2.7$ CC=bfin-uclinux-gcc ./configure --with-ssl=/lib/libssl/openssl-1.1.0e/
checking for gcc... bfin-uclinux-gcc
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
checking for suffix of executables... 
checking whether we are cross compiling... configure: error: in `/home/warren/Desktop/signuClinux/Pound-2.7':
configure: error: cannot run C compiled programs.
If you meant to cross compile, use `--host'.
See `config.log' for more details

<uClinux-New> Pound-2.7$ CROSS_COMPILE=bfin-uclinux-gcc ./configure --with-ssl=/lib/libssl/openssl-1.1.0e/
checking for gcc... bfin-uclinux-gcc
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
checking for suffix of executables... 
checking whether we are cross compiling... configure: error: in `/home/warren/Desktop/signuClinux/Pound-2.7':
configure: error: cannot run C compiled programs.
If you meant to cross compile, use `--host'.
See `config.log' for more details

What am I doing wrong?

Warren


--------------------------------------------
On Fri, 3/24/17, Joe Gooch <[email protected]> wrote:

 Subject: Re: [Pound Mailing List] Confuring Pound to work with seperate Keys/Certificate pairs
 To: "[email protected]" <[email protected]>
 Date: Friday, March 24, 2017, 10:10 AM
 
 You need a Cert directive.  In that pem
 file, append PEM versions (in this order) of the private
 key, the server certificate, and all the CA certificates up
 through the root.  I.e. My digicert cert has my private
 key, my server certificate, and then the digicert SHA2
 intermediate, and then the digicert root.
 
 You don't need a HostCert directive,
 unless you're doing SNI. (Nor CAList or CRLList)
 
 Put your private CA in VerifyList
 You want the ClientCert 2 2 command as
 well.
 
 Depending on your compliance
 requirements, you will want to specify more stringent
 ciphers. See:
 http://www.apsis.ch/pound/pound_list/archive/2014/2014-10/1414097953000
 
 You may be in an environment where you
 want to disable TLSv1 or TLSv1_1 instead.
 
 SHA512/4096 bit keys depends on your
 OpenSSL library, not Pound. See "openssl ciphers".
 
 If you add xHTTP 0 - pound will only
 accept GET, POST, and HEAD.  If you truly only want
 POST, you need to modify the config.c and replace the
 (GET|POST|HEAD) regex with POST, and compile your own
 build.
 
 As for threads, you'll have to be more
 specific as to what you believe the problem is and what
 you're trying to solve.  Any load balancer can be
 overloaded by malicious (or legit) requests if there are
 enough of them.  You may need to implement ratelimits
 at the iptables/shorewall level.
 
 
 ------
  
 Joe
 
 
 
 
 
 
 -----Original Message-----
 From: warren perdue <kronos2185-/[email protected]>
 Reply-To: "[email protected]"
 <[email protected]>
 Date: Friday, March 24, 2017 at 8:34
 AM
 To: "[email protected]"
 <[email protected]>
 Subject: Re: [Pound Mailing List]
 Confuring Pound to work with seperate Keys/Certificate
 pairs
 
 >Hi Joe and everyone,
 >
 >Just to follow up with everyone. I
 have decided to drop BOA with SSL and go solely with Pound
 for HTTPS communications. 
 >I will no longer accept HTTP
 POST/GET messages but only HTTPS POST messages. So I was
 wondering if any of you could
 >help me with my configuration to do
 the following:
 >I want to limit POUND to only
 accept a self signed certificate that is created by me and
 prevent POUND from sending out any
 >certificates or pems. So that the
 only way POUND will accept any HTTPS POST message is if they
 have the self signed certificate
 >we provide the user and if it does
 not match, we do not allow them access. 
 >
 >I also was wondering how can I
 modify POUND to run on lower than 128 threads/processes?
 Because we found a way to send 
 >commands to POUND that allows an
 intruder to issue multiple commands that allows them to
 exponentially increase the threads/
 >processes to overload POUND and the
 memory and crash the server? Below is a sample of my
 pound.cfg file. If you please could 
 >give me some guidance I would
 really appreciate it. Thank you all so much for helping me
 so far and hopefully my questions will 
 >help others on the forum as well.
 >
 >Warren
 >
 >
 >#ListenHTTP xxx.xxx.xxx.xxx,xxx
 >#ListenHTTPS xxx.xxx.xxx.xxx,xxx
 /etc/pound/mycert.pem
 >#
 >#         
     UrlGroup ".*"
 >#         
     BackEnd xxx.xxx.xxx.xxx,xxx,xxx
 >#         
     EndGroup
 >    Threads 100
 >    ListenHTTPS
 >         
         Address xxx.xxx.xxx.xxx
 >         
         Port    xxx
 >         
         Cert   
 "/etc/pound/newcert.pem"
 >#         
         HostCert
 "/etc/pound/rootCA.pem"
 >#         
         ClientCert 2 2
 >#         
         CAlist "/etc/pound/newcert.pem"
 >#         
         CRLlist"/etc/pound/cert.pem"
 >#         
        
 VerifyList"/etc/pound/Verifylist/rootCA.pem"
 >         
         Service
 >         
             BackEnd
 >         
                
 Address xxx.xxx.xxx.xxx
 >         
                
 Port    xxx
 >         
             End
 >         
         End
 >         
     End
 >--------------------------------------------
 >On Sat, 3/18/17, Joe Gooch <[email protected]>
 wrote:
 >
 > Subject: Re: [Pound Mailing List]
 Confuring Pound to work with seperate Keys/Certificate
 pairs
 > To: "[email protected]"
 <[email protected]>
 > Cc: "kronos2185-/[email protected]"
 <kronos2185-/[email protected]>
 > Date: Saturday, March 18, 2017,
 1:02 PM
 > 
 > Is your purpose to have Pound be
 a
 > load balancer, or just a security
 gateway?  (I would
 > think BOA could do client
 certificates)
 > 
 > SSL has two parts (regardless of
 the server on the other
 > end)
 > 
 > Server Authentication  -
 Server has a certificate +
 > private key, which is trusted by
 some third party (usually a
 > trusted third party, unless you go
 with a self-signed cert,
 > or an internal certificate
 authority)  The client
 > determines if it will trust the
 server based on the
 > certificate's signature(s). 
 Client requires no private
 > key in this scenario.
 > 
 > See also:
 > Cert
 > HostCert
 > CAlist
 > CRLlist
 > 
 > 
 > Client Authentication - Client has
 a certificate + private
 > key.  The server decides if
 it will trust the client
 > based on the client certificate's
 signature(s).  The
 > server must do server
 authentication also - otherwise, SSL
 > negotiation never happens.
 > 
 > See also:
 > ClientCert
 > VerifyList
 > 
 > 
 > In general there are two ways to
 verify a client:
 > 1) Trust individual certs - in
 which case you need an entire
 > list of every valid certificate
 > 2) Trust the signer of the
 client's cert - in which case you
 > just need the CA certificate
 > 
 > For instance, stunnel provides
 both of these - through the
 > verifyPeer(1) and verifyChain(2)
 options.
 > 
 > Also note that some systems may,
 after trusting the
 > certificate, map the certificate's
 subject or parameters to
 > an identity for authentication
 purposes - which Pound
 > supports by passing the
 information using the
 > X-SSL-Certificate header. (For
 instance, with my OpenVPN
 > certs - the CN is always the
 username)
 > 
 > I believe pound only supplies
 trust option #2.
 > 
 > Which means to do what you want to
 do, you need to create a
 > certificate authority.  The
 OpenSSL library can be used
 > to do this. (This is what I do,
 for instance, for OpenVPN
 > client certificates)  See http://www.octaldream.com/scottm/talks/ssl/opensslca.html
 > You create a certificate
 authority.  You have Pound
 > trust that authority (through
 VerifyList), and you issue
 > certificates signed by that
 authority.  Any certificate
 > signed by that authority is
 valid.  If you are a
 > windows shop, you can certainly
 use a windows CA for this
 > purpose instead, or really, any CA
 package.  There are
 > a bunch out there.. EJBCA, etc..
 Google for Private CA GUI
 > and you'll find them.
 > 
 > In this case for your
 authentication you *want* to use a
 > private ca in VerifyList.  If
 you put something like
 > DigiCert in your VerifyList,
 anyone who pays digicert for a
 > certificate can authenticate as a
 client.  The security
 > comes from the security and
 privacy of your CA private key,
 > and your issuing of client
 certificates through it.
 > 
 > 
 > If you're looking for trust option
 #1, you may want to look
 > into something like stunnel with
 verifyPeer.  You
 > maintain a local directory which
 each valid certificate,
 > sorted by the fingerprint of the
 certificate.  It's not
 > truly a HTTP proxy, nor will it
 provide HTTP level headers,
 > but it could provide
 verification.
 > 
 > Alternatively, if you don't need
 load balancing, you may not
 > need pound at all, and you might
 be able to configure BOA
 > for this.  Apache and Nginx
 both have options for
 > client certs, along with SSL
 features Pound doesn't have,
 > like OCSP stapling.
 > 
 > http://blog.nategood.com/client-side-certificate-authentication-in-ngi
 > 
 > https://httpd.apache.org/docs/2.4/ssl/ssl_howto.html
 > 
 > 
 > 
 > Joe
 > 
 > 
 > 
 > 
 > 
 > 
 > 
 > 
 > On 3/17/17, 5:35 PM, "warren
 perdue" <kronos2185-/[email protected]>
 > wrote:
 > 
 > >Hey everyone,
 > >
 > >I need your help with trying
 to setup my Pound on an
 > Linux embedded system. What I want
 to do is have pound only
 > accept a certificate that I give
 the user. I will place the
 > key as a private key on my machine
 and will give the user
 > the certificate. They will then
 have to add that certificate
 > to their browser so that they can
 access Pound. 
 > >
 > >I understand Pound needs an
 initial PEM to send out. But
 > I do not want to accept that PEM.
 I want to send them the
 > Certificate to place in their
 browser or what ever program
 > they will use to access the system
 and access the system.
 > >
 > >Basically. My plan is to
 create an different key and
 > certificate with SHA512 and 4096
 Bytes long. Place the key
 > in the private section of Pound.
 > >
 > >Give the certificate to the
 key to the user and they can
 > use that to access Pound and my
 system.
 > >
 > >I am having problems setting
 Pound up to function in
 > that manner. 
 > >
 > >I Am aware of the CAList,
 Verifylist commands, but what
 > else do i need to add to my
 Pound/conf file to make it
 > work?There are many options and
 not alot of documentation
 > online supporting pound. If any of
 you all can help. Please
 > reply. 
 > >
 > >I will also have it working in
 conjunction with SSL and
 > running BOA as my web-server if
 that will help you. I have
 > already compiled the system kernel
 and system to use BOA
 > with SSL and also include Pound as
 a part of its kernel. I
 > can run pound and have it control
 access through the
 > listener but I want to make it
 super hard to crack or hack
 > my system.
 > >
 > >Warren
 > >
 > >--
 > >To unsubscribe send an email
 with subject unsubscribe to
 > [email protected]
 > >Please contact [email protected]
 > for questions.
 > 
 >
 >--
 >To unsubscribe send an email with
 subject unsubscribe to [email protected]
 >Please contact [email protected]
 for questions.
 

--
To unsubscribe send an email with subject unsubscribe to [email protected]
Please contact [email protected] for questions.