Re: Using haproxy to armour a web server

2011-01-25 Thread Willy Tarreau
On Tue, Jan 25, 2011 at 11:55:57AM +, Brett Delle Grazie wrote: > Recommendation: > My recommendation would be Apache HTTPD in reverse proxy mode with > mod_security > installed and configured correctly. A properly hardened Apache HTTPD > server is very > difficult to hack and when placed in a

Re: Using haproxy to armour a web server

2011-01-25 Thread Sean Rodden
Oh I have trouble with that too! When I started in this job, my boss said "Be aware that some of the learning difficulties the kids use this software for, is congenital." which was a very polite way of saying that some of the parents have the same problems! I see what you mean with the VMWare idea

RE: Using haproxy to armour a web server

2011-01-25 Thread Mike Hoffs
Haha, i think for the most idiots is next, next, next understandable ;-) What I mean with vmware, is that u can make a vmware image, burn in on dvd with vmware player. I think with some scripting u can also make a nice installer for it to. Long time ago I did some senior admin work at a col

RE: Using haproxy to armour a web server

2011-01-25 Thread Mike Hoffs
I dont know how the community edition Works, but the licensed one is shipped with a nice installer for microsoft and Linux products. It is not browser plugin, but a little program u can start when u need it, it will connect to your vpn server. And setup the routing as you set it up. Met ee

Re: Using haproxy to armour a web server

2011-01-25 Thread Sean Rodden
Is the only way to run openVPN with the VPN client installed as a browser plugin? On Tue, Jan 25, 2011 at 11:34 PM, Mike Hoffs wrote: > I was also thinking about openVPN, we use is for some customers, it is > awesome. U can put all the students in one group with only access to that > tomcat serve

RE: Using haproxy to armour a web server

2011-01-25 Thread Mike Hoffs
I was also thinking about openVPN, we use is for some customers, it is awesome. U can put all the students in one group with only access to that tomcat server. And also it is not that expensive, don’t buy a license for the number of students, but the number that u think how many will use It co

Re: Using haproxy to armour a web server

2011-01-25 Thread Sean Rodden
On Tue, Jan 25, 2011 at 10:55 PM, Brett Delle Grazie < brett.dellegra...@gmail.com> wrote: > > Personally if the application isn't designed with security in mind I > wouldn't put it on the Internet or consider paying a developer to review the > application for just this purpose. Depending upon ho

Re: Using haproxy to armour a web server

2011-01-25 Thread Sean Rodden
The app is educational software that was designed for a classroom environment where one Tomcat server provides content to anyone on the campus intranet. We want to set up a virtual classroom because we have many customers that have trouble installing the old stand-alone version that comes on CD. A

RE: Using haproxy to armour a web server

2011-01-25 Thread Mike Hoffs
What is the reason that this internal application has to be moved to external ? Outside workers that have to reach the application ? Met een vriendelijke groet, Mike Hoffs

Re: Using haproxy to armour a web server

2011-01-25 Thread Brett Delle Grazie
Hi, On 25 January 2011 09:29, Sean Rodden wrote: > Hi folks, > > I have a web app (served by Tomcat) that was intended for intranet use. As > such I assume that the security is only basic and it is not suitable for > facing the public internet. When seeking a product to stand between my app > and

Using haproxy to armour a web server - update 1

2011-01-25 Thread Sean Rodden
OK, I found that I needed to uncomment the chroot statement before it would prompt for a password. That makes sense. That part is working now :-) Still could use some advice on the attack prevention though! Thanks, Sean

Using haproxy to armour a web server

2011-01-25 Thread Sean Rodden
Hi folks, I have a web app (served by Tomcat) that was intended for intranet use. As such I assume that the security is only basic and it is not suitable for facing the public internet. When seeking a product to stand between my app and the world, haproxy was recommended to me. I understand that t