This thread raises the question as to what are the pros and cons of fronting Aware directly onto the internet or hiding it behind a reverse proxy. The source was a query on SSL and Tomcat by Henrik. I've put this in the tips and trick rather than general as it's not really a functionality question and it might be easier for others to find someway down the road. I've come to like the model of a reverse proxy so most of my comments will be pro - while my posts may read like a statement of fact they are opinions and open to challenge and discussion. Structure Post a reply for each pro or con and rename the subject to describe the benefit or overhead - this will make it easier to follow conversation threads. The following are links to the specific posts for Pros and Cons. I'll update until such time as I forget... ### Proxy Server Pros [list=1] [*][url=https://www.awareim.com/forum/post/55476]Security through obscurity[/url] [*][url=https://www.awareim.com/forum/post/55477]Graceful Failover[/url] [*][url=https://www.awareim.com/forum/post/55478]SSL, Let's Encrypt & CertBot[/url] [*][url=https://www.awareim.com/forum/post/55479]Load Balancing[/url] [*][url=https://www.awareim.com/forum/post/55480]Physically distancing the DB from Internet[/url] [*][url=https://www.awareim.com/forum/post/55481]Decouple from AwareIM releases[/url] which leads to [*][url=https://www.awareim.com/forum/post/55482]Preventing update mistakes[/url] [*][url=https://www.awareim.com/forum/post/55483]Hide Tomcat Management Panel[/url] [*][url=https://www.awareim.com/forum/post/55484]Shutdown port access prevented[/url] [*][url=https://www.awareim.com/forum/post/55492]Subdomains instead of custom Logon Pages[/url] [*][url=https://awareim.com/forum/post/56533]Decommission Apps[/url] [/list] ### Proxy Server Cons [list=1] [*][url=https://www.awareim.com/forum/post/55486]Additional Server Required[/url] [*][url=https://www.awareim.com/forum/post/55553]Harder to run dev and prod on same AIM server[/url][/list] (The lack of threading on phpBB makes this messy to keep track of, hence the TOC list)

If you front your Tomcat server directly onto the web then the 8080 port in the URL is a bit of a giveaway as to what server is running. Using a proxy server limits the URL data to whatever your domain is. I believe that there are opportunities to do URL rewrites as well, which limits the information being posted into the URL which can become complex.

If you are using a web proxy in front of the Tomcat server you are able to use error pages to gracefully communicate to a user that the server is down. If you just have the Tomcat server exposed to the end user and you take the server down you will get a generic timeout message

You can use a web proxy to manage load where you have more than one Aware server running.

With a reverse proxy in place you can control where the traffic from the internet goes. User --> reverse proxy --> Aware Server --> Database. If you have a proxy in place you can ensure that traffic can only be served to the Aware Server. The connection to the Database can be abstracted further away from the internet. This provides an added layer of safety for your data (assuming you are not hosting your database on the same server as Aware - that is a bad idea).

As Aware ships with Tomcat, most people are probably not updating the Tomcat software separately. This means that when vulnerabilities are found in Tomcat see here https://www.cvedetails.com/product/887/Apache-Tomcat.html?vendor_id=45 you can either update Tomcat or wait until it is updated within the Aware bundle. If you abstract Tomcat away from the user it means that vulnerabilities are harder to exploit, party because the reverse proxy is acting as the user and can be expected to act in a manner that is security compliant, but also through the security by obscurity concept.

If you have configured Tomcat in any way it becomes a management overhead when you update Aware to ensure that you remember to reapply your changes e.g. enabling SSL

This is less of an issue with more recent releases of Tomcat, but you cannot load the Tomcat Management screens from behind a proxy (unless you have set a route from the proxy to the management panels). Nowadays it is more difficult to accidentally enable management user access due to changes in the way that users.xml defaults are set.

Tomcat has a shut down port. If you don't switch it off a call to http://yourservername.com:8005 will shutdown your server. For this to happen with a reverse proxy you would have to create a route to port 8005. If you didn't create the route explicitly the malicious user would just get an error message. One less thing to have to check every time you update Aware Edit: this is achievable with a decent firewall rule as well so not proxy specific.

Tomcat v Reverse Proxy pros and cons

PointsWell

hpl123 wrote
PointsWell wrote
Lets Encrypt and certbot are easily set up and allow for automatic certificate renewal without having to take the server down for updates

Letsencrypt is great and fully integrated with IIS reverse proxy via the ACME tool, how is this configured in NGINX?

certbot integrates SSL into NGINX

PointsWell

hpl123 wrote
If you configure a reverse proxy, the URL may need rewriting in some cases as the public URL is different from the private URL. Have anyone experienced problems with this when using a reverse proxy with Aware?

The URL is rewritten from the public URL to an internal private IP address.

You would run two servers
One with NGINX (or whatever) and that would be exposed to the internet.
Second one with Aware that is shielded from the internet and running on a private IP address. There is no URL for this server as it is not publicly accessible.

PointsWell

hpl123 wrote
PointsWell wrote
To run a reverse proxy you have to set up another server, so one more to manage.

The server doesn't have to be particularly hefty though as it is just managing connections and traffic.

One thing I am wondering about is how much a revere proxy actually toll a system. I am using IIS as a reverse proxy and I know others are using NGINX and it is ONLY used for that so I would think it does´nt take much but I don´t know.

I am not in production at the moment, so am not putting much load on my proxy server. I am able to run it on a micro AWS device with minimal resources.

Mark is also using this setup and can probably give you more details on his server setup in production.

hpl123

PointsWell wrote
hpl123 wrote
PointsWell wrote
Currently I am working with client subdomains to connect to their personalised login pages, which makes for a cleaner url

client.yourwebservice.com
instead of
yourwebserice.com:8080/AwareIM/LoginClientName.html

The proxy route converts client.yourwebservice.com to the full URL internally, though you could use a directory instead of a subdomain.

Personally I feel like the subdomain is more personalised, but it is a "feels" and an opinion.

How is this setup? Do you have specific rewrite rules then, 1 for each client? My reverse proxy setup for example connects "https://yourwebservice.com/app/" to "localhost:8080" so if I want to login I would use "https://yourwebservice.com/app/logonAdmin.html" and the reverse proxy cannot in it´s core configuration it seems be configured to a specific file so additional rewrite rules (or something) needs to ne configured for that to work.

This was all with the assistance of Intra on here.

You create an NGINX directive for each sub domain. You obviously have to add a route to this for your internet domain. The start of the directive contains your server name i.e. the sub.yourdomain.com and then you create locations.

The default location within the directive goes to the logon page that you want to use for that specific client. I use one that has the Domain prepopulated. So the default path is to proxy pass to the internal IP address/AwareIM/logonPage.html

The result is that customerName.yourdomain.com redirects to 123.45.67.89:8080/AwareIM/logonCustomerName.html

The end user only sees the customerName.yourdomain.com in the URL at login. It does however then start to show the full URL after login but there are ways to limit that. I haven't worked out how to mask it all yet (this translates to I haven't bothered intra enough to help me figure it out)

In the directive you include another directive to the generic error pages, I am guessing you could probably create custom error pages for each customer if you were so inclined.

Cerbot manages the SSL keys and will add all the required lines into the directive.

Probably works on the same way in IIS and I haven´t gotten to doing this yet and this is a more complex things. Setting up a reverse proxy at least in IIS is easy, if you then want custom stuff like custom URL´s, error pages etc. you have to dig into complex rewrite rules and things and it´s easy to mess things up if you don´t know what you are doing.

I also get the problem with IIS showing entire URL and also Aware showing strange and irrelevant URL things that have no function for the user (just confusing) and have tried to mask it but in my trials, I messed some part of the functionality up i.e it broke the reverse proxy or parts of it. Still working on this.

hpl123

PointsWell wrote
hpl123 wrote
If a reverse proxy is configured, Tomcat can be hidden or blocked from the web, how is this done?

The directive uses proxy_pass command to rewrite

customerName.yourDomain.com to internalIP:8080/AwareIM/...

CURL to the URL shows NGINX as the responder.

Yeah but Tomcat can still be accessed from the web? You are blocking it in the firewall or how?

hpl123

PointsWell wrote
hpl123 wrote
If you configure a reverse proxy, the URL may need rewriting in some cases as the public URL is different from the private URL. Have anyone experienced problems with this when using a reverse proxy with Aware?

The URL is rewritten from the public URL to an internal private IP address.

You would run two servers
One with NGINX (or whatever) and that would be exposed to the internet.
Second one with Aware that is shielded from the internet and running on a private IP address. There is no URL for this server as it is not publicly accessible.

The problems I was referring to are mainly resource access problems so say I have a resource (image, file whatever) on the server and it is opened up by Aware, in that case the file would be accessed using the private URL BUT when the proxy rewrites the URL in the for the user, the file is not correctly opened as there exists no file at that URL. Not sure I am explaining this correctly and I had some issues with this initially when setting up IIS but don´t any more and/so I am not sure in what circumstances this actually happened but I know it can happen. Complex stuff.

hpl123

PointsWell wrote
hpl123 wrote
PointsWell wrote
To run a reverse proxy you have to set up another server, so one more to manage.

The server doesn't have to be particularly hefty though as it is just managing connections and traffic.

One thing I am wondering about is how much a revere proxy actually toll a system. I am using IIS as a reverse proxy and I know others are using NGINX and it is ONLY used for that so I would think it does´nt take much but I don´t know.

I am not in production at the moment, so am not putting much load on my proxy server. I am able to run it on a micro AWS device with minimal resources.

Mark is also using this setup and can probably give you more details on his server setup in production.

It probably doesn´t take much, I am using it on a small scale only and in my situation, the toll is almost unnoticeable. How it looks as usage grows is the interesting part for me as it´s another factor when thinking about scaling and/but if you are also using the reverse proxy as a load balancer, I guess it can be an advantage instead of a flaw.

hpl123

Is anyone using a reverse proxy as a load balancer?

PointsWell

hpl123 wrote
PointsWell wrote
hpl123 wrote
If you configure a reverse proxy, the URL may need rewriting in some cases as the public URL is different from the private URL. Have anyone experienced problems with this when using a reverse proxy with Aware?

The URL is rewritten from the public URL to an internal private IP address.

You would run two servers
One with NGINX (or whatever) and that would be exposed to the internet.
Second one with Aware that is shielded from the internet and running on a private IP address. There is no URL for this server as it is not publicly accessible.

The problems I was referring to are mainly resource access problems so say I have a resource (image, file whatever) on the server and it is opened up by Aware, in that case the file would be accessed using the private URL BUT when the proxy rewrites the URL in the for the user, the file is not correctly opened as there exists no file at that URL. Not sure I am explaining this correctly and I had some issues with this initially when setting up IIS but don´t any more and/so I am not sure in what circumstances this actually happened but I know it can happen. Complex stuff.

The directive includes subdirectories within it.
If you rewrite

cust.yourDomain.com to 10.20.30.40:8080/AwareIM/

then everything within AwareIM is included. So if you made a call to a file in AwareIM/Documents then you could access that via cust.yourDomain.com/Documents or you could redirect cust.yourDomain.com/somethingElse to 10.20.30.40:8080/AwareIM/Documents/

Similarly you can exclude access via the proxy as well.

I may not have understood the question.

PointsWell

hpl123 wrote
PointsWell wrote
hpl123 wrote
If a reverse proxy is configured, Tomcat can be hidden or blocked from the web, how is this done?

The directive uses proxy_pass command to rewrite

customerName.yourDomain.com to internalIP:8080/AwareIM/...

CURL to the URL shows NGINX as the responder.

Yeah but Tomcat can still be accessed from the web? You are blocking it in the firewall or how?

You block access to the AIM server in your firewall. Create access only between reverse proxy and AIM server. The internal IP address should not be accessible from the outside world as this defeats the purpose of the reverse proxy.

The firewall would want to allow
80 and 443 access to the reverse proxy from external
8080 access between the reverse proxy and AIM
3306 access between AIM and the Database.

You probably also want
22 to the AIM server so that you can tunnel with SSH for access to the AIM desktop (unless you are operating headless in which case you'd use SSH for terminal access) and to connect remotely to the database. Though you may want to set up a separate server that is spun up only when you want to use SSH access to ensure that you have adequately isolated the AIM server from everything but the proxy

hpl123

PointsWell wrote
hpl123 wrote
PointsWell wrote
The directive uses proxy_pass command to rewrite

customerName.yourDomain.com to internalIP:8080/AwareIM/...

CURL to the URL shows NGINX as the responder.

Yeah but Tomcat can still be accessed from the web? You are blocking it in the firewall or how?

You block access to the AIM server in your firewall. Create access only between reverse proxy and AIM server. The internal IP address should not be accessible from the outside world as this defeats the purpose of the reverse proxy.

The firewall would want to allow
80 and 443 access to the reverse proxy from external
8080 access between the reverse proxy and AIM
3306 access between AIM and the Database.

You probably also want
22 to the AIM server so that you can tunnel with SSH for access to the AIM desktop (unless you are operating headless in which case you'd use SSH for terminal access) and to connect remotely to the database. Though you may want to set up a separate server that is spun up only when you want to use SSH access to ensure that you have adequately isolated the AIM server from everything but the proxy

Yes, this is what I thought and I haven't done this. Thanks for detailing ports.

PointsWell

hpl123 wrote
PointsWell wrote
3306 access between AIM and the Database.

Yes, this is what I thought and I haven't done this. Thanks for detailing ports.

Obv that is the MySQL/Maria port I don't know what the MSSQLS port is.

Also if you are using the Config Tool remotely from your AIM server then you have different challenges to deal with as you need a bunch of other ports open and you'd want to be able to access the AIM server and it would basically undo a bunch of the isolation protection you gain from the reverse proxy route.

PointsWell

I just thought of this a minute ago.

If you only use one server for your development and use it for production then you have to expose your AIM/Tomcat server to the internet anyway - unless you can think of some fancy pants way to route the config tools port calls to the AIM server.

If you are doing your dev on a remote server there's probably a whole bunch of other challenges that you face as well - such as maintaining the server connection. I suppose if you were doing that you'd probably be using Remote Desktop.

intra

Well here's my train of thought.

If its a single box for everything and you are running the config tool remotely...

Why not use a reverse proxy to do the normal security thing, then use a VPN to run the rest of the stuff.

<Internet> -> 443 (Bidirectional) -> [Instance]

<Internet for Config Tool> -> [VPN] -> [Instance]

PointsWell

AIM does not have a function to decommission published apps Stop Published BSV

Using a Reverse Proxy allows you to control access at a granular level to individual Apps

For example:

App.mydomain.com can direct a user to a specific app or when I decommission this app I can point this sub domain to an HTML page instead.

Jaymer

Henrik
I don't know if this was covered elsewhere (like in another nginx thread), but there is ABSOLUTELY no reason to continue using 8080 in Aware.
In this [thread] context, you simply use Tomcat on 80/443 and forget about remapping all these ports.

hpl123

Jaymer wrote
Henrik
I don't know if this was covered elsewhere (like in another nginx thread), but there is ABSOLUTELY no reason to continue using 8080 in Aware.
In this [thread] context, you simply use Tomcat on 80/443 and forget about remapping all these ports.

I can't remember the specifics of this discussion but I use IIS as a reverse proxy using HTTPS i.e 443 "in" to the server and then IIS maps that to localhost:8080..... . Do you mean this isn't the best config and if so, what is better (and why)?

Jaymer

my only point is that I NEVER use 8080 - it looks stupid to the user, and its unnecessary. Tomcat runs fine on 80 so I always change it.

hpl123

Jaymer wrote
my only point is that I NEVER use 8080 - it looks stupid to the user, and its unnecessary. Tomcat runs fine on 80 so I always change it.

Aha, yeah I agree and when using the reverse proxy the end user doesn't see ports etc. They do however see the ugly other URL fragments that Aware creates like NEW_TAB and a lot of other useless and confusing things. I am fairly sure I or someone else have logged a FR to fix this but was a long time ago. Still badly needed today IMO.

« Previous Page