From: Jeff Barczewski Date: 2007-01-29T11:03:38+09:00 Subject: Re: SSL man in the middle in Ruby? ------=_Part_43869_3309727.1170036214758 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline On 1/28/07, Jake Cutter wrote: > > > Thanks very much for the info. What my company wants is a way to monitor > ssl > traffic for its customers to any site. So, it would be like using > something > like Squid, except running some intelligent parsers on any traffic that > goes > through including SSL decrypted traffic. This is where nginx would fail, I > believe, because you have to specifically configure it to point to a set > of > hosts, whereas the tool I would hope to write would simply decrypt and > forward traffic to any host. Is this the case? > > Yes you are correct, nginx will work as a reverse proxy not a proxy. So you are wanting more like a regular proxy to be able to monitor traffic to external sites. However, other than knowing the IP address they are trying to go to, note that SSL will not allow you to decrypt the traffic in the middle, this is by design (to prevent the man in the middle attack). The key negotiation is between the client and the final destination. So you won't be able to know anything other than the IP address that the client is connecting to and maybe a rough idea of traffic volume, you won't have any specifics about the what kind of data or exact site name. Knowing all this, it sounds like you could get this same level of information from your firewall or a standard proxy. You won't be able to decrypt the traffic, nor gather any additional information no matter what you put in the middle. Jeff -- Jeff Barczewski, MasterView core team Inspired Horizons Ruby on Rails Training and Consultancy Next Ruby on Rails plus JRuby workshop Feb 22-24 St. Louis, MO http://inspiredhorizons.com/training/rails/index.html Limited seating, register now! ------=_Part_43869_3309727.1170036214758--