From: Jeff Barczewski Date: 2007-01-29T13:22:07+09:00 Subject: Re: SSL man in the middle in Ruby? ------=_Part_45077_9124143.1170044523600 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline On 1/28/07, Jake Cutter wrote: > > On 1/28/07, Jeff Barczewski wrote: > > > > Yes you are correct, nginx will work as a reverse proxy not a proxy. So > > you > > are wanting more like a regular proxy to be able to monitor traffic to > > external sites. However, other than knowing the IP address they are > trying > > to go to, note that SSL will not allow you to decrypt the traffic in the > > middle, this is by design (to prevent the man in the middle attack). The > > key > > negotiation is between the client and the final destination. So you > won't > > be > > able to know anything other than the IP address that the client is > > connecting to and maybe a rough idea of traffic volume, you won't have > any > > specifics about the what kind of data or exact site name. > > > Jeff, > > I do note this. However, the plan is to offer our own certificate for > *every* connection from the client, and then have the proxy engine itself > create the SSL connection to the server on the backend. delegate ( > www.delegate.org) and WebScarab operate in this fashion, and are able to > decrypt all traffic that way. > I see. Well the users will get a warning that the certificate does not match the domain they are trying to reach (warning of a man in the middle attack) (your certificate will not match the one from the certificate authority). Normally users are supposed to know not to continue in such a circumstance. So I guess if all of this is acceptable, I guess what you are proposing is technically possible. Of course in this situation, you are incurring the overhead of two SSL connection (terminating and originating) for every outbound connection, so your load will be signifigant if you have any number of concurrent users. I think you will indeed need some optimized code to handle such load, so you could use ruby but you will very likely need to use some native library (openssl) to get decent performance in the processor intensive SSL operations. Java might work for light loads, but I wouldn't want to use it for heavy loads. However there are hardware SSL accelerators that can help, the kind that load balancers can optionally add in. You then offload the heavy lifting to them. Hope this helps in your endeavor. Jeff -- Jeff Barczewski, MasterView core team Inspired Horizons Ruby on Rails Training and Consultancy Next Ruby on Rails plus JRuby workshop Feb 22-24 St. Louis, MO http://inspiredhorizons.com/training/rails/index.html Limited seating, register now! ------=_Part_45077_9124143.1170044523600--