You are viewing a plain text version of this content. The canonical link for it is here.
Posted to modperl@perl.apache.org by Boysenberry Payne <bo...@humaniteque.com> on 2005/12/17 23:51:20 UTC
Is $ENV{HTTP_X_FORWARDED_HOST} reliable
Hello Everyone,
I'm using a two server system. Front end Apache 1.33/php4 uses
mod_proxy
and mod_rewrite to proxy to the back end Apache2/MP2 system.
I was wondering if $ENV{HTTP_X_FORWARDED_HOST} is a reliable way
to determine the domain of the request; or is it easily spoofed?
I'm hoping to use a combination of IP screening like this:
<snip>
#
# handler for PerlPreConnectionHandler
#
sub handler {
my Apache2::Connection $c = shift;
my $ip = $c->remote_ip;
if( $good_ips{$ip} ) {
return Apache2::Const::OK;
}
warn "IP $ip tried to access perl\n";
return Apache2::Const::FORBIDDEN;
}
</snip>
where %good_ips is predefined.
With a domain/user name match where the domain is
being derived from $ENV{HTTP_X_FORWARDED_HOST}.
In order for it to work correctly I would need to know both the
IP and Domain were correct. Is there any inherent risk with
the way I'm getting the information? The user name is the only
risk I'm willing to risk, which comes from an .htaccess file where
the proxy is called.
TIA,
Boysenberry
boysenberrys.com | habitatlife.com | selfgnosis.com
Re: Is $ENV{HTTP_X_FORWARDED_HOST} reliable
Posted by Boysenberry Payne <bo...@humaniteque.com>.
On Dec 17, 2005, at 5:56 PM, Frank Wiles wrote:
> The best way to do this is to use the virtual hosts on the front
> end to your advantage. So on the front end you "tell" the backend
> which domain it came from:
>
> <VirtualHost domain.com:80>
>
> ProxyPass / http://localhost:8080/domain.com/
> ProxyPassReverse / http://localhost:8080/domain.com/
> </VirtualHost>
>
> By passing in the domain this way you can see where it came from.
> I'm sure there are probably a number of other ways to get this done,
> but that was the first that popped into my head.
Unfortunately I don't have access to the httpd.conf file for the front
end server.
It's managed, so I don't have root either. I do have ftp access and an
.htaccess
file.
On the back end server I have access to the httpd.conf file, but not
root access.
I build on a locally on Mac OSX 10.3.9 using Apache2/mod_perl2 then
upload
the static files to the front end and the perl modules to the backend.
> Also, any reason you're writing your own IP restrictions instead of
> just using allow from/deny from in Apache?
I'm writing them myself because they will be a scalable part of my code
eventually
allowing for IPs dynamically with subscription.
Thanks
Boysenberry
boysenberrys.com | habitatlife.com | selfgnosis.com
Re: Is $ENV{HTTP_X_FORWARDED_HOST} reliable
Posted by Frank Wiles <fr...@wiles.org>.
On Sat, 17 Dec 2005 16:51:20 -0600
Boysenberry Payne <bo...@humaniteque.com> wrote:
> Hello Everyone,
>
> I'm using a two server system. Front end Apache 1.33/php4
> uses mod_proxy
> and mod_rewrite to proxy to the back end Apache2/MP2 system.
>
> I was wondering if $ENV{HTTP_X_FORWARDED_HOST} is a reliable
> way to determine the domain of the request; or is it easily spoofed?
The best way to do this is to use the virtual hosts on the front
end to your advantage. So on the front end you "tell" the backend
which domain it came from:
<VirtualHost domain.com:80>
ProxyPass / http://localhost:8080/domain.com/
ProxyPassReverse / http://localhost:8080/domain.com/
</VirtualHost>
By passing in the domain this way you can see where it came from.
I'm sure there are probably a number of other ways to get this done,
but that was the first that popped into my head.
Also, any reason you're writing your own IP restrictions instead of
just using allow from/deny from in Apache?
---------------------------------
Frank Wiles <fr...@wiles.org>
http://www.wiles.org
---------------------------------
Re: Is $ENV{HTTP_X_FORWARDED_HOST} reliable
Posted by Issac Goldstand <ma...@beamartyr.net>.
Hold on a second.
That's still not going to be a good spoof because you also would check
REMOTE_CLIENT as usual, and expect to always see your front-end's IP
there, so Randal's example isn't completely accurate, since you'll see
the real client's IP there and thus know not to trust the
X-Forwarded-For header. What you really want to check is what the
front-end does if there's already an X-Forwarded-For header. If it
overwrites it, you should be fine.
Issac
Randal L. Schwartz wrote:
>>>>>> "Boysenberry" == Boysenberry Payne <bo...@humaniteque.com> writes:
>
> Boysenberry> I'm using a two server system. Front end Apache 1.33/php4
> Boysenberry> uses mod_proxy
> Boysenberry> and mod_rewrite to proxy to the back end Apache2/MP2 system.
>
> Boysenberry> I was wondering if $ENV{HTTP_X_FORWARDED_HOST} is a reliable way
> Boysenberry> to determine the domain of the request; or is it easily spoofed?
>
> telnet your.server.example.com 80
> GET /some/url HTTP/1.0
> X-forwarded-for: some-other-host
> CR
> CR
>
> Yeah, that's tough to spoof. :)
>
Re: Is $ENV{HTTP_X_FORWARDED_HOST} reliable
Posted by Boysenberry Payne <bo...@humaniteque.com>.
Using the PerlPreConnectionHandler in my original post they would
only be able to do it from a server in my IP hash and they don't have
telnet access on that server. But I see your point.
In my situation I have a bunch of domains on a couple of IPs I mostly
want to make sure they come from those IPs, then find a way to know
which domain the proxy originates from.
Maybe I should have asked is there a more reliable way than using
$ENV{HTTP_X_FORWARDED_HOST} to determine the domain
of an originating proxy request in a two tier system as I described?
Boysenberry
boysenberrys.com | habitatlife.com | selfgnosis.com
On Dec 17, 2005, at 5:24 PM, Randal L. Schwartz wrote:
>>>>>> "Boysenberry" == Boysenberry Payne <bo...@humaniteque.com>
>>>>>> writes:
>
> Boysenberry> I'm using a two server system. Front end Apache
> 1.33/php4
> Boysenberry> uses mod_proxy
> Boysenberry> and mod_rewrite to proxy to the back end Apache2/MP2
> system.
>
> Boysenberry> I was wondering if $ENV{HTTP_X_FORWARDED_HOST} is a
> reliable way
> Boysenberry> to determine the domain of the request; or is it easily
> spoofed?
>
> telnet your.server.example.com 80
> GET /some/url HTTP/1.0
> X-forwarded-for: some-other-host
> CR
> CR
>
> Yeah, that's tough to spoof. :)
>
> --
> Randal L. Schwartz - Stonehenge Consulting Services, Inc. - +1 503 777
> 0095
> <me...@stonehenge.com> <URL:http://www.stonehenge.com/merlyn/>
> Perl/Unix/security consulting, Technical writing, Comedy, etc. etc.
> See PerlTraining.Stonehenge.com for onsite and open-enrollment Perl
> training!
>
>
Re: Is $ENV{HTTP_X_FORWARDED_HOST} reliable
Posted by "Randal L. Schwartz" <me...@stonehenge.com>.
>>>>> "Boysenberry" == Boysenberry Payne <bo...@humaniteque.com> writes:
Boysenberry> I'm using a two server system. Front end Apache 1.33/php4
Boysenberry> uses mod_proxy
Boysenberry> and mod_rewrite to proxy to the back end Apache2/MP2 system.
Boysenberry> I was wondering if $ENV{HTTP_X_FORWARDED_HOST} is a reliable way
Boysenberry> to determine the domain of the request; or is it easily spoofed?
telnet your.server.example.com 80
GET /some/url HTTP/1.0
X-forwarded-for: some-other-host
CR
CR
Yeah, that's tough to spoof. :)
--
Randal L. Schwartz - Stonehenge Consulting Services, Inc. - +1 503 777 0095
<me...@stonehenge.com> <URL:http://www.stonehenge.com/merlyn/>
Perl/Unix/security consulting, Technical writing, Comedy, etc. etc.
See PerlTraining.Stonehenge.com for onsite and open-enrollment Perl training!