Apache2.2 as reverse proxy

4play · 06-24-2009, 11:07 AM

Im trying to setup apache 2.2 as a reverse proxy on our company firewall.

It needs to just forward on requests for companyname.co.uk/client/ to the specific internal client server and return the page generated by that client server.

I have got this working by editing the httpd.conf file to

Code:

<IfModule mod_proxy.c>
ProxyRequests Off

<Proxy *>
    Order deny,allow
#    Deny from all
    Allow from all
</Proxy>

proxypass /helpdesk/ http://companyname.local/helpdesk/
proxypassreverse /helpdesk/ http://companyname.local/helpdesk/

This is the entry for out helpdesk webserver.

What im really looking for is a guide to help me harden this server does one exist?
Am i doing this wrong or is there a better bit of software for this purpose?

many thanks

anomie · 06-25-2009, 12:19 PM

First, another option for a reverse proxy is squid: http://wiki.squid-cache.org/SquidFaq/ReverseProxy

Second, assuming Apache web server is going to be used only as a reverse proxy (and not serving web pages itself), there are a number of things you can do to lock it down.

Off the top of my head here are some suggestions:

Lock down default Directory permissions

Code:

<Directory />
    Order Deny,Allow
    Deny from all
    Options None
    AllowOverride None
</Directory>

Other Directory stanzas can likely be removed altogether.

Ensure httpd is running as an unprivileged user

Example:

Code:

User apache
Group apache

This will of course need to be a service account on your system.

Disable loading of some potentially dangerous modules

Including:

mod_userdir
mod_info
mod_status
mod_include
mod_dav* (unless acting as a webdav service)

Make easily retrievable server info a little quieter

Two directives:

Code:

ServerSignature Off
ServerTokens ProductOnly

-------

Those are just a few of the more obvious things. You might explore mod_security and its capabilities at some point.

Reverse proxies are very cool, because in addition to potentially offering better performance for the end user, they act as an "application firewall".