Subject: Proxy http with modssl?

From: "Chris Davis" <[email-masked]>
Date: Wed, 5 Mar 2003 14:51:21 -0500

Hi,

 I'm looking for a method to hide an old web server behind
 a modssl server. The hidden server has several applications
 served over http. What I'd like is for https requests
 to be rewritten in modssl and proxied to the hidden
 internal system.

 I installed a second interface on the modssl system. From
 the modssl system I can access the internal web server.
 In a virtualhost clause for the modssl system I've added

 ProxyRequests On
 ProxyRemote https://modssl/MyApp http://10.x.x.x

 I'd like requests of the form
 https://modssl/MyApp/pgm?SomeArgument=Value to be proxied
 to the internal system as http://10.x.x.x/pgm?SomeArgument=Value
 I receive a 404 in the browser and the following in my error log.

[Wed Mar 04 11:14:25 2003] [error] (20014)Error string
not specified yet: Cannot store SSL session to DBM file
`/usr/local/www/logs/ssl_scache'
[Wed Mar 04 11:14:25 2003] [error] [client 1.2.3.4] File does not exist:
/usr/local/www/htdocs/MyApp

 Is it possible to have modssl proxy an http conversation?

 Thanks for any advice, Chris

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Merton Campbell Crockett <[email-masked]>
Date: Wed, 5 Mar 2003 12:56:38 -0800 (PST)

Chris:

Look at Ralph Engelshall's paper on the Apache web site discussing the
mod_rewrite module.  You can provide all the SSL/TLS support on your
front-end server and use mod_rewrite to generate HTTP requests to the old
web server.

Merton Campbell Crockett

-- 
BEGIN:				vcard
VERSION:			3.0
FN:				Merton Campbell Crockett
ORG:				General Dynamics Advanced Information Systems;
				Intelligence and Exploitation Systems
N:				Crockett;Merton;Campbell
EMAIL;TYPE=internet:		[email-masked]
TEL;TYPE=work,voice,msg,pref:	+1(805)497-5045
TEL;TYPE=work,fax:		+1(805)497-5050
TEL;TYPE=cell,voice,msg:	+1(805)377-6762
END:				vcard

---

From: Marko Asplund <[email-masked]>
Date: Thu, 6 Mar 2003 07:56:09 +0200 (EET)

On Wed, 5 Mar 2003, Chris Davis wrote:

>  ...

there are probably several possible implementations for the reverse proxy
configuration you're describing but one possibility is to use mod_accel
(http://sysoev.ru/mod_accel/) for this purpose.

best regards,
-- 
	aspa					http://www.kronodoc.fi/

---

From: danalien <[email-masked]>
Date: Thu, 6 Mar 2003 14:29:42 +0100

On Thursday 06 March 2003 06:56, Marko Asplund wrote:
> >  I'm looking for a method to hide an old web server behindt 

or you could run stunnel (on that old machine, and close every other port except the one stunnel uses, or use
port-forwarding on the "remote-pc" that uses stunnel to communicate with ssl-based software...). 

"Stunnel is a program that allows you to encrypt arbitrary TCP connections 
inside SSL (Secure Sockets Layer) available on both Unix and Windows. 
Stunnel can allow you to secure non-SSL aware daemons and protocols 
(like POP, IMAP, LDAP, etc) by having Stunnel provide the encryption, 
requiring no changes to the daemon's code." -- www.stunnel.org 

- -- 

//   with regards
//   ID ::  danalien  ::  <[email-masked]>

---

From: "Chris Davis" <[email-masked]>
Date: Thu, 6 Mar 2003 12:49:24 -0500

Thanks everyone for the follow ups. I want to use mod_
 Rewrite if I can get it to work. I've added the module
 in the server and in my virtualhost clause have these
 statements

 RewriteEngine On
 RewriteRule MyApp\/Version\/Five\/ http://10.x.x.x/Version/Five/ [P,NE,L]

 I call the application as https://modssl/MyApp/Version/Five/?Arg1=1&Arg2=2
 The internal server receives the URL but has this in the 
 access logs

 GET /Version/Five/%3FArg1=1&Arg2=2

 So it appears as if this is close to working. How can I
 prevent the '?' from being changed to a '%3F' by Rewrite?

 Chris