Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We are currently trying to decide on how best to do SSL traffic in our environment. We have an externally facing Apache proxy server that is responsible for directing all traffic into our environment. It is also doing the SSL work for the majority of our servers.

There are one or two IIS servers in particular that are doing their own SSL, but they are also behind the proxy.

I'm wondering, is SSL to the proxy good enough? It would mean that traffic within our network is identifiable, but is that such a big deal?

share|improve this question
1  
You might also ask this question at security.stackexchange.com. –  sdanelson Dec 21 '10 at 4:35
add comment

2 Answers 2

up vote 1 down vote accepted

That depends on the traffic. If the traffic is sensitive enough to warrant SSL to the proxy I would err on the side of caution and maintain an SSL connection end-to-end. If you are dealing with information like Credit Card transactions then you don't have a choice.

If a host within your network is compromised then there is a possibility that the traffic could be sniffed and captured. Again the level of risk depends on the information being transmitted. Weigh the risk versus the added overhead and complexity that deploying end-to-end SSL would entail.

share|improve this answer
    
That's what I was thinking. At the moment, the only sensitive information is logins into our system. ACLs protect the majority of our environment if a login were to be compromised. –  Josh Smeaton Dec 21 '10 at 5:02
add comment

I agree with @sdanelson; BUT if I am reading this correctly, I would also ensure SSL/TLS transactions go through a firewall and make it the destination for the SSL traffic from the client. Then forward, or proxy, the requests to the internal system. This would help to lessen a man-in-the-middle attack.

share|improve this answer
    
We have a pair of firewalls infront of our proxy. –  Josh Smeaton Dec 21 '10 at 5:00
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.