0

We are being forced to install a component of a system that has a strictly HTTP login method. Vendor has stated it was 'Designed to be an internal application and not designed for internet access." like LAN app are somehow immune to credential theft, etc... Here not there, they will not budge, and I have no choice because we have no alternative at the moment. The service is on the other side of a VPN to make it worse, and I only control one side's networking.

Is there a service out there that would allow me to designate an IP on my network to impersonate the remote server, where an HTTPS session could be established, and have that system exclusively communicate with the remote?

I know this would only encrypt the traffic to and from my clients, but I could then firewall the remote IP to where communication could only come from my one host, and that reduces my overall places to intercept data form n<>1 to 1.

I know network devices such as Junpier's SSL gateway devices do something similar, you log into a web portal and it "rewrites" all data to and from to sources on the LAN side of the gateway.

Does anything this exist in the software only world?

1

This sounds a lot like one of the (once?) common use cases for reverse proxies. With something like HAProxy, Nginx or the Apache web server, you can try setting up an HTTPS listener with a valid certificate for the DNS name you want to present. Then set up a backend/reverse proxy configuration that connects to the correct HTTP port for the actual service, without any TLS configuration.

You’ll end up with secure connections from your clients to your reverse proxy, and insecure connections from your reverse proxy via the VPN to the server. If you can configure a VPN straight from the reverse proxy, your users’ credentials will be kept secure all the way to the provider’s apparently invincible network infrastructure.

2
  • i agree to mikael i would do the same way – djdomi Jul 31 '19 at 20:52
  • One of my coworkers found/suggested and configured a test HAproxy that did the trick perfectly! Yeah the "other end of the network" ended up being a contract with a data center/implementation "experts" that when it got down to deploy time, had built Frankenstein's tumor.... This whole system will be rebuilt within 6 months, I just needed a band aid till then. Many thanks. – Sabre Aug 2 '19 at 17:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.