7 ms·

This is a great case for why proxy pre-auth is so important. Doesn't matter how buggy and riddled with worms your app server is if nobody can get to it without

This is a great case for why proxy pre-auth is so important. Doesn't matter how buggy and riddled with worms your app server is if nobody can get to it without a valid token. Sure, it introduces plenty of other problems, but it does really help with this. At the end of the day, you shouldn't be able to execute anything until you're authenticated.

harmon 4y ago
Agreed, if not a proxy then put your services behind a VPN or a bastion host when possible.
pm90 4y ago
Yup. Really easy to set this up with the IDP's available today too.
- RulerOf 4y ago
  In the IdP/SP/SAML sense of it, I'm really used to that level of validation actually hitting the application and being processed through an authentication subsystem, rather than being done at the webserver level. Possibly just some nginx features I'm not familiar with, or are there whole apps out there that serve to be nothing other than an authentication layer inside of a webserver? Are they popular?
  - tyingq 4y ago
    HTTP Redirecting out to an idp and it posting back to the application with a SAML assertion is pretty common, if that's what you mean. Lots of people do that with things like O365, the AWS Web Console, etc.
    - RulerOf 4y ago
      Of course. Just asking how is the web router aware of whether or not the redirect is necessary if you're not hitting the application to validate login state.
  - InitialBP 4y ago
    Sorry if I misunderstood the question, sounds like you are asking if there are some common tools that do auth outside of the application before passing traffic back. Google IAP is a big one, and Cloudflare Access can let you do similar things (link an internal service to Cloudflare network and Cloudflare will deny someone ability to talk to that service until they've validated their identity to cloudflare and it matches your rules somehow.
    - tatersolid 4y ago
      Azure AD Application Proxy fits the bill for Microsoft 365 shops. Nothing from Atlassian should ever be exposed to the public internet. Atlassian stuff is a security tire-fire with very old dependencies even in the latest releases, a painful reinstall/config merge needed for even minor patches, and no auto-update mechanism.
    - RulerOf 4y ago
      You absolutely do, but I was more interested in the mechanics of it at the webserver level rather than SaaS equivalents. The Google IAP one is helpful as I only knew about Cloudflare Access.
tyingq 4y ago
Probably would have helped a bit if their java server process wasn't running as root as well.
- latchkey 4y ago
  Nailed it. Let's also admit that setting up iptables is harder than it needs to be. I mean, not after the first twenty times... you eventually remember all the arcane logic and expect everyone else to as well.
  - bogantech 4y ago
    If you're manually editing iptables rules in production in current year you're doing it wrong anyway, you should have some form of config management like ansible/salt/puppet etc that make it dead simple to add rules or at the very least just use firewalld or something
  - heurisko 4y ago
    In the past, I've found making tomcat listen on unprivileged 8080 and proxying it using nginx on 443 works well.
- gjvc 4y ago
  who in the hell does this?
  - reegnz 4y ago
    Mostly Linux-illiterate people, who want to bind to privileged ports (443), and have no idea about systemd sockets[1] and socket-activation[2], so they stick with the first solution that works. Most people don't know that you can have systemd bind to the privileged ports for you, and hand over the fd to the port to your (unprivileged) process. Same goes for docker/containerd btw, if you run docker as root nowadays, you are doing it wrong. [1] https://www.freedesktop.org/software/systemd/man/systemd.socket.html https://www.freedesktop.org/software/systemd/man/systemd.soc... [2] https://www.freedesktop.org/software/systemd/man/systemd-socket-proxyd.html https://www.freedesktop.org/software/systemd/man/systemd-soc...
latchkey 4y ago
False sense of security or just plugging one hole in a wedge of swiss cheese. It isn't always the server, sometimes it is just the framework. A proxy won't stop that. https://www.zdnet.com/article/equifax-confirms-apache-struts-flaw-it-failed-to-patch-was-to-blame-for-data-breach/ https://www.zdnet.com/article/equifax-confirms-apache-struts...
- Xylakant 4y ago
  Proxy preauth could be able to mitigate a vulnerable framework. The idea is that you never connect to the application server itself, but to a proxy that requires a separate authentication. That’s obviously not possible for a public-facing application. Now, if the attacker has access to the proxy authentication, all of this doesn’t help much, but at least you could track and limit who can access what chunks.
- bedatadriven 4y ago
  Your link points to a vulnerability that could have been mitigated by putting the internal application developped with Apache Struts behind a proxy server like Nginx or GCP Identity Aware Proxy (IAP) that authenticate the request before the request is forwarded to the application server. This only applies to apps for internal use like Confluence or Jenkins, not publically accessible websites.
- YPPH 4y ago
  I'm don't follow. If you have a pre-auth reverse proxy in front of your web application, you drastically reduce your attack vector. An unauthenticated attacker can no longer simply rely on a vulnerability in the application or underlying framework, but must first obtain an employee's credentials, or find another vulnerability in the proxy or authentication infrastructure. This isn't a false sense of security. It is a concrete additional layer of security which has tangible benefits.
  - YPPH 4y ago
    I don't * - Too late to edit.
- 4y ago
dx034 4y ago
And the likes of Cloudflare access or VPN only access via Tailscale make it so easy to keep it protected. I'm always a bit shocked when I come across publicl ogins for Jira or Confluence instances of large corps.
RektBoy 4y ago
Exactly, I mean everytime I saw any of this self-hosted SW, open directly to internet, my eye is starting to tick.

harmon 4y ago

Agreed, if not a proxy then put your services behind a VPN or a bastion host when possible.

pm90 4y ago

Yup. Really easy to set this up with the IDP's available today too.

RulerOf 4y ago
In the IdP/SP/SAML sense of it, I'm really used to that level of validation actually hitting the application and being processed through an authentication subsystem, rather than being done at the webserver level. Possibly just some nginx features I'm not familiar with, or are there whole apps out there that serve to be nothing other than an authentication layer inside of a webserver? Are they popular?
- tyingq 4y ago
  HTTP Redirecting out to an idp and it posting back to the application with a SAML assertion is pretty common, if that's what you mean. Lots of people do that with things like O365, the AWS Web Console, etc.
  - RulerOf 4y ago
    Of course. Just asking how is the web router aware of whether or not the redirect is necessary if you're not hitting the application to validate login state.
- InitialBP 4y ago
  Sorry if I misunderstood the question, sounds like you are asking if there are some common tools that do auth outside of the application before passing traffic back. Google IAP is a big one, and Cloudflare Access can let you do similar things (link an internal service to Cloudflare network and Cloudflare will deny someone ability to talk to that service until they've validated their identity to cloudflare and it matches your rules somehow.
  - tatersolid 4y ago
    Azure AD Application Proxy fits the bill for Microsoft 365 shops. Nothing from Atlassian should ever be exposed to the public internet. Atlassian stuff is a security tire-fire with very old dependencies even in the latest releases, a painful reinstall/config merge needed for even minor patches, and no auto-update mechanism.
  - RulerOf 4y ago
    You absolutely do, but I was more interested in the mechanics of it at the webserver level rather than SaaS equivalents. The Google IAP one is helpful as I only knew about Cloudflare Access.

tyingq 4y ago

Probably would have helped a bit if their java server process wasn't running as root as well.

latchkey 4y ago
Nailed it. Let's also admit that setting up iptables is harder than it needs to be. I mean, not after the first twenty times... you eventually remember all the arcane logic and expect everyone else to as well.
- bogantech 4y ago
  If you're manually editing iptables rules in production in current year you're doing it wrong anyway, you should have some form of config management like ansible/salt/puppet etc that make it dead simple to add rules or at the very least just use firewalld or something
- heurisko 4y ago
  In the past, I've found making tomcat listen on unprivileged 8080 and proxying it using nginx on 443 works well.
gjvc 4y ago
who in the hell does this?
- reegnz 4y ago
  Mostly Linux-illiterate people, who want to bind to privileged ports (443), and have no idea about systemd sockets[1] and socket-activation[2], so they stick with the first solution that works. Most people don't know that you can have systemd bind to the privileged ports for you, and hand over the fd to the port to your (unprivileged) process. Same goes for docker/containerd btw, if you run docker as root nowadays, you are doing it wrong. [1] https://www.freedesktop.org/software/systemd/man/systemd.socket.html https://www.freedesktop.org/software/systemd/man/systemd.soc... [2] https://www.freedesktop.org/software/systemd/man/systemd-socket-proxyd.html https://www.freedesktop.org/software/systemd/man/systemd-soc...

latchkey 4y ago

False sense of security or just plugging one hole in a wedge of swiss cheese. It isn't always the server, sometimes it is just the framework. A proxy won't stop that. https://www.zdnet.com/article/equifax-confirms-apache-struts-flaw-it-failed-to-patch-was-to-blame-for-data-breach/ https://www.zdnet.com/article/equifax-confirms-apache-struts...

Xylakant 4y ago
Proxy preauth could be able to mitigate a vulnerable framework. The idea is that you never connect to the application server itself, but to a proxy that requires a separate authentication. That’s obviously not possible for a public-facing application. Now, if the attacker has access to the proxy authentication, all of this doesn’t help much, but at least you could track and limit who can access what chunks.
bedatadriven 4y ago
Your link points to a vulnerability that could have been mitigated by putting the internal application developped with Apache Struts behind a proxy server like Nginx or GCP Identity Aware Proxy (IAP) that authenticate the request before the request is forwarded to the application server. This only applies to apps for internal use like Confluence or Jenkins, not publically accessible websites.
YPPH 4y ago
I'm don't follow. If you have a pre-auth reverse proxy in front of your web application, you drastically reduce your attack vector. An unauthenticated attacker can no longer simply rely on a vulnerability in the application or underlying framework, but must first obtain an employee's credentials, or find another vulnerability in the proxy or authentication infrastructure. This isn't a false sense of security. It is a concrete additional layer of security which has tangible benefits.
- YPPH 4y ago
  I don't * - Too late to edit.
4y ago

dx034 4y ago

And the likes of Cloudflare access or VPN only access via Tailscale make it so easy to keep it protected. I'm always a bit shocked when I come across publicl ogins for Jira or Confluence instances of large corps.

RektBoy 4y ago

Exactly, I mean everytime I saw any of this self-hosted SW, open directly to internet, my eye is starting to tick.