IBM WebSphere V5.0 Security - CGISecurity

A reverse proxy server is placed in front of all other presentation layers of anapplication and interrupts the session flow from client Web browser to the Webserver and the application servers behind them. In this role WebSEAL appearsas a Web server to browser clients and appears as a Web browser to thejunctioned back-end servers it is protecting.Browser clients access what they are told by published URL, is the contentserver for an application. In fact this URL is a reverse proxy server. The reverseproxy is configured to hold the client session and open a new session, acting asthe client with the real content server. This server will never be exposed to thereal client as reverse proxy’s configuration hides the contents server’s name, IPaddress, which is also certainly a private internal and firewalled network and canremap URLs from what is published to the Web space as it actually is on thecontent server. This remapping works both ways so any URLs listed in theheaders being returned to the client are intercepted and rewritten to conform tothe published format thus preventing external clients from getting redirectionURLs to the internal content server.In combination with Firewalls constructing DMZs to filter and direct traffic, as wellas the possibility of VPNs within DMZ’s there are several network designs whichcan strengthen the defense of an e-business Application. Decisions such asplacing WebSEAL in a DMZ on its own with all the other infrastructure, Webservers, application servers and Access Manager Secure Domain servers in thesecond region, or placing the Web servers in the region 1 DMZ behind WebSEAL(best protected by VPNs) will be driven by both security and real productioninfrastructure concerns.Figure 12-11 on page 414 shows WebSEAL functioning as a reverse proxy withthe most simple model of physical network security. This server should alwayshave dual interfaces, the first, A, is connected only to the Internet Firewall andthe second, B, is connected only to the Intranet Firewall. OS level routes on theWebSEAL box should direct traffic through the intranet firewall only to thosespecific server that WebSEAL will need to contact, the user registry, (forauthentication calls), the Policy Server (for policy database updates) andexplicitly junctioned Web servers. All other traffic must be routed throughinterface A to the Internet Firewall.Similar and supporting routing rules and filters must be placed on the Firewalls.The Internet Firewall must allow through traffic only to and from WebSEALinterface A and further if the site was to have only secure items then HTTPS onlytraffic should be also enforced. The Internet Firewall allows traffic betweenWebSEAL interface B and the LDAP Server, the Policy Server and the WebServer(s).Chapter 12. Tivoli Access Manager 413