Front cover - IBM Redbooks

184 Lotus Security Handbook
This is called client affinity or sticky sessions. It can be implemented with
cookies, rules, and so forth, but usually requires a load balancer component to
be placed in front of a cluster of proxy servers. An example is the Network
Dispatcher module within IBM WebSphere Edge Server.
The concept is simple: as long as the server is available, you get served by the
same server during the session you are having. If that server becomes
unavailable, you fail-over (gracefully transition) to another one.
Test all possible “holes”
When creating and building a new reverse proxy infrastructure, test all the paths
through the infrastructure. When most reverse proxies are implemented, it is
intended that only traffic passed by the reverse proxy is allowed through the
firewall, and that only certain types of traffic are allowed to pass through the
reverse proxy.
In addition to checking that all communications you want to work do so, be sure
to check that all other communications do not work. Only what is explicitly
allowed should work, everything else should not work. A common problem in
deployments is failing to actually “close” all the alternate and direct routes from
the requesters to the back end servers.
Verify what addresses are being listening at
You can verify if a proxy is running, and on what ports, by checking at the proxy
server if you have a process listening for the expected ports. This is also useful
to verify that the proxy is not accidentally configured to listen on more IP
addresses than intended.
You can use the operating system command NETSTAT to check if you have a
listening process for a particular port, and for what remote address.
netstat -an | find "LISTEN" | find "8080"
TCP 0.0.0.0:8080 0.0.0.0:0 LISTENING
If you get 0.0.0.0:8080 (or *.*:8080) in the local (first) address, as shown, it
means that the proxy is listening to all the TCPIP addresses declared and
enabled in the local machine. In other words, in the case of a computer which
has more than one network card and IP address, the requester can connect to
any of those addresses and communicate through the proxy.
This is important to verify, as it is sometimes extremely important to listen to
specific addresses. For example, for security reasons you may prefer to listen to
127.0.0.1:xx for traffic in the same box that should only be accessed via a local
reverse proxy, and not listen on the box’s external IP address.