Re: Reverse Proxy on DMZ

[youngk () ttc com]

> What are the pros and cons of using a proxy (caching) server on a
> DMZ segment to allow access to an internal web server?  The DMZ is
> hanging off a segment on a firewall.

It is always a bad idea to have publically-accessable servers on your
internal network. Since (I think) that most caching proxy server don't
cache CGI scripts, you can use the attack which was mentioned by  Jon
Ribbens <jon () oaktree co uk> just yesterday on BugTraq to overflow a buffer
on a specific CGI script.

Whammo... Access to your web server on your internal network means access
to your internal network. Of course, tight security on your web server
*might* be able to stop any serious damage, but do you really want to take
that chance?



--Keith Young/Avenger

-youngk () ttc com