Biensur...
Le lien etait dans mon premier post :
http://hp.vector.co.jp/authors/VA027031 ... ex_en.html
C est un reverse proxy fonctionnant sous windows ou linux...
J ai teste la version windows.
Il s installe sous forme de service et se configure tres facilement via un fichier texte... Plein d exemples de configs sont donnes avec dont 4 pour securiser des owa. D autres exemples sont fournis pour du webdav...
On peut faire tres facilement du "ssl bridging", connexion ssl d un poste internet au reverse proxy et autre connexion ssl du reverse proxy vers le IIS...
IL est fournit avec un certificat genere avec open ssl que l on peut facilement remplace...
De plus on peu se servir d une page web fournit avec orenosp pour centraliser ttes les authentifications sur les serveurs que l on possede. En effet Orenosp possede sa propre authentification par formulaire qu il transmet au bon serveur web suivant l url de depart tappe
Voici un exemple tire de mon fichier de config pour securiser un owa heberge sur un IIS en lan, le reverse proxy etant en dmz...
- Code: Tout sélectionner
#
# Orenosp OWA sample config
#
# a) SSL Bridging and OWA Form Auth - OWA 2003 only
# for Oreonosp 0.8.2 or later.
#
# For list of all available parameters,
# see ORENOSP_HOME/padmin/doc/sproxy_full.txt.
#
# For setting up SSL Port Forwarding,
# see ORENOSP_HOME/padmin/doc/tunnel/sampleconfig_en.txt.
#
#
# --- Listen ports ---
#
proxy_listen_name = ls-https 0.0.0.0@443 https
#
# --- Pass rules ---
#
proxy_pass_by = url ls-https://webmail.toto.com/exchange \
https://webmail.toto.lan/exchange -hh="_self_"
proxy_pass_by = url ls-https://webmail.toto.com/ExchWeb \
https://webmail.toto.lan/ExchWeb -hh="_self_"
proxy_pass_by = url ls-https://webmail.toto.com/Public \
https://webmail.toto.lan/Public -hh="_self_"
#
# --- Redirects ---
#
# redirect "/" to "/exchange"
proxy_redirect_by = url ls-https://webmail.toto.com/ \
https://webmail.toto.com/exchange -s
#
# --- SSL Config ---
#
# pass phrase for server private key
proxy_ssl_keypass = orenosp
#
# --- Logging ---
#
# access log file
#proxy_log_access_io = single logs/access.log
#
# --- HTTP compression ---
#
# uncomment both lines below to enable HTTP compression
#proxy_filter_define = comp-txtonly mod_filt_zlib mtype="text/" z_cmplvl=1 log=1
#proxy_filter_assign = * comp-txtonly
# You need to disable HTTP compression on backend servers for content rewrite to happen
#proxy_origin_gzip_disable = 1
#
# --- Monitoring ---
#
# You can place monitoring page at any URL.
# Here, we dedicate one listen port for the monitoring page.
#
proxy_listen_name = https-mon 127.0.0.1@4443 https
proxy_mon_xurl = https-mon://*/_monitor
proxy_auth_url = https-mon://*/_monitor* -u="admin:pass" -rlm="Admin Only"
proxy_authck_assign = https-mon://*/_monitor* _skipthis_
#
# --- Tracing ---
#
proxy_hctrace_level = 0
proxy_hbtrace_level = 0
proxy_davtrace_level = 0
#EOF
# =============
# Nimda Filters
# =============
# see http://online.securityfocus.com/archive/1/261549
# for many kinds of nimda attacks.
#
# --- switch to enable nimda filter ---
# default is 0 (off)
proxy_nimda_enable = 1
# --- nimda rules, specify path pattern ---
# up to 128 rules can be specified
# syntax
# proxy_nimda_path = <path-pattern-1> [options]
proxy_nimda_path = /scripts/root.exe*
proxy_nimda_path = /c/winnt/system32/cmd.exe*
proxy_nimda_path = /d/winnt/system32/cmd.exe*
proxy_nimda_path = /_vti_bin/*winnt/system32/cmd.exe*
proxy_nimda_path = /_vti_cnf/*winnt/system32/cmd.exe*
proxy_nimda_path = /_mem_bin/*/winnt/system32/cmd.exe*
proxy_nimda_path = /scripts/*/winnt/system32/cmd.exe*
proxy_nimda_path = /adsamples/*winnt/system32/cmd.exe*
proxy_nimda_path = /cgi-bin/*winnt/system32/cmd.exe*
proxy_nimda_path = /iisadmpwd/*winnt/system32/cmd.exe*
proxy_nimda_path = /samples/*winnt/system32/cmd.exe*
proxy_nimda_path = /scripts*winnt/system32/cmd.exe*
proxy_nimda_path = /MSADC/root.exe*
proxy_nimda_path = /MSADC/*winnt/system32/cmd.exe*
proxy_nimda_path = /msadc/*winnt/system32/cmd.exe*
proxy_nimda_path = /PBServer/*winnt/system32/cmd.exe*
proxy_nimda_path = /default.ida*
proxy_nimda_path = /scripts/Admin.dll
proxy_nimda_path = /scripts/shell.exe*
# --- nimda filter mode ---
# pass : pass nimda requests to backend servers
# refuse : return http error status
# discard : close connection without returning anything to client
# default is refuse.
#
proxy_nimda_opmode = refuse
# --- nimda filter log mode ---
# mylog : write to logfile specified by proxy_nmida_logio
# common : write to proxy-common logfile
# nolog : don't write to any log
# default is mylog
#
proxy_nimda_logmode = mylog
# --- logfile for nimda access ---
# Relevant only when logmode is "mylog".
# The default is "single trash.log".
# As for the log format, the same setting of proxy_log_access_{fmt|flags}
# is used.
#
# this is the prefered syntax
#proxy_nimda_logio = single trash.log
#
# this param will go away
proxy_nimda_logfile = trash.log
le fichier de config se nomme sproxy.conf...
Les differents fichier d exemples se trouvent ds le sous dossier "doc" du dossier "padmin"
Voila....
