Re: key storage

[Frank Knobbe <frank () knobbe us>]

On Sat, 2004-09-04 at 16:14, George Capehart wrote:
> If the load balancers and the Web server(s) use IPSec among themselves, 
> that would solve the problem, wouldn't it?

Heya George,

yeah, but have you seen this implemented somewhere? I haven't, and I
doubt you find that deployed often. Instead I see LB's terminating and
connecting to the web server farm in clear HTTP for intrusion detection
purposes. 

Perhaps the best solution would be three-tiered:

--HTTPS-->[LB]--HTTP-(monitored by IDS)-->[SSLproxy]--HTTPS-->[SERVER]

That just adds complexity, configuration mistakes, and devices that
could fail, but at least adds security by terminating data encrypted on
the web server while still having the public facing SSL certificate
isolated _and_ still being able to sniff the traffic with an IDS.

But SSL or IPSec, we again have the problem of key storage on the
server. :)   Can't have the cake and eat it too.... (but perhaps a
picture of the cake will do... nah, never mind ;)

Cheers,
Frank

Attachment: signature.asc
Description: This is a digitally signed message part