Re: Is chrooting apache behind a reverse proxy useful ?

[Chuck Yerkes <chuck+obsd@2004.snew.com>]

Quoting Dom De Vitto (dom@DeVitto.com):
> "Clean data" ?? 
> 
> Squid _may_ not forward requests that upset Apache, but will it
> never forward requests that upset any application (php/perl/whatever) ?
How's that?

> Does Squid understand that ?'s are valid in your usernames? no.
> Just one application bug could give an attacker elevated access, but
> in a chroot you (pretty much) 'cap' what that access could be.

re: clean data
Yes, ala the TIS FWTK when it came out (and DEC SEAL before it).
ftp to gateway (it's what we had) and from there connect to target.
  The proxy would block requests we didn't allow (GET, but no PUT).

The httpd proxy pretty well killed a pair of Alphas and allowed
only certain requrests.

So yes, a proxy does something to break the user from connecting
directly to a foreign (therefore presumed hostile) server.

But it will easily pass back hostile data through the proxy.
Unless the proxy "cleans" the data (well).

What was that old easy "hostile URL"?    telnet://localhost:19