시간과 공간 그리고 진실의 방

Many businesses use proxy servers to route and secure traffic between networks. There’s often confusion, however, on how this differs from a reverse proxy. In this post, we’ll dissect the two concepts and explain how administrators can use a reverse proxy for easy access management control.

What is a proxy server?

A proxy server, sometimes referred to as a forward proxy, is a server that routes traffic between client(s) and another system, usually external to the network. By doing so, it can regulate traffic according to preset policies, convert and mask client IP addresses, enforce security protocols, and block unknown traffic.

Systems with shared networks, such as business organizations or data centers, often use proxy servers. Proxy servers expose a single interface with which clients interact without having to enforce all of the policies and route management logic within the clients themselves.

What is a reverse proxy?

A reverse proxy is a type of proxy server.  Unlike a traditional proxy server, which is used to protect clients, a reverse proxy is used to protect servers. A reverse proxy is a server that accepts a request from a client, forwards the request to another one of many other servers, and returns the results from the server that actually processed the request to the client as if the proxy server had processed the request itself. The client only communicates directly with the reverse proxy server and it does not know that some other server actually processed its request.

A traditional forward proxy server allows multiple clients to route traffic to an external network. For instance, a business may have a proxy that routes and filters employee traffic to the public Internet. A reverse proxy, on the other hand, routes traffic on behalf of multiple servers. 

A reverse proxy effectively serves as a gateway between clients, users, and application servers. It handles all the access policy management and traffic routing, and it protects the identity of the server that actually processes the request.

Reverse proxy configuration

By routing client traffic through a reverse proxy, admins can simplify security administration. They can configure backend servers to only accept traffic directly from the proxy and then configure the granular access control configurations on the proxy itself.

For example, admins can configure the reverse proxy’s firewall to whitelist or blacklist specific IP addresses. All existing servers behind the proxy will be protected accordingly, and whenever admins add a new backend server to the network that is configured to only accept requests from the proxy server, the new backend server is protected according to the proxy configuration.

Using a reverse proxy can also allow administrators to easily swap backend servers in and out without disrupting traffic. Because clients interact directly with the proxy, they only need to know its host name and don't need to worry about changes to the backend network topology. In addition to simplifying client configuration, an admin can configure a reverse proxy to load-balance traffic so that requests can be more evenly distributed to the backend servers and improve overall performance.

Use case: onboarding and off-boarding

When onboarding a new user to a network, administrators must configure access control and firewalls to ensure the user can access the appropriate resources. Traditionally, an admin has to configure each server for which users need access. In a large organization with many servers, this can be a time-consuming and error-prone process.

However, with a reverse proxy, administrators can configure the access rights directly on the proxy server and have the user route all traffic through it. As such, the backend servers only need to trust and communicate with the proxy directly. This greatly simplifies the configuration process and helps ensure access is granted and revoked correctly by doing so through a single source.

Setting up a reverse proxy for access management

While a reverse proxy can greatly simplify the process of managing access to a network, setting it up and configuring it properly can get complicated. It requires provisioning the host with appropriate specifications, configuring the operating system and firewall, deciding on which proxy software to use (such as NGINX or HAProxy), enumerating and configuring the downstream servers in the proxy configuration files, setting up audit logging, and configuring the firewalls in all the downstream servers.

An administrator will need to optimize the proxy software to adjust for performance and availability requirements. For example, when a downstream server fails, the admin should configure the proxy server to quickly reroute traffic to avoid downtime.

At scale, the out-of-the-box configurations are rarely sufficient, so testing becomes important. Whenever the configurations change, you’ll need a way to run sufficient load against a representative test environment and closely monitor the impact on both performance and availability to verify that configurations will meet the needs of the production environment.

Building a reverse proxy by hand vs. buying software

Given all the steps involved in implementing, testing, and optimizing a reverse proxy, you may choose to buy software that can provide this functionality without all the custom work. Access management software can provide all of this functionality while also managing the ongoing maintenance and user management.

In addition to providing standard reverse proxy capabilities, access management software affords a number of unique benefits:

‍

1) Flexibility with user access. By abstracting away the complexity of firewalls and access control, access management software can provide higher-level concepts like user groups. This functionality makes it easy for admins to assign and remove users from various predefined groups and allows the software to automatically implement the access policies.

2) Designed to boost reliability. In distributed systems, servers can fail and network interruptions may occur. Access management software easily detects failed servers and reroutes traffic to working ones to avoid any noticeable downtime for users.

3) Load balancing capabilities. Single servers may struggle when hit with a large amount of traffic, which degrades performance and increases request latency. Access management software can help to manage traffic and balance the load across all servers, making sure it’s evenly distributed.

Managing access with strongDM

The strongDM control plane is a proxy-based solution that simplifies authentication and authorization for admins. It routes all database and server connections through its protocol-aware proxy over a TLS 1.2 secure TCP connection, and it handles load balancing and automatic failover to provide high availability. The proxy validates user sessions and permissions and then intelligently routes the session to the target database or server through the most efficient path, logging all traffic along the way.

strongDM extends the single sign-on capabilities of your identity provider, allowing you to authenticate users to any server or database. From the Admin UI, you can view connected resources and manage role-based access control for your users. See for yourself with a free, 14-day trial.

‍

홈페이지 제작 또는 관리를 할 때 파일질라 같은 ftp 프로그램을 이용하여 코드를 수정한 후 업로드를 합니다. ftp에서 파일을 다운받아 코드 편집기로 수정 후 다시 ftp로 올려야 하는 작업이 여간 번거롭습니다. 비쥬얼 스튜디오 코드에서 확장 프로그램을 이용해 ftp로 연결하여 바로 코드 편집할 수 있도록 환경을 셋팅해 보도록 하겠습니다.

먼저 파일질라 ftp 프로그램 설치 및 사용방법은 아래 링크로 걸어두었습니다.

lognam.tistory.com/54

VS Code 프로그램을 실행하여 좌측 하단 아이콘을 누른 후 ftp-simple을 검색하여 설치를 합니다.

F1키를 누른 후 ftp로 검색을 하여 ftp-simple : Config - FTP connection setting를 클릭합니다.

ftp 정보들을 입력하여 줍니다.

F1키를 눌러 이번에는 ftp-simple : Remote directory open to workspace를 클릭하여 줍니다.

등록했던 서버를 클릭합니다.

그누보드 WWW로 들어갑니다.

예시는 그누보드 디렉토리 구조인데, 자신의 티렉토리에 맞게 접속하시면 됩니다.

접속을 하면 위와 같은 안내문구가 우측 하단에 표시됩니다.

이때 폴더를 클릭하면 하위 폴더들이 아직 준비가 되지 않아 이미지처럼 표시가 되고, 클릭해도 열리지 않습니다.

기다리면 다운로드에 성공했다는 메시지가 생깁니다.

메시지를 확인 후 다시 폴더를 열어보면 정상적으로 로딩이 완료된 것을 확인할 수 있습니다.

소스를 수정 후 저장을 하면 덮어쓰기 할지 물어봅니다. OK를 누르면 FTP에 업로드가 됩니다.

저장을 할 때마다 업로드할 건지 물어보므로 confirm 설정을 false로 바꿔주면 물어보지 않고 업로드됩니다.