Re: web replication

ed ha scritto:

have you some references/advise about?


I suggest using the NAT based solution because HTTP is session based,
unless you have FTP clients of course.

To replicate the file system use rsync, or a SAN/NAS.

Filesystem replication is the bane.

i'm thinking abount 3 tier architecture
client -- load bilancer -- n web server + script engine -- db
to enable the http session information i think about using a network
filesystem placed on backend and setting the mount point as a session
directory path (using the php session's configuration directive)
the cookies should not be a problem, should it?
cookies resides in the client browser and forwarded to the server based
on domain name (the bilancer domain name).
to replicate the db i would use a simple master slave mysql configuration.

the unsolved problem is bilanced the https session, a session must use
the same server because there's an handshake for the simmetric key
exchange..
how do you recognize a single https session from another https session?
the actual idea is not shape this traffic and dedicate one server for
the ssl traffic using port for the nat prerouting rule.

rsync is a good idea to syncing the web content of the n middleware
server. thanks

every advise is really well appreciated

fusillo
.

Relevant Pages

  • Aruba Advisory ID: AID-020810 TLS Protocol Session Renegotiation Security Vulnerability
    ... TLS Protocol Session Renegotiation Security Vulnerability ... HTTPS WebUI administration interface. ... If a client browser is ... Aruba Networks recommends that all customers apply the appropriate ...
    (Bugtraq)
  • Re: Dropped session variables tied to SSL pages? Or Redirect?
    ... between HTTP and HTTPS for the same application path. ... > "Mark Schupp" wrote in message ... >> session cookie can only go to one application. ... >>> I also commented that some of the Session variables stayed intact. ...
    (microsoft.public.inetserver.asp.general)
  • Researcher demonstrates SSL attack
    ... Moxie Marlinspike, who spoke at the Black Hat security conference on Wednesday, explained how to subvert an SSL session by performing a man-in-the-middle attack. ... The anarchist researcher explained in a YouTube video that the attack uses a tool developed called SSLstrip, which exploits the interface between http and https sessions. ... Secure Sockets Layer, and its successor Transport Layer Security, are cryptographic protocols used to encrypt communications over TCP/IP networks. ...
    (alt.privacy)
  • Re: Sessions/Cookies between sites
    ... Session variables are still retained when switching from ... http to https, I never knew it was a bug, I hope Microsoft ... session variables and cookies will not be shared ...
    (microsoft.public.inetserver.asp.db)
  • Re: Sessions/Cookies between sites
    ... Session variables are still retained when switching from ... http to https, I never knew it was a bug, I hope Microsoft ... session variables and cookies will not be shared ...
    (microsoft.public.inetserver.asp.db)