1. From infra admin's point of view
Web services
From infra admin's point of view

2. Web services
The World Wide Web (abbreviated WWW or the Web) is an information space where documents and other web resources are identified by Uniform Resource Locators (URLs), interlinked by hypertext links, and can be accessed via the Internet.
Components: web server, web client, protocols
Idea by Tim-Berners Lee, 1989
Originally the idea of „hypertext” is much much older
1990 first prototype
Since 1996 most popular web server software - Apache

3. Web Server Definition
A Web server is a program that generates and transmits responses to client requests for Web resources.
Handling a client request consists of several key steps:
Parsing the request message
Checking that the request is authorized
Associating the URL in the request with a file name
Constructing the response message
Transmitting the response message to the requesting client

4. Web Server Definition
The server can generate the response message in a variety of ways:
The server simply retrieves the file associated with the URL and returns the contents to the client.
The server may invoke a script that communicates with other servers or a back-end database to construct the response message.

5. Web site vs. Web server Web site and Web server are different:
A Web site consists of a collection of Web pages associated with a particular hostname.
A Web server is a program to satisfy client requests for Web resources.
HTTP is a protocol „language“ in whitch client and server communicate

6. Handling client request
A Web server proceeds through the following steps in handling an HTTP request:
Read and parse the HTTP request message
for example GET the resource /foo.htm
Translate the URL to a file name
for example the resource be located in the base directory such as /www, where the URL
corresponds to the file of www/foo/index.html
Determine whether the request is authorized
Generate and transmit the response that includes header to show the status information

7. Web architecture

8. Dynamic responses
The documents in the WWW can be grouped into three broad categories: static, dynamic, and active. The category is based on the time at which the contents of the document are determined.
Dynamic feature differentiates the Web from earlier file transfer services on the Internet.
Dynamically generated responses are created in a variety of ways:
Server-side include
Server script
Most of the web nowdays is dynamic

9. SSI
A server-side include instructs the Web server to customize a static resource based on directives in an HTML-like file.

10. Server Script
A server script is a separate program that generates the request resource.
The program may run as
Part of the server
A separate process
The main role of the Web server is
To associate the requested URL with the appropriate script
To pass data to/from the script
The main role of the script is
To process the input from the server
To generate the content to the client

11. Active documents
Active documents are sometimes referred to as client- site dynamic documents.

12. Topics to remember
The Hypertext Transfer Protocol (HTTP) is a protocol used mainly to access data on the World Wide Web.
To get the data client sends request and server responds with data or status message
Client request must contain URL
URL stands for Uniform Resource Locator, and is used to specify addresses on the World Wide Web. A URL is the fundamental network identification for any resource connected to the web (e.g., hypertext pages, images, and sound files). URLs have the following format: protocol://hostname/other_information.
Web pages can be static, dynamic or active

13. Security HTTP is a PLAIN TEXT protocol We all know what that means
Solution: HTTPS
HTTPS (also called HTTP over SSL or HTTP Secure) is a protocol for secure communication over a computer network which is widely used on the Internet. HTTPS consists of communication over Hypertext Transfer Protocol (HTTP) within a connection encrypted by Transport Layer Security or its predecessor, Secure Sockets Layer.
The main motivation for HTTPS is authentication of the visited website and protection of the privacy and integrity of the exchanged data.

14. SSL
Next slideshow

15. Some (extra)useful features for Infra admin
Return to web services
Some (extra)useful features for Infra admin

16. Web Services – PROXYING, Cacheing
Web proxy acts as a sort of L7 sNAT/dNAT
It also can act as sort of L7 firewall
It can also act as web cache
Most common web servers include proxying module
sometimes it makes more sense to use dedicated web proxy like haproxy or squid
they also cache (though not a topic here)
sometimes it easier to use web servers proxy module
it depends what requrements you have
Big companies prefer commercial web filtering solutions sometimes integrated with firefalls (combine L3 and L7)

17. What is web cache
A web cache (or HTTP cache) is an information technology for the temporary storage (caching) of web documents, such as HTML pages and images, to reduce bandwidth usage, server load, and perceived lag.
HTTPS cannot be cached (encryption!)

18. Technologies behind
Proxy/cache can be „transparent” or client side configured
„transparent” technology involves a „trickery”
DNS records
Routes
Benefits: no client side configuration needed
No user can bypass it (ha-ha!)
Negative: HTTP only (most cases)
Can cause problems

19. Types of proxies Forward proxy Reverse proxy They can do:
Rewrite (redirect)
cacheing
SSL offloading
Load balancing
filtering

20. Forward proxy Forward proxy forwards requests from client to server.
L7 sNAT
masquerades client from server.
can be used for web filtering, „anonymous“ browsing, cache etc.

21. Forward proxy Popular in BIG Co.-s Forward proxy with URL filtering
Sorta works together with L3 filtering
Can do SSL MITM in „controlled environments“ (BigCo.)
Bad! Can go agianst a local laws
Breaks two way SLL authentication, if not implemented correctly
Dangers: misconfigured forward proxy (open-relay) is easily detectable and usable by Black Hats.

22. Reverse proxy „hides” servers from client L7 dNAT
Can be very useful for admin
Service aggregation
Can be used as L7 „firewall”
SSL offloading (good one)
Load balancing
„patching” (bad one)
Commercial proxies are extremely expensive

23. SSL Offloading Reverse
Problem: crypto is „expensive” (in terms of computational power)
Certificate management creates administrative overhead
Pluses:
Reduces server load
„enough” secure
Minuses: certificate management (SAN, wildcard)
Usually used together with load balancing
Forward
Can not be implemented with 2-way SSL
Privacy concerns
Breaks things (Skype for example)

24. Rewrite To rewrite URLs „on the fly” RegExp :( Used to redirect client
Very common HTTP to HTTPS
Improve usability (shorten URLs)
Do not mix up with proxy, they are different things
Common misuse: „patching tool”

25. Exercise In elab (NB! Its elab machine) https://elab.itcollege.ee/
Lab HTTPS security