I think what you're looking for is something like this[1], right?

That's an interesting scenario. I think if we extracted the registration module to a separated WAR file, would help to protect /ag-push infrastructure. Not sure if the idea is interesting.

Good morning Andreas, I think what you're looking for is something like this[1], right? That's an interesting scenario. I think if we extracted the registration module to a separated WAR file, would help to protect /ag-push infrastructure. Not sure if the idea is interesting. Thoughts anyone? [1] - http://www.netfilter.org/documentation/HOWTO/netfilter-extensions-HOWTO.h... On 2014-11-24, Andreas Røsdal wrote: > Hello! > > I would like to security advice for running the Aerogear UnifiedPush Server > for sending Push messages to an iPhone app. The app-server is Wildfly, and > HTTPS is enabled. It is important to prevent unauthorized push messages > from being sent. Do you have any documentation or general advice for > securing Aerogear UnifiedPush Server? > > I would like to setup firewall rules to prevent users on the internet to > log in to the UnifiedPush Admin gui /ag-push/ while still allowing > registration of iPhone app/device tokens though the same UnifiedPush Admin > server. What kind of URL pattern can I use to prevent admin logins > externally? > > > Regards, > Andreas R. > _______________________________________________ > aerogear-dev mailing list > aerogear-dev(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/aerogear-dev -- abstractj PGP: 0x84DC9914 _______________________________________________ aerogear-dev mailing list aerogear-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/aerogear-dev

well, it's up to you :) if you have different remote systems, that need to

Hi Andreas, On Mon, Nov 24, 2014 at 2:23 PM, Andreas Røsdal <andreas.rosdal(a)gmail.com&gt; wrote: > Good morning! > > > I think what you're looking for is something like this[1], right? > > Maybe this could be secured using Netfilter on Linux, I would be > interested in hearing more about this. > Initially, I thought I would be looking for a F5 firewall iRule kind of > like this: > -Allow: /ag-push/(registration) > -Deny: /ag-push/(admin-gui) and /ag-push/(java-api-access) > > Is /ag-push/ is designed to be exposed to the public Internet? > well, it's up to you :) if you have different remote systems, that need to contact the server -> you wanna expose the /sender part too. if not -> block it As you said earlier, the only one that really needs to be exposed to public is the device registration. > > >That's an interesting scenario. I think if we extracted the registration > >module to a separated WAR file, would help to protect /ag-push > >infrastructure. Not sure if the idea is interesting. > That is an interesting point, and worth evaluating. Internally of that "registration.war", we could simply act as a proxy to the 'real' registration (on the ag-push.war), which is blocked by the firewall. -Matthias > > Yes, that would be interesting as a more long-term solution. I would like > to start using > the UnifiedPush Server very soon, so then I would prefer some quick > firewall rule rather than waiting > for a new release. > > Thanks for the help so far! > > Andreas > > > > 2014-11-24 13:57 GMT+01:00 Bruno Oliveira <bruno(a)abstractj.org&gt;: > >> Good morning Andreas, I think what you're looking for is something like >> this[1], right? >> >> That's an interesting scenario. I think if we extracted the registration >> module to a separated WAR file, would help to protect /ag-push >> infrastructure. Not sure if the idea is interesting. >> >> Thoughts anyone? >> >> >> [1] - >> >> http://www.netfilter.org/documentation/HOWTO/netfilter-extensions-HOWTO.h... >> >> On 2014-11-24, Andreas Røsdal wrote: >> > Hello! >> > >> > I would like to security advice for running the Aerogear UnifiedPush >> Server >> > for sending Push messages to an iPhone app. The app-server is Wildfly, >> and >> > HTTPS is enabled. It is important to prevent unauthorized push messages >> > from being sent. Do you have any documentation or general advice for >> > securing Aerogear UnifiedPush Server? >> > >> > I would like to setup firewall rules to prevent users on the internet >> to >> > log in to the UnifiedPush Admin gui /ag-push/ while still allowing >> > registration of iPhone app/device tokens though the same UnifiedPush >> Admin >> > server. What kind of URL pattern can I use to prevent admin logins >> > externally? >> > >> > >> > Regards, >> > Andreas R. >> >> > _______________________________________________ >> > aerogear-dev mailing list >> > aerogear-dev(a)lists.jboss.org >> > https://lists.jboss.org/mailman/listinfo/aerogear-dev >> >> >> -- >> >> abstractj >> PGP: 0x84DC9914 >> _______________________________________________ >> aerogear-dev mailing list >> aerogear-dev(a)lists.jboss.org >> https://lists.jboss.org/mailman/listinfo/aerogear-dev > > > > _______________________________________________ > aerogear-dev mailing list > aerogear-dev(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/aerogear-dev > -- Matthias Wessendorf blog: http://matthiaswessendorf.wordpress.com/ sessions: http://www.slideshare.net/mwessendorf twitter: http://twitter.com/mwessendorf _______________________________________________ aerogear-dev mailing list aerogear-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/aerogear-dev

Hello Andreas! here is an example of what you can do, with a simple gateway/proxy: https://github.com/matzew/ups-proxy For our mobile-quickstarts we needed an example to show how to run a business backend behind the firewall, but since mobile devices, on the internet, need to connect to those backends, we created a gateway/proxy example, based on Fabric8. The above is a simplified version of that, having one single rule: https://github.com/matzew/ups-proxy/blob/master/src/main/webapp/WEB-INF/u... Now, you could block the entire access to /ag-push, from the public interface, and just allow the "ups-proxy", or even run the UPS behind the firewall. Your only public access-point could be the proxy servlet in the above example. Oh, btw. here is an overview of our RESTful APIs: http://aerogear.org/docs/specs/aerogear-unifiedpush-rest/overview-index.html -Matthias On Mon, Nov 24, 2014 at 4:03 PM, Andreas Røsdal <andreas.rosdal(a)gmail.com&gt; wrote: > >well, it's up to you :) if you have different remote systems, that need > to contact the server -> you wanna expose the /sender part too. if not -> > block it > > Yes, so I can block the following URL from external requests: > /ag-push/rest/sender/ > > Are there other similar URLS that I can block to secure the UnifiedPush > Server? > > Regards, > Andreas R. > > > > 2014-11-24 14:39 GMT+01:00 Matthias Wessendorf <matzew(a)apache.org&gt;: > >> Hi Andreas, >> >> On Mon, Nov 24, 2014 at 2:23 PM, Andreas Røsdal < >> andreas.rosdal(a)gmail.com&gt; wrote: >> >>> Good morning! >>> >>> > I think what you're looking for is something like this[1], right? >>> >>> Maybe this could be secured using Netfilter on Linux, I would be >>> interested in hearing more about this. >>> Initially, I thought I would be looking for a F5 firewall iRule kind of >>> like this: >>> -Allow: /ag-push/(registration) >>> -Deny: /ag-push/(admin-gui) and /ag-push/(java-api-access) >>> >>> Is /ag-push/ is designed to be exposed to the public Internet? >>> >> >> well, it's up to you :) if you have different remote systems, that need >> to contact the server -> you wanna expose the /sender part too. if not -> >> block it >> >> As you said earlier, the only one that really needs to be exposed to >> public is the device registration. >> >> >> >>> >>> >That's an interesting scenario. I think if we extracted the >>> registration >>> >module to a separated WAR file, would help to protect /ag-push >>> >infrastructure. Not sure if the idea is interesting. >>> >> >> That is an interesting point, and worth evaluating. >> Internally of that "registration.war", we could simply act as a proxy to >> the 'real' registration (on the ag-push.war), which is blocked by the >> firewall. >> >> >> -Matthias >> >> >>> >>> Yes, that would be interesting as a more long-term solution. I would >>> like to start using >>> the UnifiedPush Server very soon, so then I would prefer some quick >>> firewall rule rather than waiting >>> for a new release. >>> >>> Thanks for the help so far! >>> >>> Andreas >>> >>> >>> >>> 2014-11-24 13:57 GMT+01:00 Bruno Oliveira <bruno(a)abstractj.org&gt;: >>> >>>> Good morning Andreas, I think what you're looking for is something like >>>> this[1], right? >>>> >>>> That's an interesting scenario. I think if we extracted the >>>> registration >>>> module to a separated WAR file, would help to protect /ag-push >>>> infrastructure. Not sure if the idea is interesting. >>>> >>>> Thoughts anyone? >>>> >>>> >>>> [1] - >>>> >>>> http://www.netfilter.org/documentation/HOWTO/netfilter-extensions-HOWTO.h... >>>> >>>> On 2014-11-24, Andreas Røsdal wrote: >>>> > Hello! >>>> > >>>> > I would like to security advice for running the Aerogear UnifiedPush >>>> Server >>>> > for sending Push messages to an iPhone app. The app-server is >>>> Wildfly, and >>>> > HTTPS is enabled. It is important to prevent unauthorized push >>>> messages >>>> > from being sent. Do you have any documentation or general advice for >>>> > securing Aerogear UnifiedPush Server? >>>> > >>>> > I would like to setup firewall rules to prevent users on the >>>> internet to >>>> > log in to the UnifiedPush Admin gui /ag-push/ while still allowing >>>> > registration of iPhone app/device tokens though the same UnifiedPush >>>> Admin >>>> > server. What kind of URL pattern can I use to prevent admin logins >>>> > externally? >>>> > >>>> > >>>> > Regards, >>>> > Andreas R. >>>> >>>> > _______________________________________________ >>>> > aerogear-dev mailing list >>>> > aerogear-dev(a)lists.jboss.org >>>> > https://lists.jboss.org/mailman/listinfo/aerogear-dev >>>> >>>> >>>> -- >>>> >>>> abstractj >>>> PGP: 0x84DC9914 >>>> _______________________________________________ >>>> aerogear-dev mailing list >>>> aerogear-dev(a)lists.jboss.org >>>> https://lists.jboss.org/mailman/listinfo/aerogear-dev >>> >>> >>> >>> _______________________________________________ >>> aerogear-dev mailing list >>> aerogear-dev(a)lists.jboss.org >>> https://lists.jboss.org/mailman/listinfo/aerogear-dev >>> >> >> >> >> -- >> Matthias Wessendorf >> >> blog: http://matthiaswessendorf.wordpress.com/ >> sessions: http://www.slideshare.net/mwessendorf >> twitter: http://twitter.com/mwessendorf >> >> _______________________________________________ >> aerogear-dev mailing list >> aerogear-dev(a)lists.jboss.org >> https://lists.jboss.org/mailman/listinfo/aerogear-dev >> > > > _______________________________________________ > aerogear-dev mailing list > aerogear-dev(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/aerogear-dev > -- Matthias Wessendorf blog: http://matthiaswessendorf.wordpress.com/ sessions: http://www.slideshare.net/mwessendorf twitter: http://twitter.com/mwessendorf

On Mon, 2014-11-24 at 13:27 +0100, Andreas Røsdal wrote: > Hello! > > I would like to security advice for running the Aerogear UnifiedPush Server > for sending Push messages to an iPhone app. The app-server is Wildfly, and > HTTPS is enabled. It is important to prevent unauthorized push messages > from being sent. Do you have any documentation or general advice for > securing Aerogear UnifiedPush Server? > > I would like to setup firewall rules to prevent users on the internet to > log in to the UnifiedPush Admin gui /ag-push/ while still allowing > registration of iPhone app/device tokens though the same UnifiedPush Admin > server. What kind of URL pattern can I use to prevent admin logins > externally? I'd say hide ag-push to be accessible only on a particular interface available in your internal network and create a proxy WAR accessible on public network that will "forward" sender and registration requests to ag-push WAR. > > > Regards, > Andreas R. > _______________________________________________ > aerogear-dev mailing list > aerogear-dev(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/aerogear-dev _______________________________________________ aerogear-dev mailing list aerogear-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/aerogear-dev

Hi Karel! While reading the documentation for UnifiedPush Server I didn't get the impression that a custom proxy WAR is required to run it securely on the internet, so I would suggest you add some guidelines to the online documentation how to run it securely. Is it strictly required to setup ag-push behind a custom proxy WAR to run the UnifiedPush Server securely on a public network?

How should I go about creating such a custom proxy WAR? I would much prefer a well-supported open source or commercial off-the-shelf solution than to develop a custom proxy

WAR. So for me the most practical thing would be to secure the UnifiedPush Server by using firewall rules which block specific URLs, if it is possible to create a list of HTTP paths to block in the firewall.

Would blocking /auth/ and /ag-push/rest/sender/ be sufficient? Which URLs does the iOS device token registration client use?

Further, I have seen the chapter on "Brute Force Protection" which is described in the Security Defenses documentation, and this seems like a reasonable security feature that I will enable.

I very much appreciate all the feedback on this question so far, and I hope you see that this question will be relevant for other users of the AeroGear UnifiedPush Server who want to run it securely. Regards, Andreas R. 2014-11-24 17:30 GMT+01:00 Karel Piwko <kpiwko(a)redhat.com&gt;: > On Mon, 2014-11-24 at 13:27 +0100, Andreas Røsdal wrote: > > Hello! > > > > I would like to security advice for running the Aerogear UnifiedPush > Server > > for sending Push messages to an iPhone app. The app-server is Wildfly, > and > > HTTPS is enabled. It is important to prevent unauthorized push messages > > from being sent. Do you have any documentation or general advice for > > securing Aerogear UnifiedPush Server? > > > > I would like to setup firewall rules to prevent users on the internet to > > log in to the UnifiedPush Admin gui /ag-push/ while still allowing > > registration of iPhone app/device tokens though the same UnifiedPush > Admin > > server. What kind of URL pattern can I use to prevent admin logins > > externally? > > I'd say hide ag-push to be accessible only on a particular interface > available in your internal network and create a proxy WAR accessible on > public network that will "forward" sender and registration requests to > ag-push WAR. > > > > > > > > Regards, > > Andreas R. > > _______________________________________________ > > aerogear-dev mailing list > > aerogear-dev(a)lists.jboss.org > > https://lists.jboss.org/mailman/listinfo/aerogear-dev > > > _______________________________________________ > aerogear-dev mailing list > aerogear-dev(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/aerogear-dev > _______________________________________________ aerogear-dev mailing list aerogear-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/aerogear-dev