OS4X SmartProxy

What is OS4X SmartProxy

OS4X SmartProxy is a software product which enables you to maintain OFTP2 Proxy activities in a very secure manner. This includes:

• Partner verification upon session initialization before OFTP2 takes place
• OFTP2 message syntax verification
• TLS termination in the DMZ
• configurable outgoing IP address
• No configuration values needed in DMZ
• Secure backend communication via https
• Support for both incoming and outgoing connections
• Manageable logging activities supporting intrusion detection systems
• Extended logging of all activities

Differences against OS4X Proxy

OS4X Proxy supports to forward any TCP/IP package from any source port to any destination via a combination of OS4X proxyserver and proxyclient. The protocol used on top of this connection is not under control of this OS4X proxy.

OS4X SmartProxy terminates the encrypted session of OFTP2 TLS sessions at its end-point (proxy server), verifies any traffic and forwards it securely to the inside proxy client, where it is being transported to the OS4X receive daemon. This enables the OS4X SmartProxy to analyze the complete traffic used in the communication stream, so invalid packages lead to session termination.

The design of the OS4X SmartProxy is that the proxy server and proxy client use as less information as needed for operation. Everything needed for operation is communicated to a secure backend via https.

Involved programs

The used components for the implementation of an OS4X SmartProxy are:

• OS4X SmartProxy server
• OS4X SmartProxy client
• OS4Xapi, accessed via https

Licensing

OS4X Proxy is licensed via a license file at the OS4X Proxy (not client) side: only one license is needed to keep the system up and running. This license is based on an OS4X Proxy ID on the proxy server side, which can be easily obtained via a command line parameter:

dmz:~ # /opt/os4x/os4x_proxyserver2 -L
OS4X Proxy ID: c6bc8d9b37c5e36333a41acdda653aaef7fd4a00459eeb32a8a41059e23017c8px

This OS4X Proxy ID is needed for license generation, which can be done for test purposes on the product website at http://www.os4x.com/key.

The valid license will be searched by default at

/etc/os4x_proxy.lic

but an alternative location can be given with the commandline option "-l":

dmz:~ # /opt/os4x/os4x_proxy -l /usr/licenses/os4x_proxy.lic

OS4X SmartProxy server

The OS4X SmartProxy server is the part which connects to the outside world and which must be reachable via a defined port on the internet. The port on which the server listens to is configured in the OS4X administrative panel, "Configuration" -> "TCP/IP" -> "TCP/IP port of OFTP server (TLS)".

After having started the server, it listens on an internal port for the OS4X SmartProxy client to connect. Only after a successful connect of a OS4X SmartProxy client, the OS4X SmartProxy server is able to retrieve its configuration from the backend and start listening on the configured TCP/IP port for incoming connections.