<div dir="ltr">So the cloud is a scary place, I see that. I wouldn't want to expose anyone to an extra risk. You could just avoid the whole attack vector thing by deploying a 100% on-prem solution though, no? And if you cannot trust your internal servers, then you're screwed either way.<div><br></div><div>Also, you cannot just throw out "attack vector" and "phishing" without backing that up. What sources can you cite that URL redirects are security risks? And not open redirect services either. The services I am referring to would not be <a href="https://en.wikipedia.org/wiki/URL_redirection#Security_issues">open redirects</a>, rather they are protected/private, because you have to configure your own DNS to make it happen. URL shortening services are in use in our daily lives and they rely on the <a href="https://en.wikipedia.org/wiki/URL_shortening#Techniques">same exact techniques</a> I'm talking about here: HTTP 3XX Redirects. So, I'm not saying I'm a security expert, but I don't think it's fair to just say "It might get compromised, therefore it's bad." Otherwise, everything we do is bad, because everything is at risk. <a href="http://heartbleed.com/">Even SSL itself</a>.</div><div><div><br></div><div><div>The problem with the reverse proxy/L7 load balance might be seen at the finesse level, as only a simple redirect is supported today, but otherwise, I would love more intelligence in the routing decision versus static redirects.<br></div><div><br></div><div>And yes, of course, you could simply not bother, but seriously, I have yet to see an environment where bookmarks are pushed and documentation says "Look at your bookmarks to login to finesse." Instead, it has been a URL given to the users via documentation.</div><div><br></div><div>Perhaps a landing page akin to <a href="https://en.wikipedia.org/wiki/IGoogle">Google's old iGoogle</a> could be used to ease the distribution and launching of app URLs. Some apps already have something simliar. Like when you go to the UCCX landing page there's a link for AppAdmin and CUIC. Too bad there's no link for Finesse. And too bad it looks like garbage. And too bad there's not like a single landing page for CUCM, CUC, UCCX, etc.</div></div></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Oct 20, 2016 at 5:14 PM, Norton, Mike <span dir="ltr"><<a href="mailto:mikenorton@pwsd76.ab.ca" target="_blank">mikenorton@pwsd76.ab.ca</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div class="m_-5792956132432749249WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">I would be a bit wary of HTTP redirects being a convenient attack vector for phishing. Especially if they are happening over unencrypted HTTP and across the Internet.
But even just behaviorally, I don’t think it is a good practice to get users comfortable seeing the “official” URIs be redirected to ugly technical-looking URIs. Makes it easier to trick them into using a fake page. If they’re used to always seeing a memorable
simple and pretty URI, then they’re more likely to notice when something is amiss.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">An alternative would be to rewrite URIs with a reverse proxy (or L7 load balancer). This would avoid the need for redirects and would keep the user’s browser
pointed at a nice pretty URI. As a security bonus, you’d be able to firewall direct L3 access to the application service, and also your client machines wouldn’t need to be allowed to access weird ports.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Another option is to just not bother with friendly names, push favourites/bookmarks into users’ browsers (e.g. via group policy, mdm) and train them to get to
the applications that way.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">-mn<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> cisco-voip [mailto:<a href="mailto:cisco-voip-bounces@puck.nether.net" target="_blank">cisco-voip-bounces@<wbr>puck.nether.net</a>]
<b>On Behalf Of </b>Anthony Holloway<br>
<b>Sent:</b> October-20-16 1:07 PM<br>
<b>To:</b> Cisco VoIP Group <<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a>><br>
<b>Subject:</b> [cisco-voip] DNS Friendly Names and URL Paths<u></u><u></u></span></p><div><div class="h5">
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">Since the list is slow this week....<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<p class="MsoNormal">Ever since the push for DNS and FQDN over IP Address, I have been giving application servers a Subject Alternative Name (SAN) so that users accessing Self-Care Portal, Finesse, etc. do not have to be bothered with server names.<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<blockquote style="margin-left:30.0pt;margin-right:0cm">
<div>
<p class="MsoNormal">E.g., <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Instead of this:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<blockquote style="margin-left:30.0pt;margin-right:0cm">
<div>
<p class="MsoNormal"><a href="https://mspvmcucm001.company.com/ucmuser" target="_blank">https://mspvmcucm001.company.<wbr>com/ucmuser</a><u></u><u></u></p>
</div>
</blockquote>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">They would be able to use this:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<blockquote style="margin-left:30.0pt;margin-right:0cm">
<div>
<p class="MsoNormal"><a href="https://myphone.company.com/ucmuser" target="_blank">https://myphone.company.com/<wbr>ucmuser</a><u></u><u></u></p>
</div>
</blockquote>
</blockquote>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">That works pretty well, and Tomcat certs are easily signed to support the extra alias.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">However, when it comes to UCCX, it's a little more complicated with the following example:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<blockquote style="margin-left:30.0pt;margin-right:0cm">
<div>
<p class="MsoNormal"><a href="https://finesse.company.com:8445/desktop" target="_blank">https://finesse.company.com:<wbr>8445/desktop</a><u></u><u></u></p>
</div>
</blockquote>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Because the alias is not exactly fitting for all things on UCCX, such as:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<blockquote style="margin-left:30.0pt;margin-right:0cm">
<div>
<p class="MsoNormal"><a href="https://finesse.company.com:8444/cuic" target="_blank">https://finesse.company.com:<wbr>8444/cuic</a><u></u><u></u></p>
</div>
</blockquote>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">That's confusing, and also because the user still has to remember the port and path on the end.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<blockquote style="margin-left:30.0pt;margin-right:0cm">
<div>
<p class="MsoNormal"><a href="https://finesse.company.com" target="_blank">https://finesse.company.com</a> will not automatically take you to
<a href="https://finesse.company.com:8445/desktop" target="_blank">https://finesse.company.com:<wbr>8445/desktop</a><u></u><u></u></p>
</div>
</blockquote>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Today I had a co-worker ask me how it might be possible to have both:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<blockquote style="margin-left:30.0pt;margin-right:0cm">
<div>
<p class="MsoNormal">A) A different alias for each sub-component of the application server (E.g., Finesse vs CUIC)<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">B) Have the port and path appended automatically<u></u><u></u></p>
</div>
</blockquote>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">I decided that a shim would be appropriate here. We would take the various aliases, send them to a web server, which would then initiate an HTTP Header Location redirect to the appropriate port and path.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">A PHP example could be:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<blockquote style="margin-left:30.0pt;margin-right:0cm">
<div>
<p class="MsoNormal"><span style="font-family:"Courier New"">URL: <a href="https://agent.company.com/" target="_blank">
https://agent.company.com/</a></span><u></u><u></u></p>
</div>
</blockquote>
</div>
<blockquote style="margin-left:30.0pt;margin-right:0cm">
<div>
<p class="MsoNormal"><span style="font-family:"Courier New"">PHP: <?php header('Location:
<a href="https://mspvmuccx001.company.com:8445/desktop''" target="_blank">https://mspvmuccx001.company.<wbr>com:8445/desktop''</a>); exit; ?></span><u></u><u></u></p>
</div>
</blockquote>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">This uses the <a href="https://en.wikipedia.org/wiki/HTTP_location" target="_blank">
HTTP Location</a> header, which sends an HTTP 3XX response code to the client and let's them know where to go to get the "right" page. Unfortunately, that does mean that the address changes in your browser from the first URL to the second URL. This isn't
terrible, but it does mean that you'll still want a friendly looking CNAME record for your host still, as I described above.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">But, this would require me to install a web server in each environment and configure it, or ask for shared web server space. A better solution? The cloud!<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">I stumbled across a public service that does just this. The cloud service I found is:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<blockquote style="margin-left:30.0pt;margin-right:0cm">
<div>
<p class="MsoNormal"><a href="https://www.easyredir.com/" target="_blank"><span style="font-size:9.5pt">https://www.easyredir.com/</span></a><u></u><u></u></p>
</div>
</blockquote>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">They have both paid and a free plans:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<blockquote style="margin-left:30.0pt;margin-right:0cm">
<div>
<p class="MsoNormal"><a href="https://www.easyredir.com/free-url-redirection" target="_blank">https://www.easyredir.com/<wbr>free-url-redirection</a><u></u><u></u></p>
</div>
</blockquote>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">I was able to set this up in about 10 minutes and it works exactly like I have explained above. I have no affiliation to them, and I'm sure there's other services out there.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Icing on the cake I suppose, I was even able to take a public domain record (E.g.,
<a href="http://company.com" target="_blank">company.com</a>) and redirect it to a private domain record (E.g., company.local), proving that your application servers need not be accessible from the internet.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">In fact, your target url doesn't even have to be a public domain either.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<blockquote style="margin-left:30.0pt;margin-right:0cm">
<div>
<p class="MsoNormal">E.g.,<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><a href="https://agent.company.local" target="_blank">https://agent.company.local</a> can point to
<a href="https://mspvmuccx001.company.local:8445/desktop" target="_blank">https://mspvmuccx001.company.<wbr>local:8445/desktop</a><u></u><u></u></p>
</div>
</blockquote>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">The only requirement is that your client PC can resolve the private record (.local) to the public service host (on
<a href="http://easyredir.com" target="_blank">easyredir.com</a>), and that the returned redirect location (.local again) is also accessible to your client PC.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Has anyone come across something like this before? How are you solving all the different ports and paths now under your administrative domain?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">This does not replace your need for a smart load-balancer in the case of a server failure, though Finesse should at least redirect you to the Master node, should your DNS record point to the Slave.<u></u><u></u></p>
</div>
</div>
</div></div></div>
</div>
</blockquote></div><br></div>