How to Use Pound with SSL
Pound is a non-caching reverse proxy server for Linux and UNIX that is used in load balancing, security analysis, decryption and network monitoring. Requests to resources on a network can be configured to pass through Pound, allowing it to decide how to best serve them. Pound supports Secure Socket Layers (SSL), allowing users to send encrypted web requests to the Pound server, where it can then be decrypted and processed. You must compile Pound with SSL support and enable it in your configuration to make use of SSL technology.
Other People Are Reading
Instructions
-
-
1
Download the gzipped Pound tarball from the apsis.ch vendor website. The application is open source and free to use, download and distribute.
-
2
Open a new terminal on your system or connect to it securely via SSH. You must connect with an account that has the ability to run the "sudo" command and gain root privileges for the installation.
-
-
3
Navigate to the directory containing the pound code, extract it and move to the new directory. For example, "cd /home/frank/temp; tar -xvzf Pound-*.tgz; cd Pound-*;" without quotation marks.
-
4
Run the chmod command on the configure script to ensure it is executable, then initiate it with the "--with-ssl=<opensslssldirectory>" parameter configured to your OpenSSL directory: "chmod a+rx configure; ./configure --with-ssl=/usr/local/openssl" without quotation marks. If you cannot locate your OpenSSL directory, run the command "whereis openssl" to locate it.
-
5
Wait for the configure script to complete, then compile the application with the "make" command. It takes no parameters.
-
6
Install the newly compiled executable with root privileges, as they will be required to place the installed file in the system-wide directories. Type "sudo make install" without quotation marks, then enter your root password when prompted.
-
7
Insert the ListenHTTPS directive into your Pound configuration. Add the following blocks of script using your preferred text editor to the file at "/etc/pound/pound.cfg":
ListenHTTPS
Address <Public_Interface_Ip>
Port 443
Cert "/usr/local/openssl/etc/mycertificate.pem"
End
-
8
Replace the "<Public_Interface_Ip>," "port number" and "certificate path" with the values for your domain. The public interface IP is the external Internet Protocol address that pound should listen to, while 443 is the default SSL port and can be changed. Replace the "Cert" path with the location of your SSL certificate on the server's hard disk or network.
-
9
Restart the Pound service. The "sudo /etc/init.d/pound restart" command will work on most distributions, but consult your operating guide if you have difficulties. You have now configured Pound to make use of SSL.
-
1
