Load Balancing NTLM over HTTP with NGINX

[Maxim Dounin]

Hello!

On Fri, Nov 18, 2022 at 10:30:29PM -0500, Michael B Allen wrote:

> NTLM over HTTP is a 3 request "handshake" that must occur over the same TCP
> connection.
> My HTTP service implements the NTLMSSP acceptor and uses the clients remote
> address and port like "10.11.12.13:54433" to track the authentication state
> of each TCP connection.
>
> My implementation also uses a header called 'Jespa-Connection-Id' that
> allows the remote address and port to be supplied externally.
> NGINX can use this to act as a proxy for NTLM over HTTP with a config like
> the following:
>
> server {
>     location / {
>         proxy_pass http://localhost:8080;
>         proxy_set_header Jespa-Connection-Id 
>         $remote_addr:$remote_port;
>     }
> }

I'm pretty sure you're aware of this, but just for the record.  
Note that NTML authentication is not HTTP-compatible, but rather 
requires very specific client behaviour.  Further, NTLM 
authentication can easily introduce security issues as long as any 
proxy servers are used between the client and the origin server, 
since it authenticates a connection rather than particular 
requests, and connections are not guaranteed to contain only 
requests from a particular client.  Unless you have very specific 
reasons to support it, a better idea might be to use different 
authentication mechanisms.

[...]

> This also seems to work fine but I have doubts.
> Can NGINX use the same TCP connection to a backend server to send requests
> of different client connections?
> 
> From what I can tell, NGINX seems to create a separate TCP connection for
> each request.
> If this is always true, then it seems this scheme should work.
> Can you please confirm that this is how NGINX works?
> 
> More generally, do you see any problems with this scheme?

As of now, nginx by default does not use keepalive connections to 
the upstream servers.  These are, however, can be configured by 
using the "keepalive" directive (http://nginx.org/r/keepalive), 
and obviously enough this will break the suggested scheme as there 
will be requests from other clients on the same connection.

A better approach might be to check the client address on each 
request - this should remove the dependency on whether nginx uses 
a new connection for each request or not.

Another issue I can see here is that in a configuration where 
Jespa-Connection-Id is not removed by nginx it might be provided 
by the client, claiming arbitrary address and port.  This might be 
a security risk.

Also note that if a proxy server is used in front of nginx with 
such a configuration, and this proxy server uses keepalive 
connections, requests from different clients coming from the proxy 
server will share the same address and port.  This might be a 
security risk unless authentication token is checked on each 
request.  This risk is, however, common to all uses of NTLM 
authentication, and not really specific to the particular 
configuration.

Hope this helps.

-- 
Maxim Dounin
http://mdounin.ru/