March 13, 2025
Table of Contents
- Preface
- 1. How PNS works
- 2. Configuring PNS proxies
- 3. The PNS SSL framework
- 4. Proxies
- 4.1. General information on the proxy modules
- 4.2. Attribute values
- 4.3. Examples
- 4.4. Module AnyPy
- 4.5. Module Ftp
- 4.6. Module Http
- 4.6.1. The HTTP protocol
- 4.6.2. Proxy behavior
- 4.6.3. Related standards
- 4.6.4. Classes in the Http module
- 4.6.5. Class AbstractHttpProxy
- 4.6.6. Class HttpProxy
- 4.6.7. Class HttpProxyNonTransparent
- 4.6.8. Class HttpProxyURIFilter
- 4.6.9. Class HttpProxyURIFilterNonTransparent
- 4.6.10. Class HttpProxyURLCategoryFilter
- 4.6.11. Class HttpWebdavProxy
- 4.6.12. Class NontransHttpWebdavProxy
- 4.7. Module Plug
- 4.8. Module Pop3
- 4.9. Module Smtp
- 4.10. Module Telnet
- 4.11. Module Imap
- 4.12. Module Ldap
- 4.12.1. The LDAP protocol
- 4.12.2. Proxy behavior
- 4.12.3. Configuring policies for LDAP requests
- 4.12.4. Simple Authentication and Security Layer (SASL) on LDAP messages
- 4.12.5. Related standards
- 4.12.6. Classes in the Ldap module
- 4.12.7. Class AbstractLdapProxy
- 4.12.8. Class LdapProxy
- 4.12.9. Class LdapProxyRO
- 4.13. Module Mime
- 4.14. Module Modbus
- 4.15. Module MSRpc
- 4.16. Module Radius
- 4.17. Module Sip
- 4.18. Module Socks
- 4.19. Module SQLNet
- 4.20. Module Ssh
- 4.21. Module TFtp
- 4.22. Module Vnc
- 5. Core
- 5.1. Module Auth
- 5.1.1. Authentication and authorization basics
- 5.1.2. Authentication and authorization in PNS
- 5.1.3. Classes in the Auth module
- 5.1.4. Class AbstractAuthentication
- 5.1.5. Class AbstractAuthorization
- 5.1.6. Class AuthCache
- 5.1.7. Class AuthenticationPolicy
- 5.1.8. Class AuthorizationPolicy
- 5.1.9. Class BasicAccessList
- 5.1.10. Class InbandAuthentication
- 5.1.11. Class NEyesAuthorization
- 5.1.12. Class PairAuthorization
- 5.1.13. Class PermitGroup
- 5.1.14. Class PermitTime
- 5.1.15. Class PermitUser
- 5.1.16. Class ServerAuthentication
- 5.1.17. Class VAAuthentication
- 5.2. Module AuthDB
- 5.3. Module Chainer
- 5.4. Module Detector
- 5.5. Module Encryption
- 5.5.1. TLS parameter constants
- 5.5.2. Classes in the Encryption module
- 5.5.3. Class AbstractVerifier
- 5.5.4. Class Certificate
- 5.5.5. Class CertificateCA
- 5.5.6. Class ClientCertificateVerifier
- 5.5.7. Class ClientNoneVerifier
- 5.5.8. Class ClientOnlyEncryption
- 5.5.9. Class ClientOnlyStartTLSEncryption
- 5.5.10. Class ClientTLSOptions
- 5.5.11. Class DHParam
- 5.5.12. Class DynamicCertificate
- 5.5.13. Class DynamicServerEncryption
- 5.5.14. Class EncryptionPolicy
- 5.5.15. Class FakeStartTLSEncryption
- 5.5.16. Class ForwardStartTLSEncryption
- 5.5.17. Class PrivateKey
- 5.5.18. Class SNIBasedCertificate
- 5.5.19. Class ServerCertificateVerifier
- 5.5.20. Class ServerNoneVerifier
- 5.5.21. Class ServerOnlyEncryption
- 5.5.22. Class ServerTLSOptions
- 5.5.23. Class StaticCertificate
- 5.5.24. Class TLSOptions
- 5.5.25. Class TwoSidedEncryption
- 5.6. Module Ids
- 5.7. Module Keybridge
- 5.8. Module Matcher
- 5.9. Module NAT
- 5.10. Module Notification
- 5.11. Module Proxy
- 5.12. Module Resolver
- 5.13. Module Router
- 5.14. Module Rule
- 5.15. Module Service
- 5.16. Module Session
- 5.17. Module SockAddr
- 5.18. Module Stack
- 5.19. Module Zone
- 5.20. Module Vela
- 6. Core-internal
- A. Additional proxy information
- B. Global options of PNS
- C. PNS manual pages
- vas — Authentication Server
- vas.cfg vas(8) configuration file.
- vcf — Content Filtering Server
- vcf.cfg vcf(8) configuration file format
- vms — Vela Management Server engine
- vms.confConfiguration file format for the Vela Management Server (vms(8)).
- vms-integrity — VMS Database Integrity Checker
- instances.conf vela(8) instances database
- policy.py vela(8) policy file.
- vela — PNS Firewall Suite
- velactl — Start and stop vela instances.
- velactl.conf velactl(8) configuration file.
- vela-zone-helper — Zone helper daemon
- vela-zone-helper.conf vela-zone-helper(8) configuration file
- vela-geoip-helper — GeoIP helper daemon
- vela-geoip-helper.conf vela-geoip-helper(8) configuration file
- vavupdate — Updates the various AntiVirus engine's databases.
- vavupdate.options vavupdate(8) configuration files.
- vqc — Vela Quarantine Checker
- D. Proxedo Network Security Suite End-User License Agreement
- D.1. 1. SUBJECT OF THE LICENSE CONTRACT
- D.2. 2. DEFINITIONS
- D.3. 3. LICENSE GRANTS AND RESTRICTIONS
- D.4. 4. SUBSIDIARIES
- D.5. 5. INTELLECTUAL PROPERTY RIGHTS
- D.6. 6. TRADE MARKS
- D.7. 7. NEGLIGENT INFRINGEMENT
- D.8. 8. INTELLECTUAL PROPERTY INDEMNIFICATION
- D.9. 9. LICENSE FEE
- D.10. 10. WARRANTIES
- D.11. 11. DISCLAIMER OF WARRANTIES
- D.12. 12. LIMITATION OF LIABILITY
- D.13. 13.DURATION AND TERMINATION
- D.14. 14. AMENDMENTS
- D.15. 15. WAIVER
- D.16. 16. SEVERABILITY
- D.17. 17. NOTICES
- D.18. 18. MISCELLANEOUS
- E. Creative Commons Attribution Non-commercial No Derivatives (by-nc-nd) License
- Index of Proxy attributes
- Index of Core attributes
- Index of all attributes
List of Examples
- 2.1. Customizing FTP commands
- 2.2. Using the POLICY action
- 2.3. Default and explicit actions
- 2.4. Customizing response codes
- 2.5. Example PlugProxy allowing secondary sessions
- 2.6. Program stacking in HTTP
- 3.1. Configuring TwoSidedEncryption
- 3.2. Configuring Client Certificate for TwoSidedEncryption
- 3.3. Disabling mutual authentication
- 3.4. Specifying trusted CAs
- 3.5. Specifying CRLs
- 3.6. Disabling Common Name Verification
- 3.7. Enable untrusted certificates
- 3.8. A configured Encryption Policy
- 3.9. Creating a Service
- 3.10. Accepting invalid certificates
- 3.11. Configuring an Encryption Policy with Custom cipher suites
- 3.12. Configuring FTPS support
- 3.13. Selecting the encryption class
- 3.14. Selecting the certificate
- 3.15. Private key certificate
- 3.16. Trusted CA
- 3.17. Untrusted CA
- 3.18. A configured Encryption Policy
- 3.19. Creating a service
- 4.1. FTP protocol sample
- 4.2. Customizing FTP to allow only anonymous sessions
- 4.3. Configuring FTPS support
- 4.4. Example HTTP transaction
- 4.5. Proxy style HTTP query
- 4.6. Data tunneling with connect method
- 4.7. Implementing URL filtering in the HTTP proxy
- 4.8. 404 response filtering in HTTP
- 4.9. Header filtering in HTTP
- 4.10. URL redirection in HTTP proxy
- 4.11. Redirecting HTTP to HTTPS
- 4.12. Using parent proxies in HTTP
- 4.13. URL filtering HTTP proxy
- 4.14. POP3 protocol sample
- 4.15. Example for allowing only APOP authentication in POP3
- 4.16. Example for converting simple USER/PASS authentication to APOP in POP3
- 4.17. Rewriting the banner in POP3
- 4.18. SMTP protocol sample
- 4.19. Example for disabling the Telnet X Display Location option
- 4.20. Rewriting the DISPLAY environment variable
- 4.21. IMAP protocol sample
- 4.22. Rewriting IMAP capability response
- 4.23. Changing the greeting string in IMAP
- 4.24. IMAP arguments in use
- 4.25. Example Ldap entry
- 4.26. Example of the commands usage
- 4.27. Example mail header containing MIME message
- 4.28. Example PNG format picture attachment
- 4.29. Example multipart message
- 4.30. Example usage of MimeProxy module, denying applications
- 4.31. Customising RPC to allow connection to service "11223344-5566-7788-99aa-bbccddeeff00"
- 4.32. Example RadiusProxy config
- 4.33. Disabling video traffic in SIP
- 4.34. SOCKS and HTTP traffic
- 4.35. Enabling and disabling SSH channels
- 4.36. Enabling only SFTP connections
- 4.37. Restricting local forwarding
- 4.38. Modifying the keypair used in public-key authentication
- 5.1. A simple authentication policy
- 5.2. Caching authentication decisions
- 5.3. A simple authorization policy
- 5.4. BasicAccessList example
- 5.5. A simple PairAuthorization policy
- 5.6. A simple PermitGroup policy
- 5.7. PermitTime example
- 5.8. A simple PermitUser policy
- 5.9. Outband authentication example
- 5.10. A sample authentication provider
- 5.11. A sample ConnectChainer
- 5.12. A DirectedRouter using FailoverChainer
- 5.13. A DirectedRouter using RoundRobinChainer
- 5.14. CertDetector example
- 5.15. HttpDetector example
- 5.16. SNIDetector example
- 5.17. SshDetector example
- 5.18. Loading a certificate
- 5.19. Loading DH parameters
- 5.20. Loading a private key
- 5.21. Whitelisting e-mail recipients
- 5.22. DNSMatcher example
- 5.23. RegexpFileMatcher example
- 5.24. RegexpMatcher example
- 5.25. SmtpInvalidMatcher example
- 5.26. WindowsUpdateMatcher example
- 5.27. GeneralNat example
- 5.28. Using Natpolicies
- 5.29. A simple DNSResolver policy
- 5.30. A simple HashResolver policy
- 5.31. DirectedRouter example
- 5.32. InbandRouter example
- 5.33. TransparentRouter example
- 5.34. Sample rule definitions
- 5.35. Tagging rules
- 5.36. A simple DenyService
- 5.37. PFService example
- 5.38. Service example
- 5.39. SockAddrInet example
- 5.40. SockAddrInet example
- 5.41. SockAddrInetHostname example
- 5.42. SockAddrUnix example
- 5.43. A simple StackingProvider class
- 5.44. Using a StackingProvider in an FTP proxy
- 5.45. Finding IP networks
- 5.46. Zone examples
- 5.47. Determining the zone of an IP address
- 6.1. CSZoneDispatcher example
- 6.2. Dispatcher example
- A.1. An example for the SQL*Net connection string
List of Procedures
- 1.1. PNS startup and initialization
- 1.2.1. Handling packet filtering services
- 1.2.2. Handling application-level services
- 1.3. Proxy startup and the server-side connection
- 3.1.1. The SSL handshake
- 3.2.4.1. Enabling TLS-encryption in the connection
- 3.2.8. Configuring keybridging
- B.1. Setting global options of PNS
Copyright: © 2021 Balasys IT Security
Send your comments to support@balasys.hu
