Hiawatha is a secure and advanced Web server for Unix. It has been written with security as its main goal. It features advanced access control, prevention of SQL injection and cross-site scripting, banning of clients who try such exploits, the ability to run CGIs under any UID/GID you want, and many other features. These features make Hiawatha an interesting Web server for those who need more security than what the other available Web servers are offering. Hiawatha is also fast and easy to configure.
MatrixSSL is an embedded SSL and TLS implementation designed for small footprint devices and applications requiring low overhead per connection. The library is less than 50K on disk with cipher suites. It includes SSL and TLS client and server support, session resumption, and implementations of RSA, AES, 3DES, ARC4, SHA1, and MD5. The source is well documented and contains portability layers for additional operating systems, cipher suites, and cryptography providers.
mod_auth_pubtkt is a simple Web single sign-on (SSO) solution for Apache. It validates authentication tickets provided by the client in a cookie using public-key cryptography (DSA or RSA). Thus, only the login server that generates the tickets needs to possess the private key, while Web servers can verify tickets given only the public key. The implementation of the login server is left to the user, but an example and a library in PHP are provided with the distribution.
Cyan Secure Web Proxy Server is a carrier grade, high performance Internet filtering proxy server for Linux. It includes scalable (user/group/host) Web filter and virus scan utilities for blocking malicious applications at the gateway. It has an advanced URL database, authentication support (Active Directory, LDAP, NTLM), SSL Interception, easy deployment, and remote administration.
Shibboleth is a standards-based middleware software package providing Web single-sign-on across or within organizational boundaries. It implements standards such as OASIS' SAML to provide a federated single-sign-on and attribute exchange framework. It also provides extended privacy functionality, allowing the browser user and their home site to control the attributes released to each application.
Lasso (Liberty Alliance Single Sign On) is an implementation of the Liberty Alliance specifications. These specifications define protocols for federated identities, single sign-on, etc. Lasso supports ID-FF 1.2, SAML 2.0, and parts of ID-WSF. It provides both a C library and bindings for several languages (Python, Java, Perl, PHP 4, and PHP 5).
DeleGate is a multi-purpose application level gateway or proxy server that mediates communication of various protocols, applying cache and conversion for mediated data, controlling access from clients, and routing toward servers. It translates protocols between clients and servers, converting between IPv4 and IPv6, applying SSL (TLS) to arbitrary protocols, merging several servers into a single server view with aliasing and filtering. It can be used as a simple origin server for some protocols (HTTP, FTP, and NNTP).
For high traffic Web sites, Proto Balance Advanced provides connection rate limiting per second and limits the total number of connections. Both are done on a per-client basis. It has a complete Web configuration interface. The IP address of each connecting Web browser is recorded along with its connection stats. It is scalable to millions of clients and handles 10,000 concurrent connections. It performs server backend load balancing with an on-the-fly capability to add and remove servers. Daily and weekly traffic graphs are shown.
Proto Balance SSL negotiates an SSL connection and forwards the plain HTTP connection to your Web server. Certificate management like request generation, vendor certificate installation, and key generation are all done from an easy-to-use Web interface. It load balances connections over multiple Web servers. It performs 1000 SSL transaction per second. Traffic management and on-the-fly redirection of traffic. On-the-fly adding and removal of servers. Traffic accounting and client-connection-rate limits. Denial of server protection. Layer 7 inspection and X-Forwarded-For support.
A 'honeypot' is designed to detect server-side attacks. In contrast, a 'honeyclient' is designed to detect client-side attacks. Specifically, a honeyclient is a dedicated host that drives specially instrumented applications to access remote servers to see if those servers are behaving in a malicious manner (by compromising the client). Honeyclients can proactively detect exploits against client applications without known signatures. This framework uses a client-server model with SOAP messaging as the primary communication method, and uses the free version of VMware Server as a means of virtualizing the client environment.