|
View:
New views
12 Messages
—
Rating Filter:
Alert me
|
|
|
Security with VPNHi weberp community,
is it possible to setup weberp securely with vpn? for example, if my weberp & apache webserver are at homei'd like people at the office can connect safely to home via vpn. then from there they can just type a local ip, eg. http://192.168.2.1 to access weberp. i'm quite new with vpn, so i'm not sure if that's right what can be achieved with vpn. if yes, anyone know the procedure to setup vpn server with ubuntu 9.10? thanks, tlie ------------------------------------------------------------------------------ Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day trial. Simplify your report design, integration and deployment - and focus on what you do best, core application coding. Discover what's new with Crystal Reports now. http://p.sf.net/sfu/bobj-july _______________________________________________ web-ERP-users mailing list web-ERP-users@... https://lists.sourceforge.net/lists/listinfo/web-erp-users Thomas Timothy Lie
baliboss.com - Bali Open Source Solution |
|
|
Re: Security with VPNHi T.Lie,
Yes. You are right, that is exactly the most
famous use of VPN. There are 3 levels of VPN Tunnels: 1) PPTP, 2) L2TP and
3) IPSEC.
Nowadays only IPSEC (IP Security) is used. To
explain it shortly, what it does is simply to encrypt the traffic between to IP
nodes (tunneling is a metaphor).
There are 2 different deployments called: 1) Point
to Point and, 2) Roaming.
Point to Point may be configured
using: option 1) Certificates, option 2)
Shared Keys.
Regards,
Javier de Lorenzo-Cáceres
aese, aplicaciones software, s.l.
Canary Islands - Spain
------------------------------------------------------------------------------ Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day trial. Simplify your report design, integration and deployment - and focus on what you do best, core application coding. Discover what's new with Crystal Reports now. http://p.sf.net/sfu/bobj-july _______________________________________________ web-ERP-users mailing list web-ERP-users@... https://lists.sourceforge.net/lists/listinfo/web-erp-users |
|
|
Re: Security with VPNThanks for your reply & info
Sorry for my late reply as i had a power blackout for the whole day i see from windows xp, it can easily setup vpn server & making a new connection to vpn server but it looks like it's using PPTP. 1) if say i decide to setup IPSEC with VPN server in ubuntu, will it be easy for windows client to connect (just like PPTP)? 2) does anyone ever setup VPN for weberp? any available guide in the net? thanks, tlie
Thomas Timothy Lie
baliboss.com - Bali Open Source Solution |
|
|
Re: Security with VPNThanks for your reply & info, Javier
Sorry for my late reply as i had a power blackout for the whole day i see from windows xp, it can easily setup vpn server & making a new connection to vpn server but it looks like it's using PPTP. 1) if say i decide to setup IPSEC with VPN server in ubuntu, will it be easy for windows client to connect (just like PPTP)? 2) does anyone ever setup VPN for weberp? any available guide in the net? thanks, tlie
Thomas Timothy Lie
baliboss.com - Bali Open Source Solution |
|
|
Re: Security with VPNHi T. Lie
> i see from windows xp, it can easily setup vpn server & making a new > connection to vpn server > but it looks like it's using PPTP. Windows XP can also make IPSec Tunneling because Microsoft bought the necessary Windows IPSec implementation license to Cisco. To configure it, the user must do it through Local Security Policies under Administrative Tools (the Cisco copyright is shown), but not through Network Connections. Through Network Connections, the user may configure the VPN Client to use PPTP or L2TP, but Microsoft limited the use of L2TP to Certificates. (Note that any of the above three cases are Clients, not Servers. A server is designed to listen to client requests and accept or reject them following an Access Control List (ACL) and a certain quantity of tunnels) For your questions: Q1) No, the Windows XP IPSec Client it's not intuitive or assisted, even more, the GUI for that subject is not very good, so you must know very well what you are doing, i.e., less than being guided you will be confused even for the subjects you may known well. I did it to a D-Link NetDefend DFL-700, it works, it's very slow (keepalives doesn't seem up and running), then I bought another D-Link NetDefend DFL-200. But I, despite the fact of being a Cisco partner, will recommend you a Cisco 1801-K9 for server and a 857 for every remote LAN and Cisco VPN Client software for Roaming users, an excellent software. D-Link sell the client software apart and it's very odd. Also, you will find two implementations that can work as Ciso VPN clients for Linux. The another BIG is Cytrix. I've tested all the most famous software, including (in alphabetical order) Checkpoint, Clavister (the one licensed to be used by D-Link), Kiwi, Nortel, SafeNet, GreenBow, etc. Also you may find some hardware servers from 3Com, Symantec and others. Linux is right as server and client, but VPN is close related to Public IP and firewalls so they are good in the perimeter and I prefer WebERP in the Back-Office, so, for this setup two boxes are needed. Q2) VPN is like a network connection, it's not related to server, clients or peer to peer applications, once up and running is like an UTP Network Cable. As you well said, it permits to see the private remote LAN as if it was connected directly to the local network, hence the term Private; it's Virtual because indeed it's an Internet connection but since it's being crypted with only Private Keys or Certificates, nobody else can have access to it. Once you have a VPN connection up and running, you will find it transparent to all protocols. Indeed VPN is more useful to unsecure protocols like SMB (NetBIOS or NBT(NetBIOS over TCP)) or IPX. For WebERP you may use https, a Public Key infraestructure system like those used by Banks. Q3) You will find a lot of information on the net regarding both VPN Standards as GRE (see IP Protocols from IANA), etc. and also Propietary (and no standard) Implementations as those made by Cisco Systems. Appendix The main 2 practical differences between using Windows XP PPTP or L2TP VPN Clients against using the Windows XP IPSec Client are: 1) the first two get an IP address from the remote LAN they are connecting to, whilst the latter retains its own Local Private IP Address. 2) IPsec is more secure. Regards, Javier de Lorenzo-Cáceres aese, aplicaciones software, s.l. Canary Islands - Spain ----- Original Message ----- From: "tlie" <thomas.lie@...> To: <web-erp-users@...> Sent: Friday, November 06, 2009 4:31 PM Subject: Re: [webERP-users] Security with VPN > > Thanks for your reply & info > Sorry for my late reply as i had a power blackout for the whole day > > i see from windows xp, it can easily setup vpn server & making a new > connection to vpn server > but it looks like it's using PPTP. > > 1) if say i decide to setup IPSEC with VPN server in ubuntu, > will it be easy for windows client to connect (just like PPTP)? > > 2) does anyone ever setup VPN for weberp? any available guide in the net? > > thanks, > tlie > > > > Javier de Lorenzo-Cáceres wrote: >> >> Hi T.Lie, >> >> Yes. You are right, that is exactly the most famous use of VPN. There are >> 3 levels of VPN Tunnels: 1) PPTP, 2) L2TP and 3) IPSEC. >> >> Nowadays only IPSEC (IP Security) is used. To explain it shortly, what it >> does is simply to encrypt the traffic between to IP nodes (tunneling is a >> metaphor). >> >> There are 2 different deployments called: 1) Point to Point and, 2) >> Roaming. >> >> Point to Point may be configured using: option 1) Certificates, option 2) >> Shared Keys. >> >> >> Regards, >> >> Javier de Lorenzo-Cáceres >> aese, aplicaciones software, s.l. >> Canary Islands - Spain >> >> ----- Original Message ----- >> From: Thomas Timothy Lie >> To: web-erp-users@... >> Sent: Friday, November 06, 2009 6:21 AM >> Subject: [webERP-users] Security with VPN >> >> >> Hi weberp community, >> >> is it possible to setup weberp securely with vpn? >> >> for example, if my weberp & apache webserver are at homei'd like people >> at the office can connect safely to home via vpn. then from there they >> can >> just type a local ip, eg. http://192.168.2.1 to access weberp. >> >> i'm quite new with vpn, so i'm not sure if that's right what can be >> achieved with vpn. if yes, anyone know the procedure to setup vpn server >> with ubuntu 9.10? >> >> thanks, >> tlie >> >> >> >> ------------------------------------------------------------------------------ >> >> >> >> ------------------------------------------------------------------------------ >> Let Crystal Reports handle the reporting - Free Crystal Reports 2008 >> 30-Day >> trial. Simplify your report design, integration and deployment - and >> focus on >> what you do best, core application coding. Discover what's new with >> Crystal Reports now. http://p.sf.net/sfu/bobj-july >> >> >> ------------------------------------------------------------------------------ >> >> >> _______________________________________________ >> web-ERP-users mailing list >> web-ERP-users@... >> https://lists.sourceforge.net/lists/listinfo/web-erp-users >> >> ------------------------------------------------------------------------------ >> Let Crystal Reports handle the reporting - Free Crystal Reports 2008 >> 30-Day >> trial. Simplify your report design, integration and deployment - and >> focus >> on >> what you do best, core application coding. Discover what's new with >> Crystal Reports now. http://p.sf.net/sfu/bobj-july >> _______________________________________________ >> web-ERP-users mailing list >> web-ERP-users@... >> https://lists.sourceforge.net/lists/listinfo/web-erp-users >> >> > > -- > View this message in context: > http://old.nabble.com/Security-with-VPN-tp26227459p26230817.html > Sent from the web-erp-users mailing list archive at Nabble.com. > > > ------------------------------------------------------------------------------ > Let Crystal Reports handle the reporting - Free Crystal Reports 2008 > 30-Day > trial. Simplify your report design, integration and deployment - and focus > on > what you do best, core application coding. Discover what's new with > Crystal Reports now. http://p.sf.net/sfu/bobj-july > _______________________________________________ > web-ERP-users mailing list > web-ERP-users@... > https://lists.sourceforge.net/lists/listinfo/web-erp-users > ------------------------------------------------------------------------------ Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day trial. Simplify your report design, integration and deployment - and focus on what you do best, core application coding. Discover what's new with Crystal Reports now. http://p.sf.net/sfu/bobj-july _______________________________________________ web-ERP-users mailing list web-ERP-users@... https://lists.sourceforge.net/lists/listinfo/web-erp-users |
|
|
Re: Security with VPNThe best way to ensure that communications and data is encrypted over
http is the secure sockets layer (SSL) - this just needs some configuration of your web-server and then calling the pages with https://your_web_server_domain/webERP/index.php There is a setting in webERP configuration that ensures that only https connections can be made from Setup->configuuration Settings Only allow secure socket connections: set to Yes You can also configure apache to only serve pages over SSL too. In my view it is appropriate to only use webERP over SSL all installs should be using it - since data going over the wire is otherwise visible to all and sundry! For the paranoid, you can also add http authentication to ensure that only valid users can access your web-server - this adds another layer of security over the built in webERP authentication. If users always connect from a particular machine (or from the same LAN that uses a proxy) then it is also possible to setup apache to allow from a specific IP address to bypass this second (http authentication) layer if the connection is from a friendly LAN or computer. Phil tlie wrote: > Thanks for your reply & info, Javier > Sorry for my late reply as i had a power blackout for the whole day > > i see from windows xp, it can easily setup vpn server & making a new > connection to vpn server > but it looks like it's using PPTP. > > 1) if say i decide to setup IPSEC with VPN server in ubuntu, > will it be easy for windows client to connect (just like PPTP)? > > 2) does anyone ever setup VPN for weberp? any available guide in the net? > > thanks, > tlie > > > > Javier de Lorenzo-Cáceres wrote: >> Hi T.Lie, >> >> Yes. You are right, that is exactly the most famous use of VPN. There are >> 3 levels of VPN Tunnels: 1) PPTP, 2) L2TP and 3) IPSEC. >> >> Nowadays only IPSEC (IP Security) is used. To explain it shortly, what it >> does is simply to encrypt the traffic between to IP nodes (tunneling is a >> metaphor). >> >> There are 2 different deployments called: 1) Point to Point and, 2) >> Roaming. >> >> Point to Point may be configured using: option 1) Certificates, option 2) >> Shared Keys. >> >> >> Regards, >> >> Javier de Lorenzo-Cáceres >> aese, aplicaciones software, s.l. >> Canary Islands - Spain >> >> ----- Original Message ----- >> From: Thomas Timothy Lie >> To: web-erp-users@... >> Sent: Friday, November 06, 2009 6:21 AM >> Subject: [webERP-users] Security with VPN >> >> >> Hi weberp community, >> >> is it possible to setup weberp securely with vpn? >> >> for example, if my weberp & apache webserver are at homei'd like people >> at the office can connect safely to home via vpn. then from there they can >> just type a local ip, eg. http://192.168.2.1 to access weberp. >> >> i'm quite new with vpn, so i'm not sure if that's right what can be >> achieved with vpn. if yes, anyone know the procedure to setup vpn server >> with ubuntu 9.10? >> >> thanks, >> tlie >> >> >> >> ------------------------------------------------------------------------------ >> >> >> >> ------------------------------------------------------------------------------ >> Let Crystal Reports handle the reporting - Free Crystal Reports 2008 >> 30-Day >> trial. Simplify your report design, integration and deployment - and >> focus on >> what you do best, core application coding. Discover what's new with >> Crystal Reports now. http://p.sf.net/sfu/bobj-july >> >> >> ------------------------------------------------------------------------------ >> >> >> _______________________________________________ >> web-ERP-users mailing list >> web-ERP-users@... >> https://lists.sourceforge.net/lists/listinfo/web-erp-users >> >> ------------------------------------------------------------------------------ >> Let Crystal Reports handle the reporting - Free Crystal Reports 2008 >> 30-Day >> trial. Simplify your report design, integration and deployment - and focus >> on >> what you do best, core application coding. Discover what's new with >> Crystal Reports now. http://p.sf.net/sfu/bobj-july >> _______________________________________________ >> web-ERP-users mailing list >> web-ERP-users@... >> https://lists.sourceforge.net/lists/listinfo/web-erp-users >> >> > ------------------------------------------------------------------------------ Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day trial. Simplify your report design, integration and deployment - and focus on what you do best, core application coding. Discover what's new with Crystal Reports now. http://p.sf.net/sfu/bobj-july _______________________________________________ web-ERP-users mailing list web-ERP-users@... https://lists.sourceforge.net/lists/listinfo/web-erp-users |
|
|
Re: Security with VPN@Javier, looks like setting up VPN is quite a challenging thing.
I'll try to set it up later, in the mean time I'll settle with https as Phil suggested but I'll definitely want to get it done, appreciate your detailed steps @Phil, I've setup openssl with my own self-signed certificate. A few issues: 1) with firefox, it comes up with warning "this connection is untrusted". then i just "add exception". is this way with self-signed certificate reliable? (this weberp is not used widely for big audience, only a few people from different location) 2) changed the configuration setting so that weberp is only thru secure socket, but when it tried to access, it doesn't have "add exception" button. does it mean that when this SSL config is on, only CA certificate can be used? thanks... PS: why on nabble forum, i can't see all the replies like i saw on sourceforge read-only? and i was warned in nabble that i was not subscribed to the mailing list, although i have tried to subscribe again now.... and i can't post reply from SF. so which forum/ mailing list is actually just nice to use? Thomas Timothy Lie
baliboss.com - Bali Open Source Solution |
|
|
Re: Security with VPNWell a self signed certificate is fine - since it is the encryption you
are after not really caring about proving that you are are yourself! To get the nasty messages to go away you need to go into the browser security settings and add the certificate authority as a trusted authority then in future the nasty messages disappear.i.e. it is configuration of the browser not webERP that is required. Phil tlie wrote: > @Javier, looks like setting up VPN is quite a challenging thing. > I'll try to set it up later, in the mean time I'll settle with https as Phil > suggested > but I'll definitely want to get it done, appreciate your detailed steps > > @Phil, I've setup openssl with my own self-signed certificate. A few issues: > 1) with firefox, it comes up with warning "this connection is untrusted". > then i just "add exception". is this way with self-signed certificate > reliable? > (this weberp is not used widely for big audience, only a few people from > different location) > 2) changed the configuration setting so that weberp is only thru secure > socket, > but when it tried to access, it doesn't have "add exception" button. does it > mean that when this SSL config is on, only CA certificate can be used? > > thanks... > PS: why on nabble forum, i can't see all the replies like i saw on > sourceforge read-only? > and i was warned in nabble that i was not subscribed to the mailing list, > although > i have tried to subscribe again now.... and i can't post reply from SF. so > which forum/ > mailing list is actually just nice to use? ------------------------------------------------------------------------------ Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day trial. Simplify your report design, integration and deployment - and focus on what you do best, core application coding. Discover what's new with Crystal Reports now. http://p.sf.net/sfu/bobj-july _______________________________________________ web-ERP-users mailing list web-ERP-users@... https://lists.sourceforge.net/lists/listinfo/web-erp-users |
|
|
Re: Security with VPNHi T.Lie,
Setting up VPN may be easy or not, it depends. It's only the Windows 2000/XP IPSec Client, which is not a dektop application. https and vpn are different things, https is the only way to go for public sites like internet shops or internet banks, you protect the data in traffic from sniffers, i.e., you reach data privacity but your server (and its login screen) is visible and the server may be reached, scanned and attacked by DOS and DDOS, or user/password (security is about several things). In fact, you will see the Apache log recording activity from bots. Also, the server must be accessed from the internet using a public IP, not the private IP you refered in your first post. In the same way that https may be used instead http, you may use ssh instead telnet or sftp instead ftp, but not all the protocols have its secure-brother, for example, NBT or NFS, for which you will need to replace them with WebDAV. vpn is another story, you don't need to secure every service but you may do it, you may use https, ssh or sftp along with vpn. But the important thing is that you may hide your server to the internet (see Steve Gibson Research grc.com) and use it like if it was in your local LAN, only the people allowed by you, will be able to see and connect to your server from the internet. With vpn you have the best of both worlds because you always may decide to open your server to the internet with almost one click, and also intermadiate states are possible, since a rich level 7 firewall is provided. It's this firewall between Internet and your server what makes the difference. For the rest, only to say that the Firefox "add exception" offers two options: Temporary and Permanent. Maybe you didn't realize and selected Permanent and that is the reason that you misrelated the change to WebERP config with the fact that the Firefox dialog is not appearing any more ;-) Warmest regards, Javier de Lorenzo-Cáceres aese, aplicaciones software, s.l. Canary Islands - Spain ----- Original Message ----- From: "Phil Daintree" <phil@...> > Well a self signed certificate is fine - since it is the encryption you > are after not really caring about proving that you are are yourself! > > To get the nasty messages to go away you need to go into the browser > security settings and add the certificate authority as a trusted > authority then in future the nasty messages disappear.i.e. it is > configuration of the browser not webERP that is required. > > Phil > > tlie wrote: >> @Javier, looks like setting up VPN is quite a challenging thing. >> I'll try to set it up later, in the mean time I'll settle with https as >> Phil >> suggested >> but I'll definitely want to get it done, appreciate your detailed steps >> >> @Phil, I've setup openssl with my own self-signed certificate. A few >> issues: >> 1) with firefox, it comes up with warning "this connection is untrusted". >> then i just "add exception". is this way with self-signed certificate >> reliable? >> (this weberp is not used widely for big audience, only a few people from >> different location) >> 2) changed the configuration setting so that weberp is only thru secure >> socket, >> but when it tried to access, it doesn't have "add exception" button. does >> it >> mean that when this SSL config is on, only CA certificate can be used? >> >> thanks... >> PS: why on nabble forum, i can't see all the replies like i saw on >> sourceforge read-only? >> and i was warned in nabble that i was not subscribed to the mailing list, >> although >> i have tried to subscribe again now.... and i can't post reply from SF. >> so >> which forum/ >> mailing list is actually just nice to use? > > ------------------------------------------------------------------------------ > Let Crystal Reports handle the reporting - Free Crystal Reports 2008 > 30-Day > trial. Simplify your report design, integration and deployment - and focus > on > what you do best, core application coding. Discover what's new with > Crystal Reports now. http://p.sf.net/sfu/bobj-july > _______________________________________________ > web-ERP-users mailing list > web-ERP-users@... > https://lists.sourceforge.net/lists/listinfo/web-erp-users ------------------------------------------------------------------------------ Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day trial. Simplify your report design, integration and deployment - and focus on what you do best, core application coding. Discover what's new with Crystal Reports now. http://p.sf.net/sfu/bobj-july _______________________________________________ web-ERP-users mailing list web-ERP-users@... https://lists.sourceforge.net/lists/listinfo/web-erp-users |
|
|
Re: Security with VPNHi Phil,
I've implemented https & authentication as you suggested i'm using the mysql method, accessing the same weberp usernames & paswords the reason i woud like this authentication is so that search engine will not index all my weberp files. is there anyway i can bypass the weberp login screen then? (pass the info user types in, then go straight to the main menu?) thanks... Thomas
Thomas Timothy Lie
baliboss.com - Bali Open Source Solution |
|
|
Re: Security with VPNNo
Thomas Timothy Lie wrote: > Hi Phil, > > I've implemented https & authentication as you suggested > i'm using the mysql method, accessing the same weberp usernames & paswords > the reason i woud like this authentication is so that search > engine will not index all my weberp files. > is there anyway i can bypass the weberp login screen then? > (pass the info user types in, then go straight to the main menu?) > > thanks... > Thomas > > > > Phil Daintree-3 wrote: > >> For the paranoid, you can also add http authentication to ensure that >> only valid users can access your web-server - this adds another layer of >> security over the built in webERP authentication. If users always >> connect from a particular machine (or from the same LAN that uses a >> proxy) then it is also possible to setup apache to allow from a specific >> IP address to bypass this second (http authentication) layer if the >> connection is from a friendly LAN or computer. >> >> Phil >> >> >> > > > ----- > Thomas Timothy Lie > baliboss.com - Bali Open Source Solution > ------------------------------------------------------------------------------ Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day trial. Simplify your report design, integration and deployment - and focus on what you do best, core application coding. Discover what's new with Crystal Reports now. http://p.sf.net/sfu/bobj-july _______________________________________________ web-ERP-users mailing list web-ERP-users@... https://lists.sourceforge.net/lists/listinfo/web-erp-users |
|
|
Re: Security with VPNHi Thomas,
Search engines only follow links, so they can't index your WebERP pages. The only page linked is the main page (DNS -> IP -> index.php) and if you have protected the main page you have hidden the index page behind the handshake dialog. regards, javier ----- Original Message ----- From: "Phil Daintree" <phil@...> To: "For the general discussion of webERP project" <web-erp-users@...> Sent: Saturday, November 14, 2009 5:41 AM Subject: Re: [webERP-users] Security with VPN > No > > Thomas Timothy Lie wrote: >> Hi Phil, >> >> I've implemented https & authentication as you suggested >> i'm using the mysql method, accessing the same weberp usernames & >> paswords >> the reason i woud like this authentication is so that search >> engine will not index all my weberp files. >> is there anyway i can bypass the weberp login screen then? >> (pass the info user types in, then go straight to the main menu?) >> >> thanks... >> Thomas >> >> >> >> Phil Daintree-3 wrote: >> >>> For the paranoid, you can also add http authentication to ensure that >>> only valid users can access your web-server - this adds another layer of >>> security over the built in webERP authentication. If users always >>> connect from a particular machine (or from the same LAN that uses a >>> proxy) then it is also possible to setup apache to allow from a specific >>> IP address to bypass this second (http authentication) layer if the >>> connection is from a friendly LAN or computer. >>> >>> Phil >>> >>> >>> >> >> >> ----- >> Thomas Timothy Lie >> baliboss.com - Bali Open Source Solution >> > > > ------------------------------------------------------------------------------ > Let Crystal Reports handle the reporting - Free Crystal Reports 2008 > 30-Day > trial. Simplify your report design, integration and deployment - and focus > on > what you do best, core application coding. Discover what's new with > Crystal Reports now. http://p.sf.net/sfu/bobj-july > _______________________________________________ > web-ERP-users mailing list > web-ERP-users@... > https://lists.sourceforge.net/lists/listinfo/web-erp-users ------------------------------------------------------------------------------ Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day trial. Simplify your report design, integration and deployment - and focus on what you do best, core application coding. Discover what's new with Crystal Reports now. http://p.sf.net/sfu/bobj-july _______________________________________________ web-ERP-users mailing list web-ERP-users@... https://lists.sourceforge.net/lists/listinfo/web-erp-users |
| Free embeddable forum powered by Nabble | Forum Help |