Security with VPN

View: New views
12 Messages — Rating Filter:   Alert me  

Security with VPN

by Thomas Timothy Lie :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

Hi weberp community,

is it possible to setup weberp securely with vpn?

for example, if my weberp & apache webserver are at homei'd like people at the office can connect safely to home via vpn. then from there they can just type a local ip, eg. http://192.168.2.1 to access weberp.

i'm quite new with vpn, so i'm not sure if that's right what can be achieved with vpn. if yes, anyone know the procedure to setup vpn server with ubuntu 9.10?

thanks,
tlie

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now.  http://p.sf.net/sfu/bobj-july
_______________________________________________
web-ERP-users mailing list
web-ERP-users@...
https://lists.sourceforge.net/lists/listinfo/web-erp-users
Thomas Timothy Lie
baliboss.com - Bali Open Source Solution

Re: Security with VPN

by Javier de Lorenzo-Cáceres :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

Some parts of this message have been removed. Learn more about Nabble's security policy.
Hi T.Lie,
 
Yes. You are right, that is exactly the most famous use of VPN. There are 3 levels of VPN Tunnels: 1) PPTP, 2) L2TP and 3) IPSEC.
 
Nowadays only IPSEC (IP Security) is used. To explain it shortly, what it does is simply to encrypt the traffic between to IP nodes (tunneling is a metaphor).
 
There are 2 different deployments called: 1) Point to Point and, 2) Roaming.
 
Point to Point may be configured using: option 1) Certificates, option 2) Shared Keys.
 
 
Regards,
 
Javier de Lorenzo-Cáceres
aese, aplicaciones software, s.l.
Canary Islands - Spain
 
----- Original Message -----
Sent: Friday, November 06, 2009 6:21 AM
Subject: [webERP-users] Security with VPN

Hi weberp community,

is it possible to setup weberp securely with vpn?

for example, if my weberp & apache webserver are at homei'd like people at the office can connect safely to home via vpn. then from there they can just type a local ip, eg. http://192.168.2.1 to access weberp.

i'm quite new with vpn, so i'm not sure if that's right what can be achieved with vpn. if yes, anyone know the procedure to setup vpn server with ubuntu 9.10?

thanks,
tlie


------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now.  http://p.sf.net/sfu/bobj-july


_______________________________________________
web-ERP-users mailing list
web-ERP-users@...
https://lists.sourceforge.net/lists/listinfo/web-erp-users

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now.  http://p.sf.net/sfu/bobj-july
_______________________________________________
web-ERP-users mailing list
web-ERP-users@...
https://lists.sourceforge.net/lists/listinfo/web-erp-users

Re: Security with VPN

by Thomas Timothy Lie :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

Thanks for your reply & info
Sorry for my late reply as i had a power blackout for the whole day

i see from windows xp, it can easily setup vpn server & making a new connection to vpn server
but it looks like it's using PPTP.

1) if say i decide to setup IPSEC with VPN server in ubuntu,
will it be easy for windows client to connect (just like PPTP)?

2) does anyone ever setup VPN for weberp? any available guide in the net?

thanks,
tlie


Javier de Lorenzo-Cáceres wrote:
Hi T.Lie,

Yes. You are right, that is exactly the most famous use of VPN. There are 3 levels of VPN Tunnels: 1) PPTP, 2) L2TP and 3) IPSEC.

Nowadays only IPSEC (IP Security) is used. To explain it shortly, what it does is simply to encrypt the traffic between to IP nodes (tunneling is a metaphor).

There are 2 different deployments called: 1) Point to Point and, 2) Roaming.

Point to Point may be configured using: option 1) Certificates, option 2) Shared Keys.
 

Regards,

Javier de Lorenzo-Cáceres
aese, aplicaciones software, s.l.
Canary Islands - Spain

  ----- Original Message -----
  From: Thomas Timothy Lie
  To: web-erp-users@lists.sourceforge.net
  Sent: Friday, November 06, 2009 6:21 AM
  Subject: [webERP-users] Security with VPN


  Hi weberp community,

  is it possible to setup weberp securely with vpn?

  for example, if my weberp & apache webserver are at homei'd like people at the office can connect safely to home via vpn. then from there they can just type a local ip, eg. http://192.168.2.1 to access weberp.

  i'm quite new with vpn, so i'm not sure if that's right what can be achieved with vpn. if yes, anyone know the procedure to setup vpn server with ubuntu 9.10?

  thanks,
  tlie



------------------------------------------------------------------------------


  ------------------------------------------------------------------------------
  Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
  trial. Simplify your report design, integration and deployment - and focus on
  what you do best, core application coding. Discover what's new with
  Crystal Reports now.  http://p.sf.net/sfu/bobj-july


------------------------------------------------------------------------------


  _______________________________________________
  web-ERP-users mailing list
  web-ERP-users@lists.sourceforge.net
  https://lists.sourceforge.net/lists/listinfo/web-erp-users

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now.  http://p.sf.net/sfu/bobj-july
_______________________________________________
web-ERP-users mailing list
web-ERP-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/web-erp-users
Thomas Timothy Lie
baliboss.com - Bali Open Source Solution

Re: Security with VPN

by Thomas Timothy Lie :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

Thanks for your reply & info, Javier
Sorry for my late reply as i had a power blackout for the whole day

i see from windows xp, it can easily setup vpn server & making a new connection to vpn server
but it looks like it's using PPTP.

1) if say i decide to setup IPSEC with VPN server in ubuntu,
will it be easy for windows client to connect (just like PPTP)?

2) does anyone ever setup VPN for weberp? any available guide in the net?

thanks,
tlie


Javier de Lorenzo-Cáceres wrote:
Hi T.Lie,

Yes. You are right, that is exactly the most famous use of VPN. There are 3 levels of VPN Tunnels: 1) PPTP, 2) L2TP and 3) IPSEC.

Nowadays only IPSEC (IP Security) is used. To explain it shortly, what it does is simply to encrypt the traffic between to IP nodes (tunneling is a metaphor).

There are 2 different deployments called: 1) Point to Point and, 2) Roaming.

Point to Point may be configured using: option 1) Certificates, option 2) Shared Keys.
 

Regards,

Javier de Lorenzo-Cáceres
aese, aplicaciones software, s.l.
Canary Islands - Spain

  ----- Original Message -----
  From: Thomas Timothy Lie
  To: web-erp-users@lists.sourceforge.net
  Sent: Friday, November 06, 2009 6:21 AM
  Subject: [webERP-users] Security with VPN


  Hi weberp community,

  is it possible to setup weberp securely with vpn?

  for example, if my weberp & apache webserver are at homei'd like people at the office can connect safely to home via vpn. then from there they can just type a local ip, eg. http://192.168.2.1 to access weberp.

  i'm quite new with vpn, so i'm not sure if that's right what can be achieved with vpn. if yes, anyone know the procedure to setup vpn server with ubuntu 9.10?

  thanks,
  tlie



------------------------------------------------------------------------------


  ------------------------------------------------------------------------------
  Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
  trial. Simplify your report design, integration and deployment - and focus on
  what you do best, core application coding. Discover what's new with
  Crystal Reports now.  http://p.sf.net/sfu/bobj-july


------------------------------------------------------------------------------


  _______________________________________________
  web-ERP-users mailing list
  web-ERP-users@lists.sourceforge.net
  https://lists.sourceforge.net/lists/listinfo/web-erp-users

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now.  http://p.sf.net/sfu/bobj-july
_______________________________________________
web-ERP-users mailing list
web-ERP-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/web-erp-users
Thomas Timothy Lie
baliboss.com - Bali Open Source Solution

Re: Security with VPN

by Javier de Lorenzo-Cáceres :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

Hi T. Lie

> i see from windows xp, it can easily setup vpn server & making a new
> connection to vpn server
> but it looks like it's using PPTP.

Windows XP can also make IPSec Tunneling because Microsoft bought the
necessary Windows IPSec implementation license to Cisco. To configure it,
the user must do it through Local Security Policies under Administrative
Tools (the Cisco copyright is shown), but not through Network Connections.

Through Network Connections, the user may configure the VPN Client to use
PPTP or L2TP, but Microsoft limited the use of L2TP to Certificates.

(Note that any of the above three cases are Clients, not Servers. A server
is designed to listen to client requests and accept or reject them following
an Access Control List (ACL) and a certain quantity of tunnels)

For your questions:

Q1) No, the Windows XP IPSec Client it's not intuitive or assisted, even
more, the GUI for that subject is not very good, so you must know very well
what you are doing, i.e., less than being guided you will be confused even
for the subjects you may known well. I did it to a D-Link NetDefend DFL-700,
it works, it's very slow (keepalives doesn't seem up and running), then I
bought another D-Link NetDefend DFL-200. But I, despite the fact of being a
Cisco partner, will recommend you a Cisco 1801-K9 for server and a 857 for
every remote LAN and Cisco VPN Client software for Roaming users, an
excellent software. D-Link sell the client software apart and it's very odd.
Also, you will find two implementations that can work as Ciso VPN clients
for Linux. The another BIG is Cytrix. I've tested all the most famous
software, including (in alphabetical order) Checkpoint, Clavister (the one
licensed to be used by D-Link), Kiwi, Nortel, SafeNet, GreenBow, etc. Also
you may find some hardware servers from 3Com, Symantec and others. Linux is
right as server and client, but VPN is close related to Public IP and
firewalls so they are good in the perimeter and I prefer WebERP in the
Back-Office, so, for this setup two boxes are needed.

Q2) VPN is like a network connection, it's not related to server, clients or
peer to peer applications, once up and running is like an UTP Network Cable.
As you well said, it permits to see the private remote LAN as if it was
connected directly to the local network, hence the term Private; it's
Virtual because indeed it's an Internet connection but since it's being
crypted with only Private Keys or Certificates, nobody else can have access
to it.

Once you have a VPN connection up and running, you will find it transparent
to all protocols. Indeed VPN is more useful to unsecure protocols like SMB
(NetBIOS or NBT(NetBIOS over TCP)) or IPX. For WebERP you may use https, a
Public Key infraestructure system like those used by Banks.


Q3) You will find a lot of information on the net regarding both VPN
Standards as GRE (see IP Protocols from IANA), etc. and also Propietary (and
no standard) Implementations as those made by Cisco Systems.

Appendix
The main 2 practical differences between using Windows XP PPTP or L2TP VPN
Clients against using the Windows XP IPSec Client are:
1) the first two get an IP address from the remote LAN they are connecting
to, whilst the latter retains its own Local Private IP Address.
2) IPsec is more secure.

Regards,
Javier de Lorenzo-Cáceres
aese, aplicaciones software, s.l.
Canary Islands - Spain


----- Original Message -----
From: "tlie" <thomas.lie@...>
To: <web-erp-users@...>
Sent: Friday, November 06, 2009 4:31 PM
Subject: Re: [webERP-users] Security with VPN


>
> Thanks for your reply & info
> Sorry for my late reply as i had a power blackout for the whole day
>
> i see from windows xp, it can easily setup vpn server & making a new
> connection to vpn server
> but it looks like it's using PPTP.
>
> 1) if say i decide to setup IPSEC with VPN server in ubuntu,
> will it be easy for windows client to connect (just like PPTP)?
>
> 2) does anyone ever setup VPN for weberp? any available guide in the net?
>
> thanks,
> tlie
>
>
>
> Javier de Lorenzo-Cáceres wrote:
>>
>> Hi T.Lie,
>>
>> Yes. You are right, that is exactly the most famous use of VPN. There are
>> 3 levels of VPN Tunnels: 1) PPTP, 2) L2TP and 3) IPSEC.
>>
>> Nowadays only IPSEC (IP Security) is used. To explain it shortly, what it
>> does is simply to encrypt the traffic between to IP nodes (tunneling is a
>> metaphor).
>>
>> There are 2 different deployments called: 1) Point to Point and, 2)
>> Roaming.
>>
>> Point to Point may be configured using: option 1) Certificates, option 2)
>> Shared Keys.
>>
>>
>> Regards,
>>
>> Javier de Lorenzo-Cáceres
>> aese, aplicaciones software, s.l.
>> Canary Islands - Spain
>>
>>   ----- Original Message -----
>>   From: Thomas Timothy Lie
>>   To: web-erp-users@...
>>   Sent: Friday, November 06, 2009 6:21 AM
>>   Subject: [webERP-users] Security with VPN
>>
>>
>>   Hi weberp community,
>>
>>   is it possible to setup weberp securely with vpn?
>>
>>   for example, if my weberp & apache webserver are at homei'd like people
>> at the office can connect safely to home via vpn. then from there they
>> can
>> just type a local ip, eg. http://192.168.2.1 to access weberp.
>>
>>   i'm quite new with vpn, so i'm not sure if that's right what can be
>> achieved with vpn. if yes, anyone know the procedure to setup vpn server
>> with ubuntu 9.10?
>>
>>   thanks,
>>   tlie
>>
>>
>>
>> ------------------------------------------------------------------------------
>>
>>
>>
>> ------------------------------------------------------------------------------
>>   Let Crystal Reports handle the reporting - Free Crystal Reports 2008
>> 30-Day
>>   trial. Simplify your report design, integration and deployment - and
>> focus on
>>   what you do best, core application coding. Discover what's new with
>>   Crystal Reports now.  http://p.sf.net/sfu/bobj-july
>>
>>
>> ------------------------------------------------------------------------------
>>
>>
>>   _______________________________________________
>>   web-ERP-users mailing list
>>   web-ERP-users@...
>>   https://lists.sourceforge.net/lists/listinfo/web-erp-users
>>
>> ------------------------------------------------------------------------------
>> Let Crystal Reports handle the reporting - Free Crystal Reports 2008
>> 30-Day
>> trial. Simplify your report design, integration and deployment - and
>> focus
>> on
>> what you do best, core application coding. Discover what's new with
>> Crystal Reports now.  http://p.sf.net/sfu/bobj-july
>> _______________________________________________
>> web-ERP-users mailing list
>> web-ERP-users@...
>> https://lists.sourceforge.net/lists/listinfo/web-erp-users
>>
>>
>
> --
> View this message in context:
> http://old.nabble.com/Security-with-VPN-tp26227459p26230817.html
> Sent from the web-erp-users mailing list archive at Nabble.com.
>
>
> ------------------------------------------------------------------------------
> Let Crystal Reports handle the reporting - Free Crystal Reports 2008
> 30-Day
> trial. Simplify your report design, integration and deployment - and focus
> on
> what you do best, core application coding. Discover what's new with
> Crystal Reports now.  http://p.sf.net/sfu/bobj-july
> _______________________________________________
> web-ERP-users mailing list
> web-ERP-users@...
> https://lists.sourceforge.net/lists/listinfo/web-erp-users
>


------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now.  http://p.sf.net/sfu/bobj-july
_______________________________________________
web-ERP-users mailing list
web-ERP-users@...
https://lists.sourceforge.net/lists/listinfo/web-erp-users

Re: Security with VPN

by Phil Daintree-3 :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

The best way to ensure that communications and data is encrypted over
http is the secure sockets layer (SSL) - this just needs some
configuration of your web-server and then calling the pages with

https://your_web_server_domain/webERP/index.php

There is a setting in webERP configuration that ensures that only https
connections can be made from

Setup->configuuration Settings

Only allow secure socket connections: set to Yes

You can also configure apache to only serve pages over SSL too.

In my view it is appropriate to only use webERP over SSL all installs
should be using it - since data going over the wire is otherwise visible
to all and sundry!

For the paranoid, you can also add http authentication to ensure that
only valid users can access your web-server - this adds another layer of
security over the built in webERP authentication. If users always
connect from a particular machine (or from the same LAN that uses a
proxy) then it is also possible to setup apache to allow from a specific
IP address to bypass this second (http authentication) layer if the
connection is from a friendly LAN or computer.

Phil

tlie wrote:

> Thanks for your reply & info, Javier
> Sorry for my late reply as i had a power blackout for the whole day
>
> i see from windows xp, it can easily setup vpn server & making a new
> connection to vpn server
> but it looks like it's using PPTP.
>
> 1) if say i decide to setup IPSEC with VPN server in ubuntu,
> will it be easy for windows client to connect (just like PPTP)?
>
> 2) does anyone ever setup VPN for weberp? any available guide in the net?
>
> thanks,
> tlie
>
>
>
> Javier de Lorenzo-Cáceres wrote:
>> Hi T.Lie,
>>
>> Yes. You are right, that is exactly the most famous use of VPN. There are
>> 3 levels of VPN Tunnels: 1) PPTP, 2) L2TP and 3) IPSEC.
>>
>> Nowadays only IPSEC (IP Security) is used. To explain it shortly, what it
>> does is simply to encrypt the traffic between to IP nodes (tunneling is a
>> metaphor).
>>
>> There are 2 different deployments called: 1) Point to Point and, 2)
>> Roaming.
>>
>> Point to Point may be configured using: option 1) Certificates, option 2)
>> Shared Keys.
>>  
>>
>> Regards,
>>
>> Javier de Lorenzo-Cáceres
>> aese, aplicaciones software, s.l.
>> Canary Islands - Spain
>>
>>   ----- Original Message -----
>>   From: Thomas Timothy Lie
>>   To: web-erp-users@...
>>   Sent: Friday, November 06, 2009 6:21 AM
>>   Subject: [webERP-users] Security with VPN
>>
>>
>>   Hi weberp community,
>>
>>   is it possible to setup weberp securely with vpn?
>>
>>   for example, if my weberp & apache webserver are at homei'd like people
>> at the office can connect safely to home via vpn. then from there they can
>> just type a local ip, eg. http://192.168.2.1 to access weberp.
>>
>>   i'm quite new with vpn, so i'm not sure if that's right what can be
>> achieved with vpn. if yes, anyone know the procedure to setup vpn server
>> with ubuntu 9.10?
>>
>>   thanks,
>>   tlie
>>
>>
>>
>> ------------------------------------------------------------------------------
>>
>>
>>  
>> ------------------------------------------------------------------------------
>>   Let Crystal Reports handle the reporting - Free Crystal Reports 2008
>> 30-Day
>>   trial. Simplify your report design, integration and deployment - and
>> focus on
>>   what you do best, core application coding. Discover what's new with
>>   Crystal Reports now.  http://p.sf.net/sfu/bobj-july
>>
>>
>> ------------------------------------------------------------------------------
>>
>>
>>   _______________________________________________
>>   web-ERP-users mailing list
>>   web-ERP-users@...
>>   https://lists.sourceforge.net/lists/listinfo/web-erp-users
>>
>> ------------------------------------------------------------------------------
>> Let Crystal Reports handle the reporting - Free Crystal Reports 2008
>> 30-Day
>> trial. Simplify your report design, integration and deployment - and focus
>> on
>> what you do best, core application coding. Discover what's new with
>> Crystal Reports now.  http://p.sf.net/sfu/bobj-july
>> _______________________________________________
>> web-ERP-users mailing list
>> web-ERP-users@...
>> https://lists.sourceforge.net/lists/listinfo/web-erp-users
>>
>>
>

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now.  http://p.sf.net/sfu/bobj-july
_______________________________________________
web-ERP-users mailing list
web-ERP-users@...
https://lists.sourceforge.net/lists/listinfo/web-erp-users

Re: Security with VPN

by Thomas Timothy Lie :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

@Javier, looks like setting up VPN is quite a challenging thing.
I'll try to set it up later, in the mean time I'll settle with https as Phil suggested
but I'll definitely want to get it done, appreciate your detailed steps

@Phil, I've setup openssl with my own self-signed certificate. A few issues:
1) with firefox, it comes up with warning "this connection is untrusted".
then i just "add exception". is this way with self-signed certificate reliable?
(this weberp is not used widely for big audience, only a few people from different location)
2) changed the configuration setting so that weberp is only thru secure socket,
but when it tried to access, it doesn't have "add exception" button. does it
mean that when this SSL config is on, only CA certificate can be used?

thanks...
PS: why on nabble forum, i can't see all the replies like i saw on sourceforge read-only?
and i was warned in nabble that i was not subscribed to the mailing list, although
i have tried to subscribe again now.... and i can't post reply from SF. so which forum/
mailing list is actually just nice to use?
Thomas Timothy Lie
baliboss.com - Bali Open Source Solution

Re: Security with VPN

by Phil Daintree-3 :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

Well a self signed certificate is fine - since it is the encryption you
are after not really caring about proving that you are are yourself!

To get the nasty messages to go away you need to go into the browser
security settings and add the certificate authority as a trusted
authority then in future the nasty messages disappear.i.e. it is
configuration of the browser not webERP that is required.

Phil

tlie wrote:

> @Javier, looks like setting up VPN is quite a challenging thing.
> I'll try to set it up later, in the mean time I'll settle with https as Phil
> suggested
> but I'll definitely want to get it done, appreciate your detailed steps
>
> @Phil, I've setup openssl with my own self-signed certificate. A few issues:
> 1) with firefox, it comes up with warning "this connection is untrusted".
> then i just "add exception". is this way with self-signed certificate
> reliable?
> (this weberp is not used widely for big audience, only a few people from
> different location)
> 2) changed the configuration setting so that weberp is only thru secure
> socket,
> but when it tried to access, it doesn't have "add exception" button. does it
> mean that when this SSL config is on, only CA certificate can be used?
>
> thanks...
> PS: why on nabble forum, i can't see all the replies like i saw on
> sourceforge read-only?
> and i was warned in nabble that i was not subscribed to the mailing list,
> although
> i have tried to subscribe again now.... and i can't post reply from SF. so
> which forum/
> mailing list is actually just nice to use?

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now.  http://p.sf.net/sfu/bobj-july
_______________________________________________
web-ERP-users mailing list
web-ERP-users@...
https://lists.sourceforge.net/lists/listinfo/web-erp-users

Re: Security with VPN

by Javier de Lorenzo-Cáceres :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

Hi T.Lie,

Setting up VPN may be easy or not, it depends. It's only the Windows 2000/XP
IPSec Client, which is not a dektop application.

https and vpn are different things,

https is the only way to go for public sites like internet shops or internet
banks, you protect the data in traffic from sniffers, i.e., you reach data
privacity but your server (and its login screen) is visible and the server
may be reached, scanned and attacked by DOS and DDOS, or user/password
(security is about several things). In fact, you will see the Apache log
recording activity from bots. Also, the server must be accessed from the
internet using a public IP, not the private IP you refered in your first
post.

In the same way that https may be used instead http, you may use ssh instead
telnet or sftp instead ftp, but not all the protocols have its
secure-brother, for example, NBT or NFS, for which you will need to replace
them with WebDAV.

vpn is another story, you don't need to secure every service but you may do
it, you may use https, ssh or sftp along with vpn. But the important thing
is that you may hide your server to the internet (see Steve Gibson Research
grc.com) and use it like if it was in your local LAN, only the people
allowed by you, will be able to see and connect to your server from the
internet.

With vpn you have the best of both worlds because you always may decide to
open your server to the internet with almost one click, and also
intermadiate states are possible, since a rich level 7 firewall is provided.
It's this firewall between Internet and your server what makes the
difference.

For the rest, only to say that the Firefox "add exception" offers two
options: Temporary and Permanent. Maybe you didn't realize and selected
Permanent and that is the reason that you misrelated the change to WebERP
config with the fact that the Firefox dialog is not appearing any more ;-)

Warmest regards,
Javier de Lorenzo-Cáceres
aese, aplicaciones software, s.l.
Canary Islands - Spain


----- Original Message -----
From: "Phil Daintree" <phil@...>

> Well a self signed certificate is fine - since it is the encryption you
> are after not really caring about proving that you are are yourself!
>
> To get the nasty messages to go away you need to go into the browser
> security settings and add the certificate authority as a trusted
> authority then in future the nasty messages disappear.i.e. it is
> configuration of the browser not webERP that is required.
>
> Phil
>
> tlie wrote:
>> @Javier, looks like setting up VPN is quite a challenging thing.
>> I'll try to set it up later, in the mean time I'll settle with https as
>> Phil
>> suggested
>> but I'll definitely want to get it done, appreciate your detailed steps
>>
>> @Phil, I've setup openssl with my own self-signed certificate. A few
>> issues:
>> 1) with firefox, it comes up with warning "this connection is untrusted".
>> then i just "add exception". is this way with self-signed certificate
>> reliable?
>> (this weberp is not used widely for big audience, only a few people from
>> different location)
>> 2) changed the configuration setting so that weberp is only thru secure
>> socket,
>> but when it tried to access, it doesn't have "add exception" button. does
>> it
>> mean that when this SSL config is on, only CA certificate can be used?
>>
>> thanks...
>> PS: why on nabble forum, i can't see all the replies like i saw on
>> sourceforge read-only?
>> and i was warned in nabble that i was not subscribed to the mailing list,
>> although
>> i have tried to subscribe again now.... and i can't post reply from SF.
>> so
>> which forum/
>> mailing list is actually just nice to use?
>
> ------------------------------------------------------------------------------
> Let Crystal Reports handle the reporting - Free Crystal Reports 2008
> 30-Day
> trial. Simplify your report design, integration and deployment - and focus
> on
> what you do best, core application coding. Discover what's new with
> Crystal Reports now.  http://p.sf.net/sfu/bobj-july
> _______________________________________________
> web-ERP-users mailing list
> web-ERP-users@...
> https://lists.sourceforge.net/lists/listinfo/web-erp-users 


------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now.  http://p.sf.net/sfu/bobj-july
_______________________________________________
web-ERP-users mailing list
web-ERP-users@...
https://lists.sourceforge.net/lists/listinfo/web-erp-users

Re: Security with VPN

by Thomas Timothy Lie :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

Hi Phil,

I've implemented https & authentication as you suggested
i'm using the mysql method, accessing the same weberp usernames & paswords
the reason i woud like this authentication is so that search
engine will not index all my weberp files.
is there anyway i can bypass the weberp login screen then?
(pass the info user types in, then go straight to the main menu?)

thanks...
Thomas


Phil Daintree-3 wrote:
For the paranoid, you can also add http authentication to ensure that
only valid users can access your web-server - this adds another layer of
security over the built in webERP authentication. If users always
connect from a particular machine (or from the same LAN that uses a
proxy) then it is also possible to setup apache to allow from a specific
IP address to bypass this second (http authentication) layer if the
connection is from a friendly LAN or computer.

Phil
Thomas Timothy Lie
baliboss.com - Bali Open Source Solution

Re: Security with VPN

by Phil Daintree-3 :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

No

Thomas Timothy Lie wrote:

> Hi Phil,
>
> I've implemented https & authentication as you suggested
> i'm using the mysql method, accessing the same weberp usernames & paswords
> the reason i woud like this authentication is so that search
> engine will not index all my weberp files.
> is there anyway i can bypass the weberp login screen then?
> (pass the info user types in, then go straight to the main menu?)
>
> thanks...
> Thomas
>
>
>
> Phil Daintree-3 wrote:
>  
>> For the paranoid, you can also add http authentication to ensure that
>> only valid users can access your web-server - this adds another layer of
>> security over the built in webERP authentication. If users always
>> connect from a particular machine (or from the same LAN that uses a
>> proxy) then it is also possible to setup apache to allow from a specific
>> IP address to bypass this second (http authentication) layer if the
>> connection is from a friendly LAN or computer.
>>
>> Phil
>>
>>
>>    
>
>
> -----
> Thomas Timothy Lie
> baliboss.com - Bali Open Source Solution
>  


------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now.  http://p.sf.net/sfu/bobj-july
_______________________________________________
web-ERP-users mailing list
web-ERP-users@...
https://lists.sourceforge.net/lists/listinfo/web-erp-users

Re: Security with VPN

by Javier de Lorenzo-Cáceres :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

Hi Thomas,

Search engines only follow links, so they can't index your WebERP pages. The
only page linked is the main page (DNS -> IP -> index.php) and if you have
protected the main page you have hidden the index page behind the handshake
dialog.

regards,
javier

----- Original Message -----
From: "Phil Daintree" <phil@...>
To: "For the general discussion of webERP project"
<web-erp-users@...>
Sent: Saturday, November 14, 2009 5:41 AM
Subject: Re: [webERP-users] Security with VPN


> No
>
> Thomas Timothy Lie wrote:
>> Hi Phil,
>>
>> I've implemented https & authentication as you suggested
>> i'm using the mysql method, accessing the same weberp usernames &
>> paswords
>> the reason i woud like this authentication is so that search
>> engine will not index all my weberp files.
>> is there anyway i can bypass the weberp login screen then?
>> (pass the info user types in, then go straight to the main menu?)
>>
>> thanks...
>> Thomas
>>
>>
>>
>> Phil Daintree-3 wrote:
>>
>>> For the paranoid, you can also add http authentication to ensure that
>>> only valid users can access your web-server - this adds another layer of
>>> security over the built in webERP authentication. If users always
>>> connect from a particular machine (or from the same LAN that uses a
>>> proxy) then it is also possible to setup apache to allow from a specific
>>> IP address to bypass this second (http authentication) layer if the
>>> connection is from a friendly LAN or computer.
>>>
>>> Phil
>>>
>>>
>>>
>>
>>
>> -----
>> Thomas Timothy Lie
>> baliboss.com - Bali Open Source Solution
>>
>
>
> ------------------------------------------------------------------------------
> Let Crystal Reports handle the reporting - Free Crystal Reports 2008
> 30-Day
> trial. Simplify your report design, integration and deployment - and focus
> on
> what you do best, core application coding. Discover what's new with
> Crystal Reports now.  http://p.sf.net/sfu/bobj-july
> _______________________________________________
> web-ERP-users mailing list
> web-ERP-users@...
> https://lists.sourceforge.net/lists/listinfo/web-erp-users 


------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now.  http://p.sf.net/sfu/bobj-july
_______________________________________________
web-ERP-users mailing list
web-ERP-users@...
https://lists.sourceforge.net/lists/listinfo/web-erp-users