Internet Security, Certificates, SSL

From Opentaps Wiki
Revision as of 13:53, 25 March 2010 by Claudefeistel2 (talk | contribs) (Using SSL for opentaps Internet Security)
Jump to navigationJump to search



Introduction to Preparing Your Operational Environment

Before you configure your opentaps system with any of your business data, or your company's confidential information, or your company employee's data, it will be prudent to consider the security of your opentaps system servers and the related internet network security. Best practices with respect to this topic suggest the following partial list of salient points:

  • Your server should be protected by a properly configured firewall to allow only the required forms of network access, as defined by your management and their technical system administrative staff.
  • Any internet access to the opentaps server should probably be limited to SSL (secure socket layer) internet transmission layer security, as determined by your management and their technical system administrative staff. Consider both the public internet and any in-house local internets in this topic.
  • You should secure all of the opentaps IDs that are active on the system, using a strong and unique password having properly limited distribution to users with a business need for them, and you should disable all other IDs on opentaps.
  • You should make sure that your technical system administrator has secured all of the opentaps host server software components and related ports of every kind, so that no unintended routes of access are possible on your system.
  • You should make sure that your opentaps server has physical security that is practiced 100% of the time, and that is robust enough to meet your management's requirements.
  • Before you put any of your opentaps system functions into a production mode of operation, you should develop, test, and deploy your methods for system data backup and for system data restoration. You should actually practice the system data restoration periodically to make sure that it actually does work.
  • Consider whether you will need a server for testing data restoration, migration, or new software component releases that is separate from the production servers that you use. (Usually, production servers are off limits for testing purposes.)
  • Included in this preparation, you should include a determination of when backup will be collected, by whom, and where it will be stored so that if your operational facility is breached or destroyed there will still be a copy of your system backup data available, somewhere else.
  • Make your own list adding all items to this topic which your company deems essential to your own best practices, and complete working your list. When making your own complete list, you may wish to consider what you would do if the internet access suffers an outage, either on the public internet or on your own local internets, or if the physical opentaps server computer suffers an outage.

If you do not need to attach your server to the internets while you are doing preliminary configuration, and preparing your environment then you may be able to phase some of the steps to make progress while other steps are still being completed.

Using SSL for opentaps Internet Security

opentaps can be configured to permit access only by the secure internet protocols, thus reducing the opportunity for unauthorized access to your system. This means having your users log-in and use your opentaps system via the secure internet https protocol (rather than non-encrypted http), and using the SSL-enabled ports (default on opentaps is port 8443) rather than the non-encrypted ports such as 80 or 8080.

Then there is the question of what to do about the SSL Certificate. The certificate is simply your internet identification "papers", including an encryption key that is uniquely yours, and these items are kept in a unique secure, encrypted file which acts as a lock box. This certificate (identity document) can be one that you have signed and issues by a public "certificate authority" recognized by the industry at large, or it can be a certificate that you create for yourself including your unique encryption key.

When opentaps is downloaded in the release package, and installed it contains a certificate for one of the organizations which produce the opentaps system releases, so that certificate is not yours, and it is not unique since many people will download the release code and install it. While you could operate with this default certificate for non-critical testing with no private information of any kind, you must install your own unique certificate for any other use of the system.

To Be Continued...


Introduction to Using SSL Certificates and Use Cases

The kind of Certificate you need depends upon how your opentaps system will be used, and by whom.

To Be Continued...

Configuring Your opentaps Server with an SSL Certificate

There are several possible operational configurations for the opentaps server software, and the one you choose to implement will determine how the secure socket layer (SSL) Certificate will need to be installed.

We will begin by describing how to install your unique Certificate for opentaps simplest installation, which involves using the imbedded web server supplied in opentaps' pre-compiled, downloadable form for Linux.

Then, we will discuss some tips about how to handle the Certificates obtained in various formats from the authorities who sell "signed" and verified certificates. Finally, we will consider other possible opentaps installations and related Certificate issues.

Installing Your Certificate for Basic Installations

Certificate and File Format Tips

Installing the Certificate for a Combined httpd (Apache) and Tomcat Installation