Re: HTTP and Web server configuration and security.

Thanks Brian.  I appreciate the advice and have already started testing
with SSL.

Rob

On Thu, Dec 3, 2020 at 10:56 AM Brian May <bmay-vHNbTNUSjfwkqdnoteijUAC/[email protected]> wrote:

> The additional value would be that HTTPS encrypts data inside your network
> as well.  Shops are often worried about outside access but never consider
> an inside threat.  Honestly, there is no reason that all HTTP traffic in a
> business should not have SSL enabled, even if they use a VPN.  They are not
> mutually exclusive.
>
> Of course, there is also no reason that 5250 data should not also be using
> SSL, but that is a topic for another day.
>
> Brian May
> Director
> Pre-Sales and Customer Solutions
> Profound Logic Software
> http://www.profoundlogic.com
> 937-439-7925 Phone
> 877-224-7768 Toll Free
>
>
> UI Modernization. And More!
>
> www.profoundlogic.com
>
>
> -----Original Message-----
> From: WEB400 <[email protected]> On Behalf Of Robert
> Rogerson
> Sent: Wednesday, December 2, 2020 6:02 PM
> To: Web Enabling the IBM i (AS/400 and iSeries) <[email protected]
> >
> Subject: Re: [WEB400] HTTP and Web server configuration and security.
>
> Thanks Nathan.
>
> On Wed, Dec 2, 2020 at 6:00 PM Nathan Andelin <[email protected]> wrote:
>
> > HTTPS and VPN both provide transport-layer encryption. In that regard,
> > I don't see HTTPS offering additional value over VPN encryption.
> >
> > However, a number of shops prefer HTTPS rather than a VPN because
> > they'd rather not manage VPN credentials, or mess with VPN client
> > downloads, support, and network issues entailed in managing VPNs.
> > Shops get tired of the network device and configuration requirements
> > of VPNs, which can be especially burdensome for shops that have a
> > large or potentially large number of users.
> >
> > A number of shops prefer to manage user authority within IBM i or IBM
> > i applications rather than additionally within a VPN. I see
> > initiatives to downsize VPN use in favor of HTTPS.
> >
> >
> >
> >
> >
> > On Wed, Dec 2, 2020 at 6:18 AM Robert Rogerson <[email protected]>
> > wrote:
> >
> > > I was able to create an HTTP and web services servers from the
> > > wizard.  I then created an api.  I was able to test it with Postman
> > > and everything checked out.
> > >
> > > The next thing I'm unsure of is security.
> > >
> > > I created a new user with *USER authority and no special authority
> > > I
> > also
> > > changed the initial menu to signoff.
> > > I redeployed the web service speciying this user profile on User ID
> > > for this service.
> > > I retested with Postman and it still works.
> > >
> > > I ended my vpn.  The api now timed out in Postman.
> > >
> > > So my question is, if the api is only ever called from behind the
> > > vpn is there still a big hole I'm missing?
> > > Is SSL required if behind a vpn?
> > >
> > > Once again, your advice is very much appreciated.
> > >
> > > Thanks, Rob
> > > --
> > > This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400)
> > > mailing list To post a message email: [email protected] To
> > > subscribe, unsubscribe, or change list options,
> > > visit: https://lists.midrange.com/mailman/listinfo/web400
> > > or email: [email protected] Before posting, please
> > > take a moment to review the archives at
> > > https://archive.midrange.com/web400.
> > >
> > >
> > --
> > This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400)
> > mailing list To post a message email: [email protected] To
> > subscribe, unsubscribe, or change list options,
> > visit: https://lists.midrange.com/mailman/listinfo/web400
> > or email: [email protected] Before posting, please
> > take a moment to review the archives at
> > https://archive.midrange.com/web400.
> >
> >
> --
> This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing
> list To post a message email: [email protected] To subscribe,
> unsubscribe, or change list options,
> visit: https://lists.midrange.com/mailman/listinfo/web400
> or email: [email protected] Before posting, please take a
> moment to review the archives at https://archive.midrange.com/web400.
>
> --
> This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing
> list
> To post a message email: [email protected]
> To subscribe, unsubscribe, or change list options,
> visit: https://lists.midrange.com/mailman/listinfo/web400
> or email: [email protected]
> Before posting, please take a moment to review the archives
> at https://archive.midrange.com/web400.
>
>
-- 
This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing list
To post a message email: [email protected]
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/web400
or email: [email protected]
Before posting, please take a moment to review the archives
at https://archive.midrange.com/web400.