SUNScholar/Secure Internet Connections

From Libopedia
Revision as of 21:41, 29 December 2014 by Hgibson (talk | contribs) (Please Note)
Jump to navigation Jump to search
Back to Internet Security
For the need to use https, check: https://pressfreedomfoundation.org/encryption-works and https://ssd.eff.org
To check if your internet connection is secure, use: https://www.eff.org/https-everywhere

Introduction

This wiki page describes a method of securing communications to a DSpace installation on the internet.

To protect the user credentials of the members of the research community that your repository will serve, it is highly recommended that all logins to the system are encrypted using the procedure detailed below.

It is assumed that DSpace has been installed according to the suggested guidelines here: http://wiki.lib.sun.ac.za/index.php/SUNScholar/DSpace

Update - 2014/11/18

A free certificate authority service is launching in 2015 that will greatly simplify the configuration of a secure server. See the link below.

https://letsencrypt.org

Please Note

  • This is not needed if doing an evaluation of the software on a test server behind your institutions firewall.
  • The Tomcat server MUST be listening on port 443 and your local server firewall must allow access to port 443. See links below.

  1. http://wiki.lib.sun.ac.za/index.php/SUNScholar/Secure_Internet_Connections/S04
  2. http://wiki.lib.sun.ac.za/index.php/SUNScholar/Firewall

SSL Defaults

  • The default location for certificates is: /etc/ssl/certs. This is where we will put the certificates. Other services should point to this folder for the certificates.
  • Secure internet connections are created using the secure port (443) which must be opened on the campus firewall for your particular server by the central IT department.

Step 1. Create the SSL certificates

Step 2. Apply for a signed certificate

Step 3. Intermediate CA certs

Step 4. Setup Tomcat to use the SSL certs

Step 5. Enable secure XMLUI logins

Step 6. Enable HTTPS by default

Step 7. Rebuild DSpace

Step 8. Check the secure connection

References

Tomcat

SSL/TLS

Monopoly Notes

Please note: A quiet monopoly has been created in the SSL cert business. Verisign buys Thawte, Verisign buys Geotrust, Symantec buys Verisign.

Update - 2013/10/09. Now we know why a monopoly, so that the NSA can spy on everyone even with SSL certs. What a joke these certs are.

News