Secure CPIP - say no to port 8008...
Mulling over our cpip connectors made me realise that we should certainly not be using port 8008 as the cpipconnector port - particularly in the case where you are using pickup response rather than putting pickup.html on the external system. The obvious reason is that 8008 is very likely to be providing authentication info to the user's browser, albeit in a form that the user hardly notices, and then submitting it securely to the external system. And port 8008 isn't secure as it stands.
So put your cpipconnector on a secure port - all you need to do is change the server xml for the cpipconnector so that it's got a secure port to use, including a reference in the server.xml to a certificate (well, if it's all on the same machine as your cp web server you can re-use the web server's cert) file, and change the cpipconnector.properties to have https and the newly defined secure port. Then check it's all happening securely by doing an SSO with live headers in Firefox switched on. This issue has been noted before - after a bit of searching I found other people have done something about this too - but it ought really to be part of the standard sys setup. See also http://www.lumdev.net/node/389
- stevecarr's blog
- Login or register to post comments
Hack Your Knowledge
Recent blog posts
- Banner w/ Bursar Consultant Needed
- A different MOWA problem
- Passing user's displayName to php script
- Stats - Anyone satistified with their solutions
- Turing Off Luminis IV Cache
- Banner-Luminis-WebCT integration
- Trying to use a cpip with javascript
- Updated to 4.1.22 - Complications
- Time Estimate for Luminis Platform IV Upgrade
- Luminis IV Memory Configuration
Developer Links
Poll
Syndicate
Comments
We made a modification so
We made a modification so that port 8008 uses SSL and enabled the Full SSL partioning feature of Luminis 4.0.2 so all Luminis URLs are SSL.
I submit to you that if a man hasn't discovered something he will die for, he isn't fit to live. - Martin Luther King
Good idea, but to clear
Good idea, but to clear something up...
The port isn't the issue, the transport layer is. Port 8008 is just a port like any other port. It's no more or less secure than port 80 (standard HTTP) or port 443 (standard HTTPS) or port 98815 (random). The difference is the protocol and/or transport layer used. HTTP is sent without encryption. HTTPS (typically) uses SSL to encrypt the HTTP data.
Switching CPIP to SSL is much more secure, but not because of the port. I just wanted to clear that up to any readers that might get confused and think they need to change their CPIP port to make it more secure.
yes, but....
You are sort of right, but sort of wrong. I think you'd generally do well to follow the ports as assigned by IANA - and set up secure ports as per their listing. So I'd recommend you don't use 8008 but use something like 8443 instead. Just a matter of following protocol. You certainly can secure whatever ports you like, but following common practices is best I'd say. I did actually play with my config a bit and tried to secure 8008 but that threw config errors, so I didn't persist with using that port, and especially since I'd rather conform to IANA assigned ports.
Another alternative
Partly because we are parallel deployment, we enabled SSL for the cpipconnector Tomcat, but we only used it on the "virtual" URL used by the pickup process. We continue to use port 8008 without SSL for the CPIP communications between Luminis and the GCF implementation. Those connections are still secure since they never leave the box and it saves us some resources, although the savings are probably insignificant.
Completely agree
Yes, I agree completely, and I've not done anything to the connections that are between two servers running on the same physical box. I guess that would just slow things down - https, etc - at no real security benefit.