Re: SSL and public facing web site on the i

[Jim Oberholtzer <midrangel@xxxxxxxxxxxxxxxxx>]

While IBM i is the most secureable system in the world, and you can set 
it up so it is secure on a partition, Paul does have a point.

Another option if you have sufficient storage is create a hosted IBM i 
partition and put the web site there.  Use the packet filter to restrict 
the types of traffic and destinations for those transactions.

The most important thing to do is not infrastructure however, it is 
programming.  Only use stored procedures to access data from your web 
site.  That single thing alone will go a long way to making your web 
site secure.

Jim Oberholtzer
Chief Technical Architect
Agile Technology Architects


On 4/23/2013 11:00 AM, Paul Therrien wrote:
> Thanks Matt,  Your 2 cents is very valuable.
>
> Paul
>
> -----Original Message-----
> From:midrange-l-bounces@xxxxxxxxxxxx  [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Matt Olson
> Sent: Tuesday, April 23, 2013 10:53 AM
> To: Midrange Systems Technical Discussion
> Subject: RE: SSL and public facing web site on the i
>
> Paul,
>
> I would warn you against doing this.  Any web infrastructure guy would tell you to separate the database from your web server and place your web server in a DMZ separated from everything else on your network to mitigate your hacking risks.
>
> If any security auditor visits your place you will be slapped on the wrist if you do what you are attempting.
>
> Go buy a cheap linux or windows server and place it in the DMZ and have it access data on the i (if it request database access).
>
> My 2 cents.
>
> Matt
>
> -----Original Message-----
> From: Paul Therrien [mailto:ptherrien@xxxxxxxxxxxxxxx]
> Sent: Tuesday, April 23, 2013 10:38 AM
> To: Midrange Systems Technical Discussion (midrange-l@xxxxxxxxxxxx)
> Subject: SSL and public facing web site on the i
>
> Our company has a public web address  and a GoDaddy certificate that we currently use for SSL  to our webmail that is hosted on an exchange server.
> We are developing our first www facing site on the IBM I and want to secure it with SSL.  I have made a few stabs at trying to get SSL configured correctly and have managed to get a local CA in place on the IBM I and open the web site internally using SSL.  But I am lost as to how to configure SSL and the Apache server on the I.
> I am a great (IMHO) software guy, but I am a newbie on web infrastructure.
> What do I need to do to allow our web site on the I to be accessible from the internet via our www domain and to incorporate the SLL certificate that we have purchased from GoDaddy?
>
> I appreciate your help.
>
> Paul
>
>
> --