Michael McNamara

technology, networking, virtualization and IP telephony

Network Infrastructure Forums now HTTPS/SSL Enabled

by

I’m happy to announce that the discussion forums are now HTTPS/SSL enabled.

I’ve been wanting to-do this for sometime now but only found the time over the holidays to make the necessary changes and test everything. This will help guarantee that the user credentials you use to login along with the session cookie will now be secure from potential eavesdropping.

I’m running Simple Machines Forum software on the discussion forums and while it doesn’t “support” HTTPS/SSL nativly it’s not hard to set everything up manually. Here are the steps I took to enable HTTPS/SSL for Simple Machines Forum.

  1. Purchase certificate from RapidSSL
  2. Install certificate into Nginx web server configuration.
  3. Change base URL using repair_settings.php
  4. Change Google Adsense code to HTTPS
  5. Change Statcounter code to HTTPS
  6. Test

I’m using Nginx and Server Name Indication (SNI) so you’ll need a fairly modern web browser.

Cheers!

Update: Tuesday January 6, 2015 @ 6:00PM

As I suspected some of the URLs that the PrettyURLs mod was re-writing were getting set back to HTTP. I found the solution documented on the PrettyURL homepage/wiki. I added a file called fix.php into the root of my webserver with the following contents;

<?php
require_once(dirname(__FILE__) . '/SSI.php');
require_once($sourcedir . '/Subs-PrettyUrls.php');
updateSettings(array('pretty_root_url' => $boardurl));
pretty_update_filters();
?>

I then executed that code by calling the URL from a web browser after which I removed the file.

With that step done now all the links in the HTML source are correct and everything is working properly.

Update: Tuesday January 6, 2015 

I’ve discovered that this change is going to require some additional work. A number of links are still pointing toward HTTP as opposed to HTTPS. I went to the effort this evening to dump the MySQL database and search and replace all links with the HTTPS variant. I was hoping this change would help fix a few other problems, unfortunately not. If you look at the source HTML you’ll see that a few of the links are still holding on to the http://forums.networkinfrastructure.info as opposed to the https://forums.networkinfrastructure.info. I believe the PrettyURLs mod is writing some of the links but it’s using HTTP as opposed to HTTPS. Now I need to dig down into the code and determine what’s broken and where.

Image Credit: Mike Cooke

Verizon Email Servers now supporting SSL?

by

It’s true and you need to make some configuration changes as soon as possible if you utilize a Verizon email account.

I received the following notification this week that informs Verizon customers that Verizon’s Email servers are now supporting SSL when utilizing POP3 and SMTP to send and receive email from a traditional email client such as Mozilla’s Thunderbird,  Microsoft’s Outlook or your Android or Apple Smartphone.

VerizonSSLEmail

This is very exciting news because you hopefully already know that your username and password are sent in the clear when utilizing POP3 and SMTP (with authentication) when not utilizing SSL. So the answer to the ages old question of does Verizon support SSL encryption has changed? They now support SSL encryption on both the POP3 (receiving) and SMTP (sending) for traditional email clients.

OutlookVerizonPOP3-1I made the changed to my Microsoft Outlook client and it works perfectly.

OutlookVerizonPOP3-2

You’ll need to dig deep into the settings to modify the port numbers that are utilized for both POP3 and SMTP, they can be found under “More Settings…”

You can find additional configuration information on Verizon’s website at this link.

I also recently noticed that Verizon now redirects any attempts to connect to http://webmail.verizon.net to the SSL secured site at https://webmail.verizon.net which again is very exciting from a security perspective.

Now you can safely utilize that public hotspot or guest network without worrying if someone is going to steal your username and password when you try and check your inbox. This change is long overdue and very welcome in my opinion.

Cheers!

Update: March 20, 2013

I just noticed that Verizon is only encrypting the actual login (passing the user credentials). They are not encrypting the entire session which includes the actual contents of the message or any attachments. This approach was helpful 5 years ago but not today, I’m not sure if Verizon is using secure COOKIES or not but this approach is usually susceptible to session hijacking.

Juniper Secure Access SSL VPN Software 6.5R2 is a winner

by

Juniper Networks logoIf you’ve been following this blog you’ll know that we’ve had quite a few issues with our Juniper Secure Access SSL VPN appliances over the past two years.  Juniper was very slow to add WSAM support for Windows Vista 64-bit and by the time they started supporting Windows Vista, Windows 7 was released by Microsoft.

You might recall that I wrote about software release 6.5R2 back in December 2009, detailing our troubles with the 6.5R1 software release and our hope that Juniper could save the day.

Thankfully I’m hear to tell that software release 6.5R2 for the Juniper Secure Access SSL VPN appliances appears to be a winner!

About six days ago I upgraded a pair of SA4000s running 6.5R1 to 6.5R2. The primary goal was to resolve the compatibility issues that were introduced in 6.5R1 and finally provide support for both Windows Vista 64-bit and Windows 7 64-bit. The actually upgrade of the appliances was pretty straight forward and the initial testing didn’t reveal any issues. Unfortunately there’s no amount of testing can always predict how things will go when working with home personal computers and the myriad of software available. We waited nervously for the first few days… thankfully the calls never came. While we had one or two users that needed some hand holding during the software upgrade/installation process, the majority of our 800+ users didn’t seem to have any issues whatsoever.

Let me congratulate Juniper Networks on a job well done!

I’ve created discussion forum for anyone that would like to discuss the Juniper Secure Access SSL VPN appliances. If you have a question or would like to make a comment why not join the discussion?

Cheers!

Juniper SSL VPN Secure Access 6.5R2 Available – Windows 7

by

Juniper has released a new version of software for their SSL VPN (Secure Access) appliances. The new release, 6.5R2, hopefully corrects all the issues and heartache that 6.5R1 brought to Juniper’s customers. I won’t rehash the issues that we discovered in 6.5R1, if you haven’t heard about them you can go read the earlier posts on the subject;

I will be testing 6.5R2 on a spare SA4000 appliance (waiting for an evaluation license key from Juniper) and will share my results with everyone here.

You can find the release notes for 6.5R2 here.

Windows 7

When will Juniper Network’s SSL VPN (SA platform/IVE OS) support Microsoft’s Windows 7 OS as a supported client platform? You can refer to Juniper knowledge base article, KB13195.

Juniper states that “Microsoft Windows 7 is qualified” (not supported) on 6.5R2 and there should be no major issues aside from the know caveats/issues.

Known Issues/Caveats:

* All client components:

  1. 1. Unable to install (or) launch client component using IE8 (64 bit). This is expected as IE8 (64 bit) browser is not supported. Please use IE8 (32 bit) to avoid this issue. (470316)

* EndPoint Integrity:

  1. When using IE 8 on 64-bit Windows 7 the reason string is not available when a patch assessment policy fails. (485421)

* Secure Virtual Workspace (SVW):

  1. When opening a file with Windows Photo Viewer inside SVW, the file is shown on the real desktop rather than inside the SVW session. (447409)
  2. On Windows 7, saving a MS Office 2003 file inside SVW fails. (486104)
  3. On Windows 7, Control Panel is accessible inside SVW even if it is disabled under application to allow list. (486104)

* WSAM:

  1. If Kaspersky Anti-Virus Version 2009 (8.0.0.506) is installed on a Windows 7 (OR) Windows Vista computer, WSAM will not be able to intercept and secure traffic. This issue is not seen with older versions of Kaspersky Anti-Virus (434715).

Cheers!

Update: January 6, 2009

I should point out that I’ve discovered that JSAM will not launch properly with Windows 7 (64-bit) when running 6.5R1 software. I initially thought it might have something to-do with the 32-bit/64-bit versions of Internet Explorer or the 32-bit/64-bit versions of the Java Runtime Environment. I tested the same machine today with 6.5R2 and it worked fine using the 32-bit version of Internet Explorer. I didn’t try the 64-bit version of Internet Explorer. So it would appear the problem is resolved in 6.5R2 software, please see the forums for additional details.

Juniper SSL VPN Secure Access 6.5 Available

by

juniper-logoJuniper recently released a new version of software for their SSL VPN (Secure Access) appliances. The new release is important because it finally addresses a problem that was original documented on my blog in this post. While I have yet to deploy this new software release (I would be interested in hearing from those that have) I thought it warranted a new post.

This latest version of software now supports Windows Secure Application Manager (WSAM) when used on Windows XP 64-bit and Windows Vista 64-bit clients. There was no mention of Windows 7 which is due to be released October 22, 2009. I did find it interesting that Internet Explorer 8 was only “compatible” with respect to a few of the features while Internet Explorer 7 was “qualified” with all features (review Juniper Secure Access 6.5 Supported Platforms document for specifics). I did a quick search over in the Juniper forums and found some reports that Host Checker wasn’t working properly with Windows 7 RC.

There were two new features that jumped out at me in the What’s New document;

RDP Launcher

SA 6.5 simplifies the use of RDP sessions for end users without requiring them or administrators to create bookmarks.

  • Simplifies ease of use for remote users to RDP into remote desktops by merely clicking a button or entering a hostname or IP Address of the remote computer.
  • Simplifies the configuration for administrators and reduces the number of support calls from users who are unable to figure out how to RDP to remote computers.

VDI Support

Secure Access (SA) version 6.5 interoperates with VDI products, including VMWare’s View Manager and Citrix’s XenDesktop, enabling administrators to deploy virtual desktops alongside the SA series of SSL VPN devices. This allows the SA administrator to configure centralized remote access policies for users who access their virtual desktops.

  • This provides a centralized point of configuration for administrators to configure remote access policies for virtual desktop access through leading virtualization products from VMWare and Citrix.
  • SA 6.5 provides end users the VDI client to access the virtual desktop through, and provides flexible client fallback options thereby simplifying the deployment and management for administrators.

We have a lot of folks looking to access their corporate desktops remotely and the RDP (Terminal Services) feature of the Juniper SSL VPN really helps fill that role.

Cheers!

References;

What’s New in Juniper Networks Secure Access (SA) SSL VPN Version 6.5
Juniper Secure Access 6.5 Release Notes
WSAM and Network Connect Error Messages Release 6.5
Juniper Secure Access 6.5 Support Platforms

Update: Thursday November 5, 2009

Let me get right to the point, I would not recommend anyone deploy 6.5R1 on their Juniper Secure Access appliances. There are known issues with the Juniper Windows Secure Application Manager (WSAM) and the following four security suites; Norton 360, Symantec AntiVirus, Zone Alarm Security, ESET NOD32. Users with Norton 360 could experience a blue screen of death (BSOD) using the Juniper Windows Secure Application Manager. Juniper has a hotfix available for 6.5R1 that resolves the BSOD issues with Norton 360. The hotfix is not generally available on the Juniper website so you must contact JTAC for the hotfix.

Additional information can be found at this post; http://blog.michaelfmcnamara.com/2009/10/norton-360-and-juniper-ssl-vpn-wsam/

Update: Friday September 19, 2009

A quick update… I’ve setup a spare SA4000 and received a demo license from Juniper to test the 6.5R1 software release (thanks Matt!). I’m happy to report that the upgrade on the appliance was very smooth although it took about 6 minutes for the appliance to boot back up giving me a few frightful thoughts. Unfortunately the same can’t be said of the client software. I’m still in the process of testing but it appears that non-Administrator users (users that don’t have Administrator rights on the PC) won’t be functional after the upgrade until an Administrator manually installs the latest and greatest Juniper Installer Service. The Juniper Installer Service is designed to allow the client software to upgrade when the user doesn’t have Administrator rights. Users with Administrator rights work fine so long as they answer the prompts to install the new version of the Juniper Installer Service. I hope to release a detailed post in the next few days including some testing of Windows Vista 64-bit desktops.

Recent Posts

Categories

SUBSCRIBE BY EMAIL