Moodle - windows web client (smb)

[_techie_]

Hi,

We are currently running moodle 1.9.7 on a debian box.

We have added a mod/block from the moodle site called windows web directory, and configured the block correctly.

 

When a student logs in, they can see the block, and click the link, but it doesn't connect properly.

 

Checking the resultant link, it appears that it is requesting an SSL/HTTPS connection as part of the process. We are not running our moodle box on https at present, but I would ideally like to, but have read that some SCORMS dont work under https, and also that it can slow the server down quite a bit.

 

Is there anyway just to allow https on certain parts of moodle, and is there a definitive guide on how to convert a working apache server to https, OR get windows web client to use http only (dont really like that idea to be honest).

 

Thanks for any help...

Cheers

[kmount]

Not sure re windows web client will do some testing if it will help but I would urge you to seriously investigate upgrading from 1.9.7 to 1.9.10+.

[_techie_]

Yes, we have done this today, i was aware of some security holes thay have been fixed in 9.10...

[powdarrmonkey]

Hi,

but have read that some SCORMS dont work under https,

 

This may be true...

 

and also that it can slow the server down quite a bit.

 

...but this is almost certainly FUD. There is a cost to the web server, but unless you're running it on an 8086 you probably won't notice.

 

is there a definitive guide on how to convert a working apache server to https

 

Debian having Apache package maintainers with brains, you can use Setting up an SSL server with Apache2 to get started. In a normal install, the default virtual host is defined in /etc/apache2/sites-enabled/000-default.

[Marci]

Line 259 of config_smb_web_client.php

 

Set as follows...

$smb_cfg->cfgssl=false;

...am guessing it's currently set to 'true'

[penfold_99]

You currently have three options,

1. Run the whole Moodle sIte over SSL
   
2. Run sections of the Moodle sIte over SSL
   
3. Not Run any part of moodle over SSL
   

 

You are currently on option 3 and it would be advisable to be at option 2. This is because you are currently sending login details in clear text.

 

If you turned SSL on in moodle it would only apply to the login section of the site.

 

To have other sections run over SSL you will need a few .htacces file to force SSL or the plugin might already support it.

 

It would be inadvisable to run the the smb web block over http as anyone can read the contents if they are unencrypted.

[_techie_]

Thanks Penfold,

 

I was aware that we are sending logins in clear text...obviously not good.

I wasnt aware that we can run certain aspects of the website in SSL. This is obviously what we need to do for both login to moodle, and also for the smb client.

 

To know how to do this would be very helpful

 

Cheers

_techie_

[Achandler]

We faced the chocie that penfold si talkign about here and decided to go with option 1.

 

Yes i'm quite sure that our Moodle installation runs a little slower then a none SSL one but the benefits of this were that all our sensitive data is guaranteed to be secure.