db260179 Posted July 17, 2007 Posted July 17, 2007 Let me introduce a product called SSL Explorer (http://3sp.com/showSslExplorerCommunity.do) You may of heard of SSLBridge, but this is so much more than that product. I have this installed on my Ubuntu 6.0.6.1 LAMP Server 64bit running on a HP proliant DL380G4 server.(with ubuntu-desktop enabled) 1. Goto http://sourceforge.net/project/showfiles.php?group_id=116065&package_id=125980 and download 'sslexplorer_linux_0_2_14_01.sh' (version numbers will change). You can save this file anywhere, i usually save it in the /home/*user* folder 2.Change the mode of the file executable - chmod 755 /home/*user*/sslexplorer_linux_0_2_14_01.sh 3. Execute the file as root or sudo - A gui environment must be running - gnome preferably. 4.Follow the instructions - keep the defaults, if you are going to use the AD setup then follow this flash demo for assistance - http://3sp.com/products/ssl-explorer/flash-demos/community/Installation_Wizard.htm and http://3sp.com/kb/idx/75/0/ 5.Once the setup is finished a file in the /etc/init.d/sslexplorer will be created - this is to start and stop the sslexplorer engine. Once you have followed the on screen instructions. Goto your server address - https://youserver.com - then log in. For more guidence follow the front page flash examples http://3sp.com/showSslExplorerCommunity.do Any problems give me a buzz
ajbritton Posted July 17, 2007 Posted July 17, 2007 Nice one. I had a quick go at this product a while ago but could not get it working.
Geoff Posted July 17, 2007 Posted July 17, 2007 Execute the file as root or sudo - A gui environment must be running - gnome preferably. Gah! GUI on a server?
DMcCoy Posted July 17, 2007 Posted July 17, 2007 Execute the file as root or sudo - A gui environment must be running - gnome preferably. Gah! GUI on a server? I agree with that! None of my unix/linux servers ever have X on. Before there was a vmware gui-less installer for APC powerchute I had to setup a redhat 7 vm especially to install and configure it before I could copy the files to the esx console.
plexer Posted July 17, 2007 Posted July 17, 2007 SSLExplorer has been punted about several times in the past when relating to remote access. Can it integrate with AD or just use LDAP when installed on a nix server then? I was thinking of installing it on one of my AD servers and then forwarding the 443 requests from the firewall to it. Ben
martianx Posted July 17, 2007 Posted July 17, 2007 Gah! GUI on a server? You can use the RPM instead. The only difference in the instructions is that you have to manually launch the installation wizard once the RPM has been installed. Just cd into /opt/sslexplorer and run install-sslexplorer script. Can it integrate with AD or just use LDAP when installed on a nix server then? Yes, although LDAP is an Enterprise 'pay for' feature, AD is free in the open source version.
Geoff Posted July 17, 2007 Posted July 17, 2007 You can use the RPM instead. The only difference in the instructions is that you have to manually launch the installation wizard once the RPM has been installed. Just cd into /opt/sslexplorer and run install-sslexplorer script. er, tgz or deb's here. Is there not just a text file I can edit?
maniac Posted July 17, 2007 Posted July 17, 2007 I have SSL explorer fully configured and working for remote access to our network. See the front page at https://www.nbc.medway.sch.uk:49302 It's integrated with active directory and my network. Staff get access to their home directory and read only access to the public share. Also if they have a desktop machine, we've enabled remote access on them and set up shortcuts so they can even remotely login to a proper workstation using the full VPN features of SSL explorer to connect to it. (This has enabled out timetabler to work from home for the last 3 weeks, and she reports that the access is quick and ultra reliable.) We're looking at a terminal server in the future to enable all staff to login to a proper workstation environment from home. I've also created a support account that I can give to people I'm on the phone to for support, so if they lack their own remote support package they can still see my screen and control it via VNC. We're hoping to extend remote file access to students later this year using it as well, waiting for more staff feedback first thou, as we only officially launched it to staff this week. Also want to see how reliable it is when more than a few users are using it. All in all I love SSL explorer, and would recommend it to anyone wanting to set up VPN access on a tight budget. Mike
NetworkGeezer Posted July 17, 2007 Posted July 17, 2007 Gah! GUI on a server? I though you ran Citrix and stuff?
Geoff Posted July 17, 2007 Posted July 17, 2007 Gah! GUI on a server? I though you ran Citrix and stuff? That's windows though
bishopsgarthstockton Posted July 17, 2007 Posted July 17, 2007 Mike Think i am going to have a good play with this. Never seen this before and from first glance it looks awsome. PLease could you PM me on how well it works as more people use it? Im going to install it on my home machine.
Joedetic Posted July 17, 2007 Posted July 17, 2007 You /could/ have a gui on a server...there's nothing to say that you need to have it started though. Just start it if you absolutely need it for daft software that doesnt have a lovely terminal based config/setup etc with ncurses. I agree though. GUI on a server is best avoided imo. It /does/ look interesting but what is the advantage over an existing PPTP VPN? The browser based access? Does it support altering network routes so that the end-user can configure it so that various IP ranges or subnets can be sent down the VPN like you can do with pptpconfig for example?
Geoff Posted July 17, 2007 Posted July 17, 2007 PPTP PPTP is brain damaged. Use IPSEC for new VPN implementations if possible. If, however, you must use MS based protocols, use L2TP.
Joedetic Posted July 17, 2007 Posted July 17, 2007 IPSEC looked as if it was going to take longer to implement. But I'm not using it in a production environment, it was just for testing and teaching myself at the time (also gaining SSH to a remote server from the uni halls because they blocked the protocol for a rediculous reason.) Now you've linked me to that site...i'm going to have to change LOL *Adds to list of things to try*
ITWombat Posted July 22, 2007 Posted July 22, 2007 It /does/ look interesting but what is the advantage over an existing PPTP VPN? The browser based access? The advantage of SSL VPN is that easier to configure than IPSec and play nicer with firewalls because you already use HTTPS for VLEs, DfES websites etc Have a look at this article> it covers a lot of the issues involved. It doesn't like client-less (i.e. browser based) SSL VPN solutions such as SSL Explorer because of the breakdown in the trust model. Traditional VPN solutions like IPSec and OpenVPN normally require the IT department to install software and therefore pre-screen clients before connection to the internal network. On the otherhand browser based VPN do have an advantage in that the end users intact with an application server serving up ActiveX or Java applets rather than have direct access to the internal network.
pete.miller Posted September 23, 2007 Posted September 23, 2007 In a primary school the caretaker wants to connect to the CCTV security system from his house; would you recommend SSL Explorer for this? They have Windows 2000/2003 servers for Admin and Curric, should we install on one of these, or on the PC running the CCTV.
m25man Posted September 23, 2007 Posted September 23, 2007 Not wanting to split hairs but.. These products all use the term VPN however many implementations only use the "Reverse Proxy" elements. SSL is used to create a tunnel from client to appliance, a log in process is initiated and based upon a combination of rules, certificates and policies the remote user is permitted or denied access to a selection of redirected(proxied) services. The VPN service requires the installation on the clients pc a VPN client, normally provided through an active x or java based applet, assuming the user has the ability and the policy of the local machine permits it. Once installed the remote user recieves an ip either on the school network or from a routed segment/dmz. The best part is that those "untrusted" users (staff/kids) can be granted access to internal services without the need to install a full vpn. Whilst others (eg. network managers and support companies) can gain full access to the network. Sounds brilliant, and indeed it is. Personally I prefer the appliance approach, Netgear's SSL-312 device can do it for less than £200 and Sonicwalls for £300 both setup easily are fully AD integrated without the need to mess with PC's, Servers, Linux and 3SP's rather crippled (but Free) implementation of Open SSL. However, there are a few caveats that you should be aware of when choosing SSL-VPN as a remote access solution. Firstly, URL obscufication will cause big problems with some implementations of web services (ISA/Sharepoint etc) meaning that some links will not resolve over a reverse proxy. Thus access to a Sharepoint system or VLE via the reverse proxy alone may be impossible, the client would have to have full VPN in order to use the resource and this may not be the required solution in a school. In such a case direct access to the Sharepoint server via ISA (which can handle the URL redirects) is the better solution. Secondly SSL has a high processing overhead, and the smaller appliances do not deliver the required throughput or power to deliver some services such as OWA Premium, only Basic, which is pretty pants! So if you intended to deliver this service on a large scale you will need to select your appliance/vpn host equipment carefully. Thirdly, many of these functions will be assimilated by Server 2008's Terminal Server Gateway Services and RRAS enhancements and the next version of ISA will also contain SSL-VPN capabilaties (M$ bought out Whale Communications in 2006 a leading SSL-VPN manufacturer). I love SSL-VPN however having implemented many of them in all sorts of flavors each one has some kind of limitation that inevitably messes up how you planned for it to work! As a result I still find I have to have a logmein.com account handy to save the day.
plexer Posted September 24, 2007 Posted September 24, 2007 There will also be SSL VPN functionality in Smoothwall Corporate Firewall 3 due for release in november. Ben
Guest monkeyx Posted July 17, 2008 Posted July 17, 2008 Can I point anyone ineterested in this projec to to this post. If you are interested in helping please reply to the post in the link and not this one. Confusing or what
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now