Security in VirtualVault

[Simon_13]

Hello

I am working in a proyect to secure the Virtualvault web server, I'd like to know:

- If the certificates aren't used in the outside server the traffic could be encryted with the RSA keys or the traffic will be without encryt.

[Steven Sim Kok Leong]

Hi,

I am not sure about VirtualVault but for securing any webserver:

1) use SSL-based HTTP for encrypting traffic to and fro the client and webserver.

2) use SSL certificates for identification/non-repudiation of webserver and maintaining integrity of traffic transferred.

Hope this helps. Regards.

Steven Sim Kok Leong
Brainbench MVP for Unix Admin
http://www.brainbench.com

[harry d brown jr]

Simon,

In what ways are you trying to "secure" a already secure OS (Virtual Vault)?

Just six months ago, I replaced our 15+ Virtual Vaults with Bastion hosts. A Bastion Host, in my case HPux 9000's (10.20 and 11.x) running Iplanet, is a normal HPux host, but with most services shut off. It's a lot easier to develop on a normal host, and you don't have to worry about the stupid Virtual Vault TGP (Trusted GateWay Proxy) dying!!!

You can find bastion host info here (GREAT PAPER):
http://people.hp.se/stevesk/bastion.html

Another thing, VV is a dead product. HP doesn't even use it!!! And support for the product sucked!!!!


live free or die
harry

[Peter Cvar · Accepted solution]

I don't agree that VirtualVault is a dead product. VV is mainly used for Banks and other strongly secured E-commerce systems. Bastion host can't be a replacement for VirtualVault. In the last year HP released latest Virtual Vault 4.5 version with Apache Web Server.

I agree with Harry that support for VirtualVault is not as good as it should be. There are't many VirtualVault experts. VV is very complex to configure (especially if you use cryptographic HW accelerators) and the price is quite high.

Simon, you should use SSL and certificates to secure traffic on the outside Web Servers. You can test this with trial certificates. You can get them from Verisign for free.

Regards,
Pete