Following up on this thread, I'm looking into SSL for opensim to increase username and password security, but I'm pretty novice at server administration in general so I'm not sure I understand enough to even ask the right questions. <div>
<br></div><div>Our Opensim 0.7.2 install is running in grid mode on Windows Server 2008/IIS. I've found information about installing the security certificate and I think I generally understand what to do there, but I just want to make sure I understand the process and how it works before I go through the process of requesting a cert from our InfoSec department.</div>
<div><br></div><div>Reading the information in the thread below, I have a couple of questions:</div><div><br></div><div>1) Is it possible to have Diva's wifi account creation process done through https if I follow these steps? It's the usernames and passwords I'm most concerned about.</div>
<div><br></div><div>2) Is this only for remote admin applications or does this encrypt all traffic between the viewer and the server too?</div><div><br></div><div>Sorry if these are stupid questions and many thanks in advance if anyone has more information or can explain Opensim SSL for Dummies style. ;)</div>
<div><br></div><div>Sincerely,</div><div><br></div><div>- Chris/Fleep</div><div><br></div><div>Chris M. Collins (SL/OS: Fleep Tuque)</div><div>Center for Simulations & Virtual Environments Research (UCSIM)</div><div>UCIT Instructional & Research Computing</div>
<div>University of Cincinnati</div><div>406A Zimmer Hall</div><div>315 College Drive</div><div>PO BOX 210088</div><div>Cincinnati, OH 45221-0088</div><div><a href="mailto:chris.collins@uc.edu">chris.collins@uc.edu</a></div>
<div>(513) 556-3018</div><div><br></div><div><a href="http://ucsim.uc.edu">http://ucsim.uc.edu</a></div><div> </div><div><br><div><div><br></div><div><br><br><div class="gmail_quote">On Thu, May 5, 2011 at 10:07 PM, BlueWall <span dir="ltr"><<a href="mailto:jamesh@bluewallgroup.com">jamesh@bluewallgroup.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">SSL support for "out of band" applications is added in OpenSim commit<br>
8ca793875318efc8db3339b25bf7fa5ddeeac218 . I have tested the region<br>
server with the remote-admin plugin and also completed the lsl function<br>
- llRequestSecureURL(). In Robust, I tested using a custom service to<br>
expose a service that gets user information over https. I will post the<br>
code for that soon as an example.<br>
<br>
*Certificates<br>
To use it, you will need a certificate in the PFX/PKCS12 format. These<br>
may be certs purchased from someone like VeriSign, Thawte or others<br>
providing CA services. You may also use a self signed cert for testing.<br>
If you are using Mono, see <a href="http://www.mono-project.com/FAQ:_Security" target="_blank">http://www.mono-project.com/FAQ:_Security</a> and<br>
page down to "Can I make my own certificates ? ", and Windows users,<br>
here: <a href="http://blogs.technet.com/b/jhoward/archive/2005/02/02/365323.aspx" target="_blank">http://blogs.technet.com/b/jhoward/archive/2005/02/02/365323.aspx</a><br>
for instructions. If you have an existing cert that is not in the PFX<br>
format, such as *.crt - you may use openssl to copy it into the proper<br>
format. See<br>
<a href="http://security.ncsa.illinois.edu/research/grid-howtos/usefulopenssl.html" target="_blank">http://security.ncsa.illinois.edu/research/grid-howtos/usefulopenssl.html</a> for<br>
some background information for using openssl to create certs or convert<br>
between formats.<br>
<br>
*Configuration<br>
The region server may use ssl as an auxiliary port. The options are in<br>
the OpenSimDefaults.ini. Copy them to your OpenSim.ini and adjust the<br>
settings to your setup...<br>
<br>
[Network]<br>
http_listener_port = 9000<br>
<br>
https_listener = True<br>
https_port = 9080<br>
cert_path = "/home/opensim/etc/os_server.p12"<br>
cert_pass = "mypassword"<br>
<br>
[RemoteAdmin]<br>
enabled = true<br>
port = 9080<br>
access_password = "woohooo"<br>
<br>
Then, set your remote-admin client to use the port and make the calls<br>
using https. I used code from<br>
<a href="http://xyzzyxyzzy.net/2008/01/23/using-pythons-xmlrpclib-with-opensim/" target="_blank">http://xyzzyxyzzy.net/2008/01/23/using-pythons-xmlrpclib-with-opensim/</a><br>
to test the remote-admin. Modifying it to use my port and https.<br>
<br>
For applications in Robust, you have a couple of options. First, you can<br>
add an auxiliary port, as in the region server. But, in-case you want to<br>
split out your https application to a separate Robust server, you can<br>
make the main listener talk on https. Same options as the region server<br>
with one addition - the https_main option. Set that one to True to get<br>
your Robust main listener on https. Or set it to False to add an<br>
auxiliary https port to the main server. Then, in your application, set<br>
the port in your ServiceConnectors line to tell your application to use<br>
it...<br>
<br>
[Startup]<br>
ServiceConnectors = "8114/WxService.dll:WxServiceConnector"<br>
; ^^^^ <-- Here<br>
[Network]<br>
port = 8113<br>
;; ^^^^ <-- Main listener<br>
https_main = False<br>
;; Create http listener true / false<br>
https_listener = True<br>
;; Set our listener to this port<br>
https_port = 8114<br>
;; ^^^^ <-- And Here<br>
;; Path to X.509 cert<br>
cert_path = "/home/opensim/etc/os_server.p12"<br>
;; Password for cert<br>
cert_pass = "mypassword"<br>
<br>
<br>
Have fun!<br>
BlueWall<br>
<br>
_______________________________________________<br>
Opensim-dev mailing list<br>
<a href="mailto:Opensim-dev@lists.berlios.de">Opensim-dev@lists.berlios.de</a><br>
<a href="https://lists.berlios.de/mailman/listinfo/opensim-dev" target="_blank">https://lists.berlios.de/mailman/listinfo/opensim-dev</a><br>
</blockquote></div><br></div></div></div>