0

I am currently working on an Adobe CQ5 (CMS) application that will be serving sensitive information, so communications should be encrypted using SSL end-to-end.

The problem is that it is not currently possible for a Dispatcher (caching reverse proxy) to talk to a publish instance directly using SSL. On the Enabling HTTP over SSL page, there is a link to a knowledgebase article that describes configuration for CQ4 using stunnel.

The solution will run on Windows Server 2008 hosts.

My questions are:

  1. Is this secure?
    Could an attacker with access to the dispatcher box "sniff" traffic going into the tunnel?
  2. Are there any alternatives?
Improve this question

2 Answers 2

Reset to default
0

To answer your questions:

  1. If an attacker has already captured the dispatcher machine, it doesn't really matter. Because the attacker is able to read or manipulate the data in the dispatcher cache. So while and browser <-SSL-> dispatcher <-SSL->CQ5 connection can be kind of secure, if the dispatcher/webserver itself decrypts and encrypts the requests, any attacker on that system will compromise the webserver itself and load an additional module, which dumps all data unencrypted.

  2. Don't let any attacker get access on the dispatcher box. Seriously, if the attacker has already got access to your network, you have more severe problems.

Improve this answer
1
  • Thanks for your response Jörg. I take your point regarding the dispatcher decrypting the data. I suppose the only difference would be whether an attacker would be forced to change configuration to access protected information. Of course dispatcher boxes would have the normal protection and no attacker would be given access to dispatchers. I was more concerned with limiting the impact should access be taken. the benefits. So stunnel is not much less secure that SSL, but there are no alternatives?
    – diffa
    Feb 5, 2013 at 10:31
0

The upcoming version 4.1.4 of Dispatcher supports SSL between the dispatcher and the publish instance offering end to end encryption.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .