Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there an universal way to ensure that any connection to a service is encrypted? I mean, you can have HTTP for web, SFTP for file transfer, and SSMTP for mail, etc. but, is there a way to ensure any service talks through an encrypted connection? Kinda like tunneling but server-side.

I think VPN is an option but, there probably are other options, any suggestions?

share|improve this question
add comment

4 Answers

up vote 4 down vote accepted

The best way to setup arbitrary services to be secured is to use an IPSec tunnel. You should note you'll have to setup he IPSec properties on both end so you'll have to configure every client that connects to that service to use IPSec.

share|improve this answer
1  
Which can be automated/required within a Windows domain for instance... ^^ –  Oskar Duveborn Feb 4 '10 at 23:38
    
Excellent! Thanks! –  rgz Feb 5 '10 at 3:58
add comment

To ensure that all connections to some host (or remote network) are encrypted a VPN is probably your best option, but note that once the VPN is terminated traffic that comes out of either end isn't encrypted anymore: it's only secure while it's in transit.

To ensure that all connections to some specific service on a host are encrypted the best solution is to disallow unencrypted connections by disabling the unencrypted version of the service (e.g. ONLY serve web pages via HTTPS, ONLY allow SFTP, Require STARTTLS, etc.)
For HTTP there's the further option (at least in Apache) of setting SSLRequireSSL on locations or directories, so you can only get there via https:// and you get an error if you try to hit them via plain http://.

share|improve this answer
add comment

Well the universal answer is, "It depends..." :-)

I think the best way to start is to limit what CAN connect to your server / computer with a firewall (either builtin or 3rd party) and then secure the services that you need.

I know of a lot of companies that are moving to NAP (Network Access Protection) and builtin firewalls for LAN traffic and if it is Internet based then I would hope that you go thru the steps to only allow what is needed.

As far as how "universal" relates to security, I don't think that exists.

Anyone else?

share|improve this answer
    
I'll further research this option, thanks. –  rgz Feb 5 '10 at 3:57
add comment

Not unless you do something like SSH tunneling. If you just want the services with no VPN or tunnel, the services must support SSL or TSL.

See also: http://en.wikipedia.org/wiki/Tunneling_protocol http://www.ssh.com/support/documentation/online/ssh/winhelp/32/Tunneling_Explained.html

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.