Arc Forumnew | comments | leaders | submitlogin
Arc Web Server Security Protocols?
1 point by thaddeus 5947 days ago | 4 comments
Just wondering if anyone has thought about data security using the arc web server. Any advice on how to ? I know nothing about data security other than people pay verisign for a security token.

Wondering if there's a better/cheaper way? I don't own a business so my concern is really just about accessing my stuff from work.... etc.

Thanks, T.



3 points by CatDancer 5947 days ago | link

You mention verisign, so I assume that you're talking about using HTTPS to access your web site securely. (See http://en.wikipedia.org/wiki/Https for details).

Using HTTPS does two things: it encrypts the data being sent between the browser and the web server so that no one can listen in, and it verifies that you're actually connecting to your web server (that someone hasn't manipulated DNS so that you think you're getting your web server but you're actually getting an evil server that wants to steal your passwords or whatever).

When you pay a registrar for a certificate, you're paying for the second purpose, so that when a user connects to your web site foo.com they know, by virtue of the registrar's certificate, that they're getting your foo.com, not someone pretending to be foo.com.

However, if all you want is for you to be able to connect to your web site securely, you don't need to pay for a certificate. You can create your own certificate (this is called a "self signed certificate", because you sign it yourself, instead of having a registrar sign it). When you connect to your web site which has a self signed certificate, your browser will put up a big warning message saying that it can't verify the certificate itself, and so doesn't know if you have connected to the right server. However, you can look at the certificate and check that it's your certificate, even though the browser doesn't know if the certificate is valid. And the data between the browser and the web site will be encrypted just the same.

On the other hand, I've heard that you can get a certificate from a cheap registrar for a little at $15/year, so if you want other people to be able to connect to your site using HTTPS without getting the browser warning, that's no big deal.

Arc doesn't have HTTPS support built in, so if this is the kind of security you want, what you'd do is set up a web server (such as lighttpd or Apache) which does support HTTPS, and have it forward requests to your Arc server.

-----

2 points by thaddeus 5947 days ago | link

I see.... Thanks. I will forward an Apache server to the Arc server.

I am in the process of buying a "slice" from slicehost and setting up real website (my first time). Local8080 is getting dry as I can't show anyone the awesome things I am doing in arc!

T.

-----

1 point by CatDancer 5947 days ago | link

Hmm, because you mentioned verisign I jumped to the conclusion that you were talking about HTTPS, but by "data security" were instead talking about keeping people from breaking into your server? You wouldn't need HTTPS for that... with Slicehost or Linode you'll be using ssh to login to your server, and ssh is encrypted and secure.

-----

1 point by thaddeus 5947 days ago | link

You were correct. I was looking to log into my web-app using https. And in retrospect (you're right again) I could just log into the secure server and show the work that way too. All that being said I still would like to learn setting up https, even for the sake of learning (and I'm sure someday I will need to).

Thanks again. T.

-----