Web Server and WebSpeed Topology

[Cecil]

I have been reading a truck load of documents showing what security model should be set up for a secure Website.

Currently we have the WebSpeed Messenger and WebSpeed Broker running on our production machine.

Now after reading some documents this is a complete "NO NO..". Apparently the WebSpeed Messenger must run on a Web Server (that's a given) and the WebSpeed Broker to run on a Separate Server.

Does anyone conform to this security model?

Thanks.

 

[Casper]

At all our client sides we have the messenger installed on the webserver and the rest runs on the DB server.
Furthermore we use ScriptAliasing to get rid of the WService= stuff to get more friendly looking URL's. messenger is easily configured in case the webserver is in a DMZ.
Further best practices are changing the default portnumbers and names from NameServer and broker.
If you want, I have a pretty good PPT from Doug Merrit on WebSpeed and security.

Regards,
Casper.

 

[Cecil]

Thanks Casper.

I've tracked down the PP document from Doug Merrett. I worked with Doug back in the UK for a short while.

Anyway Doug's PP doc. confirms what I have been reading about security topologies.

But I have one more question. If you install only the "WebSpeed Messenger" on the web server, does the "OE Admin Service" gets installed as well?

If not how does one administer/configure the "Messenger" from a Progress Explorer Tool?

 

[Casper]

We do only an install of webspeed messenger. We only install messenger and choose to not copy the static the static html pages to docroot.
We configure it by editing the ubroker.properties file. (make a copy of msngrs.properties to ubroker.propertiesa and configure this). Since almost nothing has to be configured it is a fairly simple task to do.
Imo the webserver should be running as less services as possible.

Casper

 

[Optimum]

The Doug Merrit PPT anyone got a link to this?

 

[Cecil]

http://www.psdn.com/ak_download/media/exch_audio/2007/COMP/COMP-11_Merrett.ppt

 

[Casper]

The powerpoint presentation I referred to was from PDW 2004 and covered in detail how to configure webspeed within a dmz. I tried to search him just now but couldn't find it anymore on the net. If you are interested I can sent it to you offline. Just drop me a PM.

Regards,
Casper.