Trouble with SSL: Can't use "Audit Now"

Slyers · **Posted:** Thu Nov 13, 2008 9:13 pm

Hello,

I realize differents trys with Open Audit in order to use it in my company.
This morning, i tried to use Ldap for Open-Audit login, it works, it's good.
But, i just wanna say it's very unsecure to use it.
Indeed, when i've launched Wireshark to look frames, I've seen my login and password which was unencrypted.
That means if someone listens my network frames, he could kept my admin_account...
As far as I'm concerned, security is the most important element to take into account on my network.
Have you got solution(s) to remedy this?

Thanks.
(I'm sorry for my english I try to improve it :wink:

)

ef · **Posted:** Thu Nov 13, 2008 10:00 pm

You can enable https on your web server and https login on OA, so the traffic between your workstation and the OA server would be encrypted.
Still, credentials would be passed in clear text from the OA server to the LDAP server, but assuming that your servers are in a phisically secured area (datacenter, same LAN switch with no sniffing probes connected), IMO you could have a sufficient level of security...

NickBrown · **Posted:** Fri Nov 14, 2008 12:47 am

Following up from ef's response, this is a known issue. The solution is simple in principle: use LDAP over SSL. However, in practice there are a number of hurdles:

- The most common LDAP directory is AD which by default isn't configured for LDAP over SSL
- The standard PHP distributions do not support LDAP over SSL functionality

If this is a real concern you could use Open Audit authentication instead of LDAP.

Slyers · **Posted:** Mon Nov 17, 2008 10:31 pm

Hello,
Thanks for the answers,
Finally, I enable https (SSL) on my web server, but I have a new problem...
Indeed, I can't use "Audit now" because a message said "A security problem appeared" (maybe the english translation is not exact because it's in french for me :wink:

)
The Message box says trouble is at line 108 of "open-audit-of-...-to-...-from... .vbs" (it is the script which is temporarly executed on audited machine)
I've modified audit.conf + audit.vbs in order to put "https", but it's the same thing...

Is there someone who can resolve this trouble?
Thanks.

Slyers · **Posted:** Sat Jan 17, 2009 12:39 am

No one has the same problem???

A_Hull · **Posted:** Sat Jan 17, 2009 3:10 am

Try the latest SVN (1120) at time of writing. See if the issue has gone.

Slyers · **Posted:** Thu Jan 22, 2009 6:07 pm

[quote="A_Hull"]Try the latest SVN (1120) at time of writing.

A_Hull · **Posted:** Thu Jan 22, 2009 6:51 pm

This FAQ should point you in the right direction.
[url]http://www.open-audit.org/phpBB3/viewtopic.php?f=6&t=1430[/url]
If not, let us know.

Slyers · **Posted:** Mon Mar 02, 2009 11:45 pm

Hi,
I work under Debian Etch, i've download the subversion packet.
But when i realise: "svn-checkout https://open-audit.svn.sourceforge.net/ ... open-audit"
The first time i've seen a list of file and since this, console says only "Revision 1134 exctracted" (i've translate it to english)
Can you say me more about this?

Thanks;

Ben · **Joined:** Fri Apr 03, 2009 2:37 pm **Posts:** 13

Seems the option to audit now has also stopped working for me now that SSL has been implemented. The issue I feel might be related to IE security configuration?

leizz · **Joined:** Thu Oct 23, 2008 6:32 pm **Posts:** 4

Hi guys!

What about this issue: when https is enabled & "Audit my machine" is not working? I guess there are some problem sending data back to OA server. It gave me error on line 163 which is "http.send" on audit.vbs.

Also I changed manually in OA server URL some http --> https in audit.vbs but still, same error. Cant find any help from forum

Thank You,
leizz

Open-AudIT

Trouble with SSL: Can't use "Audit Now"

Who is online