[Babase] Re: Ranker security problems

Jun Yang junyang at gmail.com
Thu Aug 16 23:46:15 EDT 2007


On 8/15/07, Karl O. Pinc <kop at meme.com> wrote:

> 1) Change the security regime at Duke so that it does
> not disable the VPN software's installation on Lacey's
> machine.

This seems really odd... Is it just OpenVPN or any
VPN client?

> 2) Allow the ranker program to access the database
> without using the VPN.
>
> 2a) This would mean allowing the Duke biology network
> access to the PostgreSQL database on Papio.  Hunter has
> already approved this, so I imagine he would approve
> this again.  Karl would have to re-enable encrypted
> network access to the database on Papio.  (At present
> the database server's database is reachable only via
> the virtual network running inside Papio.)
>
> 2b) The ranker program would have to be altered so that
> it will work both with and without the VPN running, for
> users at Princeton and Duke respectively.  This means
> changing the ranker so that it attempts to connect both
> via the VPN (to papio-vpn.biology.duke.edu) and
> directly over the local network (to
> papio.biology.duke.edu).  This may need to be
> coordinated with Dr. Jun Yang of Duke University, who
> supervised the coding of the program.
>
> Better yet, the ranker could ask about the machine to
> which it should connect.
>
> This may be the best solution for the long-term.

I think (2b) is clean and should be pretty easy to do.
Regardless of what issues we have with VPN, the
ranker should be made more flexible. I will take a look
the code this weekend.

On the other hand, I think we still might need to
address the (orthogonal) problem of VPN not working
on biology.duke.edu Windows PCs. For example,
hypothetically speaking, what if Princeton hosts
the database and we need to run ranker at Duke?

> 3) Use Duke supported VPN software rather than OpenVPN.
...
> This choice seems a bit involved.

I agree. It is involved, and too dependent on millions of other
things to work correctly.

> 4) Avoid Microsoft security issues by using a Mac.

This can be our last resort if for some reason even direct database
connections don't work from biology.duke.edu Windows boxes.

> 5) Rewrite the ranker so that it runs over the web.

Certainly possible, but it will be a completely different code
base, and it will introduce many new requirements on the Web
server that runs on papio. Since Web 2.0 is still evolving
these days, I think the pure client-side Java application
(which is what ranker is right now) will be much easier to
maintain.

--- Jun Y.


More information about the Babase mailing list