New answers tagged


My thinking would be to keep it as simple as possible. Use a reverse proxy in your DMZ with ssl termination for encryption. I personally use nginx on Centos but have used HAProxy before and they are both straightforward to set up. Both of them have community and commercial editions. You might be able to find Docker images of nginx or HAProxy. Your app ...


My vote is TMG. This will allow the service to be exposed while still allowing inspection of the traffic before it reaches the internal server. Much like the VPN, it can be configured to require a client side certificate and/or a password for authentication as well as supporting a variety of encryption methods. This will prevent random scanners and ...


You can use TLS with client authentication. The communication is encrypted and both server and client have to prove their authenticity by providing valid certificates. You can install a reverse proxy in front of the existing server to handle encryption.


I would personally use a VPN and make the service accessible from the local network (VPN connections would appear to be local). When using a VPN connection everything is encrypted and you require credentials to use the VPN. These credentials could change on a weekly, monthly basis, etc, etc. Very short answer but it is very black and white.


From strictly a security standpoint, you can do it this way, but it is not ideal. Even though the credentials are only stored temporarily on the server (and perhaps configured to only be stored in memory too), the fact that they are there longer than they potentially need to be poses a risk, albeit a small one. Note that encrypting the credentials in session ...

Top 50 recent answers are included