2

We use a browser accessible CRM software in our office. Mainly it is a desktop solution, but with the browser access installed, it is available through https too (self signed certificate). Up till now, We only allowed to access it on the local network, so anyone who wanted to use it from outside connected to our OpenVPN server. The problem is, some users are plain stupid and cannot use the VPN client to connect (even though I made tutorial videos :() and they always forget to disconnect, thus hogging the resources of our servers (more like bandwidth).

Also, the users use stupidly easy passwords (yeah..), so just opening up the site to the outside is not an option. Is there a solution for securing such big security hole? I thought about making something in the middle that would authenticate the users based on a pre-distributed certificate, maybe they can install the certificate once in their browser, but i don't know how secure that would be.

Edit:

The clients use their own personal devices to connect to our servers. Until now, they used OpenVPN, but we would like to stop that method of connection and only allow the website to be used. The website pops up a login page if you open it (uses some kind of SAML2 authentication, requires you to accept two certificates), after that you need to provide a username and password, which is the same as you would use in the desktop application. These password are not secure, too easy to guess and the users don't want to change them. I need an option, where with the smallest possible work, an end user can configure a secure access to this website and after passing that first layer of authentication, can login with his unsecure password.

I can access the website's configuration, but there is not much I can do there regarding this problem. That is why I though of solving this before the website's login page.

(The platform is SAP Business One 9.2 Server, with SAP GateKeeper / Browser Access for B1 9.2. Both the SAP Server and the SAP Browser access is hosted on a Windows Server 2012R2, but on separate machines, the browser access is a virtual one and the SAP Server is a dedicated one. Also we have a pfSense Router)

Improve this question
2
  • A transparent VPN like Microsoft DirectAccess might do the trick
    – paj28
    Mar 27, 2017 at 11:06
  • Ok, knowing it is SAP makes a difference. It means that options are possible, even though you will have to pay for everything. But at least it's not a small provider with limited options. The fact that you need to allow personal devices makes this much, much harder. 2FA is possible, but you need to pay for that module. Client certs are an option, but installation and maintenance will be a headache.
    – schroeder ♦
    Mar 27, 2017 at 12:30

1 Answer 1

Reset to default
5

You could:

  • enforce strong passwords on the site
  • install client side certificates
  • specify a connection timeout on the VPN
  • implement two-factor authentication on CRM access

For remote use, you'll need to install a certificate from a recognised Certificate Authority and enforce connectivity over TLS.

Improve this answer
3
  • all these assume that these are available configurations on the CRM platform
    – schroeder ♦
    Mar 27, 2017 at 10:56
  • How can I install client side certificates that securely redirect the user to the website?
    – appl3r
    Mar 27, 2017 at 11:45
  • @appl3r certificates do not redirect - they authenticate
    – schroeder ♦
    Mar 27, 2017 at 12:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .