Making the Document Management Server Internet Accessible

Disclaimer: The information stated here and in the Installing SSL on the FileHold Server for Windows 2008 x64 IIS 7 guide is provided for customer convenience and does not imply anything beyond being an information exchange. It is recommended that a security consultant or an organizations' internal IT security department be made responsible for making the document management server available via the web or accessible to external users.

FileHold Systems does not provide specific support or assistance or take any responsibility for security breaches as a result of making the FileHold Server accessible on the Internet. FileHold is not a security consulting firm and is providing the following high level information for information only.

To make the document management server accessible via the web,  Port 80 can be opened for a web application or port 443 for SSL (more secure) on the firewall and forward that to the FileHold server's internal IP address. This requires some additional setup (below) if you wish to use SSL to protect information between user and server. We strongly recommend that you use an SSL certificate to secure transmission between end-user and server.

There are a variety of methods to access the document management software remotely.

VPN tunnels, Windows Terminal Services, Windows Remote Desktop Services and Citrix XenApp are some of  the most popular methods of secure remote access. Following are a few methods used by customers and resellers listed from most common to least common:

• Windows Terminal Services / Remote Desktop Services. The Client, Microsoft Office, WebClient, etc. are all configured on the Terminal Server. This is not the same server as the FileHold server. Various FileHold Customers use this

• Citrix XenApp. This is similar to Terminal Services. Various FileHold Customers use this.

• 2X Application Server.  Various customers use this solution from 2X to deliver applications remotely.

• VPN Access. This is very common, and there are countless VPN solutions to use. If you are using VPN access, then once implemented - your users, once they have VPN'd into the network - can access authorized resources like the FileHold server address.

• Other Secure Remote Access Products. There are too many to list.

• Secure HTTPS access to the Server. This method is explained below. There are security risks to publicly exposing a server on the Internet. This is the least common method.

External Secure HTTPS Access to the Document Management Software on the Public Internet

WARNING!: These steps are best left to expert IT personnel with a background in security and a strong working knowledge of Windows 2008 IIS 7 Web Server and in publicly Hosting Windows servers. Please do not ask FileHold to help you set this up. FileHold cannot do this due to liability reasons.

Some customers and resellers do host the document management software publicly on the Internet by following some simple guidelines. FileHold is a web server based application, so it needs to be secured properly for it to work publicly. FileHold offers this as information / advice only. Here are some of the things you should do to secure the system:

1. Obtain a strong firewall to protect the FileHold server system.

2. Map in global DNS for the domain name to create a domain record for SOMETHING.YOURDOMAIN.COM to a public IP managed by your firewall. Ideally the "SOMETHING" will be the same as the name of your FileHold server. For example "FILEHOLD. YOURDOMAIN.COM".

3. Port forward Port 80 and Port 443 (HTTP and HTTPS) in the firewall all requests from the public IP assigned to SOMETHING.YOURDOMAIN.COM to the internal IP of the FileHold server.

4. Generate an SSL certificate for SOMETHING.YOURDOMAIN.COM and install it on IIS 7. Download the Installing SSL on the FileHold Server for Windows 2008 x64 IIS 7 guide.

5. Run the FileHold Server based FHInstrumentation tool to change all web.config's to enable HTTPS, then restart IIS as stated in the Installing SSL on the FileHold Server for Windows 2008 x64 IIS 7 guide.

6. The IT security expert should run a vulnerability scanner (NESSUS, or similar) regularly to probe for vulnerabilities on the public IP address to identify potential security flaws.

Install_SSL_FileHold_Server_Windows2008x64IIS7Z.pdf