0

I developed a JavaFx Desktop program the employees of the company. Now, they want to use the program in their houses with their own personal computers. The program has MySQL and FTP services.

I need to use SSH Tunnel or VPN so that the program can connect from outside to the remote server in the office(port forwarding for FTP and MySQL).

If I want to use SSH Tunnel I have to install(or copy/paste) the certificates in the own employees' computers and I think that this option is dangerous because of the certificates can be engaged to attacks of their computers.

Sometimes I have thought to create one certificate for each employee (100 people) to control better who is connected in each time, but it's too much laborious to maintain.

I would like to use SSH Tunnel but I don't know if the best option in this situation.

What other options can I use to connect my program to remote server securely?

Arkhan6
  • 3
  • 1

2 Answers2

0

There aren't a lot of protocol choices - whatever you choose needs to be:

  • Auditable - no sharing of credentials
  • Secured - to limit risk of traffic interception/MitM
  • Manageable - if you've 100+ employees.

You could use SSH, but setting up a VPN is what most business do (in my experience). You can then only allow VPN connections through the firewall and nothing else needs to change.

Your best bet is to look into a small business VPN device. A quick search here brings up lots of (off-topic) posts asking for recommendations.

Long story short, whatever you use you're going to have to create and issue a cert or key to every employee. The only sensible way to do this is using script or management tool.

shearn89
  • 3,403
  • 2
  • 15
  • 39
  • Thank you so much for your answer. I have been thinking about do it with split tunneling with OpenVPN because I only need to use 2 ports. I don't want that all the traffic of the employees is sent throutgh the VPN. I hope it isn't a problem have to install the VPN certificate on personal employees computers (I will use password to connect the VPN as well) https://openvpn.net/for/split-tunneling-with-access-server/ – Arkhan6 Dec 23 '21 at 09:36
  • This sounds sensible. Ideally it would be good to use a more enterprise solution that uses the employees LDAP/AD Accounts for authentication - the first point I made is that it's auditable so no sharing of credentials! – shearn89 Dec 23 '21 at 09:38
  • I don't have knowledge about use LDAP/AD accounts. I'm going to search information so that I can use it. Thanks! – Arkhan6 Dec 23 '21 at 10:13
-1

As you mentioned I would authorize the employees with the private key from the generated public/private rsa key pair for ssh connection to the office server. You can store the public key in ~/.ssh/authorized_keys and secure the private key with passphrase so that the employee can connect to server. But you must open the ssh port in the firewall for outside.

Hakikat41
  • 1
  • This is terrible security practice! Remote access is a big can of worms and should be done securely or not at all, as the risks to the business are way too high! – shearn89 Dec 22 '21 at 09:56