How to Set Up Secure MobiLink Communications A whitepaper from Sybase iAnywhere TABLE OF CONTENTS 1 Mobilink Synchronization 1 The Scenarios 1 TCP/IP Synchronization 2 HTTP Synchronization 2 HTTPS Synchronization 2 HTTP Synchronization Through a Web Server 3 Authenticated HTTP Synchronization Through a Web Server 3 HTTPS Synchronization Through a Web Server 4 Conclusion i MOBILINK SYNCHRONIZATION MobiLink is the data synchronization component of SQL Anywhere. It includes a highly scalable data synchronization server and a set of synchronization clients, which can be UltraLite or SQL Anywhere databases. The back-office system may be a relational database such as Oracle, Sybase SQL Anywhere, Microsoft SQL Server, Sybase Adaptive Server Enterprise or IBM DB2; it may also be a web service or other interface to ERP or application server. Clients may run on anything from Smartphones to server machines. Security concerns introduce numerous complexities into synchronization setups: • Encryption - Encrypting data over public networks requires the use of security certificates and HTTPS synchronization (using either RSA or ECC encryption). • Authentication - HTTP network access restrictions require HTTP authentication. • Firewalls - Limiting the number of holes in organizational firewalls requires that communication go through intermediate software such as a web server or specialist security software. To meet these needs you may use web servers, SSL hardware accelerators, and load balancers between the clients and server. Each of these intermediate modules may have their own security settings and capabilities. To cope with this variety of configurations, MobiLink provides a set of parameters that you can set to enable data synchronization through whatever firewalls and intermediate modules you provide, in a secure manner. This document is a walk-through of some of the most common scenarios, showing what parameters you need to set in order to get synchronization to work. THE SCENARIOS The scenarios use the SQL Anywhere 10.0.0 software. The database in use is the SQL Anywhere 10 CustDB sample included with the package. Each scenario lists a command line to start the MobiLink server, and then also lists a MobiLink client set of synchronization parameters. These are listed as a ulsync command line, but should be easily transferable to UltraLite applications, where the parameters are provided in the application. To create an UltraLite database that can act as a remote database in the synchronization, run the following command: ulinit -a "uid=dba;pwd=sql;dsn=SQL Anywhere 10 CustDB" -c dbf=custdb.udb –n custdb_tables Each command line uses a lot of options, but for compactness I’ll list only the network connection parameters. A typical MobiLink server command line needs to be entered with a connection string, verbosity settings, logging settings, and so on: start mlsrv10 -c "dsn=SQL Anywhere 10 CustDB" -dl -fr -ot mlserver.mls -zu+ -v+ -x tcpip(port=2439) but in this paper it will be abbreviated to show just the network connection parameters, like this: mlsrv10 … -x tcpip(port=2439) A typical ulsync command line is like this: ulsync -c "dbf=custdb.udb" -v -e Username=50 -e "Version=custdb 10.0" -k tcpip -x port=2439 and will be abbreviated to this: ulsync … -k tcpip –x port=2439 To carry out the examples, use the full command lines above, modifying the network portions to fit the specific example. TCP/IP synchronization TCP/IP is the default synchronization stream, and is simple to run. Start the MobiLink server, optionally specifying TCP/IP and the port number. The following line explicitly sets the port to 2439, which is the default TCP/IP setting: mlsrv10 … -x tcpip(port=2439) Synchronize from the client, again specifying TCP/IP and the port: ulsync … -k tcpip -x port=2439 http synchronization Start the MobiLink server, specifying HTTP and the port number. The following line explicitly sets the port to 80, which is the default HTTP setting: mlsrv10 … -x http(port=80) Synchronize from the client, again specifying TCP/IP and the port: ulsync … -k http -x port=80 https synchronization In a production environment, you would probably get a security certificate from a signing authority, but this example uses the gencert utility (createcert in 10.0.1 and later) as a convenient way to generate a security certificate for testing purposes. The following session illustrates the entries needed. For more comprehensive security, the certificate should be signed by an external signing authority, but that is beyond the scope of this document. > gencert Certificate Generation Tool Choose certificate type ((R)SA or (E)CC): R Enter key length (512-2048): 1024 Generating key pair... Country Code: CA State/Province: Ontario Locality: Waterloo Organization: Sybase Organizational Unit: iAnywhere Common Name: UltraLite Serial Number: 1 Certificate valid for how many years: 2 Enter file path of signer's certificate: Certificate will be a self-signed root Enter password to protect private key: private_key_password Enter file path to save certificate: rsa_public_cert.crt Enter file path to save private key: rsa_private_key.crt Enter file path to save server identity: rsa_server_identity.crt If you have the SQL Anywhere security option, you can choose ECC (E) instead of RSA. Start the MobiLink server, specifying HTTPS and the port number, and referencing the server identity together with the password to protect the private key. The following line explicitly sets the port to 443, which is the default HTTPS setting. The command is broken across lines for easier reading, but should be entered on a single line: mlsrv10 … -x https(port=444;tls_type=rsa;certificate=rsa_server_identity.crt; certificate_password=private_key_password) Synchronize from the client, again specifying HTTPS and the port number and referencing the public certificate, which must be deployed with the client. The following line explicitly sets the port to 443, which is the default HTTPS setting. ulsync -k https -x port=444;tls_type=rsa;trusted_certificates=rsa_public_cert.crt You can optionally store certificate inside the UltraLite database, for example by using the –t option on ulcerate, in which case you do not need to reference the certificate explicitly at synchronization time. http synchronization through a web server In this scenario, you set up a web server that uses the redirector to route synchronization traffic to the MobiLink server. The scenario illustrates how to use IIS, but the principles are the same for other web servers. It is common practice to use the redirector to minimize the impact on the organization firewall. Settings for other web servers follow the same principles, but are not described in this document. In IIS, open the web site properties, go to Directory Security, and ensure that anonymous HTTP access is permitted. You need to copy two files into the Scripts virtual directory of your web site. If you don’t have a virtual directory named Scripts in the web site you need to create one. The default file-system path for the virtual directory is C:\ Inetpub\Scripts. Make a copy of the redirector.config file that is in the MobiLink\redirector subdirectory of your SQL Anywhere installation and change your copy to point to the MobiLink server on your machine. Here is only line that matters for demonstration purposes: ML="host=<machine-name>;port=8081; Copy both this redirector.config file and MobiLink\redirector\IIS5\iaredirect.dll to your web site’s Scripts folder. With this setup, you can start MobiLink, making sure that the port number matches the setting in redirector. config: mlsrv10 … -x http(port=8081) To synchronize, you need to point the synchronization client to the IIS web server, but also provide a URL suffix so that it can locate the redirector. Here is the command line: ulsync … -k http -x port=80;url_suffix=Scripts/iaredirect.dll/ml/ authenticated http synchronization through a web server If your security requirements require HTTP authentication, you can build this into the synchronization client as well. Sometimes HTTP authentication may be required by a mid-tier security software such as a web access manager. You can also require it from your web server by unchecking the Anonymous Access checkbox in the Directory Security dialog (see above). The simplest way to test this on your own machine is to leave the authentication type as Basic and then to supply the same user ID and password you use to log on to your computer. HTTP authentication is a process that is carried out between the client and intermediate software, and so requires no changes at the MobiLink server. Here is a client command line providing HTTP authentication. As the –x option is now getting long, it is split over several lines for display purposes. Remember that it needs to be entered as a single line. ulsync … -k http -x port=80; url_suffix=Scripts/iaredirect.dll/ml/; http_userid=<HTTP_USERID>; http_password=<HTTP_PASSWORD> https synchronization through a web server This final example uses encrypted HTTPS synchronization between the client and the web server, and then unencrypted HTTP communication inside the firewall between the web server and the MobiLink server. To create a security certificate, you need to make a request for a server certificate from within IIS. You can then use the SQL Anywhere gencert utility (or createcert in 10.0.1 and later) to process the request. For more advanced security you can send the request to an external certificate signing authority instead of using gencert. To create the request, open the IIS Web Site Properties sheet and go to the Directory Security tab. In the bottom panel (Secure communications) click Server Certificate and let the Server Certificate wizard guide you to create a new certificate. You should choose to prepare the request now, but send it later. On the Name and Security Settings dialog, you can leave both checkboxes unchecked. After that, the questions are the same as those listed in the gencert session above. Once you have created a certificate request file, you can use gencert to process the request. Here is a sample session, using the private key from the previous gencert certificate to sign a certificate for IIS: >gencert -q certreq.txt Certificate Generation Tool Serial Number: 12345678 Certificate valid for how many years: 1 Enter file path of signer's certificate: rsa_public_cert.crt Enter file path of signer's private key: rsa_private_key.crt Enter password for signer's private key: private_key_password Effective expiry is Fri Mar 28 09:23:11 2008 Enter file path to save certificate: iis_certificate.cer Save entire chain (y/n): y You can then go back to the IIS Server Certificate wizard and install the certificate file (iis_certificate.cer in this case). Once the certificate is installed, you are ready to synchronize. The MobiLink server can be run as a plain HTTP server, as above. At the client you need to supply the certificate information, the IIS url suffix and, if you have authentication required, the http authentication user name and password. Here is a command line with the –x option split over several lines for display purposes. The IIS server is assumed to be accepting HTTPS communications on the default HTTPS port, which is 443. ulsync … -k https -x port=443; url_suffix=Scripts/iaredirect.dll/ml/; http_userid=<HTTP_USERID >; http_password=<HTTP_PASSWORD> ; tls_type=rsa;trusted_certificates=rsa_public_cert.crt conclusion The MobiLink synchronization server and clients provide the flexibility to operate in all common network environments. The security requirements of authentication, encryption, and limited firewall ports make the setup inevitably more complex, but this paper has shown that the necessary information can always be supplied by the MobiLink server and the synchronization client. Copyright © 2007 iAnywhere Solutions, Inc. All rights reserved. Sybase, Afaria, SQL Anywhere, MobiLink, UltRaLite, and M-Business Anywhere are trademarks of Sybase, Inc. All other trademarks are property of their respective owners.
© Copyright 2018