Hello,
I would like to set up a WAPT server in an OVH VPS (Very Small Enterprise) to manage workstations located outside the network.
The WAPT server would be accessible from the internet, without direct LAN access. (WAPT Enterprise +deb13)
What are the recommended best practices for securing this type of installation: access filtering, ports to expose, protection of the administration console, certificates, etc.?
Thank you for sharing your experience.
Securing a WAPT server exposed in a SAS
Forum Rules
Community Forum Rules
* English support on www.reddit.com/r/wapt
* French community support is available on this forum
* Please prefix the topic title with [RESOLVED] if it is resolved.
* Please do not edit a topic that is tagged [RESOLVED]. Open a new topic referencing the old one.
* Specify the installed WAPT version, full version, and build number (2.2.1.11957 / 2.2.2.12337 / etc.) as well as the Enterprise/Discovery edition.
* Versions 1.8.2 and earlier are no longer supported. The only questions accepted regarding version 1.8.2 are related to upgrading to a supported version (2.1, 2.2, etc.).
* Specify the server OS (Linux/Windows) and version (Debian Buster/Bullseye - CentOS 7 - Windows Server 2012/2016/2019).
* Specify the OS of the administration/package creation machine and the machine with the problematic agent, if applicable (Windows 7/10/11/Debian 11/etc.).
* Avoid asking multiple questions when opening a topic, otherwise it may be ignored. If there are multiple topics, open separate topics, preferably one after the other and not all at the same time (i.e., do not spam the forum).
* Include code snippets, screenshots, and other images directly in the post. Links to Pastebin, Bitly, and other third-party sites will be systematically removed.
* As with any community forum, support is provided voluntarily by members. If you require commercial support, you can contact Tranquil IT's sales department at 02.40.97.57.55
Community Forum Rules
* English support on www.reddit.com/r/wapt
* French community support is available on this forum
* Please prefix the topic title with [RESOLVED] if it is resolved.
* Please do not edit a topic that is tagged [RESOLVED]. Open a new topic referencing the old one.
* Specify the installed WAPT version, full version, and build number (2.2.1.11957 / 2.2.2.12337 / etc.) as well as the Enterprise/Discovery edition.
* Versions 1.8.2 and earlier are no longer supported. The only questions accepted regarding version 1.8.2 are related to upgrading to a supported version (2.1, 2.2, etc.).
* Specify the server OS (Linux/Windows) and version (Debian Buster/Bullseye - CentOS 7 - Windows Server 2012/2016/2019).
* Specify the OS of the administration/package creation machine and the machine with the problematic agent, if applicable (Windows 7/10/11/Debian 11/etc.).
* Avoid asking multiple questions when opening a topic, otherwise it may be ignored. If there are multiple topics, open separate topics, preferably one after the other and not all at the same time (i.e., do not spam the forum).
* Include code snippets, screenshots, and other images directly in the post. Links to Pastebin, Bitly, and other third-party sites will be systematically removed.
* As with any community forum, support is provided voluntarily by members. If you require commercial support, you can contact Tranquil IT's sales department at 02.40.97.57.55
Hello,
TCP line 443 should be open from agent to server; that will be sufficient. The agent initiates the connection to the server.
Agent registration must be authenticated, ideally via Kerberos, to prevent unauthorized agents.
See this documentation for other recommendations: https://www.wapt.fr/fr/doc/wapt-securit ... erver-side
Have a good afternoon,
Bertrand
TCP line 443 should be open from agent to server; that will be sufficient. The agent initiates the connection to the server.
Agent registration must be authenticated, ideally via Kerberos, to prevent unauthorized agents.
See this documentation for other recommendations: https://www.wapt.fr/fr/doc/wapt-securit ... erver-side
Have a good afternoon,
Bertrand
-
sfonteneau
- WAPT Expert
- Messages: 2347
- Registered: July 10, 2014 - 11:52 PM
- Contact :
You can then test your Wapt server with this service: https://scan.comitari.fr
It scans the different configurations and tells you about the bad configurations.
It scans the different configurations and tells you about the bad configurations.
