[Evergreen-general] Encrypted SIP2

Blake Henderson blake at mobiusconsortium.org
Tue Jan 5 14:31:08 EST 2021


John,

Sorry :( no WordPress plugin. Sounds like fun though!

-Blake-
Conducting Magic
Can consume data in any format
MOBIUS

On 1/5/2021 12:12 PM, Lolis, John wrote:
> That's great, Blake!  I don't suppose you would also have a WordPress 
> plugin that would allow it to communicate using SIP2?  That's my holy 
> grail these days.
>
> John Lolis
> Coordinator of Computer Systems
>
> 100 Martine Avenue
> White Plains, NY  10601
>
> tel: 1.914.422.1497
> fax: 1.914.422.1452
>
> https://whiteplainslibrary.org/ <https://whiteplainslibrary.org/>
>
> /When you think about it, /all/ security is ultimately security by 
> ignorance./
>
>
>
> On Tue, 5 Jan 2021 at 11:56, Blake Henderson 
> <blake at mobiusconsortium.org <mailto:blake at mobiusconsortium.org>> wrote:
>
>     Wendell,
>
>     I'd like to add one more idea/tool. We developed a SIP proxy for a
>     computer/Raspberry Pi that can be located on the library's LAN,
>     which negotiates the tunnel to the Evergreen server using
>     pre-setup keys. Just another thing that might help you:
>
>     https://github.com/mcoia/evergreen_sip_proxy
>     <https://github.com/mcoia/evergreen_sip_proxy>
>
>     Lightening talk on the matter:
>     http://slides.mobiusconsortium.org/blake/sip_proxy/#/
>     <http://slides.mobiusconsortium.org/blake/sip_proxy/#/>
>
>     -Blake-
>     Conducting Magic
>     Can consume data in any format
>     MOBIUS
>
>     On 1/5/2021 9:44 AM, Josh Stompro wrote:
>>     Wendell, I just wanted to add another confirmation, we have had
>>     100% success requiring encrypted tunnels for sip2 access with
>>     outside vendors. Overdrive, Hoopla, OCLC (VDX ILL), BrainFuse, 
>>     Stunnel has been the easiest to setup, since it is just SSL one
>>     vendor was easily able to adjust their own software to
>>     natively connect via ssl and didn't need to run stunnel on their
>>     end at all.
>>
>>     We also offer SSH tunneling, but that takes a bit more work to
>>     setup, and I don't think anyone actually is using that method
>>     right now.  I did exchange 4 emails with OCLC support where they
>>     repeatedly used the term SSH but then finally said that what they
>>     meant was Stunnel, sigh.  I also had to quote a library journal
>>     article from a few years ago where OCLC said "of course we
>>     support encrypted authentication for all our products" to get
>>     them to admit that they could do it.  That was a fun email to send.
>>
>>     The best thing to do is to put the encrypted sip authentication
>>     requirement in the contract with the vendor up front, which means
>>     you have to be at the table when negotiating with them.  I think
>>     vendors that use SIP2 are getting much better about supporting
>>     encryption in general.  I think it is getting hard for them to
>>     say yes to "So you don't want to protect our patrons private
>>     personal information and allow us to comply with our state laws
>>     about patron privacy?"
>>
>>     If you are going to self host an evergreen system and want notes
>>     on how to setup stunnel just let me know.  Otherwise if you are
>>     looking at a hosted solution then the hosting provider can
>>     provide those assurances about stunnel being provided as an option.
>>     Josh
>>
>>     On Tue, Jan 5, 2021 at 8:46 AM Rogan Hamby
>>     <rhamby at equinoxinitiative.org
>>     <mailto:rhamby at equinoxinitiative.org>> wrote:
>>
>>         I'll just note that I have setup several Envisionware
>>         instances to use stunnel and encrypt the SIP2 communication
>>         back to Evergreen as Jason Boyer describes with no issues. 
>>         It's transparent to the clients as you would expect.
>>
>>
>>
>>         On Tue, Jan 5, 2021 at 9:42 AM Jason Boyer
>>         <jboyer at equinoxinitiative.org
>>         <mailto:jboyer at equinoxinitiative.org>> wrote:
>>
>>             Hi Wendell, there isn’t really anything that can be done
>>             to SIP2 to make it secure without making it not-SIP2.
>>             That said, what can be done is to transfer it over an
>>             encrypted channel. I know some Evergreen and Koha systems
>>             handle SIP2 this way and I suspect TLC is doing the same.
>>             This tunneling can be done with stunnel (an openssl TLS
>>             tunnel) or ssh port redirection and most vendors are
>>             capable of dealing with one or the other.
>>
>>             There’s nothing special needed in Evergreen to handle
>>             this; you just need to setup SIPServer to listen to a
>>             local IP rather than a public one and coordinate with the
>>             vendor what type of tunnel to use. I realize this is
>>             pretty non-specific but if you have any questions I or
>>             someone else on the list should be able to help out.
>>
>>             Jason
>>
>>             -- 
>>             Jason Boyer
>>             Senior System Administrator
>>             Equinox Open Library Initiative
>>             phone:  +1 (877) Open-ILS (673-6457)
>>             email:  JBoyer at EquinoxInitiative.org
>>             <mailto:JBoyer at EquinoxInitiative.org>
>>             web: https://EquinoxInitiative.org/
>>             <https://EquinoxInitiative.org/>
>>
>>>             On Jan 5, 2021, at 9:05 AM, Gragg, Wendell E
>>>             <WGragg at bryantx.gov <mailto:WGragg at bryantx.gov>> wrote:
>>>
>>>             Hi all.  I haven’t posted in a while, but we are still
>>>             in the process of evaluating ILS systems and our city IT
>>>             department is balking at one thing, SIP2 being plain
>>>             text. Apparently, one vendor, TLC claims they have an
>>>             encryption solution for SIP2, but I question whether it
>>>             actually works or not, and TLC is another proprietary
>>>             system, which we are trying to avoid.
>>>             I have been trying to research SIP2 a bit more and am
>>>             not finding a lot of information about security issues
>>>             with it.  I’m also trying to find out if anyone in the
>>>             Evergreen community has worked with encrypting SIP2
>>>             messages, at least sensitive information like passwords
>>>             and user barcodes.
>>>             Is this even possible in Evergreen and has it caused any
>>>             problems with outside vendors like OCLC or Envisionware?
>>>             I would like to find this out because I fear that our
>>>             city IT is going to force us into an ILS we really don’t
>>>             want.
>>>             Thanks,
>>>             Wendell
>>>             Wendell Gragg, MSIS
>>>             Automation Services Supervisor
>>>             Bryan+College Station Public Library System
>>>             Bryan, TX
>>>             979-209-5613
>>>             _______________________________________________
>>>             Evergreen-general mailing list
>>>             Evergreen-general at list.evergreen-ils.org
>>>             <mailto:Evergreen-general at list.evergreen-ils.org>
>>>             http://list.evergreen-ils.org/cgi-bin/mailman/listinfo/evergreen-general
>>>             <http://list.evergreen-ils.org/cgi-bin/mailman/listinfo/evergreen-general>
>>
>>             _______________________________________________
>>             Evergreen-general mailing list
>>             Evergreen-general at list.evergreen-ils.org
>>             <mailto:Evergreen-general at list.evergreen-ils.org>
>>             http://list.evergreen-ils.org/cgi-bin/mailman/listinfo/evergreen-general
>>             <http://list.evergreen-ils.org/cgi-bin/mailman/listinfo/evergreen-general>
>>
>>         _______________________________________________
>>         Evergreen-general mailing list
>>         Evergreen-general at list.evergreen-ils.org
>>         <mailto:Evergreen-general at list.evergreen-ils.org>
>>         http://list.evergreen-ils.org/cgi-bin/mailman/listinfo/evergreen-general
>>         <http://list.evergreen-ils.org/cgi-bin/mailman/listinfo/evergreen-general>
>>
>>
>>
>>     -- 
>>     Josh Stompro - IT Director
>>     Lake Agassiz Regional Library
>>     Desk: 218-233-3757 Ext 139
>>     Cell: 218-790-2110
>>
>>     _______________________________________________
>>     Evergreen-general mailing list
>>     Evergreen-general at list.evergreen-ils.org  <mailto:Evergreen-general at list.evergreen-ils.org>
>>     http://list.evergreen-ils.org/cgi-bin/mailman/listinfo/evergreen-general  <http://list.evergreen-ils.org/cgi-bin/mailman/listinfo/evergreen-general>
>
>     _______________________________________________
>     Evergreen-general mailing list
>     Evergreen-general at list.evergreen-ils.org
>     <mailto:Evergreen-general at list.evergreen-ils.org>
>     http://list.evergreen-ils.org/cgi-bin/mailman/listinfo/evergreen-general
>     <http://list.evergreen-ils.org/cgi-bin/mailman/listinfo/evergreen-general>
>
>
> _______________________________________________
> Evergreen-general mailing list
> Evergreen-general at list.evergreen-ils.org
> http://list.evergreen-ils.org/cgi-bin/mailman/listinfo/evergreen-general

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://list.evergreen-ils.org/pipermail/evergreen-general/attachments/20210105/494bd9d3/attachment-0001.html>


More information about the Evergreen-general mailing list