<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Good info. I will pass that on!<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Wendell Gragg, MSIS<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Automation Services Supervisor<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Bryan+College Station Public Library System<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Bryan, TX<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">979-209-5613<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Evergreen-general <evergreen-general-bounces@list.evergreen-ils.org>
<b>On Behalf Of </b>Josh Stompro<br>
<b>Sent:</b> Tuesday, January 5, 2021 9:45 AM<br>
<b>To:</b> Evergreen Discussion Group <evergreen-general@list.evergreen-ils.org><br>
<b>Subject:</b> Re: [Evergreen-general] Encrypted SIP2<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p align="center" style="text-align:center"><strong><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif;color:black">Notice: EXTERNAL EMAIL! </span></strong><strong><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif;color:green">Phishing
= #1 threat to Cyber Security.</span></strong><strong><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif;color:red"> Is this a phishing email? – Look again!</span></strong><b><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif;color:black"><o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif;color:black"><o:p> </o:p></span></p>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="100%" align="center">
</div>
</div>
<p class="MsoNormal">Wendell, I just wanted to add another confirmation, we have had 100% success requiring encrypted tunnels for sip2 access with outside vendors. Overdrive, Hoopla, OCLC (VDX ILL), BrainFuse, Stunnel has been the easiest to setup, since
it is just SSL one vendor was easily able to adjust their own software to natively connect via ssl and didn't need to run stunnel on their end at all.<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">We also offer SSH tunneling, but that takes a bit more work to setup, and I don't think anyone actually is using that method right now. I did exchange 4 emails with OCLC support where they repeatedly used the term SSH but then finally
said that what they meant was Stunnel, sigh. I also had to quote a library journal article from a few years ago where OCLC said "of course we support encrypted authentication for all our products" to get them to admit that they could do it. That was a fun
email to send.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">The best thing to do is to put the encrypted sip authentication requirement in the contract with the vendor up front, which means you have to be at the table when negotiating with them. I think vendors that use SIP2 are getting much better
about supporting encryption in general. I think it is getting hard for them to say yes to "So you don't want to protect our patrons private personal information and allow us to comply with our state laws about patron privacy?"<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">If you are going to self host an evergreen system and want notes on how to setup stunnel just let me know. Otherwise if you are looking at a hosted solution then the hosting provider can provide those assurances about stunnel being provided
as an option.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Josh<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Tue, Jan 5, 2021 at 8:46 AM Rogan Hamby <<a href="mailto:rhamby@equinoxinitiative.org">rhamby@equinoxinitiative.org</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<p class="MsoNormal">I'll just note that I have setup several Envisionware instances to use stunnel and encrypt the SIP2 communication back to Evergreen as Jason Boyer describes with no issues. It's transparent to the clients as you would expect.<br clear="all">
<o:p></o:p></p>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:7.5pt;color:black;background:white"><o:p> </o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Tue, Jan 5, 2021 at 9:42 AM Jason Boyer <<a href="mailto:jboyer@equinoxinitiative.org" target="_blank">jboyer@equinoxinitiative.org</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<p class="MsoNormal">Hi Wendell, there isn’t really anything that can be done to SIP2 to make it secure without making it not-SIP2. That said, what can be done is to transfer it over an encrypted channel. I know some Evergreen and Koha systems handle SIP2 this
way and I suspect TLC is doing the same. This tunneling can be done with stunnel (an openssl TLS tunnel) or ssh port redirection and most vendors are capable of dealing with one or the other.<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">There’s nothing special needed in Evergreen to handle this; you just need to setup SIPServer to listen to a local IP rather than a public one and coordinate with the vendor what type of tunnel to use. I realize this is pretty non-specific
but if you have any questions I or someone else on the list should be able to help out.<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Jason<o:p></o:p></p>
</div>
<div>
<div>
<p class="MsoNormal"><br>
-- <br>
Jason Boyer<br>
Senior System Administrator<br>
Equinox Open Library Initiative<br>
phone: +1 (877) Open-ILS (673-6457)<br>
<a href="mailto:JBoyer@EquinoxInitiative.org" target="_blank">email: JBoyer@EquinoxInitiative.org</a><br>
web: <a href="https://EquinoxInitiative.org/" target="_blank">https://EquinoxInitiative.org/</a><o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">On Jan 5, 2021, at 9:05 AM, Gragg, Wendell E <<a href="mailto:WGragg@bryantx.gov" target="_blank">WGragg@bryantx.gov</a>> wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Hi all. I haven’t posted in a while, but we are still in the process of evaluating ILS systems and our city IT department is balking at one thing, SIP2 being plain text.
Apparently, one vendor, TLC claims they have an encryption solution for SIP2, but I question whether it actually works or not, and TLC is another proprietary system, which we are trying to avoid.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">I have been trying to research SIP2 a bit more and am not finding a lot of information about security issues with it. I’m also trying to find out if anyone in the Evergreen
community has worked with encrypting SIP2 messages, at least sensitive information like passwords and user barcodes.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Is this even possible in Evergreen and has it caused any problems with outside vendors like OCLC or Envisionware?<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">I would like to find this out because I fear that our city IT is going to force us into an ILS we really don’t want.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Thanks,<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Wendell<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Wendell Gragg, MSIS<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Automation Services Supervisor<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Bryan+College Station Public Library System<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Bryan, TX<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">979-209-5613<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> <o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif">_______________________________________________<br>
Evergreen-general mailing list<br>
</span><a href="mailto:Evergreen-general@list.evergreen-ils.org" target="_blank"><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif;color:#954F72">Evergreen-general@list.evergreen-ils.org</span></a><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif"><br>
</span><a href="http://list.evergreen-ils.org/cgi-bin/mailman/listinfo/evergreen-general" target="_blank"><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif;color:#954F72">http://list.evergreen-ils.org/cgi-bin/mailman/listinfo/evergreen-general</span></a><o:p></o:p></p>
</div>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<p class="MsoNormal">_______________________________________________<br>
Evergreen-general mailing list<br>
<a href="mailto:Evergreen-general@list.evergreen-ils.org" target="_blank">Evergreen-general@list.evergreen-ils.org</a><br>
<a href="http://list.evergreen-ils.org/cgi-bin/mailman/listinfo/evergreen-general" target="_blank">http://list.evergreen-ils.org/cgi-bin/mailman/listinfo/evergreen-general</a><o:p></o:p></p>
</blockquote>
</div>
<p class="MsoNormal">_______________________________________________<br>
Evergreen-general mailing list<br>
<a href="mailto:Evergreen-general@list.evergreen-ils.org" target="_blank">Evergreen-general@list.evergreen-ils.org</a><br>
<a href="http://list.evergreen-ils.org/cgi-bin/mailman/listinfo/evergreen-general" target="_blank">http://list.evergreen-ils.org/cgi-bin/mailman/listinfo/evergreen-general</a><o:p></o:p></p>
</blockquote>
</div>
<p class="MsoNormal"><br clear="all">
<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">-- <o:p></o:p></p>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal">Josh Stompro - IT Director<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Lake Agassiz Regional Library<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Desk: 218-233-3757 Ext 139<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Cell: 218-790-2110<o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>