"Quick request" voicemail from a client: Can you open port 80 to our server?

[HCHTech]

Why do these types of things always come in at the end of the day on Friday? Short answer, "No, I can't in good conscience do that. Let's start with discussing what you are trying to accomplish, sound good?"

Turns out they use a software called "BillQuick" for timekeeping and invoice generation. It runs on a SQL database on their app server. This product has a mobile app so folks can access it with their phones while offsite, that the client wants to enable instead of upgrading to the cloud-based version of the software because "It's really pricey".

I'm thinking: "Not as pricey as opening port 80 to your main application server" ha. This will be a fun conversation...

 

[Markverhyden]

Because it's Friday. Things can't be simple on Friday's.

If it was me I'd not necessarily shoot it down right away. Sure, just opening any common port sending traffic to the LoB server is always problematic.

I'd do some work on the mobile app features/functions. What's the edge situation? I'd probably build a VPN then run the app over that.

 

[HCHTech]

So the app hits a website created in IIS, which has to be open to the internet, of course. They have some free static IPs, so I could forward traffic on an unused IP to that site, but securing / segregating that traffic stream without affecting everything else going on in that server is problematic, at least. I have a call with the vendor on Monday so talk about their suggested setup. I would think you would want a dedicated server in a DMZ for that kind of thing. They've got a TZ500 Sonicwall at the edge, BTW.

 

[trevm999]

I would at least want to put Nginx in front. Also, doesn't this sounds traffic that should be going one HTTPS?

 

[Markverhyden]

Also, doesn't this sounds traffic that should be going one HTTPS?

I'm amazed, in this day and age, the number of companies who are completely ok with running sessions on HTTP vs HTTPS.

 

[YeOldeStonecat]

A Windows Server....with port 80 hanging on the internet.

Just get out the K-Y jelly and lube her up for a...pillaging! Yikes!

 

[Sky-Knight]

Ok everyone sing along...

That's what, VPNs are for!

 

[phaZed]

I'd be making them VPN into the network and getting to port 80 from that, keeping it off the net.

edit: @Sky-Knight Beat me to it, lol!