How Secure is Your E-commerce?-1998-06-16-Red Hat's new Secure Web Server plus a peek at Linux 5.1-Maggie Biggs

A mobile employee needs to access the company intranet database for the latest sales figures. A regular supplier needs to send you confidential information. How can you be sure you're dealing with the right people? And how can you keep your communications with them truly secure? The answer is adding Secure Sockets Layer (SSL) and digital certificates to your Web server.

Of course, if you run your server with Windows NT or similar products from Netscape or Lotus, you already have support for SSL and digital certificates. But Linux users haven't been quite so blessed-until now. Although the free Apache Web server offers a robust SSL implementation, it doesn't support digital certificates. Red Hat's new Secure Web Server finishes the job by pulling Apache-SSL and digital certificate support into one neat package.

Now, would I run a heavy-duty commerce site with Red Hat Secure Web Server? Probably not. But it's a good solution-and NT's equal-for extranets (where you exchange sensitive information with another company) and intranets used by remote employees.

Meet SSL

You use the TCP/IP protocol to communicate across the Internet and the HTTP protocol to browse your favorite Web site. When you implement SSL on your Web server, it's sandwiched between TCP/IP, HTTP, and other application protocols such as FTP. SSL provides data encryption, server authentication, message integrity, and optional client authentication during the session.

SSL does all of this more or less transparently. Let's say an authorized customer wants to access your secure SSL commerce Web server connected to your intranet. Before the customer even taps in her Visa card number, her browser sends your commerce server a connection request and a public key that uniquely identifies the customer. The server sends back an encrypted response that includes connection information and the server's public key. The browser responds with an encrypted message requesting a private session key. When the customer finally buys a product and supplies her credit card number, the information and private key are encrypted and sent to the server. Not only is the credit card number secure, but the server can truly authenticate the customer's identity. This swapping of encrypted information and keys continues for the duration of the online ordering session.

The Certificate Angle

What Red Hat's $99 Secure Web Server adds to the Apache-SSL mix is support for digital certificates. It lets visitors confirm the identity of the organization running the Web server.

On the server side, your Webmaster must create a random encryption key and place it in a certificate request file. (Red Hat's Secure Web Server does that with two keystrokes.) The certificate request and documents verifying your company's existence (such as a copy of your business license) are then sent to a certificate authority. The certificate authority is a third party that verifies your company's claims and supplies you with a digital certificate that can be placed on your Web server.

Now when customers visit your site, they'll know for certain they're dealing with you and not some rogue hacker. Their browsers will display a notice and let them view your certificate. That should go a long way toward easing their anxieties about parting with credit card and other sensitive information.

Just keep in mind that the peace of mind certificates offer is limited. For starters, there are a number of competing certificate authorities, and they're all mutually incompatible. Red Hat's Secure Web Server supports two of the more popular providers, VeriSign (www.verisign.com) and Thawte (www.thawte.com). Also, visitors must also be using either Navigator 3.x/4.x or IE 4.x. And adding certificates to your server costs money. VeriSign charges $349 for the first Web server and $249 for each additional server, while Thawte generally charges $125 per server. (Red Hat customers get $25 off.) Finally, digital certificates aren't foolproof. Certificates have been copied, stolen, or hacked. (For more information, see "Certifiable" at www.currents.net/magazine/national/1516/intb1516.html.)

By the way, Red Hat's Secure Web Server offers other goodies. You get Perl scripting access to Apache's C programming interface and PHP scripting support, which are faster alternatives to CGI. There's also a proxy server that speeds user browsing by storing frequently viewed pages in a RAM or disk cache. And you get a utility that tracks server activity.

Meet Linux 5.1

While testing Secure Web Server, I also spent time with Red Hat's Linux 5.1 and was impressed with its stability and completeness. Installation has been greatly streamlined and includes helpful extras, such as a back key so you can step back to the previous dialog box. There's also the new LinuxConf utility, which lets administrators easily control settings from a single interface.

Do you need to back up network information, servers, and clients? Linux 5.1 has got it. You also get a CD-ROM chock-full of functional Linux software, such as WordPerfect 7.0 (limited to 30 days), Principia (Web serving), and Regullis (accounting).

Altogether, Red Hat's two offerings-Secure Web Server and Linux 5.1-are worth serious consideration. Linux 5.1 gives you everything you need to run your intranet and then some, and you get 90 days of e-mail and fax support. Secure Web Server is the only product I know of that adds digital certificates to Apache-SSL. Of course, if you don't need certificates, just download Apache-SSL for free at www.apache-ssl.org. Both products offer terrific value, stability, and a wealth of necessary features.

Maggie Biggs is a senior analyst at the InfoWorld Test Center, where she evaluates emerging application and database technologies. You can reach her at maggie_biggs@infoworld.com or care of Computer Currents.

Where to Buy

Red Hat Secure Web Server 1.0
Red Hat Linux 5.1
Red Hat
888/733-4281
www.redhat.com
List price: $49.95, Linux 5.1; $99.95, Secure Server