Welcome to the NEW CHUG— your ultimate destination for cutting-edge insights and discussions at the intersection of healthcare and technology.

Our platform is dedicated to exploring the dynamic landscape of healthcare technology, empowering professionals, enthusiasts, and innovators alike with the knowledge and resources to navigate the rapidly evolving field.

From telemedicine revolutionizing patient care to the transformative potential of artificial intelligence in diagnostics, we delve into a myriad of topics shaping the future of healthcare delivery. Whether you’re a seasoned healthcare IT professional, an aspiring entrepreneur in the digital health space, or simply curious about the latest innovations, our curated content, expert interviews, and thought-provoking articles provide a comprehensive exploration of healthcare technology’s most pressing issues.

Join us as we navigate the forefront of innovation, driving forward the transformation of healthcare for a healthier, more connected world.

Have questions or suggestions? Please use the contact button below.

Notifications

Clear all

Revers Proxy Anyone?

General Discussion

Last Post by jsander 8 years ago

7 Posts

5 Users

0 Reactions

74 Views

RSS

gfishback

(@gfishback)

Posts: 70

Estimable Member

Topic starter

I have a need to expose the CPS Web Access to one of our payers. GE states that to provide adequate security, one must place it behind reverse proxy border security. This was a pretty simple setup and I now have an IIS web server reverse proxying to my CPS JBOSS server. The login screen comes right up but when you click the "login" button, you immediately get "Inactivity period exceeded" and are returned to the login screen. This seems to have something to do with JBOSS session ID. Anyone out there done this successfully?? Any hints, tips or suggestions? I've got a call into GE but expectations are low that I will get a good answer.

Greg

Posted : June 13, 2016 9:52 am

SLHV

(@slhv)

Posts: 478

Honorable Member

I've seen a CPS read only website referenced before but haven't set it up myself.

I just want to point out that I would not expose the JBOSS server directly to the internet. I wouldn't trust the proxy to filter anything. The version of JBOSS is probably quite old and almost certainly has vulnerabilities that could allow an attacker to gain unauthorized access.

Also last time I checked I believe credentials and all other data are passed in the clear, so that's not good to send over the internet. Well, I suppose if your IIS server is only listening for SSL connections, then that part might be covered.

I'd suggest VPN of some type with your payor. Then you know they can only connect across the VPN tunnel. No internet exposure that way. You can set up access lists to allow only the traffic required as well.

Posted : June 13, 2016 10:20 am

gfishback

(@gfishback)

Posts: 70

Estimable Member

Topic starter

That would be the exact reason. RDP never works with external entities. They never put you on the HR List to disable user accounts etc. and when they forget the password, it is call to our much smaller I.T. group or worse yet, they tend to share credentials. Not to mention the additional overhead to the RDP farm servers of managing those desktops. I'd feel much better about the web access. It winds up creating a much larger security hole. this way you can proxy nothing but the minimal necessary ports and keep foreign machines completely off of the network. The revers proxy is in fact GE's recommended security method for securing the HTTPS web interface. They just don't know how to do it 🙁

Posted : June 13, 2016 10:37 am

jkratzer

(@jkratzer)

Posts: 138

Estimable Member

Here is some documentation on how to do it through Apache.

It is using URL rewrites instead of proxy's.

It was originally written by one of the GE programmers.

http://www.designitsolutions.com/apache_instructions.pdf

Posted : June 13, 2016 10:42 am

gfishback

(@gfishback)

Posts: 70

Estimable Member

Topic starter

Hmmm.... I could do that. I was hoping to be opportunistic and use the IIS Role on an existing server. I'll see what I can do with this info. Thanks!

Posted : June 13, 2016 10:51 am

petemarkey

(@petemarkey)

Posts: 373

Honorable Member

didn't read the response re: apache but would agree that would be the way to go. unless you are an IIS expert. Apache documentation is clear and info is plentiful.

re: security, i might try to get a IP list from the external party and restrict access to your apache server to that IP range.

Posted : June 13, 2016 3:42 pm

jsander

(@jsander)

Posts: 108

Estimable Member

Can someone please send me a copy of the instruction file from designitsolutions.com? That url only directs to their home page now. [email protected]

Thanks!

Posted : September 14, 2016 8:38 am

Share:

24 Forums
9,940 Topics
39.9 K Posts
3 Online
6,470 Members

Forum Icons: Forum contains no unread posts Forum contains unread posts

Topic Icons: Not Replied Replied Active Hot Sticky Unapproved Solved Private Closed

Powered by wpForo Powered by wpForo version 2.4.0