Firewalling Proxy Server for Innopac 香港中文大學圖書館系統 University Library System The Chinese University of Hong Kong Firewalling Proxy Server for Innopac Ernest Yik, Information Technology & Planning December 9, 2003

Proxy, Firewall and Innopac Combining proxy and firewall

Proxy : Description Transparent web proxy Change of browser settings not required All access to WebPAC must first go through the proxy Proxy software : Apache or Squid

Proxy : Encoding detection OPAC migrate to Unicode in July 2003 R2002 phase 2 : browser encoding problem Add an HTML META tag to facilitate automatic encoding detection <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> Solved in R2002 phase 3

Proxy : Logging Logging of all WebPAC activities including OPAC searching & browsing Downloading MARC records Viewing book covers etc etc… Many tools available to generate statistics from the standard log files

Proxy : Statistics

Proxy : Statistics (cont.)

Proxy : Other applications Fine-grain access control, e.g. Restricting access to Innopac manual Controlling download of MARC records Banner display during software updates When WebPAC is down for maintenance Enhance WAM Rewrite Proxy Bypass WAM Proxy for on-campus users

Firewall : Description Transparent bridging firewall No modification to Innopac settings All access to Innopac must first go through the firewall (not only WebPAC) Firewall software : Linux kernel + iptables

Firewall : Security Another line of defence against security holes No software is perfect Configuration error Delay in software update Low level logging and monitoring

Firewall : Security (cont.) Innopac - Limit Network Access PatronAPI, OCLCNET etc. Are they really secure? Operating system

Firewall + proxy Firewall security + proxy features Work together nicely within the same box

HW/SW requirements Hardware Software Low hardware requirements PC Server with two network interfaces Software All open source Highly flexible and reliable

Things to note What you want to achieve Choose among available solutions Extra resource may be required What to do in case of failure – recovery plan Study Innovative’s FAQ on Firewalls Thorough testing to make sure that normal services are not adversely affected Firewall itself is not perfect! Can only provide certain kind of protection Do not blindly trust the firewall

Thank you Questions & comments For technical details, please contact : Ernest YIK, Information Technology & Planning, University Library System, CUHK ernest@lib.cuhk.edu.hk