<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Entente Development Blog</title>
	<atom:link href="http://blog.ententecorp.com/feed/" rel="self" type="application/rss+xml" />
	<link>http://blog.ententecorp.com</link>
	<description>Chronicling the development process at Entente using FreeSWITCH and Ruby</description>
	<lastBuildDate>Fri, 19 Jun 2009 20:18:26 +0000</lastBuildDate>
	<generator>http://wordpress.org/?v=2.8.4</generator>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
			<item>
		<title>Modifying Freeswitch’s XML interfaces to support custom SSL client + server certificates</title>
		<link>http://blog.ententecorp.com/2009/06/modifying-freeswitch-to-support-custom-ssl-certificates/</link>
		<comments>http://blog.ententecorp.com/2009/06/modifying-freeswitch-to-support-custom-ssl-certificates/#comments</comments>
		<pubDate>Fri, 19 Jun 2009 20:18:26 +0000</pubDate>
		<dc:creator>ententecorp</dc:creator>
				<category><![CDATA[Freeswitch]]></category>
		<category><![CDATA[libcurl]]></category>
		<category><![CDATA[security]]></category>

		<guid isPermaLink="false">http://ententecorp.com/blog/?p=19</guid>
		<description><![CDATA[As you can see from the previous post, there was a lot of work left to be done in order to secure communications between Freeswitch's XML interfaces and our web servers.  I researched the other possible security options with libcurl using https, as well as SSL encryption options in general.  Libcurl already supported a bunch of different SSL certificate options that were not being used in Freeswitch, presumably because nobody had ever cared enough to implement them before.

It seemed that the most secure setup possible was to implement client &#038; server SSL certificate authentication (both ends check each other's certs).  I used this resource as an introduction to Client Authentication with SSL.  This guide also explained how to become your own certificate authority and sign your own client + server certificates.  Becoming our own CA is perfect for our setup because, unlike a browser scenario, libcurl wouldn't be popping up a message telling our users that we are an untrusted/unofficial CA.

The first thing to do was to modify Freeswitch to support the various SSL options that libcurl provides.]]></description>
		<wfw:commentRss>http://blog.ententecorp.com/2009/06/modifying-freeswitch-to-support-custom-ssl-certificates/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Analyzing the Security of Freeswitch&#8217;s XML Curl Interfaces</title>
		<link>http://blog.ententecorp.com/2009/06/analyzing-the-security-of-freeswitchs-xml-interfaces/</link>
		<comments>http://blog.ententecorp.com/2009/06/analyzing-the-security-of-freeswitchs-xml-interfaces/#comments</comments>
		<pubDate>Fri, 19 Jun 2009 06:44:23 +0000</pubDate>
		<dc:creator>ententecorp</dc:creator>
				<category><![CDATA[Freeswitch]]></category>
		<category><![CDATA[libcurl]]></category>
		<category><![CDATA[security]]></category>

		<guid isPermaLink="false">http://ententecorp.com/blog/?p=6</guid>
		<description><![CDATA[Recently, we were working on a part of our Freeswitch configuration web app.  This app generates configuration files for our servers in XML format.  When Freeswitch needs a piece of configuration data, it is able to fetch the configurations in real time from our web server using its 'mod_xml_curl' module.  This is a very powerful tool, but as we were thinking about how to deploy this to a large number of our client servers, security came to mind.

Freeswitch's XML interfaces have the ability to provide authentication credentials to a web server using HTTP Basic authentication, which essentially transmits the username and password as plain text (yeah, ok, it's base64 encoded, but that may as well be plain text).  To offset this potential security issue and prevent unauthorized individuals from requesting our server configs, Freeswitch can connect to a web server through SSL (https).  This is a little bit better, but there were a few things lacking from this solution.]]></description>
		<wfw:commentRss>http://blog.ententecorp.com/2009/06/analyzing-the-security-of-freeswitchs-xml-interfaces/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>
