SSL Explorer: Community Edition

History, versions and discontinuance

The product was first released on the SourceForge.net website in August 2004 and has since had over 275,000 downloads of the main product distribution as of December 2007 [1]. All versions of the core Community Edition product were licensed under the GPL while the commercial Enterprise Edition product, which was built upon the Community Edition but with additional functionality, was licensed separately under a commercial license. A fork of the last GPL release has been created named Adito, which was later renamed to OpenVPN ALS[2].

Around March 2008, 3SP Ltd announced that they discontinued development of the Community Edition [3].

SSL-Explorer was known to install and function on the following operating systems:

As with any product previously licensed under the GPL, the source code is still available via SourceForge.net. However, future updates to the source code or pre-built binaries will not be forthcoming from 3SP Ltd.

As of November 18, 2008, 3SP Ltd. is now part of Barracuda Networks [5]. The technology behind SSL-Explorer is now incorporated into the Barracuda SSL VPN.

How It Works

SSL-Explorer is an application written in Java and contains its own database and web server that is used to serve secure web pages in order to access back-end network resources. While the product is ideally installed upon a standalone server, it may be installed as a service and run in the background to other processes if desired.

The product acts as a web-based proxy that mediates requests for resources from external users while also providing a means of authenticating these users' identities by querying a number of user databases including Microsoft's Active Directory. Access rights are enforced by the principle of role based access control and other secondary access control measures such as NTFS filesystem permissions can also affect the resources that a user may access.

Some resources (e.g. remote desktop access) require the use of port forwarding to operate successfully. For this purpose a lightweight Java applet known as the 'SSL-Explorer Agent' is downloaded and launched by the client browser. The applet intercepts TCP/IP requests on certain configurable ports and forwards them to the SSL-Explorer server which in turn routes them to the appropriate endpoint on the network.

Using a combination of various techniques such as web proxying and port forwarding, most corporate applications can continue to function unimpeded with their data tunneled transparently between the end point and the client (via SSL-Explorer) using the HTTPS protocol.

Network resources that may be externalized by SSL-Explorer include the following:

The actual VPN server itself may be placed inside either the DMZ or within the trusted network itself with incoming connections on port 443 forwarded directly to SSL-Explorer by firewall rules. One of the main advantages associated with SSL VPN products lies in the fact that when correctly set up it should be technically possible to close all other firewall ports apart from the HTTPS/SSL port 443.

While often lumped together as similar solutions, SSL-Explorer is conceptually different from OpenVPN in that it provides controlled and authenticated access to services and applications within a network rather than full, unchallenged network access [6].

Who is it intended for?

While SSL-Explorer and SSL VPN products as a whole are beneficial to many people, there are a number of distinct groups which benefit greatly from their usage;

Security Measures

The Community Edition of SSL-Explorer provided a number of security features. Features such as One-Time-Password support and hardware token authentication are offered via the commercial implementation, the Barracuda SSL VPN.

Performance Testing

In February 2007, 3SP Ltd conducted performance benchmarking of the SSL-Explorer solution using a test bed platform of three systems using different specifications of hardware. The benchmarking was conducted with the assumption that a minimum 256 kbit/s data throughput rate would be a realistic value to place upon a responsive VPN tunnel for use such as remote desktop access. The BEA jRockit JRE was used in all tests on both Microsoft Windows and Linux systems.

The results obtained indicated that:

1. An entry-level PC based upon a 1.8 GHz Athlon with 768 MB RAM was able to sustain 144 concurrent tunnels at 256 kbit/s (36 Mbit/s overall throughput on Windows, 46 Mbit/s on Linux),
2. A mid-spec PC based upon a 2.8 GHz Pentium 4 with 1 GB RAM sustained 192 concurrent tunnels (overall 49 Mbit/s throughput on Windows, 61 Mbit/s on Linux)
3. A high-spec PC using a Core 2 Duo 6600 with 4 GB RAM sustained 528 tunnels (overall throughput of 135 Mbit/s on Windows, 168 Mbit/s on Linux)

SSL-Explorer is known to operate successfully using the nCipher nFast LN1200 SSL Accelerator card [7].

Technologies used by SSL-Explorer

SSL-Explorer was built using a number of open source software components and frameworks. The most notable projects are summarized here:

Security Vulnerabilities

In June 2007, Secunia published an advisory [9] stating that versions of SSL-Explorer prior to 0.2.13 are vulnerable to cross-site scripting attacks and HTTP header injection attacks. 3SP Ltd fixed this vulnerability in later versions of the product and advised users to upgrade their servers.

Currently there is a US-Cert advisory notice for an unresolved potential security flaw affecting a whole class of URL-rewriting Clientless SSL VPN products including all versions of SSL-Explorer and its derivatives, and many other similar utilities: see [10]