Skip to main content
A
Anonymous
October 12, 2011
Question

Origin Edge Setup Security Settings

  • October 12, 2011
  • 1 reply
  • 2124 views

I am currently testing security hardening with FMS 4.0.3 r4011 in an Origin Edge setup.

What I have found is that the SWF verification can only be processed on the Origin, is this correct? The config ( adobe/fms/conf/_defaultRoot_/_defaultVHost_/Application.xml ) within the Edge server is ignored when <SWFVerification enabled="true"> is set and the correct SWF file copied to the correct directory, once this config is enabled on the Origin then SWF-v takes place.

RTMPE calls from client to edge fails on the origin with error message connection rejected by server. Reason : [ Server.Reject ] : Connection failed.

We know RTMPE from edge to origin does not work ( with this version of FMS ), however if I remove the rtmp block ( <DisallowedProtocols></DisallowedProtocols> ), rtmpe from client to edge works and is accepted by the origin server. If I do the same call (rtmpe) direct to the Origin with rtmp blocked it works fine.

My questions really are how do I only allow rtmpe and enable SWF verification within an Origin Edge setup. Can the Edge server do any security checking?

To enable the Edge I have done the below and have successfully played content before changing to enable rtmpe only and enforce swf-v.

<Mode>remote</Mode>

<Anonymous>false</Anonymous>

<CacheDir enabled="true" useAppName="true">

<RouteEntry>*:*;my_origin_server_ip_removed:1935</RouteEntry>

This topic has been closed for replies.

1 reply

S
Adobe Employee
SE_0208
Adobe Employee
October 12, 2011

I think that's because edge to origin connection would be "rtmp" in case of rtmp/rtmpe connections. So i think you need to allow RTMP on Origin , Disallow RTMPE on Edge and enable SWFV on origin - have you tried that - i think that should work.

Are you concerned that Edge-Origin connection would be RTMP based?

A
Anonymous
October 12, 2011

I am not concerned about Edge-Origin connection being RTMP based.

Adding <DisallowedProtocols>rtmp</DisallowedProtocols> to the adobe/fms/conf/_defaultRoot_/_defaultVHost_/Application.xml on the Edge server does not block rtmp connections.

It seems none of the application.xml settings are read by the Edge server.

Is it possible to enforce rtmpe only streaming within an Origin Edge setup?

S
Adobe Employee
SE_0208
Adobe Employee
October 12, 2011

I am working on it - will let you know what i find in my investigations.

Terms & ConditionsAccessibility statement
Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices