Security concerns opening 8443 from capser server to outside for iOS devices?

[dan_westby]

I'm looking at how to help track down ipads and thought if we had 843 open from the outside and casper logs the IP from a users home or another business (which will be obviously different from our own), is this standard practice, advisable and/or a security concern?

[mm2270 · Accepted solution]

You could do it, but its not best practice, nor advisable. There are better options. Talk to your JAMF buddy about setting up a limited access JSS in the DMZ that talks to your internal protected JSS over port 3306 (MySQL) This kind of setup is considered a cluster of sorts, since technically the externally facing JSS is writing back to the same database as your internal server. The Casper Suite starting with I think version 8.2 or thereabouts began to include some functions directly in the web interface for helping get this kind of setup off the ground. The external box or VM can be locked down so it can't be "logged into"; it only accepts communication from external Macs and/or iOS devices.

This is much more secure, though not completely bulletproof. You can take extra steps from that point to protect your internal server even further though.