Security questions when using off-shore developers

Our company is upgrading from XE to 811 and will be using off-shore developers to assist with the retrofitting. To start off, they will be using VPN and then PCAnywhere into fat-clients. Does anyone have any experience with this and I was wondering if you can advise us about things like firewall issues and how we can protect the rest of the network. Thanks!

I wouldn't use pcAnywhere as your remote connectivity.
You should use RDP it's much more stable.

Some ideas to consider:
1) Don't use PCanywhere. Use WinXP on your clients and have your remote developers use Remote Desktop (mstsc.exe). It's much more efficient and transparent than pcAnywhere which is utdated.
2) Put your clients on their own subnet and configure the router to only pass tcp ports as required through to the main network. You'll need to pass at least your JDENet ports plus http and https.

Tippy,

Attached is a whitepaper I wrote in late 2005 on that topic. That should give you some ideas and pricing. I'll also send it to you offline. Good luck!

Gregg Larkin
Praxair North American System Admin
JDE CNC and Security, Websphere, Tidal, Princeton Softech

Gregg, I read your White Paper with interest. One question. You state that when setting up either VMware or a Fat Client Farm, when making an image, do not include EnterpriseOne. Doesn't EnterpriseOne count the license only after the first time that Fat Client logs in? And therefore it should be OK to include it in an image?

Scott W. Allen
E1 8.9 Tools 8.95L2 Ent=AS400 Deploy=Win2000 JAS=Win20003

Hi Scott,

In my paper, I made the following statement when building a vm-ware or fat-farm soultion:

"Install EnterpriseOne onto each virtual PC. Be sure to include the developer as well as the production objects. Install all of the pathcodes that you will need. Run R98CRTGL and R92TAM as per the previous section.

You may have noted that I did not include EnterpriseOne in the PC template. That was intentional. EnterpriseOne licenses its clients on a per seat basis. Installing Enterprise-One on a template would confuse the count. As a side benefit, you will have a list of workstations that have received a client. You can use that list to “Push” out client updates to."

I left the JDE client off of the VM-ware image for several reasons:

1) License count - installing the client to the virtual PC will assign the JDE license. The license is per seat, not per user. It is something installed on the C drive of the PC. The license file is an everygreen file, updated everytime you use JDE. If you change the date and time of the PC more than 24 hours backwards, your JDE license expires.

2) Build a list - installing JDE individually will help you to build a list of places where the fat client is installed. This will pay off later if you want to "push" an update or full package out to the clients. If JDE was part of an image, you loose the ability to "push" the package.

3) Registry - Have you ever looked at all of the registry entries that JDE dumps on your system? It's in the thousands. If you had JDE as part of the PC image and replicated it, god knows how many registry entries would need to be tweaked to get it to work on the cloned machine.

Bottom line, the JDE fat client was not designed to be part of standard PC image. You could try it that way, but my gut tells me that that would be an exercise in frustration. But don't let me stop you, have at it!

Gregg Larkin
Praxair North American System Admin
JDE CNC and Security, Websphere, Tidal, Princeton Softech
175 E Park Drive
Tonawanda, NY 14150
(716) 879-3169