Re: [sleuthkit-users] Autopsy over SSL?

[Angus M. <an...@n-...>]

Not adding anything to the debate - but isn't it wonderful that, in the space of
a couple of hours, we've come up with 4 ways to do this - meanwhile, I know of
someone who is struggling to do the same thing using a very popular commercial
tool on a dominant proprietary O/S.

I love the smell of open source in the morning ;-)

I think it would help us if the original poster could give us a bigger clue about
what they're trying to achieve...

My personal preference is for a ssh type solution since it adds an auditable
authentication step - aiding continuity, but I can see situations where the
apache proxy could be useful too. The ssh + VNC solution is nice as it solves the
interrupted session problem and would allow the investigator to launch a lengthy
process (e.g. string search, file sorting) and leave the machine in a secure
state while it processes.

The "farm" of ssh + apache sounds like a horrendously complex case to have worked
on! Have you written the method up for publication anywhere ?