1 2 3 Previous Next 215 Replies Latest reply on May 30, 2015 1:00 PM by jormond

    FileMaker 13v9 Security Update

    taylorsharpe

      Security Update - FileMaker 13.0v9/FileMaker 12 | FileMaker

       

      I saw this posted by Steven Blackwell and didn't realize it was out already.  There are some very specific instructions.  I wonder why going up to v9.  Oh well. 

        • 1. Re: FileMaker 13v9 Security Update
          taylorsharpe

          FYI, this is all about SSL certificate updates for FMS.  I understand from working on many clients machines that people have not purchased and installed SSL certificates.  FileMaker has not made it easy either (command line process).  Hopefully that will improve in the future (e.g., FM14).  But purchasing an authorized SSL certificate really does improve security and I highly recommend it.  I use the Comodo ones (cheaper).  I posted an article a while back about why I use those for inexpensive certificates.  Also, rumor mill has it that Apple was unhappy with FileMaker for not making it the default to install authorized SSL certificates. 

          • 2. Re: FileMaker 13v9 Security Update
            imarc

            The current FileMaker Go version is 13.0.8, so it looks like to minimize confusion, they wanted Pro, Go and Server to all be on the same rev number for this product line-wide update.

            • 3. Re: FileMaker 13v9 Security Update
              steveromig

              Marc Wood wrote:

               

              The current FileMaker Go version is 13.0.8, so it looks like to minimize confusion, they wanted Pro, Go and Server to all be on the same rev number for this product line-wide update.

               

              That is correct.

               

              See here for a detailed Q & A about the v9 update - it includes mention why v9 is called v9.

               

              http://help.filemaker.com/app/answers/detail/a_id/14590/

               

              Steve Romig

              FileMaker, Inc.

              • 4. Re: FileMaker 13v9 Security Update
                DavidZakary

                I'm trying to update my dev server to 13v9 and running into issues.

                 

                Java 8 Update 31 is installed on the machine. The 13v9 updater does not like this version of Java.  A little hunting around, turns out that I need Java 7 Update 75. Found a download of that, but of course I can't install that version as I already have a newer version installed. The Java installer doesn't seem to include an uninstall option.

                 

                I'm sure I'm not the first to run into this. Any pointers?

                 

                Thanks.

                • 6. Re: FileMaker 13v9 Security Update
                  richardcarlton

                  Hi Steve,

                   

                  Just so I am clear on this...  If USING SSL on FMS... Pro and Go 13v9 client will not connect to previous V Revs of FM Server.... for example FMS 13v4.

                   

                  If NOT USING SSL on FMS.... Pro and Go 13v9 client ... will still be able to connect to previous releases of FM Server?

                   

                  - Richard

                  • 7. Re: FileMaker 13v9 Security Update
                    jcooper

                    This close to v14 (I imagine/hope) combined with the nightmare I had a few weeks just trying to get SSL to work properly on FMS, I'm tempted to hold off for bit.  However, I'm wondering if anyone gathers from the documentation whether this applies to the Database Server using SSL, or if either it or the Web server using SSL.

                     

                    We have a FMS web server where users connect via htts://blahblah.com, but since it uses CWP and talks to the database server on the same machine, we never turned on SSL for the database server since it's all on our LAN anyway.  With everything happening behind our firewall, and staff using a VPN to get in, we figured we were pretty well secured without taking an additional performance hit.

                     

                    Just wondering, as far as this update is concerned, if this configuration means my server is or isn't using SSL to protect the data?

                     

                    Thanks,

                     

                    Jeff

                    • 8. Re: FileMaker 13v9 Security Update
                      davidhead

                      v9 means that all products - FileMaker Pro, FileMaker Go and FileMaker Server are all the same version.

                      • 9. Re: FileMaker 13v9 Security Update
                        davidhead

                        Richard that is correct but it is still strongly recommended to upgrade FileMaker Server to v9.

                        • 10. Re: FileMaker 13v9 Security Update
                          davidhead

                          Hi Jeff

                          This update refers to the SSL certificate for the database server, not the web server serving CWP.

                          • 11. Re: FileMaker 13v9 Security Update
                            adatasol

                            Am I correct that "When deploying FileMaker Server with SSL, the only secure way to connect is to install a custom third-party certificate. The default certificates included with FileMaker are only for testing." is new verbiage? 

                             

                            SSL data transport has been built into FileMaker forever... since FM 7 ?  The certificates have always been provided and I believe the option to replace them is very recent.  I certainly didn't know about it until having issues with WebDirect HTTPS. 

                             

                            In any case...the entire SSL functionality totally confuses me; we have SSL in Server Admin URL, SSL in Web Direct URL, and SSL in FileMaker transport.  I assume this certificate refers to the SSL in FileMaker Transport. 

                             

                            Finally, the SSL generation / installation process is also terrible and is very difficult - a command-line tool ??

                             

                            FileMaker needs some damage control ASAP.

                            • 12. Re: FileMaker 13v9 Security Update
                              richardcarlton

                              Yes... that all fine.  But I want to make sure that we're not going to blow up users who are slow on the updates.

                               

                              - RC

                              • 13. Re: FileMaker 13v9 Security Update
                                richardcarlton

                                ADatasol,

                                 

                                Installing SSL certs have always sucked.... since I did my first one in 97.   Always a command line job.   Lot of money and a pain in the ass.   That why when FMI put this into FMS... it is was SUPER cool!!!!.

                                 

                                But its not overly secure against a fairly dedicated attacker... SO...we have to go back to a standard SSL Cert.

                                 

                                - RC

                                • 14. Re: FileMaker 13v9 Security Update
                                  PointInSpace

                                  Can we get a matrix of which versions of v12 and v13 will be compatible with which?  Eg: if we upgrade Server, do old Pro and Go clients have to be upgraded to be able to connect, etc.  As is, it's all clear as mud...

                                   

                                  - John

                                  1 2 3 Previous Next