Info contained here is intended to be publicly available – Lab Environment Findings based on results from Lab Environment and due diligence exercise with intent to take away learnings and apply elsewhere in a secure manner!!!
Exercise Caution if restricting Production grade systems using settings defined in this guide – there may be situations where doing so will impact systems which customers/clients rely on accessing using older browsers. If backwards compatible is concerned, first perform due diligence by baselining access through logging or manual validation prior to enacting the changes!!
Finding’s Notes:
- If using keepalived to publish VIPs, consider what services are running on the underlying Operating System and what interfaces AND/OR IP addresses the daemon is bound to. Example;
- Keepalived A-P cluster publishing multiple VIPs (for load balancing) will listen on the port configured in keepalived.conf but would also permit the logical connectivity to SSH daemon which by default listens on 0.0.0.0. The net result of this finding is that you could inadvertently open up management services on VIPs unintentionally.
- Takeaway(s):
- Always enforce source/destination/service rules when using IP tables so that if daemon is misconfigured, you don’t inadvertently expose services.
- Always bind services to IP addresses – Going to be a bit hard to do this if dealing with automation and system cloning etc where re-addressing may be required (micro management of hard coded IP addresses in configuration files will be a headache).
- Consider dynamically capturing IP address in global variable and referencing that in configuration files where network interface IP address may change.
- SSH Findings;
- Change default “ListenAddress” from 0.0.0.0 to IP address of choice.
- Consider also changing IPv6 if network is IPv6 capable and those services are in use. Also review host based firewall to determine if enforcement for both IPv4 and IPv6 is effective.
- Centos 7 by default, sshd does not contain ciphers line. Add the following like to sshd_config and also. ***Compatibility – Some SSH Clients will not work if they don’t negotiate these ciphers – be warned!***
- Removed 3DES, Blowfish, Cast, ArcFour and AES ciphers <=192
-
# Removal of Weak Ciphers - Consider Compatibility!!
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
- HTTPS Web Service Findings
- MAC OSX Finder creates _DS* files in folders which client accesses. Result is that the file may be inadvertently exposed to users who have logical path way to the service.
- Action: (Add explicit block in httpd.conf or specific virtual host file)
Block MAC OSX Finder DS file from being accessible via WebSite which may leak information regarding file/folder structure<FilesMatch “^\.[Dd][Ss]_[Ss]$”>
Order allow,deny
Deny from all
</FilesMatch>
- Consider possibility that developers may be using MAC OSX and potentially leaving residual bits of information lying around irrespective of SDLC environment in which they are operating in.
- Remove weak cipher suits from httpd
- TLSv1.2 was enforced but the following weak ciphers were still actively in use; RC4 and SEED primarily.
TLS_ECDHE_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_SEED_CBC_SHA
- Add this to your virtual host(s); ** Be mindful of compatibility **
- SSLCipherSuite High:!Medium:!aNULL: !MD5: !RC4
- Disable Debugging Features in httpd
- Perform against all virtual hosts including the defaults if they still exist;
- # Remove TRACE and TRACK methods – Security Enhancement RewriteEngine on
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
RewriteRule .* – [F]
- Remember to disable welcome pages that are of no use to the general public and are representative of a slop and drop deployment which may indicate security oversight and which may mean a higher likelihood of successful compromise if attacked.
- IMAPS Security Issues (DoveCot specifically)
- Weak Diffi Hellman Key Used, default 1024.
- Modify /etc/dovecot/conf.d/10-ssl.conf by uncommenting ssl_dh_parameters_length = 1024 and changing the value to 2048. I set it to 4096 which may result in performance penalty on very busy servers. Assess the importance of your mail service to determine if offline decryption risk from powerful adversaries is important to you.
