1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
|
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
lang="en" dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title></title>
<!-- metadata -->
<meta name="generator" content="Offline" />
<meta name="version" content="Offline 0.1" />
<!-- style sheet links -->
<link rel="stylesheet" media="all" type="text/css" href="../../../css/all.css" />
<link rel="stylesheet" media="screen" type="text/css" href="../../../css/screen.css" />
<link rel="stylesheet" media="print" type="text/css" href="../../../css/print.css" />
</head>
<body>
<div class="dokuwiki export">
<h1><a name="security_recommendation" id="security_recommendation">Security recommendation</a></h1>
<div class="level1">
</div>
<!-- SECTION "Security recommendation" [1-39] -->
<h2><a name="secure_configuration_access" id="secure_configuration_access">Secure configuration access</a></h2>
<div class="level2">
<p>
Configuration can be stored in several formats (<a href="../../documentation/1.3/sqlconfbackend.html" class="wikilink1" title="documentation:1.3:sqlconfbackend">SQL</a>, <a href="../../documentation/1.3/fileconfbackend.html" class="wikilink1" title="documentation:1.3:fileconfbackend">File</a>, <a href="../../documentation/1.3/ldapconfbackend.html" class="wikilink1" title="documentation:1.3:ldapconfbackend">LDAP</a>) but must be shared over the network if you use more than 1 server. If some of your servers are not in the same (secured) network than the database, it is recommended to use <a href="../../documentation/1.3/soapconfbackend.html" class="wikilink1" title="documentation:1.3:soapconfbackend">SOAP access</a> for those servers.
</p>
<p>
<p><div class="notetip">You can use different type of access: <a href="../../documentation/1.3/sqlconfbackend.html" class="wikilink1" title="documentation:1.3:sqlconfbackend">SQL</a>, <a href="../../documentation/1.3/fileconfbackend.html" class="wikilink1" title="documentation:1.3:fileconfbackend">File</a> or <a href="../../documentation/1.3/ldapconfbackend.html" class="wikilink1" title="documentation:1.3:ldapconfbackend">LDAP</a> for servers in secured network and <a href="../../documentation/1.3/soapconfbackend.html" class="wikilink1" title="documentation:1.3:soapconfbackend">SOAP</a> for remote servers.
</div></p>
</p>
<p>
Next, you have to configure the <acronym title="Simple Object Access Protocol">SOAP</acronym> access as described <a href="../../documentation/1.3/soapconfbackend.html#next_configure_soap_for_your_remote_servers" class="wikilink1" title="documentation:1.3:soapconfbackend">here</a> since <acronym title="Simple Object Access Protocol">SOAP</acronym> access is denied by default.
</p>
</div>
<!-- SECTION "Secure configuration access" [40-809] -->
<h2><a name="protect_the_manager" id="protect_the_manager">Protect the Manager</a></h2>
<div class="level2">
<p>
By default, the manager is restricted to the user 'dwho' (default backend is Demo). To protect the manager, you have to choose one or both of :
</p>
<ul>
<li class="level1"><div class="li"> protect the manager by Apache configuration</div>
</li>
<li class="level1"><div class="li"> protect the manager by <acronym title="LemonLDAP::NG">LL::NG</acronym></div>
</li>
</ul>
</div>
<!-- SECTION "Protect the Manager" [810-1069] -->
<h3><a name="protect_the_manager_by_apache" id="protect_the_manager_by_apache">Protect the Manager by Apache</a></h3>
<div class="level3">
<p>
You can use any of the mechanisms proposed by Apache: <acronym title="Secure Sockets Layer">SSL</acronym>, Auth-Basic, Kerberos,… Example
</p>
<pre class="code apache"><<span class="kw3">VirtualHost</span> *:443>
<span class="kw1">ServerName</span> manager.example.com
<span class="co1"># SSL parameters</span>
...
<span class="co1"># DocumentRoot</span>
<span class="kw1">DocumentRoot</span> /var/lib/lemonldap-ng/manager/
<<span class="kw3">Location</span> />
<span class="kw1">AuthType</span> Basic
<span class="kw1">AuthName</span> <span class="st0">"Lemonldap::NG manager"</span>
<span class="kw1">AuthUserFile</span> /usr/local/apache/passwd/passwords
<span class="kw1">Require</span> <span class="kw1">user</span> rbowen
<span class="kw1">Order</span> <span class="kw1">allow</span>,<span class="kw1">deny</span>
<span class="kw1">Deny</span> from <span class="kw2">all</span>
<span class="kw1">Allow</span> from 192.168.142.0/24
<span class="kw1">Options</span> +ExecCGI
</<span class="kw3">Location</span>>
</<span class="kw3">VirtualHost</span>></pre>
</div>
<!-- SECTION "Protect the Manager by Apache" [1070-1680] -->
<h3><a name="protect_the_manager_by_llng" id="protect_the_manager_by_llng">Protect the Manager by LL::NG</a></h3>
<div class="level3">
<p>
To protect the manager by <acronym title="LemonLDAP::NG">LL::NG</acronym>, you just have to set this in <code>lemonldap-ng.ini</code> configuration file (section [manager]):
</p>
<pre class="code file ini"><span class="re0"><span class="br0">[</span>manager<span class="br0">]</span></span>
<span class="re1">protection</span> <span class="sy0">=</span><span class="re2"> manager</span></pre>
<p>
<p><div class="noteimportant">Before, you have to create the virtual host <code>manager.your.domain</code> in the manager and set a <a href="../../documentation/1.3/writingrulesand_headers.html#rules" class="wikilink1" title="documentation:1.3:writingrulesand_headers">rules</a>, else access to the manager will be denied.
</div></p>
</p>
</div>
<!-- SECTION "Protect the Manager by LL::NG" [1681-2097] -->
<h2><a name="write_good_rules" id="write_good_rules">Write good rules</a></h2>
<div class="level2">
</div>
<!-- SECTION "Write good rules" [2098-2127] -->
<h3><a name="order_your_rules" id="order_your_rules">Order your rules</a></h3>
<div class="level3">
<p>
<a href="../../documentation/1.3/writingrulesand_headers.html#rules" class="wikilink1" title="documentation:1.3:writingrulesand_headers">Rules</a> are applied in alphabetical order (comment and regular expression). The first rule that matches is applied.
</p>
<p>
<p><div class="noteimportant">The “default” rule is only applied if no other rule match
</div></p>
</p>
<p>
The Manager let you define comments in rules, to order them:
</p>
<p>
<a href="/_detail/documentation/manager_access_rule.png?id=documentation%3A1.3%3Asecurity" class="media" title="documentation:manager_access_rule.png"><img src="../../../media/documentation/manager_access_rule.png" class="mediacenter" alt="" /></a>
</p>
<p>
For example, if these rules are used without comments:
</p>
<table class="inline">
<tr class="row0 roweven">
<th class="col0 centeralign"> Regular expression </th><th class="col1 centeralign"> Rule </th><th class="col2 leftalign"> Comment </th>
</tr>
<tr class="row1 rowodd">
<td class="col0"> ^/pub/admin/ </td><td class="col1"> $uid eq “root” </td><td class="col2"> </td>
</tr>
<tr class="row2 roweven">
<td class="col0"> ^/pub/ </td><td class="col1"> accept </td><td class="col2"> </td>
</tr>
</table>
<p>
Then the second rule will be applied first, so every authenticated user will access to <code>/pub/admin</code> directory.
</p>
<p>
Use comment to correct this:
</p>
<table class="inline">
<tr class="row0 roweven">
<th class="col0 centeralign"> Regular expression </th><th class="col1 centeralign"> Rule </th><th class="col2 leftalign"> Comment </th>
</tr>
<tr class="row1 rowodd">
<td class="col0"> ^/pub/admin/ </td><td class="col1"> $uid eq “root” </td><td class="col2"> 1_admin </td>
</tr>
<tr class="row2 roweven">
<td class="col0"> ^/pub/ </td><td class="col1"> accept </td><td class="col2"> 2_pub </td>
</tr>
</table>
<p>
<p><div class="notetip">
</p>
<ul>
<li class="level1"><div class="li"> Reload the Manager to see the order that will be used</div>
</li>
<li class="level1"><div class="li"> Use rule comments to order your rules</div>
</li>
</ul>
<p>
</div></p>
</p>
</div>
<!-- SECTION "Order your rules" [2128-3051] -->
<h3><a name="be_careful_with_url_parameters" id="be_careful_with_url_parameters">Be careful with URL parameters</a></h3>
<div class="level3">
<p>
You can write <a href="../../documentation/1.3/writingrulesand_headers.html#rules" class="wikilink1" title="documentation:1.3:writingrulesand_headers">rules</a> matching any component of <acronym title="Uniform Resource Locator">URL</acronym> to protect including GET parameters, but be careful.
</p>
<p>
For example with this rule on the <code>access</code> parameter:
</p>
<table class="inline">
<tr class="row0 roweven">
<th class="col0 centeralign"> Regular expression </th><th class="col1 centeralign"> Rule </th><th class="col2 leftalign"> Comment </th>
</tr>
<tr class="row1 rowodd">
<td class="col0"> ^/index.php\?.*access=admin </td><td class="col1"> $groups =~ /\badmin\b/ </td><td class="col2"> </td>
</tr>
<tr class="row2 roweven">
<td class="col0"> default </td><td class="col1"> accept </td><td class="col2"> </td>
</tr>
</table>
<p>
Then a user that try to access to one of the following <em class="u">will be granted</em> !
</p>
<ul>
<li class="level1"><div class="li"> /index.php?access=admin&access=other</div>
</li>
<li class="level1"><div class="li"> /index.php?Access=admin</div>
</li>
</ul>
<p>
You can use the following rules instead:
</p>
<table class="inline">
<tr class="row0 roweven">
<th class="col0 centeralign"> Regular expression </th><th class="col1 centeralign"> Rule </th><th class="col2 leftalign"> Comment </th>
</tr>
<tr class="row1 rowodd">
<td class="col0"> ^/(?i)index.php\?.*access.*access </td><td class="col1"> deny </td><td class="col2"> 0_bad </td>
</tr>
<tr class="row2 roweven">
<td class="col0"> ^/(?i)index.php\?.*access=admin </td><td class="col1"> $groups =~ /\badmin\b/ </td><td class="col2"> 1_admin </td>
</tr>
<tr class="row3 rowodd">
<td class="col0"> default </td><td class="col1"> accept </td><td class="col2"> </td>
</tr>
</table>
<p>
<p><div class="notetip"><strong>(?i)</strong> means case no sensitive.
</div></p>
</p>
<p>
<p><div class="notewarning">Remember that rules written on GET parameters must be tested.
</div></p>
</p>
</div>
<!-- SECTION "Be careful with URL parameters" [3052-3960] -->
<h3><a name="encoded_characters" id="encoded_characters">Encoded characters</a></h3>
<div class="level3">
<p>
Some characters are encoded in URLs by the browser (such as space,…). To avoid problems, <acronym title="LemonLDAP::NG">LL::NG</acronym> decode them using <a href="http://search.cpan.org/perldoc?Apache2::URI#unescape_url" class="urlextern" title="http://search.cpan.org/perldoc?Apache2::URI#unescape_url" rel="nofollow">http://search.cpan.org/perldoc?Apache2::URI#unescape_url</a>. So write your rules using normal characters.
</p>
</div>
<!-- SECTION "Encoded characters" [3961-4214] -->
<h2><a name="secure_reverse-proxies" id="secure_reverse-proxies">Secure reverse-proxies</a></h2>
<div class="level2">
<p>
<acronym title="LemonLDAP::NG">LL::NG</acronym> can protect any Apache hosted application including Apache reverse-proxy mechanism. Example:
</p>
<pre class="code apache">PerlOptions +GlobalRequest
PerlRequire /var/lib/lemonldap-ng/handler/MyHandler.pm
<<span class="kw3">VirtualHost</span> *:443>
<span class="kw1">SSLEngine</span> <span class="kw2">On</span>
... other SSL parameters ...
PerlInitHandler My::Handler
<span class="kw1">ServerName</span> appl1.example.com
<span class="kw1">ProxyPass</span> / http://hiddenappl1.example.com/
<span class="kw1">ProxyPassReverse</span> / http://hiddenappl1.example.com/
<span class="kw1">ProxyPassReverseCookieDomain</span> / http://hiddenappl1.example.com/
</<span class="kw3">VirtualHost</span>></pre>
<p>
See <a href="http://httpd.apache.org/docs/2.2/mod/mod_proxy.html" class="urlextern" title="http://httpd.apache.org/docs/2.2/mod/mod_proxy.html" rel="nofollow">mod_proxy</a> and <a href="http://httpd.apache.org/docs/2.2/mod/mod_rewrite.html" class="urlextern" title="http://httpd.apache.org/docs/2.2/mod/mod_rewrite.html" rel="nofollow">mod_rewrite</a> documentation for more about configuring Apache reverse-proxies.
</p>
<p>
Such configuration can have some security problems:
</p>
<ul>
<li class="level1"><div class="li"> if a user can access directly to the hidden application, it can bypass <acronym title="LemonLDAP::NG">LL::NG</acronym> protection</div>
</li>
<li class="level1"><div class="li"> if many hidden applications are on the same private network, if one is corrupted (by <acronym title="Structured Query Language">SQL</acronym> injection, or another attack), the hacker will be able to access to other applications without using reverse-proxies so it can bypass <acronym title="LemonLDAP::NG">LL::NG</acronym> protection</div>
</li>
</ul>
<p>
It is recommended to secure the channel between reverse-proxies and application to be sure that only request coming from the <acronym title="LemonLDAP::NG">LL::NG</acronym> protected reverse-proxies are allowed. You can use one or a combination of:
</p>
<ul>
<li class="level1"><div class="li"> firewalls (but be careful if more than 1 server is behind the firewall)</div>
</li>
<li class="level1"><div class="li"> server based restriction (like Apache “allow/deny” mechanism)</div>
</li>
<li class="level1"><div class="li"> <acronym title="Secure Sockets Layer">SSL</acronym> client certificate for the reverse-proxy (see SSLProxy* parameters in <a href="http://httpd.apache.org/docs/2.2/mod/mod_ssl.html" class="urlextern" title="http://httpd.apache.org/docs/2.2/mod/mod_ssl.html" rel="nofollow">mod_ssl documentation</a>)</div>
</li>
</ul>
</div>
<!-- SECTION "Secure reverse-proxies" [4215-5883] -->
<h2><a name="configure_security_settings" id="configure_security_settings">Configure security settings</a></h2>
<div class="level2">
<p>
Go in Manager, <code>General parameters</code> » <code>Advanced parameters</code> » <code>Security</code>:
</p>
<ul>
<li class="level1"><div class="li"> <strong>Username control</strong>: Regular expression used to check user login syntax.</div>
</li>
<li class="level1"><div class="li"> <strong>Force authentication</strong>: set to 'On' to force authentication when user connects to portal, even if he has a valid session</div>
</li>
<li class="level1"><div class="li"> <strong>Encryption key</strong>: key used to crypt some data, should not be known by other applications</div>
</li>
<li class="level1"><div class="li"> <strong>Trusted domains</strong>: domains on which the user can be redirected after login on portal. Set '*' to accept all.</div>
</li>
<li class="level1"><div class="li"> <strong>Use Safe jail</strong>: set to 'Off' to disable Safe jail. Safe module is used to eval expressions in headers, rules, etc. Disabling it can lead to security issues.</div>
</li>
<li class="level1"><div class="li"> <strong>Check <acronym title="Cross Site Scripting">XSS</acronym> Attacks</strong>: Set to 'Off' to disable <acronym title="Cross Site Scripting">XSS</acronym> checks. <acronym title="Cross Site Scripting">XSS</acronym> checks will still be done with warning in logs, but this will not prevent the process to continue.</div>
</li>
</ul>
</div>
<!-- SECTION "Configure security settings" [5884-6752] -->
<h2><a name="fail2ban" id="fail2ban">Fail2ban</a></h2>
<div class="level2">
<p>
For block brute force attack with fail2ban
</p>
<p>
Edit /etc/fail2ban/jail.conf
</p>
<pre class="code">[lemonldap-ng]
enabled = true
port = http,https
filter = lemonldap
action = iptables-multiport[name=lemonldap, port="http,https"]
logpath = /var/log/apache*/error*.log
maxretry = 3
</pre>
<p>
and edit /etc/fail2ban/filter.d/lemonldap.conf
</p>
<pre class="code">
# Fail2Ban configuration file
#
# Author: Adrien Beudin
#
# $Revision: 2 $
#
[Definition]
# Option: failregex
# Notes.: regex to match the password failure messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
# Values: TEXT
#
failregex = Lemonldap\:\:NG \: .* was not found in LDAP directory \(<HOST>\)
Lemonldap\:\:NG \: Bad password for .* \(<HOST>\)
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =
</pre>
<p>
Restart fail2ban
</p>
</div>
<!-- SECTION "Fail2ban" [6753-] --></div><!-- closes <div class="dokuwiki export">-->
|
