Liferay hardening principles

Hardening Principles

Copyright © 2000-2013 Liferay, Inc.All Rights Reserved.

No material may be reproduced electronically or in print, duplicated,copied, sold, resold, or otherwise exploited for any commercial purpose

without express written consent of Liferay, Inc.

Time for DEMO!

Let's d0 s0me hacking

Time for DEMO!

Let's d0 s0me hacking

WHAT IS HARDENING?

“Hardening refers to providing various means of protection in a computer system. Protection is provided in various layers and is often referred to as defense in depth. Protecting in layers means to protect at the host level, the application level, the operating system level, the user level, the physical level and all the sublevels in between. Each level requires a unique method of security.”

- http://www.techopedia.com/definition/24833/hardening

“In computing, hardening is usually the process of securing a system by reducing its surface of vulnerability. A system has a larger vulnerability surface the more that it does; in principle a single-function system is more secure than a multipurpose one. Reducing available vectors of attack typically includes the removal of unnecessary software, unnecessary usernames or logins and the disabling or removal of unnecessary services.”

- http://en.wikipedia.org/wiki/Hardening_(computing)

LAYERS OF HARDENING

NETWORK

SERVER

APPLICATION

NETWORK

Usually Liferay Portal's operating environment has been spread out to multiple

servers.

NETWORK - HARDENING

Think which connections are needed?

Allow Liferay server should access only servers that is required. Database, Solr, Disk-share, Web-services, staging live server..

Liferay Portal should not have direct Internet connection

Connections through HTTP server

Connecting to internet through Proxy

Image: wikipedia.org

SERVER

Liferay running at server

Image: wikipedia.org

SERVER - HARDENING

Server administration (Unix, Linux)

No root level access, only SUDO

Administrators should use own personal user id's to administer

Block unnecessary ports with Firewall

Disable unwanted services

All the applications and services should run with their respective operating system user account.

Separate disk spaces for the system, application, data, logs and temp files

chroot the Application server installation

APPLICATION

Liferay specific hardening principles

APPLICATION – LIFERAY #1

Remove demo data!(if exists)


Disable and change default administrative accounts. Change the username / email /

passwordportal.properties ( default value )

default.admin.screen.name=test default.admin.password=testdefault.admin.email.address.prefix=test

portal.properties ( default value )

default.admin.screen.name=test default.admin.password=testdefault.admin.email.address.prefix=test


Keep you Liferay system patched!


Disable create account if registration is not required!


company.security.strangers=true

# Also good to disable open.id auth

open.id.auth.enabled=true


company.security.strangers=true

# Also good to disable open.id auth

open.id.auth.enabled=true


Make sure that password are stored securely!


passwords.encryption.algorithm=SHA

## SHOULD BE SSHA or better


passwords.encryption.algorithm=SHA

## SHOULD BE SSHA or better


Design permission scheme for Portal users!

NEVER RUN PORTAL USER

WITHADMINISTRATION

ROLE


Do not show portlets if user do not have permission!


layout.show.portlet.access.denied=true


layout.show.portlet.access.denied=true


Change authentication token / shared secret


auth.token.shared.secret=BAHyWOT9TbPB


auth.token.shared.secret=BAHyWOT9TbPB


Do not change touch p_auth and p_p_auth tokens settings!


auth.token.check.enabled=trueportlet.add.default.resource.check.enabled=true


auth.token.check.enabled=trueportlet.add.default.resource.check.enabled=true


Disabling autologin functionality that is not required!portal.properties ( default value )

## SET NOT REQUIRED FALSE

com.liferay.portal.servlet.filters.autologin.AutoLoginFilter=truecom.liferay.portal.servlet.filters.sso.cas.CASFilter=truecom.liferay.portal.servlet.filters.sso.ntlm.NtlmFilter=truecom.liferay.portal.servlet.filters.sso.ntlm.NtlmPostFilter=truecom.liferay.portal.servlet.filters.sso.opensso.OpenSSOFilter=truecom.liferay.portal.sharepoint.SharepointFilter=true

## REMOVE REQUIRED

auto.login.hooks=com.liferay.portal.security.auth.CASAutoLogin...

auto.login.ignore.hosts=auto.login.ignore.paths=


## SET NOT REQUIRED FALSE

com.liferay.portal.servlet.filters.autologin.AutoLoginFilter=truecom.liferay.portal.servlet.filters.sso.cas.CASFilter=truecom.liferay.portal.servlet.filters.sso.ntlm.NtlmFilter=truecom.liferay.portal.servlet.filters.sso.ntlm.NtlmPostFilter=truecom.liferay.portal.servlet.filters.sso.opensso.OpenSSOFilter=truecom.liferay.portal.sharepoint.SharepointFilter=true

## REMOVE REQUIRED

auto.login.hooks=com.liferay.portal.security.auth.CASAutoLogin...

auto.login.ignore.hosts=auto.login.ignore.paths=


HTTP / HTTPS ?


Disable Liferay remote services that are not used!portal.properties ( default value )spring.remoting.servlet.hosts.allowed=127.0.0.1,SERVER_IPspring.remoting.servlet.https.required=false

tunnel.servlet.hosts.allowed=127.0.0.1,SERVER_IPtunnel.servlet.https.required=false

axis.servlet.hosts.allowed=127.0.0.1,SERVER_IPaxis.servlet.https.required=false

atom.servlet.hosts.allowed=127.0.0.1,SERVER_IPatom.servlet.https.required=false

webdav.servlet.hosts.allowed=webdav.servlet.https.required=false

json.servlet.hosts.allowed=json.servlet.https.required=falsejsonws.servlet.hosts.allowed=jsonws.servlet.https.required=false

portal.properties ( default value )spring.remoting.servlet.hosts.allowed=127.0.0.1,SERVER_IPspring.remoting.servlet.https.required=false

tunnel.servlet.hosts.allowed=127.0.0.1,SERVER_IPtunnel.servlet.https.required=false

axis.servlet.hosts.allowed=127.0.0.1,SERVER_IPaxis.servlet.https.required=false

atom.servlet.hosts.allowed=127.0.0.1,SERVER_IPatom.servlet.https.required=false

webdav.servlet.hosts.allowed=webdav.servlet.https.required=false

json.servlet.hosts.allowed=json.servlet.https.required=falsejsonws.servlet.hosts.allowed=jsonws.servlet.https.required=false


Disable core-portlets or just functionality that you are not ever going to use!

StrutsActionHooks can be used to disable functionality

Modify liferay-porlet-ext.xml with Ext-plugin:

StrutsActionHooks can be used to disable functionality

Modify liferay-porlet-ext.xml with Ext-plugin:

liferay-portlet-ext.xml <portlet>

<portlet-name>...</portlet-name><include>false</include>

</portlet>

liferay-portlet-ext.xml <portlet>

<portlet-name>...</portlet-name><include>false</include>

</portlet>


Change Company encryption key size and algorithm


company.encryption.key.size=56company.encryption.algorithm=DES


company.encryption.key.size=56company.encryption.algorithm=DES


Security Manager - PACL!

portal.properties

## NOTE: This is default setting#portal.security.manager.strategy=smart

portal.properties

## NOTE: This is default setting#portal.security.manager.strategy=smart

liferay-plugin-package.properties

security-manager-enabled=true

# The make work easier

liferay-plugin-package.properties

security-manager-enabled=true

# The make work easier


Antisamy Plugin


Audit Plugin!


Log rotation!

PLUGIN DEVELOPMENT

OWASP 10

Use frameworks that helps you to avoid XSS.

Use Liferay API's to escape where ever necessary

HTMLUtil.escape (..) etc.

Liferay tags, make sure that escapeModel=true

Use Lifeay permission framework

ServiceBuilder: Remember to write permission checks in the remote services

Support Security Manager / PACL!

RECOVERING!

Make disaster recovery plan

Step by step instructions to rebuild new system

How to buildup system again from backups?

How long time this will take?

Test the plan!

WHAT ELSE?

Liferay portal is only one component of your Liferay installation.

Give a hardening though also to:

Http server

Apache: https://www.google.fi/search?q=hardening+apache2

Application server

Tomcat: https://www.owasp.org/index.php/Securing_tomcat

Database

MySql: https://www.google.fi/search?q=hardening+mysql

Other services

https://www.google.fi/search?q=hardening+apache2

https://www.owasp.org/index.php/Securing_tomcat

https://www.google.fi/search?q=hardening+mysql

Thanks guys!

Questions!

Liferay hardening principles

Technology

Transcript of Liferay hardening principles