Novell IMANAGER 2.7.3, Руководство администратора

Страница: 111 / 114

iManager Security Issues 111
n
ov
do
cx (e
n)
22
Ju
n
e 20
09
NOTE: Not specifying an Authorized User or Group, which prevents the
configiman.properties
file from being created, or specifying an Authorized User or Group of
AllUsers
, allows any user to install iManager plug-ins and modify iManager server settings. This is
a security risk for server-based iManager environments.
A.4 Preventing Username Discovery
In some installations, the eDirectory server is protected behind a firewall, but the iManager server is
open to the outside world to allow management from home or on the road. Access to iManager is
controlled with Username, Password, and Treename fields on the login screen. In such installations,
it is often desirable to tighten security to avoid revealing any information about the system.
Standard iManager configurations pass through eDirectory messages related to invalid usernames
and passwords during iManager authentication. These messages can inadvertently provide too much
information to potential crackers. To avoid this, iManager 2.7 includes a configuration option to hide
the specific reason for login failure. When enabled, the following error messages are replaced with a
generic error message that reads:
Login Failure. Invalid Username or Password
.
Š Invalid Username (-601)
Š
Incorrect password (-669)
Š Expired password or disabled account (-220)
To enable this setting, open the Configure view and select iManager Server > Configure iManager .
On the Authentication tab, select Hide specific reason for login failure . This sets
Authenticate.Form.HideLoginFailReason=true
in iManager’s
config.xml
file.
Additionally, iManager 2.7 does not support the asterisk (*) character as a wildcard in the Username
field. This prevents unauthorized users from discovering valid usernames. It also prevents possible
denial-of-service attacks that attempt to overload the eDirectory server by continually attempting a
login using only the wildcard (*), which forces eDirectory to search for and return all matching
usernames.
A.5 Tomcat Settings
Because iManager makes use of Tomcat Servlet Container, iManager administrators should be
aware of the encryption-related configuration options of those resources as part of their overall
security strategy. Of particular interest are cipher suites and trusted certificates, which directly
impact the quality of your wire-level encryption. Consider the following rules when configuring
your Tomcat environment:
Š Do not use SSL 2.0 cipher suites, which are outdated and not guaranteed to be secure.
Š
Do not use the NULL cipher suite in a production environment.
Š Do not use any cipher suite classified as LOW or EXPORT quality, because these are less
secure.
Š
Regularly review the list of trusted certificates, and limit the list of accepted Certificate
Authorities to only those you are actually using
More information for Tomcat is available at the Tomcat Documentation Web site (http://
tomcat.apache.org/tomcat-4.1-doc/index.html) .