Skip to main content

Hardening the CentreStack Cluster

Jeff Reed
Updated

Background

There are a number of configuration settings that should be enabled in order to "harden" the CentreStack Cluster. For example, in order for the system to pass a penetration test these settings will most likely be required. WARNING: Review CentreStack Support for TLS 1.1 and TLS 1.2 before performing the steps in this article. 

Update machine key

TLS Setup

Others

Checklist

  1. There must be a valid server certificate bound to TCP 443 in IIS Manager.
  2. Verify that the system responds to the https://<fqdn> URL, where <fqdn> is the fully qualified domain name of the CentreStack cluster.
  3. Verify that the server certificate reported by the browser is valid and there are no certificate errors.
  4. Navigate to Cluster Dashboard > Server Farm > Worker Node Count 
    1. Click the pencil icon (Edit) . Set the External URL to be the fully qualified domain name of the CentreStack cluster.
    2. Click the gray gear icon (Advanced Settings).  
      1. Enable Always force SSL on Login
      2. Always force SSL for Native Clients
  5. Navigate to Cluster Dashboard > Cluster Settings > Cluster Settings
    1. Enable: Hide login failure message details
    2. Enable: Hide build number from login page
    3. Click the disk icon in the lower right to save the settings
  6. Restrict Management Access to Private Networks
    1. Navigate to Cluster Dashboard > Tenant Manager > My Tenant
    2. Go to Settings > Data Leak Protection > Client Access Policy
    3. Click Add New Access Policy and give it a name
    4. Choose "Not Access from Customer-Defined Network", enter the private IP Range that will be allowed to access the Management Options and click Next mceclip0.png
    5.  Choose the option "Deny following checked permission(s)", check the Web Management" option and click COMMIT.           mceclip1.png

Update machine key

Centrestack installation contains a default machine key. To enhance security, change the default machine key. Keep in mind new Centrestack installation will update the machine key automatically.

  1. On Centrestack server, go to Centrestack installation folder C:\Program Files (x86)\Gladinet Cloud Enterprise\root 
  2. Make a backup of web.config
  3. open IIS Manager
  4. Select Sites, Default Web Site. In the middle ASP.NET section, double click Machine Key
  5. It shows the current machine key used. Click 'Generate Keys' on the right pane
  6. A new machine key is generated. Click Apply to save it to root\web.config
  7. If you have multiple worker nodes, all nodes need to use the same machine key. Follow the above procedure to generate a new machine key on one node. Copy the new machine key on root\web.config on the node.
  8. Go to all other nodes. Make a backup of root\web.config. Edit root\web.config to use the same machine key as the first node. Save the change.
  9. Restart IIS.

TLS Setup

  1. Download IISCrypto and apply the PCI 3.1 template which disable all SCHANNEL protocols except TLS 1.1 and TLS 1.2. 
  2. Additional in IISCrypto, disable TLS_RSA_WITH_3DES_EDE_CBC_SHA as it is considered a medium strength cipher:

Other Configurations

For all the configurations below, only do them when it is necessary. Record what you have done. If you see strange behaviors after enabling them, disable the newly updated configuration first to see whether the issue disappears.

1. Hide server details in response headers

Some penetration tests will insist that the server response headers should not display version or  platform information about the server. For example this curl command will display the response headers:

curl -I https://cspentest.hadroncloud.com/portal/loginpage.aspx
HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 44437
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
Set-Cookie: y-glad-lsid=; domain=cspentest.hadroncloud.com; path=/; secure
Set-Cookie: y-glad-state=; domain=cspentest.hadroncloud.com; path=/; secure
Set-Cookie: y-glad-token=; domain=cspentest.hadroncloud.com; path=/; secure
Set-Cookie: y-glad-sharetoken=; domain=cspentest.hadroncloud.com; path=/; secure
X-Powered-By: ASP.NET
Date: Mon, 27 Aug 2018 16:58:33 GMT

The theory is that the response fields, Server, X-AspNet-Version, and X-Powered-By contain information about the server that could be used to attack it. 

    1. To disable the X-AspNet-Version: 
      1. Start PowerShell as Administrator (elevated) and execute this command: 
        Set-WebConfigurationProperty -filter /system.web/httpRuntime -name enableVersionHeader -value false -PSPath 'IIS:\Sites\Default Web Site'
    2. Use this at your own risk. It hasn't been fully tested. To return empty strings for the Server and X-Powered-By response headers:
      1. Install the URLRewrite tool on the CentreStack server: http://www.iis.net/downloads/microsoft/url-rewrite
      2. In IIS Manager click on the server name (this setting will be server wide in scope)
      3. Open the URL Rewrite feature.
      4. In the Actions pane, click View Server Variables
      5. In the Actions pane, click Add...
      6. In the Add Server Variable dialog type: RESPONSE_SERVER
      7. Again in the Actions pane, click Add...
      8. In the Add Server Variable dialog type: RESPONSE_X-POWERED-BY
      9. The middle pane will look like this after both server variables are added:
      10. In the Actions pane, click Back to Rules
      11. In the Actions pane, click Add Rule(s)...
      12. In the Outbound rules section click Blank rule then click the OK button.
      13. For the first outbound rule match this screen:
      14. In the Actions pane, click Apply
      15. In the Actions pane, click Back to Rules
      16. In the Actions pane, click Add Rule(s)...
      17. In the Outbound rules section click Blank rule then click the OK button.
      18. For the second outbound rule match this screen:
      19. In the Actions pane, click Apply
      20. In the Actions pane, click Back to Rules
      21. The two rules will be displayed as:
      22. Use curl or similar tool to verify the response headers are empty:
        curl -I https://cspentest.hadroncloud.com/portal/loginpage.aspx
HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 44437
Content-Type: text/html; charset=utf-8
Server:
Set-Cookie: y-glad-lsid=; domain=cspentest.hadroncloud.com; path=/; secure
Set-Cookie: y-glad-state=; domain=cspentest.hadroncloud.com; path=/; secure
Set-Cookie: y-glad-token=; domain=cspentest.hadroncloud.com; path=/; secure
Set-Cookie: y-glad-sharetoken=; domain=cspentest.hadroncloud.com; path=/; secure
X-Powered-By:
Date: Mon, 27 Aug 2018 17:21:42 GMT

2. Protect Against Clickjacking

To protect against clickjacking attacks add the The X-Frame-Options header (or XFO header): 

    1. In IIS Manager select the Default Web Site node in the tree pane. 
    2. In the middle pane double-click HTTP Response Headers
    3. In the Action pane click Add...
    4. In the Add Custom HTTP Response Header dialog:
      Name: X-Frame-Options
      Value: SAMEORIGIN
    5. Click the OK button
    6. Again, in the Action pane click Add...
    7. In the Add Custom HTTP Response Header dialog:
      Name: Content-Security-Policy
      Value: frame-ancestors 'self'
    8. Click the OK button

3. Reject Empty Response Headers

Use this at your own risk. It hasn't been fully tested. The server may return it's private IP address if an response header is submitted to the server. To reject empty response headers:

    1. Install the URLRewrite tool on the CentreStack server: http://www.iis.net/downloads/microsoft/url-rewrite
    2. In IIS Manager click on the Default Web Site
    3. Open the URL Rewrite feature.
    4. In the Actions pane click Add Rule(s)...
    5. In the Add Rule(s) dialog select Request blocking then click the OK button:
    6. In the Add Request Blocking Rule:
      • Block access based on: Host Header
      • Block request that: Does Not Match the Pattern
      • Pattern (Host Header): *.<yourdomainname>
      • Using: Wildcards
      • How to block: Send an HTTP 403 (Forbidden) Response

Related articles

Comments

0 comments

Please sign in to leave a comment.