1. Alfresco Security Best Practices Toni de la Fuente ! Alfresco Senior Solutions Engineer! Blog: blyx.com Twitter: @ToniBlyx! ! toni.delafuente@alfresco.com!
2. Who I am?•  Alfresco Senior Solutions Engineer!•  Working with Alfresco for 5 years!•  More than 2 years as part of the team!•  Always involved with:! •  Operating Systems! •  Networks! •  Security! •  Open Source!•  Consultant & Auditor: ethical hacking,penetration tests.!•  And writing about that at blyx.com since 2002 !
3. Agenda•  Intro!•  Project life cycle and security! •  Planning! •  Installation! •  Post-install conﬁguration and hardening! •  Maintenance! •  Monitoring and auditoring!•  Other security-related tasks!•  Demo: information leaks and metadata!•  Conclusions!•  Next steps!
building rich context around content! Image Alfresco Rich Media Management SupportEcosystem of Integrations"CIFS, WebDAV, SharePoint, Exchange,GoogleDocs, CMIS, SAP, Salesforce, Process Web ContentKofax, and thousands more.
6. Introduction•  In Alfresco we must take security seriously.! •  Because we care about contents!•  If Alfresco stops working and that poses a problem for your business, security is important.!•  Security is a process not a product.!•  Think of protection, integrity and privacy.!•  Reduce as much as posible the MTBF, to guarantee minimum MTTR posible.!•  Taking into account the Security Plan of the organization, Contingency Plan and Disaster Recovery Plan.!
8. Planning and previous review!•  What should I secure? It depends on… •  Project needs •  Interfaces •  Users, applications or both •  Customization •  Architecture, high availability and scalability Document Collaboration Web Content Records Email Management Management Management Archive Interfaces? Number of…? Customization?
11. Best practices and tips 1/2•  Run Alfresco as a non-root user! •  Conﬁgure all ports beyond 1024! •  Authbind on Debian-like OS! •  IPTables port redirect!•  Avoid default password (admin, db, jmx).!•  Change default certiﬁcates and keys in SOLR.! •  Use keytool or your own certiﬁcates.! •  installRoot/alf_data/solr/CreateSSLKeystores.txt!•  Set permissions for conﬁguration ﬁles, content store, indexes and logs. Only the user running Alfresco must be able to access this folders.! •  chown –R alfresco:alfresco installRoot/! •  chmod –R 600 installRoot/!
12. Best practices and tips 2/2•  Before installing run Alfresco Environment Validation Tool in order to avoid conﬂictive services and ports.!•  Keep SSL active when possible:! •  Do not use self-signed certiﬁcates in live environments.! •  Take care with SSL Strip: force using SSL and teach your users!! •  Check your certiﬁcate strength on:! •  https://www.ssllabs.com/ssldb/analyze.html!•  Use Apache (or other web server) to protect your application server and services.!•  SELinux (review alfresco.sh)!•  When possible, run bundle installer to keep third party binary ﬁles controlled and avoid rootkits ! •  If third party applications are installed by OS rpm repository use rpm command! •  rpm –Vf /path/to/binary! •  rpm –V <rpm-name>!•  Check third party vulnerabilities often.!
15. Which ports should I open and keep inmind? OUTProtocol Port TCP/UDPIN/OUT Activated CommentsSMTP% 25% TCP% OUT% No% To%your%MTA.%DB%–%PostgreSQL% 5432% TCP% OUT% Yes*% Depending%on%DB%DB%–%MySQL% 3306% TCP% OUT% Yes*% Depending%on%DB%DB%–%MS%SQL%Server%1433% TCP% OUT% Yes*% Depending%on%DB%DB%–%Oracle% 1521% TCP% OUT% Yes*% Depending%on%DB%DB%–%DB2% 50000% TCP% OUT% Yes*% Depending%on%DB%LDAP% 396% TCP% OUT% No% For%authetication/sync%LDAPS% 636% TCP% OUT% No% For%authetication/sync%docs.google.com% 443% TCP% OUT% No% %OpenOffice% 8100% TCP% OUT% No% Only%for%remote%OpenOffice%or% Alfresco%Transformation%Server%JGroups% 7800T7802% TCP% OUT% No% Between%cluster%nodes%NFS% 111,2049% TCP/UDP% OUT% No% Only%if%using%remote%NFS%for% contentstore%Kerberos% 88% TCP/UDP% OUT% No% If%Kerberos%SSO%is%configured%DNS% 53% UDP% OUT% Yes% Basic%DNS%service%NTP% 123% UDP% OUT% Yes% Network%Time%% * Also allow outbound traffic to Facebook, Twitter, LinkedIn, Slideshare, Youtube, Flickr, Blogs if you are able to use Publishing Framework, Target Servers for Replication or Cloud Sync.
16. Control and review!•  Controls processes and ports used by the system (Linux):#	netstat	-­‐tulpn|grep	-­‐i	java	tcp	0	0	0.0.0.0:50500	0.0.0.0:*	LISTEN	8591/java	tcp	0	0	127.0.0.1:8005	0.0.0.0:*	LISTEN	8591/java	tcp	0	0	0.0.0.0:8009	0.0.0.0:*	LISTEN	8591/java	tcp	0	0	0.0.0.0:139	0.0.0.0:*	LISTEN	8591/java	tcp	0	0	0.0.0.0:8080	0.0.0.0:*	LISTEN	8591/java	tcp	0	0	0.0.0.0:21	0.0.0.0:*	LISTEN	8591/java	tcp	0	0	0.0.0.0:8443	0.0.0.0:*	LISTEN	8591/java	tcp	0	0	0.0.0.0:445	0.0.0.0:*	LISTEN	8591/java	tcp	0	0	0.0.0.0:7070	0.0.0.0:*	LISTEN	8591/java	udp	0	0	0.0.0.0:137	0.0.0.0:*	8591/java	!•  On Windows OS: ! •  netstat –an | ﬁndstr <port #>!
17. Activate SSL for all services required•  HTTP à HTTPS! •  Appliance supporting SSL ofﬂoading! •  Activate HTTPS on a frontal web server (Apache, IIS, etc)! •  Activate HTTPS on the application server!•  FTP à FTPS ! •  Check ofﬁcial documentation!•  SharePoint (jetty) à SSL! •  You will avoid MS users related workarounds! •  Check ofﬁcial documentation!•  SMTP à SMTPS: IN and OUT! •  Check ofﬁcial documentation!•  IMAP à IMAP-SSL ! •  Greenmail (based) or Perdition or Stunnel!•  JGroups! •  Stunnel or Proxy!
18. Post installation configuration - 1/5•  Redirect ports below 1024:! •  E.g. for FTP and IPTables: ! •  iptables -t nat -A PREROUTING -p tcp --dport 21-j REDIRECT --to-ports 2121! •  http://wiki.alfresco.com/wiki/File_Server_Conﬁguration!•  Change JMX credentials and roles! •  http://blyx.com/2011/12/20/persistencia-en-las-credenciales- jmx-de-alfresco/!•  Make sure you have control of your logs! •  http://blyx.com/2011/06/02/consejos-sobre-los-logs-en-alfresco/!
19. Post installation configuration - 2/5•  Are you going to use external authentication?! •  Encrypt communication between Alfresco and the LDAP/AD or SSO system (port 636 TCP for LDAPS)!•  Replication Service between on-premises?! •  HTTPS!!!•  Disable unneeded services:! •  ftp.enabled=false! •  cifs.enabled=false ! •  imap.server.enabled=false ! •  nfs.enabled=false ! •  transferservice.receiver.enabled=false! •  audit.enabled=false/true! •  webdav: disable on tomcat/webapps/alfresco/WEB-INF/web.xml! •  SharePoint: do not install VTI module if unneeded.!
20. Post installation configuration - 3/5 •  Backup conﬁguration and sequence! •  Backup Lucene 2 AM! • installRoot/alf_data/backup-lucene-indexes! •  Backup SOLR 2 AM Alfresco core and 4 AM Archive core.! • installRoot/workspace-SpacesStore ! • installRoot/archive-SpacesStore! •  Backup SQL.! •  Backup contentStore, audit, etc.!•  Consider using LVM snapshots for the contenstore and snapshot-like backup for db!•  For small amounts of content you may use:! •  http://code.google.com/p/share-import-export/!•  Try recovery often as a preventive measure !•  Add a checked Alfresco recovery procedure to your Contingence Plan!•  Consider using Replication Service for disaster recovery plan:! •  replication.enabled=true and replication.transfer.readonly=false!
21. Post installation configuration - 4/5•  Disable guest user:! •  For NTLM-Default:! • alfresco.authentication.allowGuestLogin=false (default is true)! •  For pass-through:! • passthru.authentication.guestAccess=false (default is false)! •  For LDAP/AD:! • ldap.authentication.allowGuestLogin=false (default is true)!•  Limit number of users and state of the repository:! •  server.maxusers=-1 (-1 no limit)! •  server.allowedusers=admin,toni,bill (empty for all)! •  server.transaction.allow-writes=true (false to turn the whole system into read only mode)!
24. Maintenance•  Daily review of logs and audit records (if enabled).!•  Daily review of backup, and monthly restoring!!•  Delete orphan ﬁles, log rotation/compression and temporary ﬁles cleaning.! •  Use a crontab script, for further information:! •  http://www.fegor.com/2011/08/mantenimiento-diario-de- alfresco.html!
26. Monitoring and Auditory•  JMX! •  Jconsole! •  VisualVM!•  Hyperic! •  http://blyx.com/2009/11/19/monitoring-alfresco-nagiosicinga- hyperic-auditsurf-jmx-rocks/!•  Nagios/Icinga! •  http://blyx.com/2009/11/19/monitoring-alfresco-nagiosicinga- hyperic-auditsurf-jmx-rocks/!•  Javamelody! •  http://blyx.com/2010/09/13/monitoring-alfresco-con-javamelody/!!
27. Nagios/Icinga plugin•  Always monitoring! !•  Nagios4Alfresco Plugin!
30. Other security-related tasks - 1/2•  Avoid information leaks through metadata (demo)! •  content + metadata in Alfresco DB ! !vs.! •  (content + metadata) + metadata in Alfresco!•  Consider using the new type “d:encrypted”!•  Add checksum to the content (third party development)!•  User blocking after a certain number of failed authentications (LDAP or third party)!•  Change webdav visibility root!•  Session timeout for Explorer and Webdav!•  Session timeout for Share!•  Session timeout for CIFS!•  Set CIFS and FTP on read only mode if required!
33. Demo Script•  Starting an attack: gathering information! •  Google Hacking! •  FOCA!•  Exiftool & wget!•  Publishing/Replication/Sync contents with Alfresco (web sites, blog, social networks or just contents.)!•  Backdoors and metadata: yes, we can…!•  Cleaning contents with Alfresco! •  cmd-line-action-clean-metadata-1.0.1.amp! •  Conﬁguration (script + alfresco-global.properties)! •  Add rule! •  Test!
34. Tools, References and Links•  Gathering info tools:! •  Cleaners:! •  FOCA - http://www.informatica64.com/ •  Exiftool! foca.aspx! •  OOMetaExtractor - •  Exiftool - http://www.codeplex.org/ http://owl.phy.queensu.ca/~phil/ oometaextractor! exiftool/ ! •  MS Ofﬁce 2003 & XP •  Metagooﬁl - http://www.microsoft.com/ http://www.edge-security.com/ downloads/details.aspx? metagooﬁl.php! displaylang=en&FamilyID=144e5 4edd43e-42ca- •  Libextractor - bc7b-5446d34e5360! http://www.gnu.org/software/ libextractor/! •  BatchPuriﬁer - $19 (BatchPuriﬁerCon.exe)! •  Shodan - http://www.shodanhq.com/! •  Explanation:!•  Alfresco Security Toolkit CMD •  http://blyx.com – theory! LINE ! •  http://blyx.com – practice / POC ! •  cmd-line-action-clean- metadata-1.0.1.amp!
37. Conclusions•  Trust no one, including users!!•  Nobody cleans documents.! •  Almost everything can reveal information!•  Currently we have tools and information available to secure Alfresco, but unfortunately they are not on a single place and we have to improve some of them.!•  Remember: security measures have to be taken constantly!!•  Other topics to be covered in future related to security:! •  Security in development! •  In-depth auditory ! •  Users, roles and permissions.! •  Authentication subsystems creation (webinar already carried out in Spanish)! •  SSO with CAS, Siteminder, OpenSSO, JoSSO, ForgeRock, Oracle Identity Manager, etc. ! •  PKI integration or best practices for digital signatures, content encryption, etc.!
38. Next steps•  Lets use “Alfresco Security Toolkit” as main project for collection of security related docs and tools. ! •  http://code.google.com/p/alfresco-security-toolkit/!•  “Hardening Alfresco Guide”.!•  “Bastille Alfresco” – useful?!•  Any idea? !
40. # while you=applause; do echo THANKS!; done Toni de la Fuente! Alfresco Senior Solutions Engineer! Blog: blyx.com Twitter: @ToniBlyx! ! toni.delafuente@alfresco.com!