Oracle Financial Services Analytical Applications Infrastructure

Transcription

1 Oracle Financial Services Analytical Applications Infrastructure Security Guide Release

2 DOCUMENT CONTROL Version Number Revision Date Changes Done Draft January 2015 Made the document generic for all releases. This document captures the necessary security related configurations. 1.0 April 2015 Added section 3.3 Configuration to restrict file uploads for the Ngan Hang SR November 2015 Added section 3.4 based on Bug December 2015 Updated Web Application Server Security Configuration section based on Bug June 2016 Added content based on Bug December 2016 Rectified the broken link in the TLS Configuration for WebLogic section. Modified the Configuration to restrict HTTP methods other than GET/POST section based on Bug June 2017 Added section Configuring Application Security for Bug , and August 2017 Updated for Bug September 2017 Removed list of filter servlet keywords and created a MOS document. Created by: Gitcy Reviewed by: Darshan/Dhaval/Suresh Approved by: Kiran/ Jeevraj / Surag / Subhashini Executive Summary: This OFSAAI Security Guide includes configuration details for the Filter Servlet, and Web Application Server Security. It also includes generic security configurations.

3 Table of Contents TABLE OF CONTENTS About this Guide... 4 Audience... 4 Recommended Skills FILTER SERVLET Introduction Security and Access Vulnerability Checks Cross Site Scripting SQL Injection Filter Servlet Configurations Checking for XSS Vulnerability Exclusion of Keywords/ Key Characters Debug/ Logs WEB APPLICATION SERVER SECURITY CONFIGURATIONS Security Configuration for Tomcat Security Configuration for WebSphere Session Management Configuration Web Container Settings TLS Configuration for WebSphere Configuring Application Security Security Configuration for WebLogic TLS Configuration for WebLogic ADDITIONAL SECURITY CONFIGURATIONS Configuration to Restrict Access to Default Web Server Pages Configuration to Restrict Display of the Web Server Details Configuration to Restrict File Uploads Configuration to restrict HTTP methods other than GET/POST KNOWN ISSUES/ LIMITATIONS iii

4 About this Guide The information contained in this document is intended to give you a quick exposure and an understanding of the security configurations required after the installation of Oracle Financial Services Analytical Application Infrastructure. This guide is organized into following chapters: Filter Servlet Web Application Server Security Configurations Additional Security Configurations Known Issues Audience This guide is intended for System Administrators (SA) who are instrumental in installing and configuring the Infrastructure application. Recommended Skills It is assumed that the users (System Administrators) are technically sound and proficient in Unix, Database Administration, and Web Application Administration to install and configure OFSAAI in the released environment.

5 1 Filter Servlet This section consists of information related to Filter Servlet and the required configurations. This section also lists out the Keywords and Key Characters. 1.1 Introduction Filter Servlet is a controller in the web-container whose functions are the following: Security and Access This functionality checks whether a user has rights to access a web page that is trying to be accessed Vulnerability Checks This functionality checks for intrusion and Cross-site Scripting vulnerability. Currently this check is for the following group of keywords / key characters: JavascriptKeyWords - paramname in configuration table XSS_JS_KEYWORDS1 to XSS_JS_KEYWORDS13 JavascriptKeyChars - paramname in configuration table XSS_JS_METACHARS1 to XSS_JS_METACHARS10 SQLKeyWords - paramname in configuration table XSS_SQL_KEYWORDS1 to XSS_SQL_KEYWORDS23. SQLWords - paramname in configuration table XSS_SQL_WORDS1 to XSS_SQL_WORDS4 SQLTOKENS- XSS_SQL_TOKENS1 to XSS_SQL_TOKENS8 SQLOPERATORS- XSS_SQL_OPERATORS1 to XSS_SQL_OPERATORS5 are present in Configuration table Cross Site Scripting A Cross Site Scripting vulnerability check is triggered if the HTTP request contains a combination of any JavascriptKeyWords with the JavascriptKeyChars. For example, if an HTTP request contains a combination of any of the JavascriptKeyWords (such as Return, Alert, Script, JavaScript, or VBscript) along with any of JavascriptKeyChars (Meta Chars) such as,, (, ), ;, <, >, {, or }, then the request is blocked displaying an error message. 5

6 You can see the My Oracle Support Document (Doc ID ) containing the PARAMNAME, PARAMVALUE, and DESCRIPTION to view the list of keywords and key characters scoped for filtering SQL Injection An SQL Injection vulnerability check filters multiple combinations of SQLKeyWords and SQLWords. For example, if an HTTP request contains a combination of any of the disallowed SQLWords (such as From, Into, Where, table) with any of the SQLKeyWords (such as Alter, Insert, Select, Create, Update, Delete, Drop, Truncate) for XSS check, then the request is blocked displaying an error message. You can see the My Oracle Support Document (Doc ID ) containing the PARAMNAME, PARAMVALUE, and DESCRIPTION to view the list of keywords and key characters scoped for filtering. 1.2 Filter Servlet Configurations Checking for XSS Vulnerability The following entry will be available in the configuration table present in the Configuration Schema. The Cross site Checks will not be performed if the entry is not present or the PARAMVALUE is FALSE. By default PARAMVALUE is set to TRUE. PARAMNAME PARAMVALUE DESCRIPTION XSS_IS_CHECK_REQUIRED TRUE Parameter to decide whether XSS check is to be enabled or not Exclusion of Keywords/ Key Characters You can exclude the evaluation of a keyword by adding a new PARAMNAME with PARAMVALUE and a DESCRIPTION (optional) to the configuration table. The ending numeral in the new PARAMNAME should be higher than any other numbers in the group. For example, if you want to exclude the evaluation of JS keyword return, which has the PARAMNAME XSS_JS_KEYWORDS1, you need to update the keyword numeral to XSS_JS_KEYWORDS12 considering the table has 11 other keywords listed under this category. Ensure that the updated number is higher than any other numbers in the group. 6

7 1.2.3 Debug/ Logs In case of detection of vulnerability, a message is displayed in the front-end and logged into a file called CSSlogger.log under <deployed context>\logs directory of the webserver. The log contains date, time, URL, and the user. You can configure the CSSlogger.log file creation path. Insert the path for the CSS logger file in the place holder CSS_LOGGER_PATH provided in $FIC_WEB_HOME/conf/FICWeb.cfg file. If you do not provide the path, it gets generated in the default path (<deployed context>\logs). 7

8 2 Web Application Server Security Configurations Refer to the following sections depending on your configured web application server. Alternatively, you may refer to your web application server specific administration guide for additional details. Security Configuration for Tomcat Security Configuration for WebSphere Security Configuration for WebLogic 2.1 Security Configuration for Tomcat Perform the following security configurations for Tomcat: 1. Add preferred cipher list to Tomcat and update the value of sslprotocol to TLS 1.2 in the SSL Connector tag of $CATALINA_HOME/conf/server.xml file. 2. Add the following ciphers attribute to the same tag: ciphers="ssl_rsa_with_rc4_128_sha,tls_ecdhe_ecdsa_with_rc4_128_s HA,TLS_ECDHE_RSA_WITH_RC4_128_SHA,TLS_ECDH_ECDSA_WITH_RC4_128_SH A,TLS_ECDH_RSA_WITH_RC4_128_SHA,TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_DH_DSS_WITH_AES_128_CBC_SHA2 56,TLS_DH_RSA_WITH_AES_128_CBC_SHA256,TLS_DH_DSS_WITH_AES_256_CB C_SHA256,TLS_DH_RSA_WITH_AES_256_CBC_SHA256,TLS_DHE_DSS_WITH_AES _256_CBC_SHA256,TLS_DHE_RSA_WITH_AES_256_CBC_SHA256" 3. Add the following session attributes under Context tag of $CATALINA_HOME/conf/server.xml file. sessioncookiepath= <context> sessioncookiedomain= <domain> NOTE: <context> is OFSAAI context and <domain> is domain name of the server that needs to receive the cookie. For example, if the application is accessed through URL as app.mysite.com, then it should be set to app.mysite.com and not mysite.com. 8

9 2.2 Security Configuration for WebSphere In the WebSphere Admin console, you must restrict cookies to HTTPS sessions in Sessions Management Configuration, specify JSESSIONID variable in the Web Container Settings, set TLS configuration, and configure application security. The subsections describe the procedures in detail Session Management Configuration In Session Management Configuration, restrict cookies to HTTPS Sessions. The following is the procedure: 1. Navigate to your WebSphere Admin Console and in the LHS menu, select Servers > Application Servers. 2. Select the configured Application Server from the list by clicking on the Server Name. 9

10 3. In the Configuration tab, click Session Management link, in Container Settings section. 10

11 4. In the General Properties tab, click the Enable Cookies link. 5. Enter the following details: Cookie Name - JSESSIONID Cookie domain - <domain> Cookie Path - /<context>/ NOTE: <context> is OFSAAI context and <domain> is domain name of the server that needs to receive the cookie. For example, if the application is accessed through URL as app.mysite.com, then it should be set to app.mysite.com and not mysite.com. 11

12 6. Select the Restrict Cookies to HTTPS Sessions checkbox and click Apply and OK. 12

13 2.2.2 Web Container Settings In Web Container Settings, specify JSESSIONID variable in Custom Properties. This value is a string that can set internal system configuration properties. The following is the procedure: 1. Navigate to your WebSphere Admin Console and in the LHS menu, select Servers > Application Servers. 2. Select the configured Application Server from the list by clicking on the Server Name. 3. In the Configuration tab, expand Web Container Settings and click Web Container link. 13

14 4. In the Additional Properties section, click Custom Properties link. 5. Add a variable with the Name com.ibm.ws.webcontainer.httponlycookies and Value as JSESSIONID. You can also specify a Description if required. NOTE: Ensure you specify JSESSIONID in upper case. 6. Click Apply and OK to save the changes. 7. In the Messages section, click on Save link. 14

15 8. Restart Application Server through the console TLS Configuration for WebSphere Following are the steps to configure TLS protocol in WebSphere: 1. Log on to the console ( 2. Under the Security menu, select SSL certificate and key management, SSL configurations, NodeDefaultSSLSettings, and Quality of protection (QoP) settings. 3. Change the Protocol value to TLSv1.2. This ensures that WebSphere server will accept only TLSv1.2 connections. That is, when the web server acts as a server (inbound) or as client (outbound) the SSL connections will be established through the TLSv1.2 protocol. When testing from a browser, make sure to check the browser settings to initiate TLS handshakes only. For more information, see Configuring WebSphere Application Server to support TLS Configuring Application Security Enable Application security to secure your server from unauthorized users and allow access only to authenticated users. It prevents unauthorized access of configuration files in directories. The following is the procedure to enable Application security: 1. Log in to WebSphere with administrator credentials. 2. Click Security from the left menu and click Global security to display the Global security window. NOTE: By default, Administrative security is enabled. However, if it is disabled, enable it before you enable Application security. This is a prerequisite to enable Application security. 15

16 3. Select Enable application security. 2.3 Security Configuration for WebLogic In the WebLogic Server, though the Auth Cookie option is enabled by default, the cookies are not secure. In-order to ensure this, you need to toggle the Auth Cookie Enabled option in WebLogic console by disabling it first and then re-enabling it for secure cookies. You will then need to create a weblogic.xml file and deploy.ear file in your Weblogic server. Perform the following configurations: 1. Login to WebLogic Server Administrative Console and select the Domain from LHS > Domain Structure section. 2. In the Configurations tab (selected by default), select the Web Application tab. 16

17 3. Scroll through the configurations options within the page and locate Auth Cookie Enabled option. By default, the checkbox is selected. 4. De-select the checkbox adjacent to Auth Cookie Enabled option and click Save. 5. On save, select the Auth Cookie Enabled checkbox and resave the change. 6. If your OFSAAI version is below , do the following: Create a file with name weblogic.xml under $FIC_WEB_HOME/webroot/WEB-INF/ and add the below tags. <weblogic-web-app xmlns=" <session-descriptor> <cookie-secure>true</cookie-secure> <cookie-name>jsessionid</cookie-name> <cookie-domain><domain></cookie-domain> <cookie-path>/<context>/</cookie-path> </session-descriptor> </weblogic-web-app> 17

18 7. If your OFSAAI version is or higher, modify weblogic.xml file and add below tag under root element: <session-descriptor> <cookie-name>jsessionid</cookie-name> <cookie-domain><domain></cookie-domain> <cookie-path>/<context>/</cookie-path> </session-descriptor> NOTE: <context> is OFSAAI context and <domain> is domain name of the server that needs to receive the cookie. For example, if the application is accessed through URL as app.mysite.com, then it should be set to app.mysite.com and not mysite.com. 8. Build.ear file and deploy it onto the WebLogic server TLS Configuration for WebLogic Following are the steps to configure TLS protocol in Weblogic: 1. Add the following parameters in setdomainenv.sh present under /domains/<domainname>/bin as arguments for JAVA_OPTIONS: - Dweblogic.security.disableNullCipher=true - Dweblogic.security.SSL.protocolVersion=TLS1.2 For more information, see Enabling TLS-Only on WebLogic. 18

19 3 Additional Security Configurations 3.1 Configuration to Restrict Access to Default Web Server Pages Following are the configurations to restrict access to default web server pages in the Apache Tomcat server: 1. Start the Apache Tomcat server by executing the command startup.sh. 2. Log in to the Tomcat Web Application Manager. 3. Undeploy the Examples application from Tomcat: Go to the Tomcat Web Application Manager screen and click the Remove link corresponding to the Tomcat Examples application. 4. Shut down the Apache Tomcat Server by executing the command shutdown.sh. 5. Comment the following two sections from %CATALINA_HOME%/conf/server.xml (if available). Section I <Context path="/examples" docbase="examples" debug="0" reloadable="true" crosscontext="true"> <Logger classname="org.apache.catalina.logger.filelogger" prefix="localhost_examples_log." suffix=".txt" timestamp="true"/> <Ejb name="ejb/emplrecord" type="entity" home="com.wombat.empl.employeerecordhome" remote="com.wombat.empl.employeerecord"/> Section II <Environment name="maxexemptions" type="java.lang.integer" value="15"/> <Parameter name="context.param.name" value="context.param.value" override="false"/> <Resource name="jdbc/employeeappdb" auth="servlet" type="javax.sql.datasource"/> <ResourceParams name="jdbc/employeeappdb"> <parameter><name>user</name><value>sa</value></parameter> 19

20 <parameter><name>password</name><value></value></parameter> <parameter><name>driverclassname</name> <value>org.hsql.jdbcdriver</value></parameter> <parameter><name>drivername</name> <value>jdbc:hypersonicsql:database</value></parameter> </ResourceParams> <Resource name="mail/session" auth="container" type="javax.mail.session"/> <ResourceParams name="mail/session"> <parameter> <name>mail.smtp.host</name> <value>localhost</value> </parameter> </ResourceParams> </Context> <ResourceLink name="linktoglobalresource" global="simplevalue" type="java.lang.integer"/> 6. Delete %CATALINA_HOME%\webapps\ROOT\index.jsp file. 7. Create a blank file %CATALINA_HOME%\webapps\ROOT\index.html. 8. Comment the following two tags from %CATALINA_HOME%\conf\web.xml file: <welcome-file>index.htm</welcome-file> <welcome-file>index.jsp</welcome-file> 9. Change the default passwords of Tomcat users in %CATALINA_HOME%\conf\tomcat-users.xml file. Following are some examples: <user username="both" password="b$12" roles="tomcat,role1"/> <user username="tomcat" password="t$12" roles="tomcat"/> <user username="admin" password="a$12" roles="admin,manager"/> <user username="role1" password="r$12" roles="role1"/> 20

21 3.2 Configuration to Restrict Display of the Web Server Details Following are the configurations to restrict the display of the web server details from http responses: Modify the /httpd.conf file and set: ServerTokens parameter to Prod ServerSignature parameter to off 3.3 Configuration to Restrict File Uploads Following is the configuration to restrict upload of files with certain file types. This configuration is applicable for all UIs/ APPs that are rendered out of the platform s Forms Framework module. The parameter DOCUMENT_ALLOWED_EXTENSION in the CONFIGURATION table of the configuration schema holds the list of file extensions for valid file types that are allowed to be attached and uploaded in to OFSAA applications. Any files being attached that do not have an extension as listed in this parameter value, will be blocked. The current release has the below values set for the parameter. This list is extensible. DOCUMENT_ALLOWED_EXTENSION --> txt, pdf, doc, Doc, html, htm, xls, zip, jar,xml, jpg, bmp, and jpeg. 3.4 Configuration to restrict HTTP methods other than GET/POST Following configuration is required to restrict HTTP methods other than GET/POST: Modify httpd.conf file of HTTP Server (Apache HTTP Server/Oracle HTTP Server/IBM HTTP Server) RewriteEngine On RewriteCond %{REQUEST_METHOD}!^(GET POST) RewriteRule.* - [R=405,L] If the application is not configured with HTTP Server, perform the following steps in case of WebLogic and WebSphere application servers. 1. Add the following snippet to the $FIC_WEB_HOME/webroot/WEB-INF/web.xml file. <security-constraint> <web-resource-collection> methods</web-resourcename> <web-resource-name>restricted <url-pattern>/*</url-pattern> <http-method>put</http-method> 21

22 <http-method>patch</http-method> <http-method>head</http-method> <http-method>delete</http-method> <http-method>options</http-method> <http-method>trace</http-method> <http-method>connect</http-method> </web-resource-collection> <auth-constraint/> </security-constraint> 2. Navigate to the $FIC_WEB_HOME directory on the OFSAA Installed server. 3. Execute./ant.sh to regenerate <CONTEXTNAME>.ear/.war. 4. Re-deploy the EAR/WAR file onto your configured web application server. For more information on deploying EAR / WAR file, refer to the Post Installation Configuration section in Oracle Financial Services Advanced Analytical Applications Infrastructure Application Pack Installation and Configuration Guide. 22

23 4 Known Issues/ Limitations The following are the known issues or limitations while working with filter servlet: In modules like Data Management Tools, Unified Analytical Metadata, and Forms Framework, if an entered keyword is vulnerable to XSS attack, the page context may lose or action performed on screen may stop without a proper message. Refer CSSlogger.log file for details. In modules like Excel Upload and Modeling Framework, JavaScript error may be displayed if any vulnerability is found. Ensure the excludeurllist.cfg file is not empty. If it is empty, the filter servlet will include all the pages / URL s without filtering. 23

24 OFSAAI Security Guide Oracle Corporation World Headquarters 500 Oracle Parkway Redwood Shores, CA U.S.A. Worldwide Inquiries: Phone: Fax: financial_services/ Copyright 2017 Oracle Financial Services Software Limited. All rights reserved. No part of this work may be reproduced, stored in a retrieval system, adopted or transmitted in any form or by any means, electronic, mechanical, photographic, graphic, optic recording or otherwise, translated in any language or computer language, without the prior written permission of Oracle Financial Services Software Limited. Due care has been taken to make this OFSAAI Security Guide and accompanying software package as accurate as possible. However, Oracle Financial Services Software Limited makes no representation or warranties with respect to the contents hereof and shall not be responsible for any loss or damage caused to the user by the direct or indirect use of this OFSAAI Security Guide and the accompanying Software System. Furthermore, Oracle Financial Services Software Limited reserves the right to alter, modify or otherwise change in any manner the content hereof, without obligation of Oracle Financial Services Software Limited to notify any person of such revision or changes. All company and product names are trademarks of the respective companies with which they are associated. 24