HP Business Service Management

Transcription

1 HP Business Service Management for the Windows and Linux operating systems Software Version: 9.13 Hardening Guide Document Release Date: May 2012 Software Release Date: May 2012

2 Legal Notices Warranty The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein. The information contained herein is subject to change without notice. Restricted Rights Legend Confidential computer software. Valid license from HP required for possession, use or copying. Consistent with FAR and , Commercial Computer Software, Computer Software Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor's standard commercial license. Copyright Notices Copyright Hewlett-Packard Development Company, L.P. Trademark Notices Adobe and Acrobat are trademarks of Adobe Systems Incorporated. AMD and the AMD Arrow symbol are trademarks of Advanced Micro Devices, Inc. Google and Google Maps are trademarks of Google Inc. Intel, Itanium, Pentium, and Intel Xeon are trademarks of Intel Corporation in the U.S. and other countries. ipod is a trademark of Apple Computer, Inc. Java is a registered trademark of Oracle and/or its affiliates. Microsoft, Windows, Windows NT, Windows XP, and Windows Vista are U.S. registered trademarks of Microsoft Corporation. Oracle is a registered trademark of Oracle Corporation and/or its affiliates. UNIX is a registered trademark of The Open Group. 2

3 Acknowledgements This product includes software developed by the Apache Software Foundation ( This product includes software developed by the JDOM Project ( This product includes software developed by the MX4J project ( mx4j.sourceforge.net). 3

4 Documentation Updates The title page of this document contains the following identifying information: Software Version number, which indicates the software version. Document Release Date, which changes each time the document is updated. Software Release Date, which indicates the release date of this version of the software. To check for recent updates, or to verify that you are using the most recent edition of a document, go to: This site requires that you register for an HP Passport and sign-in. To register for an HP Passport ID, go to: Or click the New users - please register link on the HP Passport login page. You will also receive updated or new editions if you subscribe to the appropriate product support service. Contact your HP sales representative for details. 4

5 Support Visit the HP Software Support web site at: This web site provides contact information and details about the products, services, and support that HP Software offers. HP Software online support provides customer self-solve capabilities. It provides a fast and efficient way to access interactive technical support tools needed to manage your business. As a valued support customer, you can benefit by using the support web site to: Search for knowledge documents of interest Submit and track support cases and enhancement requests Download software patches Manage support contracts Look up HP support contacts Review information about available services Enter into discussions with other software customers Research and register for software training Most of the support areas require that you register as an HP Passport user and sign in. Many also require a support contract. To register for an HP Passport ID, go to: To find more information about access levels, go to: 5

6 6

7 Table of Contents Welcome to This Guide...9 Who Should Read This Guide...9 How Do I Find the Information That I Need?...9 Additional Online Resources...11 Documentation Updates...12 Chapter 1: Hardening Workflow...13 Chapter 2: Introduction to Hardening the BSM Platform...19 Introduction to Hardening...19 Deploying BSM in a Secure Architecture...20 Tracking Login Attempts and Logged In Users...21 Recommendations and Notes...22 Chapter 3: Using a Reverse Proxy in BSM...25 Overview of Reverse Proxies...26 Security Aspects of Using Reverse Proxies...26 BSM and Reverse Proxies...27 Specific and Generic Reverse Proxy Mode Support for BSM...28 Using a Reverse Proxy

8 Table of Contents Chapter 4: Using SSL in BSM...45 Introducing SSL Deployment in BSM...46 Issuing SSL Certificates...48 SSL-Supported Topologies in BSM...51 Configuring BSM to Work with SSL...51 Configuring SSL from Application Users to the Gateway Server...53 Handling Security Certificate Expiration...55 Creating a Keystore...55 Configuring Tomcat to Support HTTPS...58 Configuring JBOSS to work with SSL...60 Configuring the JMX Console to Work with SSL in Other Processes...63 Securing JMX-RMI Channel Used for Internal BSM Communications...64 Using SSL Offloader...69 Chapter 5: Using SSL with TransactionVision...71 About SSL and TransactionVision...72 Configuring SSL Between a TransactionVision Processing Server and the BSM Gateway Server...73 Chapter 6: Using Basic Authentication in BSM...79 Introducing Basic Authentication Deployment in BSM...80 Configuring Basic Authentication Between the Gateway Server and Application Users...83 Configuring Basic Authentication Between the Gateway Server and the Data Collectors...86 Auto Upgrading Data Collectors Remotely when Using Basic Authentication...90 Chapter 7: Troubleshooting and Limitations...93 Index

9 Welcome to This Guide This chapter includes: Who Should Read This Guide on page 9 How Do I Find the Information That I Need? on page 9 Additional Online Resources on page 11 Documentation Updates on page 12 Who Should Read This Guide This guide is intended for the following users of BSM: BSM administrators Security administrators Readers of this guide should be highly knowledgeable about enterprise system security. How Do I Find the Information That I Need? This guide is part of the HP Business Service Management Documentation Library. This Documentation Library provides a single point of access for all Business Service Management documentation. You can access the Documentation Library by doing the following: 9

10 Welcome to This Guide In Business Service Management, select Help > Documentation Library. From a Business Service Management Gateway Server machine, select Start > Programs > HP Business Service Management > Documentation. 10

11 Welcome to This Guide Additional Online Resources Troubleshooting & Knowledge Base accesses the Troubleshooting page on the HP Software Support Web site where you can search the Self-solve knowledge base. Choose Help > Troubleshooting & Knowledge Base. The URL for this Web site is HP Software Support accesses the HP Software Support Web site. This site enables you to browse the Self-solve knowledge base. You can also post to and search user discussion forums, submit support requests, download patches and updated documentation, and more. Choose Help > HP Software Support. The URL for this Web site is Most of the support areas require that you register as an HP Passport user and sign in. Many also require a support contract. To find more information about access levels, go to: To register for an HP Passport user ID, go to: HP Software Web site accesses the HP Software Web site. This site provides you with the most up-to-date information on HP Software products. This includes new software releases, seminars and trade shows, customer support, and more. Choose Help > HP Software Web site. The URL for this Web site is 11

12 Welcome to This Guide Documentation Updates HP Software is continually updating its product documentation with new information. To check for recent updates, or to verify that you are using the most recent edition of a document, go to the HP Software Product Manuals Web site ( 12

13 1 Hardening Workflow This section describes the overall workflow needed to harden the HP Business Service Management environment. The procedures in this book should not be performed outside of the context of this workflow. 1 Hardening prerequisites Verify BSM functionality. Verify that the BSM environment is fully functioning before starting the hardening procedures. This includes the basic data flow into and out of BSM. Define security requirements. Before starting the hardening process, define what areas of your environment you want to secure (with SSL). Review recommendations and notes. For details, see "Recommendations and Notes" on page Obtain server certificates for the BSM virtual gateway server URLs Obtain a server certificate for each of the following front-end URLs that you want to secure: one for users to access BSM, and one for data collectors to access BSM. For details, see "Issuing SSL Certificates" on page 48. Note: If your SSL termination points are not the front-end URLs (BSM virtual gateway server URLs), you need to issue server certificates for these termination points as well. 13

14 Chapter 1 Hardening Workflow The server certificates must be issued into the exact FQDNs. Later, these same FQDNs must be entered into the BSM Console > Admin > Setup and Maintenance > Infrastructure Settings page in the following two rows: Default Virtual Gateway Server for Application Users URL Default Virtual Gateway Server for Data Collectors URL For example: If your URL is you would issue a certificate to bsmusers.mycompany.com. 3 Obtain root CA certificate(s) Obtain the root CA certificates from the root and any intermediate authorities that issued the server certificates above. 4 Configure SSL connection using the server certificates Install the server certificates on the termination points of SSL. This may be a load balancers, a reverse proxy, or BSM Gateway servers. Use the web server documentation depending on your web server type and version: For IIS web server. The Microsoft Web site ( For Apache web server. The Apache Jakarta Web site ( 5 Establish trust to the Certificate Authority On all BSM Gateway servers, establish trust to the Certificate Authority that issued the BSM server certificates above. Note: The same procedure must be performed in both the JRE and JRE64 directories 14

15 Chapter 1 Hardening Workflow Example: cd <BSM root directory>/jre64/bin > keytool -import -alias <myca> -file c:\mycarootcert.cer -keystore..\lib\security\cacerts -trustcacerts -storepass changeit cd <BSM root directory>/jre/bin > keytool -import -alias <myca> -file c:\mycarootcert.cer -keystore..\lib\security\cacerts -trustcacerts -storepass changeit 6 Verify secure connection works From a client browser, open the Default Virtual Gateway Server for Application Users and Default Virtual Gateway Server for Data Collectors URLs that you secured. If the login page appears, this verifies that the secure connection is configured. 7 Update BSM Virtual URLs to use https Log in to BSM and enter the secured URLs in BSM Console > Admin > Setup and Maintenance > Infrastructure Settings page in the following two rows: Default Virtual Gateway Server for Application Users URL Default Virtual Gateway Server for Data Collectors URL Enable and disable all BSM Gateway servers, and verify (again) that a client can log in using those URLs. 8 Connect every data collector to secure BSM Now that the BSM servers are secured, you configure other servers to communicate securely with BSM. The basic flow for any data collector connecting to secure BSM is as follows: a b c Import root CA certificate(s) obtained in step 3 on page 14 into the JVM used by the data collector. Configure the connection to BSM using https. Make sure data flows over the secure connection. 15

16 Chapter 1 Hardening Workflow Follow the appropriate procedures for more detailed descriptions for each of the data collectors: Data Collector / Server type BPM SIS RUM Data Flow Probe Transaction Vision Relevant Documentation See the HP Business Process Monitor Administrator s Guide. See the HP SiteScope Deployment Guide PDF See the Real User Monitor Administration PDF The default UCMDB SSL port, 8443, must be changed to the BSM SSL port, 443, in the DiscoveryProbe.properties file For more information, see the RTSM Data Flow Management Guide. See the HP TransactionVision Deployment Guide PDF 16

17 Chapter 1 Hardening Workflow 9 Secure JBOSS Management API (http JMX) on BSM servers. Up to this point in the procedure, you secured access to BSM from web servers (port 80). However, the applications servers (port 8080) are not secured. We recommend securing them as well. For details, see "Configuring JBOSS to work with SSL" on page Configure mutual SSL If the connection to BSM requires a client certificate, perform the appropriate procedures: Data Collector / Server type BSM front-end server (could be a web server on the Gateway server, a load balancer, or a reverse proxy) BPM Relevant Documentation Follow the standard procedures for requiring client certificates on the front end of your choice. (could be a web server on the Gateway server, a load balancer, or a reverse proxy). For details, see "How to Secure User Access to BSM Using Client-Side Authentication Certificates" in the Platform Administration guide See the HP Business Process Monitor Administrator s Guide. SIS "Configuring SiteScope to Connect to a BSM Server That Requires a Client Certificate" in the HP SiteScope Deployment Guide PDF. RUM Data Flow Probe See the Real User Monitor Administration PDF. See the RTSM Data Flow Management Guide. 17

18 Chapter 1 Hardening Workflow 11 (Recommended) Secure data collectors admin consoles with SSL This section describes how to secure access to the data collector admin consoles (UI). Follow the appropriate procedures depending on your data collectors: Data Collector / Server type Relevant Documentation BPM "Configuring Tomcat to Support HTTPS" on page 58 SIS "Configuring Tomcat to Support HTTPS" on page 58 RUM "Configuring Tomcat to Support HTTPS" on page 58 Transaction Vision "Enable SSL on the TransactionVision Processing Servers" on page (Optional ) Secure JBOSS Management API (JMX-RMI channel) In certain cases, you may need to secure the JMX-RMI channel used for internal BSM communications. This procedure should only be performed if there is a specific reason to do so. For details, see "Securing JMX-RMI Channel Used for Internal BSM Communications" on page (Optional) Secure JMX console for other processes You can also secure the JMX console to work with SSL in other processes. For details, see "Configuring the JMX Console to Work with SSL in Other Processes" on page

19 2 Introduction to Hardening the BSM Platform This chapter includes: Introduction to Hardening on page 19 Deploying BSM in a Secure Architecture on page 20 Tracking Login Attempts and Logged In Users on page 21 Recommendations and Notes on page 22 Introduction to Hardening This chapter introduces the concept of a secure BSM platform and discusses the planning and architecture required to implement a secure platform. It is strongly recommended that you read this chapter before proceeding to the following chapters, which describe the actual hardening procedures. The BSM platform is designed so that it can be part of a secure architecture, and can therefore meet the challenge of dealing with the security threats to which it could potentially be exposed. The hardening guidelines deal with the configuration required to implement a more secure (hardened) BSM platform. The hardening guidelines relate to both single machine (where all servers are installed on the same machine) and distributed (where all servers are installed on separate machines) deployments of BSM. You can also invoke dedicated Gateway deployment, in which several Gateway servers are assigned different tasks. 19

20 Chapter 2 Introduction to Hardening the BSM Platform The hardening information provided is intended primarily for BSM administrators, and for the technical operator of each component that is involved in the implementation of a secure BSM platform (for example, the Web Server). These people should familiarize themselves with the hardening settings and recommendations prior to beginning the hardening procedures. Deploying BSM in a Secure Architecture Several measures are recommended to securely deploy your BSM servers: DMZ architecture using a firewall The secure architecture referred to in this document is a typical DMZ architecture using a device as a firewall. The basic concept of such an architecture is to create a complete separation, and to avoid direct access between the BSM clients and the BSM servers. Secure browser Internet Explorer in a Windows environment and FireFox in a Linux environment must be configured to securely handle Java scripts, applets, and cookies. SSL communication protocol Secure Sockets Layer protocol secures the connection between the client and the server. URLs that require an SSL connection start with HTTPS instead of HTTP. Reverse proxy architecture One of the more secure and recommended solutions is to deploy BSM using a reverse proxy. BSM fully supports reverse proxy architecture as well as secure reverse proxy architecture. The following security objectives can be achieved by using a reverse proxy in DMZ proxy HTTP/HTTPS communication with BSM: No BSM logic or data resides on the DMZ. No direct communication between BSM clients and servers is permitted. No direct connection from the DMZ to the BSM database is required. 20

21 Chapter 2 Introduction to Hardening the BSM Platform The protocol used to communicate with the reverse proxy can be HTTP or HTTPS. HTTP can be statefully inspected by firewalls if required. A static, restricted set of redirect requests can be defined on the reverse proxy. Most of the Web server security features are available on the reverse proxy (authentication methods, encryption, and others). The reverse proxy screens the IP addresses of the real BSM servers as well as the architecture of the internal network. The only accessible client of the Web server is the reverse proxy. This configuration supports NAT firewalls. The reverse proxy requires a minimal number of open ports in the firewall. The reverse proxy provides good performance compared to other bastion host solutions. It is strongly recommended that you use a reverse proxy with BSM to achieve a secure architecture. For details on configuring a reverse proxy for use with BSM, see "Using a Reverse Proxy in BSM" on page 25. If you must use another type of secure architecture with your BSM platform, contact HP Software Support to determine which architecture is the best one for you to use. Tracking Login Attempts and Logged In Users To track who has attempted to log in to the system: See <HPBSM root directory>\log\ejbcontainer\useractions.servlets.log. The appender for this file is located in <HPBSM root directory>\conf\core\tools\log4j\ejb\topaz.properties. To display a list of users currently logged in to the system: 1 Open the JMX console on this machine. For detailed instructions, see "Using the JMX Console" in the Platform Administration guide. 2 Under the Topaz section, select service=active Topaz Sessions. 3 Invoke the java.lang.string showactivesessions() operation. 21

22 Chapter 2 Introduction to Hardening the BSM Platform Recommendations and Notes Notes. Prerequisites. To best use the hardening guidelines given here for your particular organization, do the following before starting the hardening procedures: Evaluate the security risk/security state for your general network, and use the conclusions when deciding how to best integrate the BSM platform into your network. Review the entire guide, especially Chapter 1, "Hardening Workflow". Log management. BSM uses the log4j framework for managing log files. If you wish to change the locations of log files, these can be set in the log4j appenders, which are located in <HPBSM root directory>\conf\core\tools\log4j. There is a separate directory for each process, for example EJB for the JBoss application server. Security officer. The security officer is a user who has security privileges to view sensitive information in the system. The security officer is typically not a regular BSM user and receives access to configure certain sensitive reporting information, such as which RUM transaction parameters to include or exclude from certain reports (Session Details, Session Analyzer, etc.). For details, see "Security Officer" in the Platform Administration guide. The Security Officer can see the parameters and decide to expose them in the reports, but once they are exposed in the reports, anyone with access to these reports will be able to see this data, so it is imperative that the application being monitored encrypts sensitive data, such as passwords, credit card numbers, and identity numbers. Changing the encryption algorithm. You can change the encryption algorithm used by BSM, but only before running the configuration wizard. Open the encryption properties file, <HPBSM root directory>\conf\encryption.properties, and choose one of the predefined crypt configuration entries (crypt.conf.x) by setting crypt.conf.active.id to the appropriate index. If you want to add another entry, follow the standard Java Cryptography Extension (JCE) format. 22

23 Chapter 2 Introduction to Hardening the BSM Platform The hardening procedures are based on the assumption that you are implementing only the instructions provided in this guide, and not performing other hardening steps not documented here. Where the hardening procedures focus on a particular distributed architecture, this does not imply that this is the best architecture to fit your organization s needs. It is assumed that the procedures included in the hardening guide will be performed on machines dedicated to the BSM platform. Using the machines for other purposes in addition to BSM may yield problematic results. Recommendations. Isolate BSM servers in their own internal segment behind a firewall since the traffic between the various BSM servers is not encrypted. Follow all security guidelines for LDAP servers and Oracle databases. Run SNMP and SMTP servers with low permissions. Note: SNMP and mail traffic may not be secure. 23

24 Chapter 2 Introduction to Hardening the BSM Platform 24

25 3 Using a Reverse Proxy in BSM This chapter includes: Overview of Reverse Proxies on page 26 Security Aspects of Using Reverse Proxies on page 26 BSM and Reverse Proxies on page 27 Specific and Generic Reverse Proxy Mode Support for BSM on page 28 Using a Reverse Proxy on page 29 25

26 Chapter 3 Using a Reverse Proxy in BSM Overview of Reverse Proxies This chapter describes the security ramifications of reverse proxies and contains instructions for using a reverse proxy with BSM. This chapter discusses only the security aspects of a reverse proxy. It does not discuss other aspects of reverse proxies, such as caching and load balancing. A reverse proxy is an intermediate server that is positioned between the client machine and the Web server(s). To the client machine, the reverse proxy seems like a standard Web server that serves the client machine s HTTP or HTTPS protocol requests with no dedicated client configuration required. The client machine sends ordinary requests for Web content, using the name of the reverse proxy instead of the name of a Web server. The reverse proxy then sends the request to one of the Web servers. Although the response is sent back to the client machine by the Web server through the reverse proxy, it appears to the client machine as if it is being sent by the reverse proxy. Security Aspects of Using Reverse Proxies A reverse proxy functions as a bastion host. It is configured as the only machine to be addressed directly by external clients, and thus obscures the rest of the internal network. Use of a reverse proxy enables the application server to be placed on a separate machine in the internal network, which is a significant security objective. This chapter discusses the use of a reverse proxy in DMZ architecture, the more common security architecture available today. DMZ (Demilitarized Zone) is a network architecture in which an additional network is implemented, enabling you to isolate the internal network from the external one. Although there are a few common implementations of DMZs, this chapter discusses the use of a DMZ and reverse proxy in a backto-back topology environment. 26

27 Chapter 3 Using a Reverse Proxy in BSM The following are the main security advantages of using a reverse proxy in such an environment: No DMZ protocol translation occurs. The incoming protocol and outgoing protocol are identical (only a header change occurs). Only HTTP or HTTPS access to the reverse proxy is allowed, which means that stateful packet inspection firewalls can better protect the communication. A static, restricted set of redirect requests can be defined on the reverse proxy. Most of the Web server security features are available on the reverse proxy (authentication methods, encryption, and more). The reverse proxy screens the IP addresses of the real servers as well as the architecture of the internal network. The only accessible client of the Web server is the reverse proxy. This configuration supports NAT firewalls (as opposed to other solutions). The reverse proxy requires a minimal number of open ports in the firewall. The reverse proxy provides good performance compared to other bastion solutions. BSM and Reverse Proxies BSM supports a reverse proxy in DMZ architecture. The reverse proxy is an HTTP or HTTPS mediator between the BSM data collectors/application users and the BSM servers. BSM must be configured to recognize use of a reverse proxy. Your data collectors may access BSM through the same virtual host or a different virtual host as your application users. For example, your environment may use one load balancer for application users and one load balancer for data collectors. To configure a reverse proxy for either of these architectures, see "Using a Reverse Proxy" on page

28 Chapter 3 Using a Reverse Proxy in BSM Specific and Generic Reverse Proxy Mode Support for BSM BSM servers reply to application users by sending a base URL that is used to calculate the correct references in the HTML requested by the user. When a reverse proxy is used, BSM must be configured to return the reverse proxy base URL, instead of the BSM base URL, in the HTML with which it responds to the user. If the reverse proxy is being used for data collectors only, configuration is required only on the data collectors and reverse proxy, and not on the BSM server(s). There are two proxy modes that control user access to BSM servers: "Specific Mode" on page 28 "Generic Mode" on page 29 Specific Mode This mode should be used if you want to concurrently access BSM servers through specific reverse proxies and by direct access. Accessing the server directly means that you are bypassing the firewall and proxy because you are working within your intranet. If you are working in this mode, each time an application user s HTTP/S request causes BSM to calculate a base URL, the base URL is replaced with the value defined for either the Default Virtual Server URL or the Local Server URL (when defined), if the HTTP/S request came through one of the IP addresses defined for the HTTP or HTTPS Reverse Proxy IPs parameter. If the HTTP/S request did not come through one of these IP addresses, the base URL that BSM receives in the HTTP/S request is the base URL that is returned to the client. 28

29 Chapter 3 Using a Reverse Proxy in BSM Generic Mode This mode is used when you try to access the Gateway server via the reverse proxy. Any URLs requested are rewritten and sent back with the virtual IP of the Gateway server. If you are working in this mode, each time an HTTP/S request causes the BSM application to calculate a base URL, the base URL is replaced with the value defined for either the Default Virtual Server URL or the Local Virtual Server URL (when defined). Note that when using this mode, you must ensure that all BSM clients are accessing the BSM servers via the URL defined for the Default Virtual Server URL or the Local Virtual Server URL parameters. Using a Reverse Proxy This section includes the following topics: "Reverse Proxy Configuration" on page 29 "Configuring BBC Port 383 Connection on Reverse Proxy" on page 36 "HP BSM Specific Configuration" on page 38 "Limitations" on page 41 "Apache 2.x Distributed Configuration Example" on page 41 Reverse Proxy Configuration In this topology, the reverse proxy context is divided into two sections: Communication that is redirected to the Virtual Host for Data Collectors. Communication that is redirected to the Virtual Host for Application Users. 29

30 Chapter 3 Using a Reverse Proxy in BSM The use of a reverse proxy is illustrated in the diagram below. Your data collectors may access BSM through the same virtual host or a different virtual host as your application users. For example, your environment may use one load balancer for application users and one load balancer for data collectors. Reverse proxy BSM support should be configured differently in each of the following cases: Scenario # BSM Components Behind the Reverse Proxy 1 Data collectors (Business Process Monitor, Real User Monitor, SiteScope, Data Flow Probe) 30