Parallels Business Automation 4.3

Transcription

1 Parallels Parallels Business Automation 4.3 Advanced Security Configuration Guide Revision (c)

2 ISBN: N/A Parallels 660 SW 39th Street Suite 205 Renton, Washington USA Phone: +1 (425) Fax: +1 (425) Copyright 2008, Parallels, Inc. All rights reserved Distribution of this work or derivative of this work in any form is prohibited unless prior written permission is obtained from the copyright holder.

3 3 Contents Introduction 4 Configuring RSA Server 5 Configuring RSA Encryption 6 Enabling Encryption...6 Creating Encryption Keys...7 Loading Private Key...7 Removing Private Key From Server...7 Dropping Keys Pair...8

4 4 C HAPTER 1 Introduction The primary intent of this document is to bring Parallels Business Automation (hereinafter PBA) into compliance with Requirements 3.5 and 3.6 of PCI Data Security Policies. The requirements state: Protect encryption keys against both disclosure and misuse. Restrict access to keys to the fewest number of custodians necessary Store keys securely in the fewest possible locations and forms. PBA provides two encryption schemes with user definable keys as: Encryption of data with symmetric key using DES. DES key is splitted into two parts. One part is hardcoded into application server code. Customer provides the second part, which is then located on the file system of the server the application server runs. The key is not stored in database and cannot be changed through application interface. Encryption of data with asymmetric key using RSA. Whenever RSA key is used, customer must generate public and private keys himself. Private key should be placed into separate server or securely stored otherwise. Public key is uploaded into application database and is used for encrypting the data. In both cases the key used for encoding is stored in a single place (RSA server, for instance), not accessible from GUI or database, and not transferred on customer computers in any form. Organization or company implementing PCI DSS is fully responsible for providing limited access to the server containing private RSA key or to customer part of DES key. If not for certification purposes, try to avoid using RSA. It will unavoidably bring performance slow down (due to data encoding/decoding processes) and disable any search facilities on CC number. Use physical security systems, firewall, and partition encryption software. If you persist using RSA, execute extreme caution when creating and storing security keys. This document covers enabling RSA encryption only. For DES encryption, refer to the Parallels Business Automation 4.3 Installation guide. RSA encryption configuration comprise the following stages: 1 RSA server installation. 2 Database initialization. 3 Firewall configuration. 4 Enabling RSA encryption from PBA CP.

5 5 C HAPTER 2 Configuring RSA Server RSA server consists of two modules (containers): cryptrec - encrypts and decrypts data cryptkey - generates key pairs Both containers are included into PBA core. Thus, no additional packages are to be installed at RSA server. Deploying RSA server consists in installing PBA on a separate node. This section covers deploying RSA server on the same node with database. The latter variant is conventional and requires minimum configuration efforts. If you want database to be installed on a separate node, refer to Parallels Business Automation 4.3 Installation guide for details. Installation and configuration in this case is similar as for PBA production server. To install RSA server: 1 Log in to the node where you would like to deploy RSA server as root. 2 Copy PBA installation script ("bm-installer-bm{version}.sh") to the node. Make sure that distributive version is the same as of PBA production server. 3 Maximize the console window to fit the full screen height. 4 Run the installation script by executing the command:./bm-installer-bm4_1_xxx_xxx.sh 5 Proceed with the wizard to the components selection step. Unselect all additional components (if any). 6 Finish installation. To initialize database: 1 Execute the following script to initialize database: cd ~bm/bin./configure.sh 2 Stop RSA server by executing the following via command: /etc/init.d/bm stop 3 Start RSA server by executing the following via command: /etc/init.d/bm start Configure firewall to allow all connections from PBA production server. Drop other connections.

6 6 C HAPTER 3 Configuring RSA Encryption RSA encryption can be enabled and fully configured from PBA control panel. Two key pairs can be generated for data encryption. The mechanism is implemented to ensure safe encryption keys pair change. The mechanism works as follows: 1 Two PBA containers perform data encryption: cryptrec - encrypts and decrypts data; cryptkey - generates key pairs. When first key pair is generated, the data is encrypted with public key. Private key is given to user. Encrypted data is unavailable until user loads private key to PBA. The key is stored in memory of server where encryption containers are run. 2 As soon as user stores private key, the data can be decrypted. On this stage the encryption can be considered finished. 3 To ensure key pairs rotation, second key pair can be generated. The data is first decrypted with private key 1, and then encrypted with public key 2. Thus, the data is duplicated in database encrypted with different keys. Second private key is to be securely stored for cases of first private key loss or key pairs rotation. 4 Now, the user can drop original encryption keys and thus rotate encryption key pairs. Credit cards information encrypted with dropped keys pair gets deleted as well. In This Chapter Enabling Encryption...6 Creating Encryption Keys...7 Loading Private Key...7 Removing Private Key From Server...7 Dropping Keys Pair...8 Enabling Encryption Before you can generate key pair to encrypt data, the encryption has to be enabled from CP. To enable encryption: 2 Click Edit. The editing e-commerce general settings dialog window is displayed. 3 Select the Store Payment Methods Encrypted check box. 4 Click Save to confirm settings.

7 Configuring RSA Encryption 7 Creating Encryption Keys To generate encryption keys pair: 2 Click Generate New Key. The generating new key pair dialog window is displayed. 3 Type a password into the Password field. Memorize or write down the password. It will be required when loading private key to server. 4 Confirm password in the Confirm Password field. 5 Click Save to Local Disk to save the private key displayed in a safe place. When saving manually, make sure you have copied the key exactly as it shown (everything, including lines "===Private Key===" and "===End of Private Key==="). Loading Private Key As the first key pair is generated, it is time to load the private key to server memory. To load private key: 2 Click Load Private Key. The loading private key dialog window is displayed. 3 Insert private key into the Private Key field. Use Load From Local Disc to load the key from a file. 4 Type the password into the Password field. 5 Click Load Private Key to finish loading the key. Removing Private Key From Server When the private key is removed, the data is still stored encrypted, but can not be decrypted. The operation is required when you change encryption keys pair for another - current private key is removed and the second one is loaded. Make sure you always have at least one private key loaded/saved. Otherwise the data can not be decrypted. To remove private key: 2 Click Unload Private Key.

8 Configuring RSA Encryption 8 Dropping Keys Pair After encryption keys are first generated, at least one of two pairs is always stored and can not be removed. To remove a keys pair: 2 Click Drop Key 1 or Drop Key 2 to drop respective keys pair.