None Computing title HPE Alletra Storage ArcusOS Web Server Security Technical Implementation Guide version 1 releaseinfo Release: 1 Vuln_Num V-283027 Rule_ID SV-283027r1193771_rule Severity medium Rule_Title The HPE Alletra Storage ArcusOS device must implement cryptographic mechanisms to prevent unauthorized disclosure and modification of all information at rest on all system components. Vuln_Discuss Data at rest is inactive data which is stored physically in any digital form (e.g., databases, data warehouses, spreadsheets, archives, tapes, off-site backups, mobile devices, etc.). Data at rest includes, but is not limited to, archived data, data that is not accessed or changed frequently, files stored on hard drives, USB thumb drives, files stored on backup tape and disks, and files stored off-site or on a storage area network. While data at rest can reside in many places, data at rest for a web server is data on the hosting system storage devices. Data stored as a backup on tape or stored off-site is no longer under the protection measures covered by the web server. There are several pieces of data that the web server uses during operation. The web server must use an accepted encryption method, such as SHA1, to protect the confidentiality and integrity of the information. Check_Content Verify HPE Alletra Storage MP is configured to provide backend drive encryption with the following command: Cli%controlencryption status -d Licensed Enabled BackupSaved State SeqNum Keystore FIPS non-SEDs FailedDisks nodeNonSED yes yes yes normal 0 --- yes 12 0 0 If the output does not show licensed, enabled, BackupSaved, and FIPS as "yes" this is a finding. If the state is not "normal", this is a finding. If Keystore is not "EKM", this is a finding. Fix_Text Enable data at rest encryption. If "cli% showlicense" does not show "SED Encryption" under "License features currently enabled:", then import a SED Encryption license with the "cli% setlicense" command. Create a CSR for the EKM: cli% createcert ekm-client -f -csr -CN ekm_username Sign the CSR with a CA and import the entire certificate chain with: Cli% importcert ekm-client -f stdin Paste the ekm-client certificate chain. Import the EKM Server Certificates: Cli% createcert ekm-server -f stdin Paste the ekm-server certificate chain. Set the connection to the EKM with the following command: cli% controlencryption setekm -setserver <EKM_IP> -port 5696 -ekmuser ekm_username -kmipprotocols (supported protocols by the ekm) -passwordnoprompt <ekm_user_password> Enable encryption with the following command: cli% controlencryption enable -ekm /common/encryptionBackup Enter passwords and save the encryption backup file off of the array for disaster recovery. Not_Reviewed Vuln_Num V-283037 Rule_ID SV-283037r1193801_rule Severity medium Rule_Title The HPE Alletra Storage ArcusOS device must set an inactive timeout for sessions. Vuln_Discuss Leaving sessions open indefinitely is a major security risk. An attacker can easily use an already authenticated session to access the hosted application as the previously authenticated user. By closing sessions after a set period of inactivity, the web server can make certain those sessions not closed through the user logging out of an application are eventually closed. Acceptable values are 5 minutes for high-value applications, 10 minutes for medium-value applications, and 20 minutes for low-value applications. Check_Content Verify the WSAPI Session Timeout value is set with the following command: %cli showwsapi -d -------------------------------WSAPI Server Configuration-------------------------------- service State: Enabled HPE GreenLake for Block Storage UI State: Active server State: Active HTTPS Port: 443 Number of Sessions Created: 0 System Resource Usage: 96 Number of Sessions Active: 0 Version: 1.14.0 Event Stream State: Enabled Max Number of SSE Sessions Allowed: 5 Number of SSE Sessions Created: 0 Number of SSE Sessions Active: 0 Session Timeout: 10 Minutes Policy : per_user_limit API URL: https://s2475-cluster.lr4-storage.net/api/v1 If "Session Timeout" is set to a value greater than "10 minutes", this is a finding. Fix_Text Configure the WSAPI Session Timeout to a value less than or equal to 10 minutes: cli% setwsapi -timeout 10 Not_Reviewed Vuln_Num V-283038 Rule_ID SV-283038r1193804_rule Severity medium Rule_Title The HPE Alletra Storage ArcusOS device must disable remote access. Vuln_Discuss Remote access to the web server is any access that communicates through an external, nonorganization-controlled network. Remote access can be used to access hosted applications or to perform management functions. A web server can be accessed remotely and must be able to enforce remote access policy requirements or work in conjunction with enterprise tools designed to enforce policy requirements. Examples of the web server enforcing a remote access policy are implementing IP filtering rules, using https instead of http for communication, implementing secure tokens, and validating users. Check_Content Verify the RDA service is disabled and controlrecoveryauth is set to use ciphertext with the following commands: cli% stoprda RDA service is already disabled. cli% controlrecoveryauth status Recovery authentication method is Ciphertext. If the message returned is not "RDA service is already disabled", this is a finding. If the message returned is not "Recovery authentication method is Ciphertext", this is a finding. Fix_Text Configure the system to disable remote access: Stop the RDA service: cli% stoprda Are you sure you want to stop RDA service? select q=quit y=yes n=no: Enter "y" to confirm the action. Set the recovery authentication to ciphertext: cli% controlrecoveryauth setmethod ciphertext Not_Reviewed Vuln_Num V-283073 Rule_ID SV-283073r1193911_rule Severity medium Rule_Title The HPE Alletra Storage ArcusOS device must have an SNMPv3 user account configured. Vuln_Discuss Audit information includes all information needed to successfully audit system activity, such as audit records, audit log settings, audit reports, and personally identifiable information. Audit logging tools are those programs and devices used to conduct system audit and logging activities. Protection of audit information focuses on technical protection and limits the ability to access and execute audit logging tools to authorized individuals. Physical protection of audit information is addressed by both media protection controls and physical and environmental protection controls. Check_Content Verify an SNMPv3 user account is configured: cli% showsnmpuser Username AuthProtocol PrivProtocol Alletrasnmpuser HMAC-SHA-96 CFB128-AES-128 If the output is not displayed in the above format, this is a finding. Fix_Text Configure SNMPv3 alert notifications using the following sequence of operations: Create and enable an SNMPv3 user, and create associated keys for authentication and privacy. cli% createuser Alletrasnmpuser all browse Enter the password and confirm. cli% createsnmpuser Alletrasnmpuser At the prompt, enter the password. At the next prompt, reenter the password. Not_Reviewed Vuln_Num V-283074 Rule_ID SV-283074r1193914_rule Severity medium Rule_Title The HPE Alletra Storage ArcusOS device must be configured to collect and send SNMPv3 notifications. Vuln_Discuss Audit information includes all information needed to successfully audit system activity, such as audit records, audit log settings, audit reports, and personally identifiable information. Audit logging tools are those programs and devices used to conduct system audit and logging activities. Protection of audit information focuses on technical protection and limits the ability to access and execute audit logging tools to authorized individuals. Physical protection of audit information is addressed by both media protection controls and physical and environmental protection controls. Check_Content Identify the SNMP trap recipient and report SNMP configuration: cli% showsnmpmgr HostIP Port SNMPVersion User Notify AlertClear <snmp trap recipient IP> 162 3 Alletrasnmpuser standard standard If the SNMP trap recipient IP address is incorrect, this is a finding. If the SNMP port is not "162", this is a finding. If the SNMP version is not "3", this is a finding. If the SNMP user ID is incorrect, this is a finding. Fix_Text Configure SNMPv3 alert notifications using the following sequence of operations: Add the IP address of the SNMPv3 trap recipient, where permissions of the account are used: cli% addsnmpmgr -version 3 -snmpuser Alletrasnmpuser <ip address> Not_Reviewed Vuln_Num V-283090 Rule_ID SV-283090r1193962_rule Severity medium Rule_Title The HPE Alletra Storage ArcusOS device must utilize trusted and authorized certificates. Vuln_Discuss Public key infrastructure (PKI) certificates are certificates with visibility external to organizational systems and certificates related to the internal operations of systems, such as application-specific time services. In cryptographic systems with a hierarchical structure, a trust anchor is an authoritative source (e.g., a certificate authority) for which trust is assumed and not derived. A root certificate for a PKI system is an example of a trust anchor. A trust store or certificate store maintains a list of trusted root certificates. Check_Content Verify the system includes only approved certificates with the following command: s2475 cli% showcert Service Commonname Type Enddate Fingerprint cli* lr4-vlan3489-ca.lr4-storage.net rootca Mar 27 16:00:17 2034 GMT 741809eb70791ab41d4b695ffef01beb7ea3531e ekm-client test-user cert Mar 11 10:24:42 2034 GMT 7eae686ffe489b200a4a4bf353db4a0b139043db ekm-client CipherTrust Root CA rootca Mar 11 10:24:42 2034 GMT c2b3e77b89279d830299d60561152b2bedbf6ef6 ekm-server CipherTrust Root CA rootca Mar 11 10:24:42 2034 GMT c2b3e77b89279d830299d60561152b2bedbf6ef6 ldap lr4-storage-CA rootca May 31 17:38:44 2032 GMT 409e507985813f294f9c9464e488e46d903f4f58 syslog-sec-client lr4-vlan3489-ca.lr4-storage.net rootca Mar 27 16:00:17 2034 GMT 741809eb70791ab41d4b695ffef01beb7ea3531e syslog-sec-server lr4-vlan3489-ca.lr4-storage.net rootca Mar 27 16:00:17 2034 GMT 741809eb70791ab41d4b695ffef01beb7ea3531e wsapi lr4-vlan3489-ca.lr4-storage.net rootca Mar 27 16:00:17 2034 GMT 741809eb70791ab41d4b695ffef01beb7ea3531e For each certificate listed above, utilize the system documentation to verify the fingerprint(s) match the authorized certificate(s). If the fingerprint(s) listed above do not match the certificate(s) listed in the system documentation, this is a finding. Fix_Text Install the correct certificate for each service using the importcert command. importcert <SSL_service> [-f] -ca <CA_bundle> Not_Reviewed