{"stig":{"title":"HPE Alletra Storage ArcusOS Web Server Security Technical Implementation Guide","version":"1","release":"1"},"checks":[{"vulnId":"V-283027","ruleId":"SV-283027r1193771_rule","severity":"medium","ruleTitle":"The HPE Alletra Storage ArcusOS device must implement cryptographic mechanisms to prevent unauthorized disclosure and modification of all information at rest on all system components.","description":"Data at rest is inactive data which is stored physically in any digital form (e.g., databases, data warehouses, spreadsheets, archives, tapes, off-site backups, mobile devices, etc.). Data at rest includes, but is not limited to, archived data, data that is not accessed or changed frequently, files stored on hard drives, USB thumb drives, files stored on backup tape and disks, and files stored off-site or on a storage area network.\n\nWhile data at rest can reside in many places, data at rest for a web server is data on the hosting system storage devices. Data stored as a backup on tape or stored off-site is no longer under the protection measures covered by the web server.\n\nThere are several pieces of data that the web server uses during operation. The web server must use an accepted encryption method, such as SHA1, to protect the confidentiality and integrity of the information.","checkContent":"Verify HPE Alletra Storage MP is configured to provide backend drive encryption with the following command:\n\nCli%controlencryption status -d\nLicensed Enabled BackupSaved State  SeqNum Keystore FIPS non-SEDs FailedDisks nodeNonSED\nyes      yes      yes          normal      0 ---      yes        12           0          0\n\nIf the output does not show licensed, enabled, BackupSaved, and FIPS as \"yes\" this is a finding.\n\nIf the state is not \"normal\", this is a finding.\n\nIf Keystore is not \"EKM\", this is a finding.","fixText":"Enable data at rest encryption.\n\nIf \"cli% showlicense\" does not show \"SED Encryption\" under \"License features currently enabled:\", then import a SED Encryption license with the \"cli% setlicense\" command.\n\nCreate a CSR for the EKM:\ncli% createcert ekm-client -f -csr -CN ekm_username\n\nSign the CSR with a CA and import the entire certificate chain with:\nCli% importcert ekm-client -f stdin\nPaste the ekm-client certificate chain.\n\nImport the EKM Server Certificates:\nCli% createcert ekm-server -f stdin\nPaste the ekm-server certificate chain.\n\nSet the connection to the EKM with the following command:\ncli% controlencryption setekm -setserver <EKM_IP> -port 5696 -ekmuser ekm_username -kmipprotocols (supported protocols by the ekm) -passwordnoprompt <ekm_user_password>\n\nEnable encryption with the following command:\ncli% controlencryption enable -ekm /common/encryptionBackup\n\nEnter passwords and save the encryption backup file off of the array for disaster recovery.","ccis":["CCI-001199"]},{"vulnId":"V-283037","ruleId":"SV-283037r1193801_rule","severity":"medium","ruleTitle":"The HPE Alletra Storage ArcusOS device must set an inactive timeout for sessions.","description":"Leaving sessions open indefinitely is a major security risk. An attacker can easily use an already authenticated session to access the hosted application as the previously authenticated user. By closing sessions after a set period of inactivity, the web server can make certain those sessions not closed through the user logging out of an application are eventually closed. \n\nAcceptable values are 5 minutes for high-value applications, 10 minutes for medium-value applications, and 20 minutes for low-value applications.","checkContent":"Verify the WSAPI Session Timeout value is set with the following command:\n\n%cli showwsapi -d\n\n-------------------------------WSAPI Server Configuration--------------------------------\nservice State:                                        Enabled\nHPE GreenLake for Block Storage UI State:                                        Active\nserver State:                                                                    Active\nHTTPS Port:                                                                       443\nNumber of Sessions Created:                                                         0\nSystem Resource Usage:                                                         96\nNumber of Sessions Active:                                                          0\nVersion:                                                     1.14.0\nEvent Stream State:                                                                    Enabled\nMax Number of SSE Sessions Allowed:                                               5\nNumber of SSE Sessions Created:                                                         0\nNumber of SSE Sessions Active:                                                             0\nSession Timeout:                                                10 Minutes\nPolicy :                                            per_user_limit\nAPI URL:               https://s2475-cluster.lr4-storage.net/api/v1\n\nIf \"Session Timeout\" is set to a value greater than \"10 minutes\", this is a finding.","fixText":"Configure the WSAPI Session Timeout to a value less than or equal to 10 minutes:\n\ncli% setwsapi -timeout 10","ccis":["CCI-002361"]},{"vulnId":"V-283038","ruleId":"SV-283038r1193804_rule","severity":"medium","ruleTitle":"The HPE Alletra Storage ArcusOS device must disable remote access.","description":"Remote access to the web server is any access that communicates through an external, nonorganization-controlled network. Remote access can be used to access hosted applications or to perform management functions.\n\nA web server can be accessed remotely and must be able to enforce remote access policy requirements or work in conjunction with enterprise tools designed to enforce policy requirements. \n\nExamples of the web server enforcing a remote access policy are implementing IP filtering rules, using https instead of http for communication, implementing secure tokens, and validating users.","checkContent":"Verify the RDA service is disabled and controlrecoveryauth is set to use ciphertext with the following commands:\n\ncli% stoprda\nRDA service is already disabled.\n\ncli% controlrecoveryauth status\nRecovery authentication method is Ciphertext.\n\nIf the message returned is not \"RDA service is already disabled\", this is a finding.\n\nIf the message returned is not \"Recovery authentication method is Ciphertext\", this is a finding.","fixText":"Configure the system to disable remote access:\n\nStop the RDA service:\ncli% stoprda\nAre you sure you want to stop RDA service?\nselect q=quit y=yes n=no: \n\nEnter \"y\" to confirm the action.\n\nSet the recovery authentication to ciphertext:\ncli% controlrecoveryauth setmethod ciphertext","ccis":["CCI-002314"]},{"vulnId":"V-283073","ruleId":"SV-283073r1193911_rule","severity":"medium","ruleTitle":"The HPE Alletra Storage ArcusOS device must have an SNMPv3 user account configured.","description":"Audit information includes all information needed to successfully audit system activity, such as audit records, audit log settings, audit reports, and personally identifiable information. Audit logging tools are those programs and devices used to conduct system audit and logging activities. Protection of audit information focuses on technical protection and limits the ability to access and execute audit logging tools to authorized individuals. Physical protection of audit information is addressed by both media protection controls and physical and environmental protection controls.","checkContent":"Verify an SNMPv3 user account is configured:\n\ncli%  showsnmpuser\n\nUsername        AuthProtocol PrivProtocol\nAlletrasnmpuser HMAC-SHA-96  CFB128-AES-128\n\nIf the output is not displayed in the above format, this is a finding.","fixText":"Configure SNMPv3 alert notifications using the following sequence of operations:\n\nCreate and enable an SNMPv3 user, and create associated keys for authentication and privacy.\n\ncli% createuser Alletrasnmpuser all browse\n\nEnter the password and confirm.\n\ncli%  createsnmpuser Alletrasnmpuser\n\nAt the prompt, enter the password.\n\nAt the next prompt, reenter the password.","ccis":["CCI-003831"]},{"vulnId":"V-283074","ruleId":"SV-283074r1193914_rule","severity":"medium","ruleTitle":"The HPE Alletra Storage ArcusOS device must be configured to collect and send SNMPv3 notifications.","description":"Audit information includes all information needed to successfully audit system activity, such as audit records, audit log settings, audit reports, and personally identifiable information. Audit logging tools are those programs and devices used to conduct system audit and logging activities. Protection of audit information focuses on technical protection and limits the ability to access and execute audit logging tools to authorized individuals. Physical protection of audit information is addressed by both media protection controls and physical and environmental protection controls.","checkContent":"Identify the SNMP trap recipient and report SNMP configuration:\n\ncli%  showsnmpmgr\nHostIP                                      Port          SNMPVersion   User                            Notify          AlertClear\n<snmp trap recipient IP>  162                                    3    Alletrasnmpuser   standard   standard\n\nIf the SNMP trap recipient IP address is incorrect, this is a finding.\n\nIf the SNMP port is not \"162\", this is a finding.\n\nIf the SNMP version is not \"3\", this is a finding.\n\nIf the SNMP user ID is incorrect, this is a finding.","fixText":"Configure SNMPv3 alert notifications using the following sequence of operations:\n\nAdd the IP address of the SNMPv3 trap recipient, where permissions of the account are used:\n\ncli%  addsnmpmgr -version 3 -snmpuser Alletrasnmpuser  <ip address>","ccis":["CCI-003831"]},{"vulnId":"V-283090","ruleId":"SV-283090r1193962_rule","severity":"medium","ruleTitle":"The HPE Alletra Storage ArcusOS device must utilize trusted and authorized certificates.","description":"Public key infrastructure (PKI) certificates are certificates with visibility external to organizational systems and certificates related to the internal operations of systems, such as application-specific time services. In cryptographic systems with a hierarchical structure, a trust anchor is an authoritative source (e.g., a certificate authority) for which trust is assumed and not derived. A root certificate for a PKI system is an example of a trust anchor. A trust store or certificate store maintains a list of trusted root certificates.","checkContent":"Verify the system includes only approved certificates with the following command:\n\ns2475 cli% showcert\nService                      Commonname                                     Type           Enddate                                        Fingerprint\ncli*                              lr4-vlan3489-ca.lr4-storage.net    rootca       Mar 27 16:00:17 2034 GMT     741809eb70791ab41d4b695ffef01beb7ea3531e\nekm-client                test-user                                                  cert            Mar 11 10:24:42 2034 GMT    7eae686ffe489b200a4a4bf353db4a0b139043db\nekm-client                CipherTrust Root CA                            rootca       Mar 11 10:24:42 2034 GMT   c2b3e77b89279d830299d60561152b2bedbf6ef6\nekm-server               CipherTrust Root CA                           rootca       Mar 11 10:24:42 2034 GMT    c2b3e77b89279d830299d60561152b2bedbf6ef6\nldap                             lr4-storage-CA                                      rootca       May 31 17:38:44 2032 GMT    409e507985813f294f9c9464e488e46d903f4f58\nsyslog-sec-client    lr4-vlan3489-ca.lr4-storage.net    rootca       Mar 27 16:00:17 2034 GMT    741809eb70791ab41d4b695ffef01beb7ea3531e\nsyslog-sec-server   lr4-vlan3489-ca.lr4-storage.net    rootca       Mar 27 16:00:17 2034 GMT    741809eb70791ab41d4b695ffef01beb7ea3531e\nwsapi                          lr4-vlan3489-ca.lr4-storage.net    rootca       Mar 27 16:00:17 2034 GMT    741809eb70791ab41d4b695ffef01beb7ea3531e\n\nFor each certificate listed above, utilize the system documentation to verify the fingerprint(s) match the authorized certificate(s).\n\nIf the fingerprint(s) listed above do not match the certificate(s) listed in the system documentation, this is a finding.","fixText":"Install the correct certificate for each service using the importcert command.\n\nimportcert <SSL_service> [-f] -ca <CA_bundle>","ccis":["CCI-004909"]}]}