-
Title
Security Best Practices for the Kace SDA and the Remote Site Appliance (RSA) -
Description
To protect the Kace SDA and Remote Site Appliances (as well as the data they contain) from malicious users it is important to follow the guidelines below. -
Resolution
Change default Passwords:
Even if the KACE SDA or the RSA is set up to use LDAP authentication, there remains one local user “admin”. This account can not be deleted so it is imperative its default password be changed right after system installation.
Change the local admin password on the KACE SDA or the RSA, log in to the WebUI.
Appliances on older version go to Settings & maintenance | Control Panel | Users.
Appliances on latest version navigate to Settings | Users.Click on the “admin” user and fill in the Password fields and then click the “save” button.
The K2000 also has passwords for its Samba shares, its Boot Manager, and the KBE VNC Server ( if not disabled ). These should also be changed from their defaults after the system is installed.
Note: Changing the Samba share password will also require rebuilding all the KBE's on the K2000 as the password is stored within the KBE itself and KBE's created before the password change will no longer function properly.
To change the K2000 default passwords
Older systems navigate to Settings & Maintenance | Control Panel. Then scroll to the bottom of the screen and hit the “edit” button.
Scroll up to the top and enter the password for the Samba Shares, Boot Manager and/or VNC password.
Then scroll to the bottom and click the “save” button.
Older later versions navigate to Settings | General Settings.
Enter the new password for the Samba Shares, Boot Manager and/or VNC Password.
Then scroll to the bottom and click the “save” button.
LDAP Security:If using an LDAP server for authentication, ensure the LDAP server is following LDAP securities best practices.
http://msdn.microsoft.com/en-us/library/aa913688.aspxNote that LDAP authentication is only used for logging into the WebUI and is not used for the KACE SDA Samba shares, Boot Manager, or VNC server passwords.
Network Security:
It is recommended the KACE SDA and the RSA not use public IP addresses. Further it is recommended there be no Internet ingress to either the KACE SDA or the RSA. Should the Internet be required for communication between a KACE SDA and its RSA then both appliances should be behind a firewall which opens only ports 80, 443, and 22 between the KACE SDA IP address and the RSA IP address blocking all other Internet IP addresses from access.
If Internet access to the KACE SDA WebUI is required, then SSL should be enabled on the KACE SDA and a Firewall rule set to allow only port 443 to access the K2000 or the RSA. Even with SSL active, no other ports including port 22 on the KACE SDA or the RSA should be open for general Internet access, and should only be opened for specific (KACE SDA or RSA ) IP addresses. Keep in mind that SSL does not encrypt Samba, Boot Manager, or VNC traffic.
To enable tether support and driver feed access, insure the KACE SDA and RSA have egress to the Internet on port 22, 80, and 443.
Recovery Account (CVE-2011-4046)
The K2000 releases 3.3 and older has a recovery account intended for use by KACE support only when assisting customers. The password to this account can be determined by examination of the PHP source code on the appliance. This account will be removed in future release and replaced with an alternate admin recovery password. This recovery password will be cycled regularly, unavailable in the PHP source code, and not available in the clear anywhere on the appliance.This account has been replaced with an alternate admin recovery password in KACE SDA versions 3.3 SP1 to 3.6.98680. This recovery password will be cycled regularly, unavailable in the PHP source code, and not available in the clear anywhere on the appliance. All KACE SDA administrators are encouraged to upgrade to the latest release.Note: All recovery accounts have been removed in KACE SDA version 3.7 GA and newer.Quest KACE recommends that access to the appliance web UI be limited by means of physical and network security to mitigate this possible vulnerability.Arbitrary Command Execution (CVE-2011-4047)
There is a database table in the appliance which schedules commands that are run as root on the appliance. If write access to the database is obtained, commands can be injected into this table which are then run as root on the appliance, resulting in a possible compromise of appliance security. We note that in the normal configuration of the appliance- External SSH access to the root account is turned off by default
- Offboard database access is turned off by default
Note: In K2000 3.3 SP1 and newer, there are no write privileges to the database when using offboard access, eliminating this potential vulnerability. All KACE SDA administrators are encouraged to upgrade to the latest release.Quest KACE recommends that these remain turned off as a best practice, mitigating this possible vulnerability.Account Info Disclosure (CVE-2011-4048)
Offboard database access is turned off by defaultNo passwords are stored in clear text in the appliance database.All password hashes are created using the MD5 or SHA-1 algorithm.When assigned by the administrator, the admin password is rated using a standard algorithm, making the disclosure of its hashed value less vulnerable to an offline dictionary attack if an appropriately strong password is used.When LDAP integration is turned on,- local user accounts, other than "admin", are disabled, making their passwords unusable
- no passwords for LDAP accounts are stored on the appliance for longer than it takes to authenticate the user.
- no passwords for LDAP accounts are ever stored in the appliance database
Quest KACE recommends that security best practices be followed in keeping offboard database access turned off and the use of complex, dictionary-attack-resistant passwords for all local users.These practices will mitigate any theoretical vulnerability posed by the storage of hashed passwords for local users in the appliance database.Cross-site Scripting (XSS) Vulnerabilities (CVE-2011-4436)
The KACE SDA engineering team follows internal development practices to minimize the chance that our user interface will have any XSS problems.In addition, we test the K2000 for XSS vulnerabilities using standard network security tools such as OpenVAS and QualysGuard. Occasionally, these tools may miss a vulnerability. If any are discovered, we endeavor to correct them as quickly as possible.
XSS vulnerabilities reported thus far require authenticated access to the KACE SDA administrative interface in a role which can get to particular URLs.
We recommend that our customers use browsers, such as Chrome, and browser plug-ins, such as NoScript, which mitigate XSS vulnerabilities in all websites.