Organizations that are either considering deployment of
Hitachi ID Password Manager or have already deployed it need to understand how to
secure the Password Manager server. Password Manager is a sensitive part of an
organization's IT infrastructure and consequently must be defended
by strong security measures.
This document is intended to form the basis of a "best practices" guide for securing a Password Manager server. The objective of a secure Password Manager server is to have a reliable, high availability server which is difficult or impossible for users and intruders to compromise.
Organizations that are either considering deployment of Password Manager or have already deployed it need to understand how to secure the Password Manager server. Password Manager is a sensitive part of an organization's I.T. infrastructure and consequently must be defended by strong security measures.
Password Manager houses sensitive data, which may include:
It is important to protect both the Password Manager server itself and the data it contains.
The remainder of this document is organized as follows:
Some common-sense security precuations.
How to configure a secure Windows server operating system for use with Password Manager.
How to select and configure a web server.
How to protect the data transmitted into and out of each Password Manager server.
How the data stored on each Password Manager server is protected.
Why auditing is important.
Suggestions on how to control the physical access to the Password Manager server.
Some of the most effective security measures are common sense:
If required, you can still expose the Password Manager web UI to the Extranet using a reverse web proxy, such as Apache, or using a "shadow instance" program available at no extra charge from Hitachi ID Systems.
The first step in configuring a secure Password Manager server is to harden its operating system.
Hitachi ID Systems suggests that Password Manager be installed on the Windows 2003 server operating system. The following are suggestions on how to lock down this operating system.
Since the Password Manager server contains sensitive information (please see [link] for how this information is stored), it makes sense to limit the number of users who can access its files.
One way to limit the number of users who can access the Password Manager server is to remove it from any Windows / Active Directory domains. When the Password Manager server is not a member of any domain, domain administrators are prevented from using their Windows credentials to attempt to compromise privileged credentials on other systems with which Password Manager has been integrated.
Ensuring that the Password Manager server is not a domain member also reduces the risk of lockouts due to concurrent domain logins by the Password Manager server - some by the Password Manager software, and others by an administrator interactively logged into the server's console.
The Password Manager setup program creates one local user on the Password Manager server, typically called psadmin.
The account is, by default, a member of the local Administrators group. It is the only account needed by Password Manager. We recommend removing unused accounts, leaving just:
Use the DENY NETWORK LOGON feature in the local security policy to protect the Administrator account against remote access attempts using brute force password attacks.
If you need other accounts on the Password Manager server, then we recommend the following:
Additionally, a regular review of accounts, groups and group memberships should be carried out, to ensure that access permissions are appropriate.
An important way to secure a server on any platform is to reduce the amount of software that it runs. This eliminates potential sources of software bugs that could be exploited to violate the server's security.
The following services, at most, are needed on the Password Manager server:
If additional services are required during implementation, then Hitachi ID Systems will notify Hitachi ID Systems customer.
All other services should be disabled unless there is some specific reason (not related to Password Manager) to enable them. Once you have identified a minimum set of services for your server, save the list. Check which services are running after applying service packs and other operating system updates, and disable services as required to return to your original list.
The Password Manager server can also take advantage of simple packet filtering services in Windows 2003, to block all inbound connections other than those to the web service, as shown in the figure below:
Open ports are an exploitable means of system entry. By limiting the number of open ports, you effectively reduce the number of potential entry points into the server.
A hardened Password Manager server can be port scanned to identify available services. Following is a typical port scan result:
delli:/data/idan/vmware/win2ksrv# nmap -sT 192.168.100.8 Starting nmap V. 2.54BETA31 ( www.insecure.org/nmap/ ) Interesting ports on (192.168.100.8): (The 1551 ports scanned but not shown below are in state: closed) Port State Service 80/tcp open http 443/tcp open https Nmap run completed -- 1 IP address (1 host up) scanned in 1 second delli:/data/idan/vmware/win2ksrv# nmap -sU 192.168.100.8 Starting nmap V. 2.54BETA31 ( www.insecure.org/nmap/ ) All 1459 scanned ports on (192.168.100.8) are: filtered Nmap run completed -- 1 IP address (1 host up) scanned in 91 seconds
The process table on the same server looks like this:
Note: VMWare entries in the figure reflect the fact that this sample was taken from a VMWare virtual PC.
This server was running with just the mandatory services described earlier.
Enable the following TCP/IP registry settings as shown below to make the Password Manager server resistant to denial of service (DOS) attacks:
Some of the settings may cause some applications to fail. Be sure to test all settings before implementing.
HKLM\System\CurrentControlSet\Services \Tcpip\Parameters\SynAttackProtectType: REG_DWORD
HKLM\System\CurrentControlSet\Services \Tcpip\Parameters\TcpMaxHalfOpenType: REG_DWORD
HKLM\System\CurrentControlSet\Services \Tcpip\Parameters\TcpMaxHalfOpenRetriedType: REG_DWORD
HKLM\System\CurrentControlSet\Services \Tcpip\Parameters\TcpMaxPortsExhaustedType: REG_DWORD
The following keys, not present on a default Windows server installation, are also helpful to protect against a variety of attacks against the IP stack:
HKLM\System\CurrentControlSet\Services \AFD\Parameters\EnableDynamicBacklogType: REG_DWORD
HKLM\System\CurrentControlSet\Services \AFD\Parameters\MinimumDynamicBacklogType: REG_DWORD
HKLM\System\CurrentControlSet\Services \AFD\Parameters\MaximumDynamicBacklogType: REG_DWORD
HKLM\System\CurrentControlSet\Services \AFD\Parameters\DynamicBacklogGrowthDeltaType: REG_DWORD
HKLM\System\CurrentControlSet\Services \Tcpip\Parameters\EnableDeadGWDetectType: REG_DWORD
HKLM\System\CurrentControlSet\Services \Tcpip\Parameters\KeepAliveTimeType: REG_DWORD
HKLM\System\CurrentControlSet\Services \Tcpip\Parameters\PerformRouterDiscoveryType: REG_DWORD
HKLM\System\CurrentControlSet\Services \Tcpip\Parameters\EnableICMPRedirectsType: REG_DWORD
HKLM\System\CurrentControlSet\Services \Tcpip\Parameters\DisableIPSourceRoutingType: REG_DWORD
The web server is a required component since it provides all user interface modules. It should therefore be carefully protected.
Since Password Manager does not require any web server functionality beyond the ability to serve static documents (HTML, images) and to execute self-contained CGI executable programs, all non-essential web server content should be removed.
Several web servers are commonly available for Windows servers, including Apache, IIS, iPlanet and more. Hitachi ID Systems suggests that the Apache or IIS web server be used with Password Manager. As such, this document will detail how to lock down the Apache or IIS web server.
The Apache server is recommended, as it is well supported and has had a very good security track record. Most recent web server security vulnerabilities have been specific to IIS, and would not affect Apache.
If you select Apache, you can harden it by:
IIS is more than a web server - it is also an FTP server, indexing server, proxy for database applications and a server for active content / applications.
If you run Password Manager on IIS, you should disable most of these features, as each of them may represent a security risk, due to the possibility of software bugs.
Lock down IIS as follows:
Create two separate NTFS partitions - one for the operating system and one for IIS. This will separate most of the operating system files from the application files, allowing a more controlled distribution of permission sets.
As stated previously, Password Manager only requires the web server to serve static documents (HTML, images) and to execute self-contained CGI executable programs, which means all non-essential web server content should be removed. This means removing IISAdmin, Printers, Scripts and similar folders, as shown in the figure below:
The web server's scripting, indexing and data access subsystems should likewise be removed as shown in the figure below:
As an extra precaution, remote data services (RDS) should be disabled by removing the following registry keys:
All ODBC drivers that are not required (and Password Manager uses none) should also be disabled because they can introduce possible security concerns for IIS. To disable the ODBC drivers, remove the data sources manually and add this entry to the registry:
HKLM\Software\Microsoft\Jet\4.0\engines\SandBoxMode = 3
The above registry entry will ensure that no cmd.exe commands can be chained with ODBC queries.
Consult the following Microsoft Knowledge Base article for more information:
The IUSR account is created during the IIS installation and provides the mechanism that allows web clients to access the web server anonymously. The IWAM account is used to start out-of-process web applications in IIS. Do not add these accounts to a privileged group such as Administrators. Delete these accounts if possible as Password Manager does not use them (it creates and uses the psadmin user for anonymous access).
Install the latest service packs, as these frequently include security patches and updates.
Service packs for Windows 2003 may be found at:
Service packs for Windows 2000 may be found at:
We recommend that to be notified of the latest security upgrades for Windows 2003, you subscribe to the Microsoft's security bulletin at:
Equally important to installing the latest service pack is testing the service pack installation before deployment on a production platform. This will ensure there are no adverse affects on Password Manager.
Password Manager sends and receives sensitive data over the network. Its communications include user passwords, administrator credentials and personal user information. These are all valuable assets that must be defended.
Network attacks typically fall into two classes:
Hitachi ID Systems strongly recommends that users access Password Manager using SSL (HTTPS). To do this, you must:
As long as the Password Manager server is configured with an SSL certificate, and configured to require HTTPS client communication, no sensitive data will be transmitted in plaintext. This will protect communications against both passive and active attacks.
The Password Manager server houses some sensitive data, and this data must be protected against anyone who has physical access to the server, or has a legitimate right to log into it.
All sensitive data on the Password Manager server is encrypted, as follows:
Encryption is used to protect stored Password Manager data as follows:
|Data stored on the Password Manager server|
|Privileged passwords, used to log into target systems||128-bit AES||128-bit random|
|Answers to security questions||128-bit AES||128-bit random|
|User old password history||SHA-1||64-bit random salt|
Of the above, the only mandatory data is administrator credentials for target systems. Everything else may be pulled by Password Manager from other systems (database, directory, etc.), on demand. Note, however, that moving sensitive data to another system generally introduces more security problems (communication, storage) than it solves, and is not recommended as a solution to security concerns.
As a result of this encryption, someone with access to the filesystem of the Password Manager server would not be able to readily decipher sensitive data on that server. They would first have to figure out where the data is stored, then how it is encoded, then how it is encrypted, and then they would have to find a suitable key (itself encrypted, in the Password Manager server's registry).
This provides as much protection as possible to sensitive data on the server, without compromising its functionality.
Audit logs are an important measure to identify and analyze suspicious activity.
Since anyone with with administrator access to the Password Manager server can alter or remove audit logs, arrange for periodic archive of audit logs to a different server, managed by different administrators.
Windows 2003 provides various audit logs through the "Event Viewer." Additionally, IIS provides configurable logging information with W3C Extended Log File Format.
An audit log is only effective if it is examined. These logs provide the best indications of break-ins, fraud and misuse. Therefore, regular examination of the logs is recommended.
Password Manager servers should be physically protected, since any logical security measures can be bypassed by an intruder with physical access to the server, time and skill.
Suggestions for physically securing the Password Manager server include:
Put the Password Manager server(s) in a locked and secured room. Restrict access to authorized personnel only. Access should be logged.
Protect the Password Manager server with uninterruptable power sources (UPS). UPS equipment will protect the server from temporary power loss that could cause a server crash or corruption of critical user files.
Restrict the boot process so it is more difficult for intruders to circumvent Windows 2003 security by booting from floppy disks or a CD-ROM. Specifically, use a BIOS-level password, disable boot from a floppy drive, flash device or CD-ROM drive and lock the system BIOS to prevent unauthorized changes to the BIOS configuration.
This document highlights the fact that Password Manager is a sensitive server, and should be managed carefully. In particular, it should be installed on a locked-down server, and managed with close attention to security.
This document illustrates the best-practice measures that should be implemented to protect Password Manager servers.
To learn more about hardening a Windows 2003 server, please refer to the Microsoft site:
In case the above URL changes, search http://microsoft.com for the document titled "Windows Server 2003 Security Guide."