View Attach (6) Info

Add new attachment

Only authorized users are allowed to upload new attachments.

List of attachments

Kind Attachment Name Size Version Date Modified Author Change note
jpg
 hardening_csp1.jpg 607.6 kB 1 27-Jan-2025 23:32 Ada Csaba
jpg
 hardening_ftp1.jpg 675.7 kB 1 27-Jan-2025 23:33 Ada Csaba
jpg
 hardening_pgp1.jpg 298.0 kB 1 27-Jan-2025 23:33 Ada Csaba
jpg
 hardening_pgp2.jpg 406.7 kB 1 27-Jan-2025 23:33 Ada Csaba
jpg
 hardening_sftp1.jpg 637.1 kB 1 28-Jan-2025 00:31 Ada Csaba
jpg
 hardening_ssl.jpg 587.1 kB 1 27-Jan-2025 23:33 Ada Csaba

This page (revision-40) was last changed on 28-Jan-2025 00:56 by Ada Csaba

This page was created on 05-Dec-2023 05:32 by Ben Spink

Only authorized users are allowed to rename pages.

Only authorized users are allowed to delete pages.

Difference between version and

At line 2 changed 8 lines
So to secure the server, follow these steps:\\
1.) Login to the WebInterface, Admin, Preferences.\\
2.) Remove the FTP port on port 21, or click on advanced and enable require encryption.\\
3.) Remove the HTTP port on 8080 and 9090, or change the IP from "lookup" to be 127.0.0.1 making them inaccessible.\\
4.) Go to Encryption, SSL. Click the link to disable insecure ciphers.\\
5.) On the IP / Servers tab, right click on the HTTPS port, and restart it for the prior change to take effect.\\
!Remove plaintext protocols\\
By default we ship a plain HTTP port listening on port bumber 8080 and 9090, delete these on [IP Servers|IP Servers] page. Or change the IP from "lookup" to be 127.0.0.1 making them inaccessible.\\
The default setup of the FTP/FTPES port does not enforce FTPES, to do so turn on encryption. Or remove the FTP port completely, if not needed.\\
At line 11 changed one line
If you need data at rest encryption:\\
[{Image src='hardening_ftp1.jpg' width='100%' height='..' align='left' style='..' class='..' }]
----\\
!Hardening SSL/TLS ciphers\\
This affects FTPS, FTPES, HTTPS and WebDAVS server mode. On Encryption->[SSL|SSL] page press the "All insecure ciphers" button, save the settings then restart the HTTPS server listener.\\
\\
[{Image src='hardening_ssl.jpg' width='100%' height='..' align='left' style='..' class='..' }]
----\\
!Hardening the HTTP headers\\
Usually resetting the WebInterface->[CSP|CSP] page to defaults will do. When using SAML, OAUTH, or other external IDP integration, will need to add the IDP portal domain as allowed domain.\\
\\
[{Image src='hardening_csp1.jpg' width='100%' height='..' align='left' style='..' class='..' }]
\\
The changes take effect instantly, no restart required.\\
\\
----\\
!Hardening SSH algorithms\\
On IP/Servers page select the __SFTP__ server listener, select the __Advanced__ tab, remove all weak algorithms from the list. The actual strength of various algorithms is debated, must consult your own security advisor. Usually the __NIST__ recommanded algorithms will satisfy most security assessors.\\
[{Image src='hardening_sftp1.jpg' width='100%' height='..' align='left' style='..' class='..' }]
\\
__Hostkey algorithms:__\\
\\
Use the default __RSA__ or enable __ECDSA__ and/or __ED25519__.\\
\\
__Ciphers:__\\
{{{
aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
}}}
__Key Exchange (KEX) algorithms:__\\
{{{
curve25519-sha2@libssh.org,curve25519-sha256@libssh.org,diffie-hellman-group18-sha512,diffie-hellman-group17-sha512,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521
}}}
__Message Authentication Code (MAC) algorithms :__\\
{{{
hmac-sha256,hmac-sha2-256,hmac-sha256@ssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha512,hmac-sha2-512,hmac-sha512@ssh.com,hmac-sha2-512-etm@openssh.com
}}}
\\
----
\\
If you need __data at rest encryption:__\\
\\
At line 49 added one line
[{Image src='hardening_pgp1.jpg' width='100%' height='..' align='left' style='..' class='..' }]
At line 51 added one line
[{Image src='hardening_pgp2.jpg' width='100%' height='..' align='left' style='..' class='..' }]
At line 17 changed one line
(Do not try to disable or remove the default user as the user cannot be used for logins and is just for applying settings.)
----
\\
__IMPORTANT:__ Do not try to disable or remove the default user as the user cannot be used for logins and is just for applying settings.
Version Date Modified Size Author Changes ... Change note
40 28-Jan-2025 00:56 3.421 kB Ada Csaba to previous
39 28-Jan-2025 00:55 3.424 kB Ada Csaba to previous | to last
38 28-Jan-2025 00:49 3.423 kB Ada Csaba to previous | to last
37 28-Jan-2025 00:46 3.422 kB Ada Csaba to previous | to last
36 28-Jan-2025 00:45 3.426 kB Ada Csaba to previous | to last
35 28-Jan-2025 00:44 3.418 kB Ada Csaba to previous | to last
34 28-Jan-2025 00:42 3.267 kB Ada Csaba to previous | to last
33 28-Jan-2025 00:41 3.235 kB Ada Csaba to previous | to last
32 28-Jan-2025 00:40 3.223 kB Ada Csaba to previous | to last
31 28-Jan-2025 00:40 3.227 kB Ada Csaba to previous | to last
30 28-Jan-2025 00:39 3.211 kB Ada Csaba to previous | to last
29 28-Jan-2025 00:38 3.207 kB Ada Csaba to previous | to last
28 28-Jan-2025 00:35 2.782 kB Ada Csaba to previous | to last
27 28-Jan-2025 00:35 2.776 kB Ada Csaba to previous | to last
26 28-Jan-2025 00:32 2.68 kB Ada Csaba to previous | to last
25 28-Jan-2025 00:32 2.684 kB Ada Csaba to previous | to last
24 28-Jan-2025 00:30 2.678 kB Ada Csaba to previous | to last
23 28-Jan-2025 00:30 2.674 kB Ada Csaba to previous | to last
22 28-Jan-2025 00:29 2.664 kB Ada Csaba to previous | to last
21 28-Jan-2025 00:28 2.66 kB Ada Csaba to previous | to last
« This page (revision-40) was last changed on 28-Jan-2025 00:56 by Ada Csaba
G’day (anonymous guest)
CrushFTP11 | What's New

Referenced by
Certifications and compliancy
FAQ

JSPWiki