SCG D BIGIP - Revision history

Aushack: Typo etc

2015-12-03T00:59:32Z

Typo etc

Dnkolegov at 07:47, 27 August 2015

2015-08-27T07:47:25Z

Dnkolegov: /* Remediation */

2015-05-08T05:06:47Z

‎Remediation

Dnkolegov: /* Remediation */

2015-05-08T05:05:43Z

‎Remediation

Dnkolegov: /* Remediation */

2015-05-08T05:03:46Z

‎Remediation

Dnkolegov: /* Remediation */

2015-05-08T05:03:03Z

‎Remediation

Dnkolegov: /* Remediation */

2015-05-08T05:02:05Z

‎Remediation

Dnkolegov: /* Remediation */

2015-05-08T05:01:36Z

‎Remediation

Dnkolegov: /* Remediation */

2015-05-08T05:01:13Z

‎Remediation

Dnkolegov: /* Remediation */

2015-05-08T05:00:32Z

‎Remediation

@@ Line 181: / Line 181: @@
 ==== Description ====
-Host header in HTTP requests is not always validated by BIG-IP systems by default. This validation depends on enabled modules, features and their configuration: for example, BIG-IP system in APM portal access mode performs a base sanitization of HTTP host header against XSS attacks. In most cases BIG-IP systems handle HTTP request with arbitrar Host header. This weakness can lead to vulnerabilities which can be used in [http://www.acunetix.com/blog/articles/automated-detection-of-host-header-attacks/ different attacks based on HTTP Host header] (e.g., [http://www.ptsecurity.com/download/DNS-rebinding.pdf DNS Rebinding], [https://www.mehmetince.net/concrete5-reflected-xss-vulnerability-via-http-header-host-parameter/ XSS], [http://www.skeletonscribe.net/2013/05/practical-http-host-header-attacks.html password reset poisoning], etc).
+Host header in HTTP requests is not always validated by BIG-IP systems by default. This validation depends on enabled modules, features and their configuration: for example, BIG-IP system in APM portal access mode performs a base sanitization of HTTP host header against XSS attacks. In most cases, BIG-IP systems action HTTP requests with an arbitrary Host header. This weakness can lead to vulnerabilities which can be used in [http://www.acunetix.com/blog/articles/automated-detection-of-host-header-attacks/ different attacks based on HTTP Host header] (e.g., [http://www.ptsecurity.com/download/DNS-rebinding.pdf DNS Rebinding], [https://www.mehmetince.net/concrete5-reflected-xss-vulnerability-via-http-header-host-parameter/ XSS], [http://www.skeletonscribe.net/2013/05/practical-http-host-header-attacks.html password reset poisoning], etc).
 ==== How to test ====

@@ Line 15: / Line 15: @@
 == Common Misconfigurations ==
-=== BIG-IP persistence cookie information leakage ===
+=== Persistence Cookie Information Leakage ===
 ==== Description ====
@@ Line 82: / Line 82: @@
 </pre>
-=== BIG-IP HTTP Server header information leakage ===
+=== HTTP Server Header Information Leakage ===
 ==== Description ====
@@ Line 135: / Line 135: @@
 </pre>
-=== Administrative access to BIG-IP system via Internet ===
+=== Access to management interface from Internet ===
 ==== Description ====
@@ Line 178: / Line 178: @@
 </pre>
-=== Protection against HTTP host header attacks  ===
+=== HTTP host header insufficient validation  ===
 ==== Description ====
@@ Line 280: / Line 280: @@
 :: For example, navigate to the Customization Settings > Access profiles > /Common/<profile_name> > Logout > logout.inc. Change "<title>BIG-IP logout page</title>" to "<title>Logout page</title>".
-=== Protection against APM session exhaustion DoS attack ===
+=== APM session exhaustion DoS attack ===
 ==== Description ====
@@ Line 312: / Line 312: @@
 save /sys config
 </pre>
 == References ==

@@ Line 170: / Line 170: @@
 #* For all self IPs set "Port Lockdown" option to "Allow None".
 #* Click on "Update" button.
-# If you need to administer BIG-IP using Self IPs you should also use private (RFC 1918) IP-address space
+# If you need to administer BIG-IP using Self IPs you should also use private (RFC 1918) IP-address space.
-# The most unsecure configuation is to use routable addresses on your Self-IPs. In this case it is highly recommended to lock down access to the networks that need it. To lock-down SSH and the GUI for a Self IP from a specific network. For examle, to permit access from network 192.268.2.0/24 it is necessary to perform the following commands in TMSH
+# The most unsecure configuation is to use routable addresses on your Self-IPs. In this case it is highly recommended to lock down access to the networks that need it. To lock-down SSH and the GUI for a Self IP from a specific network. For examle, to permit access from network 192.268.2.0/24 it is necessary to perform the following commands in TMSH:
 <pre>
 modify /sys sshd allow replace-all-with { 192.168.2.* }

@@ Line 277: / Line 277: @@
 # Log in to the Configuration utility.
 # Navigate Access Policy > Customization > General. Change all "BIG-IP" substrings to some neutral strings.
-# Navigate Access Policy > Customization > Advanced. Change strings with "BIG-IP" values. For example, go to the Customization Settings > Access profiles > /Common/<profile_name> > Logout > logout.inc. Change "<title>BIG-IP logout page</title>" to "<title>Logout page</title>".
+# Navigate Access Policy > Customization > Advanced. Change strings with "BIG-IP" values.
+:: For example, navigate to the Customization Settings > Access profiles > /Common/<profile_name> > Logout > logout.inc. Change "<title>BIG-IP logout page</title>" to "<title>Logout page</title>".
 === Protection against APM session exhaustion DoS attack ===

@@ Line 307: / Line 307: @@
 # Log in to TMSH.
 # Run the following commands:
-:: modify apm profile access <profile_name> max-in-progress-sessions 128
+<pre>
-:: modify /apm profile access <profile_name> generation-action increment
+modify apm profile access <profile_name> max-in-progress-sessions 128
 == References ==

@@ Line 251: / Line 251: @@
 :2. Log in to TMSH.
 :3. Run the following command:
-::load sys config from terminal merge
+<pre>
 :4. Copy the config and press CTL-D to submit.
 :5. Run the following command:
-::modify ltm virtual <virtual_server> policies add { _http_host_validation }
+<pre>
 === Protection against mass enumeration via search engines  ===

@@ Line 129: / Line 129: @@
 # Log in to TMSH.
 # Run the following commands:
-:: create ltm profile http <profile_name>
+<pre>
-:: modify ltm profile http <profile_name> server-agent-name none
+create ltm profile http <profile_name>
 === Administrative access to BIG-IP system via Internet ===

@@ Line 79: / Line 79: @@
 modify ltm persistense cookie <profile_name> cookie-encryption-passphrase <secure_passphrase>
 modify ltm virtual <virtual_server> persist replace-all-with { <profile_name> }
 </pre>

@@ Line 73: / Line 73: @@
 # Log in to TMSH.
 # Run the following commands:
-:: create ltm persistense cookie <profile_name>
+<pre>
-:: modify ltm persistense cookie <profile_name> cookie-name <secure_cookie_name>
+create ltm persistense cookie <profile_name>
-:: modify ltm persistense cookie <profile_name> cookie-encryption required
+modify ltm persistense cookie <profile_name> cookie-name <secure_cookie_name>
-:: modify ltm persistense cookie <profile_name> cookie-encryption-passphrase <secure_passphrase>
+modify ltm persistense cookie <profile_name> cookie-encryption required
-:: modify ltm virtual <virtual_server> persist replace-all-with { <profile_name> }
+modify ltm persistense cookie <profile_name> cookie-encryption-passphrase <secure_passphrase>
 === BIG-IP HTTP Server header information leakage ===

@@ Line 158: / Line 158: @@
 ==== Remediation ====
-# Connect MGMT interface to management network only.
+# Connect MGMT interface to special management network only. Management network should operates under private (RFC 1918) IP-address space that is completely separate from the production network.
-# Set "Allow None" on all Self IPs and only administer the BIG-IP using the Management Port. Setting "Allow None" on each Self IP will block all access to administrative IP addresses except for the Management Port. Access to individual ports can be selectively enabled, but this is not recommended in a secure environment.
+# The most secure configuration is to set "Allow None" on all Self IPs and only administer a BIG-IP using the Management Port. Setting "Allow None" on each Self IP will block all access to BIG-IP's administrative IP addresses except for the Management Port. Access to individual ports can be selectively enabled, but this is not recommended in a highly secure environment.
 #* Log in to the Configuration utility.
 #* Navigate Network > Self IPs.
 #* For all self IPs set "Port Lockdown" option to "Allow None".
 #* Click on "Update" button.
 === Protection against HTTP host header attacks  ===