NetIQ Access Manager Appliance 5.0 Security Guide

  NetIQ Access Manager Appliance 5.0 Security Guide

    Deployment Considerations

      Protecting Access Manager Appliance through Firewall

        Access Manager Appliance in DMZ

    Securing Administration Console

      Managing Administration Console Session Timeout

      Securing iManager Login Settings

      Securing Administrator Accounts

        Enforcing Case-Sensitive Universal Password For Access Manager

      Protecting the Configuration Store

      Securing Configuration Store Using TLS Port

      Running the DHost HTTP Server on localhost

      Preventing the SWEET32 Attack

      Default Security Settings in Configuration Files

        server.xml

        web.xml

        tomcat8.conf

    Securing Identity Server

      Disabling Unused Authentication Protocols

      Configuring SSL Communication between Browsers and Identity Server

      Configuring SSL Communication with Identity Server and a Service Provider

      Securing Authentication by Using Strong and Multi-Factor Authentication Methods

      Securing Federation

        Setting Options

        Configuring the Encryption Method for the SAML Assertion

      Configuring a Whitelist of Target URL

        Configuring a Global Whitelist of Target URL

        Configuring a Whitelist of Intersite Transfer Service Target URL

        Configuring a Whitelist of Assertion Consumer Service URL

        Configuring a Whitelist of URLs for RelayState URL

      Blocking Access to Identity Server Pages

      Enabling Advanced Session Assurance

      Securing Identity Server Web Service Interface

      Enabling reCAPTCHA

      Preventing the SWEET32 Attack

      Detecting the Brute Force Attack

      Restricting the Direct Access to Files in the nidp Folder

      Preventing Cross-Site Request Forgery Attacks

      Using the Device ID in the URN Cookie

      Configuring the Cookie Secure Flag

      Default Security Settings in Configuration Files

        server.xml

        web.xml

        tomcat.conf

    Securing Access Gateway

      Enabling SSL Communication between Access Gateway and Identity Server

      Enabling Secure Cookies

        Securing the Embedded Service Provider Session Cookie

        Securing the Proxy Session Cookie

      Disabling Phishing

      Disabling Weak Protocols between Access Gateway and Web Servers

      Configuring Stronger Ciphers for SSL Communication between Access Gateway and Web Servers

      Enabling Perfect Forward Secrecy

      Preventing Error Messages to Show the Failure Reason on Browsers

      Enabling Advanced Session Assurance

      Preventing the Slowloris Attack

      AJP Communication Setting for Access Gateway

      Using the Device ID in the URN Cookie

      Default Security Settings in Configuration Files

        ESP web.xml

        Access Gateway Advanced Options

        httpd.conf

        NovellAgSettings.conf

    Securing Analytics Server

      Customizing the Size of EDH Keys

      Configuring SSL in Analytics Server

      Disabling SSL Renegotiations

      Securing Analytics Server Cluster Communication

      Setting Analytics Dashboard Timeout

      Default Security Settings in Configuration Files

        server.xml

        web.xml

    Hardening Appliance

      Disabling Weak MAC Algorithms on a Secure Shell Server

    Configuring Secure Communication

      Configuring SSL in Identity Server

        Configuring a SSL Channel between Identity Server and LDAP Servers

        Enabling SSL between Browsers and Identity Server

        Enabling SSL between Identity Server and a Service Provider

      Configuring SSL in Access Gateway

        Enabling SSL between Browsers and Access Gateway

        Enabling SSL between Access Gateway and Web Servers

      Configuring SSL for Authentication between Identity Server and Access Gateway

      Configuring SSL in Analytics Server

      Using Trusted Certificates Authority

    Strengthening TLS/SSL Settings

      Disabling SSLv2 and SSLv3 Protocols

      Optimizing SSL Configuration with Ciphers

      Enabling Perfect Forward Secrecy

      Adding HTTP Strict Transport Security

      Disabling SSL Renegotiations

      Customizing the Size of Ephemeral Diffie-Hellman Keys

    Strengthening Certificates

      Key Size and Signature Algorithm Considerations

      Trusted Certificate Authorities

      Certificate Renewal

    XSS, XFS, and Clickjacking Attacks

      Cross-site Scripting Attacks

      Cross-Frame Scripting Attacks

      Clickjacking Attacks

    Getting the Latest Security Patches

    Restoring Previous Security Level After Upgrading Access Manager Appliance

      Restoring Previous Security Settings for Administration Console

        Restoring the Previous Protocols Settings

        Restoring the Previous Settings of Ciphers for SSL Communication

        Disabling Perfect Forward Secrecy

        Restoring the Previous Size of EDH Keys

        Removing HTTP Strict Transport Security

      Restoring Previous Security Settings for Identity Server

        Restoring the Previous Protocols Settings

        Restoring the Previous Settings of Ciphers for SSL Communication

        Disabling Perfect Forward Secrecy

        Restoring the Previous Settings of the Size of EDH Keys

        Removing HTTP Strict Transport Security

        Removing the Clickjacking Filter

      Restoring Previous Security Settings for Access Gateway

        Restoring the Previous Protocol Settings between Browsers and Access Gateway

        Restoring the Previous Ciphers Settings between Browsers and Access Gateway

        Removing the Clickjacking Filter

        Removing HTTP Strict Transport Security

    Appendix

      Default Ciphers for Identity Server

      Default Ciphers for Administration Console

      Default Ciphers for Analytics Server

      Default Ciphers for Access Gateway

    Legal Notice