Perform Manual Hardening for Versa Branches, Controllers, and Hubs

Enable Centralized Authentication

It is recommended that you enable centralized authentication on all Versa devices, using either TACACS+ or RADIUS for authentication.

To enable centralized authentication:

1. In Director view:
   1. Select the Configuration tab in the top menu bar.
   2. Select Templates > Device Templates in the horizontal menu bar.
   3. Select a device template in the main pane. The view changes to Appliance view.
2. Select the Configuration tab in the top menu bar.
3. Select Others > System > Appliance User Management > External AAA in the left menu bar.
   
   
4. Click the Edit icon. In the Edit External AAA popup window, enter information for the following fields.
   
   
    

   Field	Description
   Protocol	Select the protocol: RADIUS TACACS+
   Authentication Order	Select the order of authorization: local-then-remote remote-then-local
   Action	Click to select the AAA action: Accounting Authentication Both
   Server (Group of Fields)
   Key	Enter the password to use to access the server.
   IP Address	Enter the IP address of the server.
   Routing Instance	Select the routing instance to use to reach the AAA server.

Enable TACACS+ or RADIUS Authentication at the Device Level

1. In Director view:
   1. Select the Configuration tab in the top menu bar.
   2. Select Devices > Devices in the horizontal menu bar.
   3. Select a Controller in the main pane. The view changes to Appliance view.
2. Select the Configuration tab in the top menu bar.
3. Select Others > System > Appliance User Management > External AAA in the left menu bar.
   
   
4. Click the Edit icon. The Edit External AAA popup window displays.
   
   
    
5. In the Protocol field, select TACACS+ or RADIUS, and enter information for the other fields.
6. Click OK.

Authentication Attributes for SSH Access

To retain SSH access to a Director node, the following attributes must be returned as part of the TACACS+ or RADIUS accept message:
 

Attribute	Access Level
Versa-User-Group = admin	CLI read/write access
Versa-User-Group = oper	CLI read only access

The following is a sample of a TACACS+ server configuration file:

root@tacacs:/etc/tacacs+# more tac_plus.conf
# See man(5) tac_plus.conf for more details

# Define where to log accounting data; this is the default.

accounting file = /var/log/tac_plus.acct

# Dey that clients have to use to access TACACS+

key = versa123

# Use /etc/passwd file for authentication
    
# default authentication = file /etc/passwd

# Define a per-host key with different enable passwords
# host = 127.0.0.1 {
#        key = test
#        type = cisco
#        enable = <des|cleartext> enablepass
#        prompt = "Welcome XXX ISP Access Router \n\nUsername:"
#}

# Define local users and specify a file where data is stored.
# That file can be filled using tac_pwd
# user = test1 {
#    name = "Test User"
#    member = staff
#    login = file /etc/tacacs/tacacs_passwords
#}

# Specify rules valid per group of users.
# group = group1 {
#       cmd = conf {
#               deny
#       }
#}

# Another example: forbid configure command for some hosts
# for a defined range of clients
# group = group1 {
#       login = PAM
#       service = ppp
#       protocol = ip {
#               addr = 10.10.0.0/24
#       }
#       cmd = conf {
#               deny .*
#       }
#}

user = DEFAULT {
        login = PAM
        service = ppp protocol = ip {}
}

# Many more features are availables, such as ACL, more service compatibilities,
# commands authorization, and scripting authorization.
# See the man page for more information.
#

group = TenantSuperAdminGroup {
    login = PAM
    service = test {
        Versa-Role = "TenantSuperAdmin"
        Versa-Tenant = "Galaxy-Foods"
        Versa-GUI-Idle-TimeOut = "300"
    }
}
 
group = TenantOperatorGroup {
    login = PAM
    service = test {
        Versa-Role = "TenantOperator"
        Versa-Tenant = "Galaxy-Foods"
        Versa-GUI-Idle-TimeOut = "300"
    }
}
 
group = TenantSecurityAdminGroup {
    login = PAM service = test {
        Versa-Role = "TenantSecurityAdmin"
        Versa-Tenant = "Galaxy-Foods"
        Versa-GUI-Idle-TimeOut = "300"
    }
}
 
group = TenantADCAdminGroup {
    login = PAM
    service = test {
        Versa-Role = "TenantADCAdmin"
        Versa-Tenant = "Galaxy-Foods"
        Versa-GUI-Idle-TimeOut = "300"
        }
}
 
group = ProviderDataCenterAdminGroup {
    login = PAM
    service = test {
        Versa-Role = "ProviderDataCenterAdmin"
         Versa-GUI-Idle-TimeOut = "300"
    }
}
 
group = ProviderDataCenterOperatorGroup {
    login = PAM service = test {
        Versa-Role = "ProviderDataCenterOperator"
        Versa-GUI-Idle-TimeOut = "300"
    }
}

 
group = ProviderDataCenterSystemAdminGroup {
    login = PAM service = test {
        Versa-Role = "ProviderDataCenterSystemAdmin"
        Versa-GUI-Idle-TimeOut = "300"
    }
}

group = flex_oper {
     default service = permit
     service = versa {
        Versa-User-Group = oper
     }
}

group = flex_admin {
     default service = permit
     service = versa {
        Versa-User-Group = admin
     }
}

group = uber_admin {
     default service = permit
     service = versa {
        Versa-User-Group = admin
     }
    login = PAM service = test {
        Versa-Role = "ProviderDataCenterSystemAdmin"
        Versa-GUI-Idle-TimeOut = "300"
    }
}

user = providersystemadmin {
    member = ProviderDataCenterSystemAdminGroup
    login = cleartext "versa123"
    pap = cleartext "versa123"
# pap is needed for CLI access
# # login is needed for GUI access
}

user = dave {
    default service = permit
    member =  uber_admin
    login = des 1V4lf5pe4zRkE
    expires = "Sep 30 2099"
    pap = cleartext "versa123"
    # pap is needed for CLI access
    # # login is needed for GUI access
}

user = sultan {
    default service = permit
    member = ProviderDataCenterSystemAdminGroup
    login = des 1V4lf5pe4zRkE
    expires = "Sep 30 2099"
    pap = cleartext "versa123"
}

user = flexadmin {
    member =  flex_admin
    login = cleartext "versa123"
    pap = cleartext "versa123"
} 

Create IP Tables Rules for Versa Network Components

1. Create the following iptables rules so that Director nodes can work properly by allowing traffic to the following host interfaces:
   • Primary and secondary Director northbound interface address
   • Primary and secondary Director southbound interface address
   • localhost loopback, 127.0.0.1

     sudo iptables -A INPUT -s ip-address -j ACCEPT
     

2. Create the following iptables rules to block all outside traffic:

   sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
   sudo iptables -P OUTPUT ACCEPT
   sudo iptables -P FORWARD DROP
   sudo iptables -P INPUT DROP
   

3. Add rules for hosts requiring SSH access to the Analytics node:

   sudo iptables -A INPUT -s ip-address-of-ssh-source -p tcp -m tcp --dport 22 -j ACCEPT
   

4. Save the iptables rules and set the startup script to execute them:

   root@Controller-1:~# iptables-save > /opt/versa/etc/rules.v4
   root@Controller-1:~# echo -e  "#Restore iptables  rules\niptables-restore < /opt/versa/etc/rules.v4" >> /opt/versa/scripts/setup_versa_env.sh
   

Edit the Hub IP Tables Templates

To edit the IP tables template for a hub device:

1. Save the current IP tables template by issuing the iptables-save command.

   root@device-name:~# iptables-save > /opt/versa/etc/rules.v4
   

2. Edit rules file, /etc/iptables/rules.v4 file, using the editor of your choice (nano or vi) to reflect template fields shown above. Define the rules for the chains associated with the filter table. Replace each line between “*filter” and “COMMIT” with the content shown below, specifying the appropriate IP addresses. Specify the DROP and ACCEPT actions as appropriate.

3. Activate the iptables rules:

   root@Branch-device:~# iptables-restore < /opt/versa/etc/rules.v4
   

4. Make the rules permanent by editing the /opt/versa/scripts/setup_versa_env.sh file using the editor of your choice (nano or vi) and ensure that the following line is at the end of file:

# Restore iptables rules
iptables-restore < /opt/versa/etc/rules.v4

6. Ensure that the startup script is still configured to load the iptables rules.
7. Check the /opt/versa/etc/rules.v4 and /opt/versa/scripts/setup_versa_env.sh files.

The following lines in the IP tables file come from the services loaded in the device, and they are included to avoid a reboot or service restart after you apply the rules:

-A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh  <-- Block IP addresses of clients who had too many SSH login attempts; from the fail2ban service
-A INPUT -p icmp -m icmp --icmp-type 13 -j DROP           <-- Block ICMP timestamp replies
-A OUTPUT -p icmp -m icmp --icmp-type 3 -j DROP           <-- Block ICMP destination unreachable messages
-A OUTPUT -p icmp -m icmp --icmp-type 14 -j DROP          <-- Block ICMP timestamp requests

The default output chain target is ACCEPT. To handle this, include the following line:

-A INPUT -m comment --comment "ACCEPT (RELATED | ESTABLISHED" -m state --state (RELATED | ESTABLISHED) -j ACCEPT

In this line:

• ESTABLISHED—The state has established traffic in both directions and continuously matches these packets.
• RELATED—A connection in this state is related to an ESTABLISHED connection, for example, an FTP connection.

Disable Promiscuous Mode

As part of branch, controller, or hub device hardening, you should disable promiscuous mode on the eth0 Ethernet interface.

To disable promiscuous mode on the eth0 interface:

1. Edit the /etc/network/interfaces file.

$ sudo vi /etc/network/interfaces

2. Locate the line "iface ethx inet static", and replace x with the interface number.
3. Add the line "up ip link set ethx promisc off" to the file, replacing x with the interface number.
4. Save the file.
5. Switch off promiscuous mode:

$ sudo ip link ethx promisc off

The following shows an example of the modified /etc/network/interfaces file for the eth0 interface:

auto eth0
iface eth0 inet static
up ip link set eth0 promisc off
address 192.168.0.10
netmask 255.255.255.0
mtu 1200
up route add -net 192.168.0.0 netmask 255.255.0.0 gw 192.168.0.239
up route add -net 10.0.0.0 netmask 255.255.0.0 gw 192.168.0.239
up route add -net 10.1.0.0 netmask 255.255.0.0 gw 192.168.0.239
up route add -net 10.2.0.0 netmask 255.255.0.0 gw 192.168.0.239

Harden SSH

Harden File System Permissions

For Controller nodes only.

To harden harden the permissions on a Controller node:

1. Change the ownership of the /tmp and /var/tmp directories:

   $ sudo chown root:versa_priv /tmp
   $ sudo chown root:versa_priv /var/tmp
   

2. Change the permissions of the /tmp and /var/tmp directories:

   $ sudo chmod 1770 /tmp
   $ sudo chmod 1770 /var/tmp>

Secure Confd SSH and SSL

As part of branch, Controller, and hub device hardening, you must perform additional hardening for port 8443, which is the Apache Tomcat port used for HTTPS and web GUI services. You can harden the channel between Versa Director and VOS devices, including Controller nodes, by using an encryption that is stronger than the default encryption for SSH and SSL transport.

To secure confd SSH and SSL:

1. Log in to the device using the Director CLI.
2. Update the encryption for each Controller and VOS device:

devices {
    device SP01 {
        config {
            confdConfig {
                ssh {
                    algorithms {
-                         encryption aes128-ctr,aes192-ctr,aes256-ctr;
+                         encryption aes256-ctr,aes256-cbc;
+                         kex diffie-hellman-group-exchange-sha256;
                       }
                   }
                   webui {
                       transport {
                           ssl {
-                             ciphers DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:DHE-RSA- 
AES128-SHA256:DHE-RSA-AES256-SHA256;
+                             ciphers DHE-DSS-AES256-SHA256,AES256-SHA256;
                        }
                    }
                }
            }
        }
    }
}

Perform System Upgrades

When you perform a system upgrade, for example, if you upgrade from Release 16.1R2S9 to Release 16.1R2S10, doe the following to keep the system hardened

Before you upgrade a VOS device:

• Update to the latest OS Spack. For more information, see Use OS Security Packages.
• Back up the iptables rules:

$ sudo iptables-save > iptables.rules

After you upgrade a VOS device:

• Reapply all the iptables rules

Supported Software Information

Releases 20.2 and later support all content described in this article.

Additional Information

Configure AAA
Configure DNS Servers
Configure Systemwide Functions
Configure Time Settings
Perform Manual Hardening for Versa Analytics
Perform Manual Hardening for Versa Director
Use OS Security Packages