Data Domain - System hardening and best practices guide

Follow the company password policy to set the default password aging policy.

# user password aging option set
{[min-days-between-change <days>]
[max-days-between-change <days>]
[warn-days-before-expire <days>]
[disable-days-after-expire <days>]}

Set a user password strength policy:

# user password strength set
{[min-length <length>]
[min-character-classes <num-classes>]
[passwords-remembered <0 - 24>][minpositions-changed <min-positions>]}

Password recommendations:
● A minimum of 12 characters
● No spaces
● No common dictionary words
● Minimum 8 positions should be changed during the password change
 

Add security officer role user, force password change, and enable Authorization Policy. Use user add command to add security officer as a security role user.

# user add <user>
[uid <uid>]
[role {admin | limited-admin | security |
user | backup-operator | none}]
[min-days-between-change <days>]
[max-days-between-change <days>]
[warn-days-before-expire <days>]
[disable-days-after-expire <days>]
[disable-date <date>]
[force-password-change {yes | no}]

Set force-password-change to yes when adding the security officer account.

Log in as security officer, and run 
# authorization policy set security-officer enabled

Add a limited-admin role user and set a password different to sysadmin/admin role users.

# user add <user>
[uid <uid>]
[role {admin | limited-admin | security |
user | backup-operator | none}]
[min-days-between-change <days>]
[max-days-between-change <days>]
[warn-days-before-expire <days>]
[disable-days-after-expire <days>]
[disable-date <date>]
[force-password-change {yes | no}]

Log in as security officer, and then run 
# user change password

For SSH:
● Add an SSH host.
# adminaccess ssh add <host-list>
● Delete hosts from the SSH list.
# adminaccess ssh del <host-list>
For HTTP and HTTPS:
● Add an HTTP/HTTPS host.
# adminaccess http add <host-list>
● Delete hosts from the HTTP/HTTPS list.
# adminaccess http del <host-list>
NOTE: Do not use a wildcard character enabling access
for any user. Type individual IP addresses or client names
instead.

● Configure and forward logs to syslog server.
● Monitor audit log and access log. See the DDOS Command
Reference UIde for more information.
○ # log view access-info
○ # log view audit-info
● Consider writing a script that runs the above commands
several times a day and reports any suspicious activities.
● Pay close attention to sensitive and not often used
commands that are related to user access management
and network settings, including time setting.
● Monitor authentication and authorization failures in
particular.
● Monitor all operations that require password.
● Monitor destruction operations and any failures and
repeating attempts.
● Highly recommended is to write searches and dashboards
to view log forwarded info. Also setup alerts rules on your
log server.

Disable telnet by running # adminaccess disable telnet

Set and use a hardened system passphrase. The default
minimum length requirement is 9 characters. Use system
passphrase option set min-length to set higher
length requirements. 

Configure two-way authentication when adding a replication
pair.
# replication add source <source>
destination <destination>
[low-bw-optim {enabled | disabled}]
[encryption {enabled [authentication-mode
{one-way | two-way | anonymous}] |
disabled}]
[propagate-retention-lock {enabled |
disabled}]
[ipversion {ipv4 | ipv6}]
[max-repl-streams <n>]
[destination-tenant-unit <tenant-unit>]

By default the global authentication mode is set to none, and encryption is disabled. The configurations ensure only DD Boost clients with at least two-way-password authentication support, those using DD Boost 3.3 or later, can attach and data is encrypted on the wire. 

NOTE: More secure configurations, one-way (per client) and two-way (global), are available. With these settings, DD Boost clients must provide the necessary certificates to connect.

# ddboost option set global-authenticationmode two-way-password global-encryptionstrength <high/medium>

By default the password hash is set to MD5. Modifying this to SHA512 prevents DD Boost clients unable to support the SHA512 from attaching.

 # adminaccess option set password-hash
{md5 | sha512}

Create a none role user and associates it to be a DD Boost
user.
 # user add <user> role none
# ddboost user assign <user> 

# ddboost clients add client-list [encryption-strength {none | medium | high} authentication-mode {one-way | two-way | twoway-password | anonymous | kerberos}]

Use two-way authentication-mode.

# ddboost file-replication option set
encryption enabled authentication-mode twoway

# nfs option set nfs3-port <new port number>
# nfs option set nfs4-port <new port number>

# net filter add operation block protocol
tcp ports 111

# net filter add operation block protocol
udp ports 111

Ensures that data on the wire is encrypted.
# nfs export create <export name> path
<path> option sec=krb5p

Delete NFS clients from an export
# nfs add <path> <client-list> [ ( <optionlist> ) ]
Delete NFS clients from an export.
# nfs del <path> <client-list>

Verify using the following command:

# nfs export show list

Should verify no_root_squash is not configured for any exports.

DD supports use of only FIPS 140-2 approved ciphers for
secured connections. DD recommends using UI or CLI to
enable FIPS mode:
● UI: Administration > Setting > FIPS mode
● CLI: system fips-mode enable

DD recommends UI or CLI hardening:
● UI: Administration > Access > More Tasks > Change
Login Options (to set active login to 100)
● CLI: adminaccess option set login-maxactive 100

DD recommends use of UI or CLI to configure:
● UI: Administration > Access > More Tasks > Change value on Maximum login Attempts as 3, Unlock timeout as 900 sec

● CLI:
○ adminaccess option set login-maxattempts 3
○ adminaccess option set login-unlocktimeout 900

DD supports terminating connections at the end of the session and support session termination after configured time of inactivity. There is a CLI to specify the inactivity period. SSH connection is still alive but any request from the client is rejected. A session clean-up process is running and cleanup and terminates sessions that are no longer valid. DD recommends the following for UI or CLI hardening:

● UI: Administration > Access > Check on HTTPS >
Configure > ADVANCE and set timeout value as 600 sec.
Repeat the same for SSH by clicking SSH in Services.
● CLI:
○ SSH: adminaccess ssh option set sessiontimeout 600
○ https: adminaccess web option set
session-timeout 600

DD recommends the CLI user password aging option. By default the password policy is relaxed to be backward compatible. The customer can use UI or CLIs to modify the password configuration so it is more restrictive and meets the aging requirements.

● UI: Administration > Access > More Tasks > Change Login Options NOTE: Per user option can be set through Administration > Access > Local Users > Modify > Advanced
 

● CLI: user password aging

DD supports a comprehensive password policy and recommends using CLI or UI to harden the password. Set or modify account password policy characteristics and complexity to whatever is wanted within the application code. See the password policy for more information about requirements.

● UI: Administration > Access > More Tasks > Change Login Options
 

● CLI: user password strength set

● CLI: ntp add timeserver <server-name> ntp enable

DD supports different HTTPS port and limiting of certain interface instead of default of all interfaces for HTTPS connections. DD recommends using adminaccess and netfilter CLI command to harden:

● adminaccess web option set https-port
<port>
● net filter add operation allow protocol
tcp ports <port> interfaces <IP_address>

NOTE: IP address must be an active interface reported by ifconfig command.

The application server must uniquely identify all network-connected endpoint devices before establishing any connection.

The Apache web server must restrict inbound connections from nonsecure zones.

To restrict inbound connections, DD recommends configuring allowed host in HTTPS and SSH connections using UI or CLI command.

● UI: Administration > Access > ADMINISTRATOR ACCESS > select HTTPS/SSH > CONFIGURE > GENERAL and click the + (Add) sign.

● CLI:
○ adminaccess http add <host_list>
○ adminaccess ssh add <host-list>

Email alert can be sent when audit log storage space reaches 80% and 100% threshold. DD recommends use of UI or CLI to configure the system to "Send Alert Notification Emails." ● UI: Health > Alerts > NOTIFICATION > ADD(Groups on file system Class with WARNING and CRITICAL and Subscriber CONFIGURE (Add email addresses and Groups)

● CLI:
○ alerts notify-list create <group name
warning> class filesystem severity
warning
○ alerts notify-list add <group name
warning> emails <email>
○ alerts notify-list create <group name
critical> class filesystem severity
critical
○ alerts notify-list add <group name
critical> emails <email>

DD supports syslog forwarding and recommends using CLI to
set up connection to a remote syslog server.
● log host add <Remote_syslog_Server>
● log host enable

DD supports multiple name servers protocols such as LDAP,
NIS, and AD. DD recommends using OpenLDAP with FIPS
enabled. DD manages only local accounts. DD recommends
using UI or CLI to configure LDAP.
● UI: Administration > Access > Authentication
● CLI: Authentication LDAP commands
Active Directory can also be configured for user logins with
FIPS enabled. However, CIFS data access with AD users is no
longer be supported with that configuration.

DD supports SNMPV3 that is FIPS-compliant. DD
recommends using UI or CLI to configure SNMPV3.
● UI: Administration > Settings > SNMP
● CLI: SNMP commands

DD supports using of DoD issued CAC/PIV card at client browser to log in using UI. This is a multifactor login using certificate of CAC/PIV card. DD recommends UI or CLI command to configure MFA and set up OpenLDAP for user authorization.

General Procedure:
● Configure OpenLDAP Import CA certificate to DD.
● Import DoD CA to DD
● Create local users (if LDAP authentication is not used).
● Disable password-based login

DD supports CRL on MFA with issuing CA revoking CAC
certificate by importing CRL cert to DD. DD recommends
using CLI to import CRL certificate.
● CLI: adminaccess certificate cert-revokelist import application login-auth

DD recommends disabling HTTPS service to terminate all
active sessions by UI or CLI.
● UI: Administration > Access > Administrator Access >
HTTPS > CONFIGURE (clear HTTPS and save).
● CLI: adminaccess disable https

DD supports SSH connection using ssh keys instead of password-based login. If password-based login is disabled, UI login using password is also disabled. DD recommends using CLI to import the key certificate and disable password-based SSH login.

● CLI:
○ adminaccess add ssh-keys user
<user_name>
○ adminaccess option set password-auth
disable

NOTE: Sysadmin account must have ssh key imported first to disable password-based login.

The system must use a FIPS 140-2 approved cryptographic hashing algorithm for generating account password hashes. Systems must employ cryptographic hashes for passwords using the SHA-2 family of algorithms or FIPS 140-2 approved successors. The use of unapproved algorithms may result in weak password hashes more vulnerable to compromise.

NOTE: The DDOS Command Reference UIde describes
how to use the adminaccess option set
passwordhash {md5 | sha512}

command to set the FIPS 140-2-approved cryptographic hashing on the system. Changing the hash algorithm does not change the hash value for any existing passwords. Any existing passwords that were hashed with md5 will still have md5 hash values after changing the password-hash algorithm to sha512. Those passwords must be reset so that a new sha512 hash value is computed.

Telnet can be removed. Run adminaccess uninstall
telnet to remove the telnet package from the DD system.
NOTE: If telnet is removed, it cannot be added back to
the system.

○ log host add <Remote_syslog_IP>
○ log host enable
NOTE: Corresponding configuration to accept system
syslog at Remote Syslog server is required.

DD can be configured to prompt for user consent prior to log in to the system UI interface.
● UI: Administration > LOGIN BANNER > CONFIGURE
● CLI: system option set loginbanner /ddr/var/releases/<banner_file>
● Where <banner_file> is uploaded to
DD's /ddr/var/releases as text file