Data Domain — 系统加固和最佳实践指南

按照公司密码策略设置默认密码老化策略。

# user password aging option set
{[min-days-between-change <days>]
[max-days-between-change <days>]
[warn-days-before-expire <days>]
[disable-days-after-expire <days>]}

设置用户密码强度策略：

# user password strength set
{[min-length <length>]
[min-character-classes <num-classes>]
[passwords-remembered <0 - 24>][minpositions-changed <min-positions>]}

密码建议：
● 至少 12 个字符
● 没有空格
● 没有常用的字典单词
● 密码更改时至少应更改 8 个位置
 

添加安全专员角色用户，强制更改密码，并启用授权策略。使用 user add 命令将安全专员添加为安全角色用户。

# user add <user>
[uid <uid>]
[role {admin | limited-admin | security |
user | backup-operator | none}]
[min-days-between-change <days>]
[max-days-between-change <days>]
[warn-days-before-expire <days>]
[disable-days-after-expire <days>]
[disable-date <date>]
[force-password-change {yes | no}]

添加安全专员帐户时，将 force-password-change设置为 yes。

Log in as security officer, and run 
# authorization policy set security-officer enabled

添加 limited-admin角色用户，并设置与 sysadmin/admin角色用户不同的密码。

# user add <user>
[uid <uid>]
[role {admin | limited-admin | security |
user | backup-operator | none}]
[min-days-between-change <days>]
[max-days-between-change <days>]
[warn-days-before-expire <days>]
[disable-days-after-expire <days>]
[disable-date <date>]
[force-password-change {yes | no}]

Log in as security officer, and then run 
# user change password

For SSH:
● Add an SSH host.
# adminaccess ssh add <host-list>
● Delete hosts from the SSH list.
# adminaccess ssh del <host-list>
For HTTP and HTTPS:
● Add an HTTP/HTTPS host.
# adminaccess http add <host-list>
● Delete hosts from the HTTP/HTTPS list.
# adminaccess http del <host-list>

● Configure and forward logs to syslog server.
● Monitor audit log and access log. See the DDOS Command
Reference UIde for more information.
○ # log view access-info
○ # log view audit-info
● Consider writing a script that runs the above commands
several times a day and reports any suspicious activities.
● Pay close attention to sensitive and not often used
commands that are related to user access management
and network settings, including time setting.
● Monitor authentication and authorization failures in
particular.
● Monitor all operations that require password.
● Monitor destruction operations and any failures and
repeating attempts.
● Highly recommended is to write searches and dashboards
to view log forwarded info. Also setup alerts rules on your
log server.

Disable telnet by running # adminaccess disable telnet

Set and use a hardened system passphrase. The default
minimum length requirement is 9 characters. Use system
passphrase option set min-length to set higher
length requirements. 

Configure two-way authentication when adding a replication
pair.
# replication add source <source>
destination <destination>
[low-bw-optim {enabled | disabled}]
[encryption {enabled [authentication-mode
{one-way | two-way | anonymous}] |
disabled}]
[propagate-retention-lock {enabled |
disabled}]
[ipversion {ipv4 | ipv6}]
[max-repl-streams <n>]
[destination-tenant-unit <tenant-unit>]

默认情况下，全局身份验证模式设置为无，并且加密处于禁用状态。这些配置可确保只有至少支持双向密码身份验证的 DD Boost 客户端（即使用 DD Boost 3.3 或更高版本的客户端）才能连接网络，并对数据进行网络加密。 

# ddboost option set global-authenticationmode two-way-password global-encryptionstrength <high/medium>

默认情况下，密码哈希设置为 MD5。将其修改为 SHA512 可防止 DD Boost 客户端无法连接 SHA512。

 # adminaccess option set password-hash
{md5 | sha512}

Create a none role user and associates it to be a DD Boost
user.
 # user add <user> role none
# ddboost user assign <user> 

# ddboost clients add client-list [encryption-strength {none | medium | high} authentication-mode {one-way | two-way | twoway-password | anonymous | kerberos}]

使用双向身份验证模式。

# ddboost file-replication option set
encryption enabled authentication-mode twoway

# nfs option set nfs3-port <new port number>
# nfs option set nfs4-port <new port number>

# net filter add operation block protocol
tcp ports 111

# net filter add operation block protocol
udp ports 111

Ensures that data on the wire is encrypted.
# nfs export create <export name> path
<path> option sec=krb5p

Delete NFS clients from an export
# nfs add <path> <client-list> [ ( <optionlist> ) ]
Delete NFS clients from an export.
# nfs del <path> <client-list>

使用以下命令进行验证：

# nfs export show list

应验证未为任何导出配置no_root_squash。

DD supports use of only FIPS 140-2 approved ciphers for
secured connections. DD recommends using UI or CLI to
enable FIPS mode:
● UI: Administration > Setting > FIPS mode
● CLI: system fips-mode enable

DD recommends UI or CLI hardening:
● UI: Administration > Access > More Tasks > Change
Login Options (to set active login to 100)
● CLI: adminaccess option set login-maxactive 100

DD 建议使用 UI 或 CLI 来配置：
● UI：管理 > 访问 > 更多任务 > 将“最大登录尝试次数”的值更改为 3，将解锁超时更改为 900 秒

● CLI:
○ adminaccess option set login-maxattempts 3
○ adminaccess option set login-unlocktimeout 900

DD 支持在会话结束时终止连接，并支持在配置的非活动时间后终止会话。有一个 CLI 可以指定非活动时段。SSH 连接仍处于活动状态，但来自客户端的任何请求都会被拒绝。会话清理进程正在运行，清理和终止不再有效的会话。DD 建议执行以下 UI 或 CLI 强化：

● UI: Administration > Access > Check on HTTPS >
Configure > ADVANCE and set timeout value as 600 sec.
Repeat the same for SSH by clicking SSH in Services.
● CLI:
○ SSH: adminaccess ssh option set sessiontimeout 600
○ https: adminaccess web option set
session-timeout 600

DD 建议使用 CLI 用户密码老化选项。默认情况下，密码策略将放宽到向后兼容。客户可以使用 UI 或 CLI 修改密码配置，使其更具限制性并满足过时要求。

● UI：管理 >访问 >更多任务>更改登录选项

● CLI: user password aging

DD 支持全面的密码策略，并建议使用 CLI 或 UI 来强化密码。根据应用程序代码的需要设置或修改帐户密码策略特征和复杂性。有关要求的更多信息，请参阅密码策略。

● UI：管理 >访问>更多任务>更改登录选项
 

● CLI: user password strength set

● CLI: ntp add timeserver <server-name> ntp enable

DD 支持不同的 HTTPS 端口并限制特定接口，而不是 HTTPS 连接所有接口的默认接口。DD 建议使用 adminaccess 和 netfilter CLI 命令来强化：

● adminaccess web option set https-port
<port>
● net filter add operation allow protocol
tcp ports <port> interfaces <IP_address>

在建立任何连接之前，应用程序服务器必须唯一标识所有已连接网络的端点设备。

Apache Web 服务器必须限制来自非安全分区的入站连接。

为了限制入站连接，DD 建议使用 UI 或 CLI 命令在 HTTPS 和 SSH 连接中配置允许的主机。

● UI：AdministrationAccessADMINISTRATOR >> ACCESS > 选择 HTTPS/SSHCONFIGURE >> GENERAL，然后单击 +（添加）符号。

● CLI:
○ adminaccess http add <host_list>
○ adminaccess ssh add <host-list>

当审核日志存储空间达到 80% 和 100% 阈值时，可以发送电子邮件警报。DD 建议使用 UI 或 CLI 将系统配置为“发送警报通知电子邮件”。● UI：健康 >警报 >通知 >ADD（文件系统类别上的组，具有警告和严重以及订阅者配置（添加电子邮件地址和组）

● CLI:
○ alerts notify-list create <group name
warning> class filesystem severity
warning
○ alerts notify-list add <group name
warning> emails <email>
○ alerts notify-list create <group name
critical> class filesystem severity
critical
○ alerts notify-list add <group name
critical> emails <email>

DD supports syslog forwarding and recommends using CLI to
set up connection to a remote syslog server.
● log host add <Remote_syslog_Server>
● log host enable

DD supports multiple name servers protocols such as LDAP,
NIS, and AD. DD recommends using OpenLDAP with FIPS
enabled. DD manages only local accounts. DD recommends
using UI or CLI to configure LDAP.
● UI: Administration > Access > Authentication
● CLI: Authentication LDAP commands
Active Directory can also be configured for user logins with
FIPS enabled. However, CIFS data access with AD users is no
longer be supported with that configuration.

DD supports SNMPV3 that is FIPS-compliant. DD
recommends using UI or CLI to configure SNMPV3.
● UI: Administration > Settings > SNMP
● CLI: SNMP commands

DD 支持在客户端浏览器上使用 DoD 颁发的 CAC/PIV 卡通过 UI 登录。这是使用 CAC/PIV 卡证书的多因素登录。DD 建议使用 UI 或 CLI 命令来配置 MFA 并设置 OpenLDAP 以进行用户授权。

一般过程：
● 配置 OpenLDAP 将 CA 证书导入 DD。
● 将 DoD CA 导入 DD
● 创建本地用户（如果未使用 LDAP 身份验证）。
● 禁用基于密码的登录

DD supports CRL on MFA with issuing CA revoking CAC
certificate by importing CRL cert to DD. DD recommends
using CLI to import CRL certificate.
● CLI: adminaccess certificate cert-revokelist import application login-auth

DD recommends disabling HTTPS service to terminate all
active sessions by UI or CLI.
● UI: Administration > Access > Administrator Access >
HTTPS > CONFIGURE (clear HTTPS and save).
● CLI: adminaccess disable https

DD 支持使用 ssh 密钥而不是基于密码的登录进行 SSH 连接。如果禁用基于密码的登录，则使用密码的 UI 登录也会被禁用。DD 建议使用 CLI 导入密钥证书并禁用基于密码的 SSH 登录。

● CLI:
○ adminaccess add ssh-keys user
<user_name>
○ adminaccess option set password-auth
disable

系统必须使用 FIPS 140-2 批准的加密哈希算法来生成帐户密码哈希。系统必须使用 SHA-2 家族算法或 FIPS 140-2 批准的后继算法对密码进行加密哈希处理。使用未经批准的算法可能会导致密码哈希较弱，更容易受到入侵。

命令在系统上设置 FIPS 140-2 认可的加密哈希。更改哈希算法不会更改任何现有密码的哈希值。将 password-hash 算法更改为 sha512 后，任何使用 md5 进行哈希处理的现有密码仍将具有 md5 哈希值。必须重置这些密码，以便计算新的 sha512 哈希值。

Telnet can be removed. Run adminaccess uninstall
telnet to remove the telnet package from the DD system.

○ log host add <Remote_syslog_IP>
○ log host enable

DD can be configured to prompt for user consent prior to log in to the system UI interface.
● UI: Administration > LOGIN BANNER > CONFIGURE
● CLI: system option set loginbanner /ddr/var/releases/<banner_file>
● Where <banner_file> is uploaded to
DD's /ddr/var/releases as text file