Secure configuration
In order to operate Web Portal securely, all involved software and infrastructure components (f.e. databases, operating system, container runtime, …) have to be configured securely and always be provided with the latest security patches.
Access to cloud infrastructure, user administration is managed by Operations and Support.
Bosch Connected Industries recommends applying Security Benchmarks of the Center for Internet Security (https://www.cisecurity.org/) or comparable standards for secure configuration.
Embedding Web Portal in frames
Web Portal sends the Content-Security-Policy csp header frame-ancestors 'self' to prevent clickjacking attack scenarios. This prevents Web Portal from being embedded in an iframe of another HyperText Markup Language html application. Refer to Mozilla Developer Network mdn for further information.
To allow specific domains, the header can be extended by frame-ancestors.
TLS
The directory /etc/ssl/server should contain the server certificate for serving TLS. It is defined as a volume in order to be able to install the installation-specific certificates
Note, that the private key of the certificate should have permissions 600 and the password needs to be removed from the key file otherwise it will be requested at startup time. Alternatively you can specify the directive proxy_ssl_password_file with the secret key password. A default TLS password store is already installed in /etc/ssl/server_keys.pass and /etc/ssl/proxy_keys.pass respectively. Set the environment variable SERVER_KEY_PASS at run-time to install a key password suitable to a volume-mounted certificate key.
The hardening includes:
-
limiting the allowed TLS versions to 1.1, 1.2 and 1.3 but nothing older
-
limiting the allowed cipher suites to a set of secure algorithms
-
certificate validation turned on
-
some security headers are enforced
-
OSCP stapling is enabled. Note that when using self-signed certificates this will be skipped as these certificates do not contain OCSP or CRL information. When using a certificate bought from Bosch trust center or a customer brings their own certificate, this will be delivered and used.
-
By default the server does answer all other URL and requests with a status code 404
-
HTTP is redirected to HTTPS for incoming requests
-
detailed logging using structural logging for errors, access and special TLS log
-
Two password files are provided for the server key and the proxy keys in /etc/ssl/ where key passwords could be added by applications via Dockerfile environment