5.3 Advanced Security Topics

The following sections cover various security related configurations:

5.3.1 SSL Cipher Suites and Protocols Configuration

You can manage SSL cipher suites and protocols for all connections to the Operations Center server by setting the properties in the formula.properties file in the Operations Center server.

NOTE:The following configurations are global settings and apply to all SSL connections.

To setup SSL cipher suites and protocols for connections to the Operations Center server:

Open the Formula.custom.properties file in the Operations Center server, and uncomment and edit the following list to control cipher suites for all SSL connections (outside Apache Tomcat):

#com.mosol.ssl.enabledCipherSuites=\
# SSL_RSA_WITH_RC4_128_MD5,\
# SSL_RSA_WITH_RC4_128_SHA,\
# TLS_RSA_WITH_AES_128_CBC_SHA,\
# TLS_DHE_RSA_WITH_AES_128_CBC_SHA,\
# TLS_DHE_DSS_WITH_AES_128_CBC_SHA,\
# SSL_RSA_WITH_3DES_EDE_CBC_SHA,\
# SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA,\
# SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA,\
# SSL_RSA_WITH_DES_CBC_SHA,\
# SSL_DHE_RSA_WITH_DES_CBC_SHA,\
# SSL_DHE_DSS_WITH_DES_CBC_SHA,\
# SSL_RSA_EXPORT_WITH_RC4_40_MD5,\
# SSL_RSA_EXPORT_WITH_DES40_CBC_SHA,\
# SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA,\
# SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA,\
# SSL_RSA_WITH_NULL_MD5,\
# SSL_RSA_WITH_NULL_SHA,\
# SSL_DH_anon_WITH_RC4_128_MD5,\
# TLS_DH_anon_WITH_AES_128_CBC_SHA,\
# SSL_DH_anon_WITH_3DES_EDE_CBC_SHA,\
# SSL_DH_anon_WITH_DES_CBC_SHA,\
# SSL_DH_anon_EXPORT_WITH_RC4_40_MD5,\
# SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA,\
# TLS_KRB5_WITH_RC4_128_SHA,\
# TLS_KRB5_WITH_RC4_128_MD5,\
# TLS_KRB5_WITH_3DES_EDE_CBC_SHA,\
# TLS_KRB5_WITH_3DES_EDE_CBC_MD5,\
# TLS_KRB5_WITH_DES_CBC_SHA,\
# TLS_KRB5_WITH_DES_CBC_MD5,\
# TLS_KRB5_EXPORT_WITH_RC4_40_SHA,\
# TLS_KRB5_EXPORT_WITH_RC4_40_MD5,\
# TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA,\
# TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5

For connections to the Operations Center Dashboard, modify the dashboard server.xml file, which is located in the /OperationsCenter_Dashboard_install_path/server/config and /OperationsCenter_Dashboard_install_path/server/template directories, to include the ciphers wish.

For example:

<Connector port="7443" maxHttpHeaderSize="8192"
maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
enableLookups="false" disableUploadTimeout="true"
acceptCount="100" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS"
ciphers="SSL_RSA_WITH_DES_CBC_SHA,SSL_RSA_WITH_NULL_MD5,TLS_KRB5_WITH_RC4_128
_SHA,TLS_RSA_WITH_AES_128_CBC_SHA"
keystoreFile="conf/keystore" keystorePass="formula"
URIEncoding="UTF-8" />

Stop and restart the Operations Center for the changes to take effect.

The same settings are valid in the relay.properties file for the relay server. For more information on the use of the relay server, see the Operations Center Adapter and Integration Guide.

For more information about using the Formula.custom.properties file to customize configuration options, see Making Custom Changes in the Operations Center Server Configuration Guide.

5.3.2 Enabling Protocol Versions for SSL Connections

NOTE:The following configuration is a global setting and applies to all SSL connections.

To enable SSL connection protocols:

Open the Operations_Center_install_path/NOC/config/Formula.custom.properties file and set the following properties:
To control protocol versions for all SSL connections (outside Apache Tomcat), uncomment and edit the following list:
```
#com.mosol.ssl.enabledProtocols=\
# SSLv2Hello,\
# SSLv3,\
# TLSv1
```
Stop and restart the Operations Center for the changes to take effect.

For more information about using the Formula.custom.properties file to customize configuration options, see Making Custom Changes in the Operations Center Server Configuration Guide.

5.3.3 Configuring Certificate Validators

Operations Center provides a default validator to guarantee that client and server certificates are valid and active between Operations Center server and dasbhoard and CMS clients. Other validator implementations are only available as customizations.

To enable the default Operations Center certificate validators:

Open the Operations_Center_install_path/NOC/config/Formula.custom.properties file and set the following properties:

mymo.rmi.security.serverCertValidator: Server certificate validator; the default is com.mosol.Formula.Common.remote.security.DefaultValidator.

The server certificate is checked to verify that it is trusted and active during the SSL handshake. A certificate validator extends the basic SSL certificate validation and ensures that the server certificate matches the hostname of the server that provided it..

To disable the default validation, set this property to NONE.

mymo.rmi.security.clientCertValidator: Client certificate validator; the default is com.mosol.Formula.Common.remote.security.DefaultValidator.

When client certificate authentication is enabled (sslWithClientAuth), the client certificate is checked to that it is trusted and active during the SSL handshake. A certificate validator extends the basic SSL certificate validation and ensures that the client certificate matches the hostname of the client that provided it.

To disable the default validation, set this property to NONE.
Stop and restart the Operations Center for the changes to take effect.

For more information about using the Formula.custom.properties file to customize configuration options, see Making Custom Changes in the Operations Center Server Configuration Guide.

5.3.4 Configuring RMI Connection ACLs

Operations Center uses Remote Services Port (RMI) services to connect with the dashboard and CMS. Configure the Formula.custom.properties file to ensure security on the RMI port.

To configure the servers that are allowed to access the RMI port:

Set the following property in the Operations_Center_install_path/NOC/config/Formula.custom.properties file:

mymo.rmi.acl: The Connection ACL (Access Control List) limits the servers that can access the interface; the default is empty.

To configure this setting, precede the hostname or IP address of each CMS/dashboard server that accesses this interface with a plus sign (+), and separate the entries with a semicolon (;). For example:
```
mymo.rmi.acl=+devtower10;+qasun1;
```
Stop and restart the Operations Center for the changes to take effect.

For more information about using the Formula.custom.properties file to customize configuration options, see Making Custom Changes in the Operations Center Server Configuration Guide.