Security checklist for configuring PSM

The following checklist is a set of recommendations and configuration best practices to ensure that your PSM is configured securely.

Encryption-related settings

  • Balabit recommends using 2048-bit RSA keys (or stronger).

  • Use strong passwords: at least 8 characters that include numbers, letters, special characters, and capital letters. For local PSM users, require the use of strong passwords (set AAA > Settings > Minimal password strength to strong). For details, see Procedure 5.2, Setting password policies for local users.

  • When exporting the configuration of PSM, or creating configuration backups, always use encryption. Handle the exported data with care, as it contains sensitive information, including credentials. For details on encrypting the configuration, see Procedure 4.7.6, Encrypting configuration backups with GPG.

  • Use every keypair or certificate only for one purpose. Do not reuse cryptographic keys or certificates, for example, do not use the certificate of the PSM webserver to encrypt audit trails, or do not use the same keypair for signing and encrypting data.

  • Do not use the CBC block cipher mode, or the diffie-hellman-group1-sha1 key exchange algorithm. For details, see Section 11.6, Supported encryption algorithms.

  • Always encrypt your audit trails to protect sensitive data. For details, see Procedure 7.10.1, Encrypting audit trails.

Connection policies

  • When configuring connection policies, always limit the source of the connection to the client network that requires access to the connection.

  • Always use gateway authentication to authenticate clients. Do not trust the source IP address of a connection, or the result of server authentication.

  • To prevent Denial of Service (DoS) attacks against PSM, set the Connection rate limit option of your connection policies. For details, see Procedure 7.1, Configuring connections.

  • Configure your RDP connection policies to use strong encryption. To enable SSL-encryption for the RDP protocol, select the Enable RDP 5 option, and either select the Enable Network Level Authentication option, or set a Signing CA in your RDP connection policies. For details, see Procedure 10.4, Using SSL-encrypted RDP connections.

  • In RDP connections, if the client uses the Windows login screen to authenticate on the server, the password of the client is visible in the audit trail. To avoid displaying the password when replaying the audit trail, you are recommended to encrypt the upstream traffic in the audit trail using a separate certificate from the downstream traffic. For details, see Procedure 7.10.1, Encrypting audit trails.

  • Ensure that host key verification is enabled in SSH connection policies. That is, the Server side hostkey settings > Allow plain host keys and Server side hostkey settings > Allow X.509 host certificates options do not have the No check required option selected. For details, see Procedure 11.1, Setting the SSH host keys and certificates of the connection.

Appliance access

  • Accessing the PSM host directly using SSH is not recommended or supported, except for troubleshooting purposes. In such case, the Balabit Support Team will give you exact instructions on what to do to solve the problem.

    For security reasons, disable SSH access to PSM when it is not needed. For details, see Procedure 6.5.2, Enabling SSH access to the PSM host.

  • Permit administrative access to PSM only from trusted networks. If possible, monitored connections and administrative access to the PSM web interface should originate from separate networks.

  • Configure PSM to send an alert if a user fails to login to PSM. For details, see the Login failed alert in Section 4.6.4, System related traps.

  • Configure Disk space fill up prevention, and configure PSM to send an alert if the free space on the disks of PSM is low. For details, see Procedure 4.6.3, Preventing disk space fill up.

Networking considerations

  • PSM stores sensitive data. Use a firewall and other appropriate controls to ensure that unauthorized connections cannot access it.

  • If possible, enable management access to PSM only from trusted networks.

  • Make sure that the HA interface of PSM is connected to a trusted network.