Solution Steps in Detail
Note - (Add Snaps Of steps wherever applicable)
Redis Server Unprotected by Password Authentication
Issue : Redis was exposed to everyone and so it can share all the details.
Solution: To restrict access. We have removed redis access from the host machine as well as localhost. Port will only be accessible through containers only.
Action : Removed port from 4_redis.yml file.
Apache mod_status /server-status Information Disclosure
Issue: By exposing server-status it exposesA remote unauthenticated attacker can obtain an overview of the remote Apache web server's activity and performance by requesting the URL '/server-status'. This overview includes information such as current hosts and requests being processed, the number of workers idle and service requests, and CPU utilization.
Solution: Remove the server-status from mod-status.conf file of apache2.
Action : Perform below steps
- login to vuinterface-1
vsmaps login vuinterface-1
- open file /etc/apache2/mods-enabled/status.conf and comment below line.
- then save it and restart vuinterface container
Elasticsearch Unrestricted Access Information Disclosure
Issue: The Elasticsearch application running on the remote web server is affected by an information disclosure vulnerability due to a failure to restrict resources via authentication. An unauthenticated, remote attacker can exploit this to disclose sensitive information from the database.
Solution : Block all the unauthenticated and remote access. To do this we have blocked all the remote access. It will be accessible only through localhost and container.
Action : Run below line on all the servers where elasticsearch is running.
