ARCHIVED - University of Auckland specific security notes

Responsibility for cybersecurity on the Nectar infrastructure at the University of Auckland is a partnership between you and the University.
To reduce cybersecurity risk, and to protect the University and you from data breaches and reputational harm, we are periodically scanning all virtual machines (VMs) with public IP addresses for known vulnerabilities.

Vulnerability detection

The University uses the services of tenable.io.

Vulnerability classification

Tenable classifies your vulnerabilities on the Common Vulnerability Scoring System (*) indicating the severity of, or risk associated with, a vulnerability, and its score. These ratings and scores are (**):

• Low (0 - 3.9)
• Medium (4 - 6.9)
• High (7 - 9.9)
• Critical (10)

Vulnerability notification

If vulnerabilities of level High and Critical risk are detected on one of your virtual machines, a ticket detailing the issues is created in the Nectar help desk, and everybody associated with the project the VM belongs to will be notified.

Remedial action

We ask that you attend to whatever remedial action is needed. The urgency depends on the detected severity. If detected vulnerabilities of an instance are not addressed in time, we may lock the VM and limit access to it. In any event, we will be in touch and support you in addressing the issues.

Expected time-lines to address your vulnerabilities:

Expectation

The general expectation is that your VMs are kept up-to-date with any security-related software updates, and any vulnerabilities detected by our scans are fixed. This will help keep your VMs and data safe as possible.

The remainder of this document provides you with information that will help you address detected known vulnerabilities. If you are unsure what to do, please reply to the email that informed you about the existing vulnerabilities, or get in touch via email with nectarsupport@auckland.ac.nz.

Recipes and practices to address (and avoid) known vulnerabilities

1. Do not use an OS version beyond its end of life

Every OS version is supported only for a limited period of time. When this time runs out,

• all security support for your OS distribution version stops
• no more security updates are provided
• you need to upgrade the OS to a supported version, or replace the VM entirely with a new VM using a supported OS version.

Determine your current OS version with the following command:

$ cat /etc/os-release

Find the date when security support stops for your OS in the table below, or here: https://endoflife.date/

If your VM OS version has reached end-of-life, upgrade to a supported version immediately, or set up a new VM with an up-to-date OS.

sudo apt update
sudo apt upgrade
sudo do-release-upgrade

sudo apt update
sudo apt upgrade
sudo apt full-upgrade

2. Maintain your current OS version

The process of installing latest updates in an operating system (OS) is sometimes called patching. Every OS provides fairly straight-forward tooling to apply latest updates. In addition to manual patching most OS also provide mechanisms to apply updates in an automated and scheduled way. This is called auto-patching, or automatic updates. These updates

• address new security vulnerabilities
• integrate new features
• address identified bugs/flaws
• improve Operating System/software stability
• install new drivers

Linux

We recommend you apply security patches regularly, and upgrade your OS regularly.

See here for details, and check if your instance is configured with auto-patching from the Nectar dashboard as follows:

• Click the link for the "Image Name" value under Metadata.
• Inspect the "automatic updates" field under Custom Properties. If "security" is listed there, automatic security updates are applied to your VM.

If you use older images you need to either regularly patch your OS manually, or configure auto-patching.

sudo apt-get update
sudo apt-get dist-upgrade

sudo apt-get update
sudo apt-get upgrade

sudo dnf upgrade

Windows 2012 Server R2

We recommend to enable automatic updates on Windows 2012 Server VMs (on later versions of the image automatic updates are already configured). Use the following steps to configure automatic updates:

1. Connect to the Windows server
2. Click on the Windows icon in the lower-left corner
3. Click Control Panel > System and Security. The Choose your Windows Update settings page appears
4. Under the Windows Update section, click Turn automatic updating on or off
5. Select Install updates automatically (recommended) from the drop-down menu
6. If you also want to automatically install recommended updates, select the check box under Recommended Updates (optional)
7. If you want to install updates for other Microsoft® products at the same time that the Windows updates are installed, select the check box under Microsoft Update (optional)
8. When you are finished making selections, click OK in the lower portion of the window

3. Set up HTTPS for web servers

Protecting your web servers with HTTPS provides important security and data integrity capabilities for your website and your website user's information. Even if your site does not handle sensitive information, HTTPS is quickly becoming a requirement for features in the latest web browsers.

Setting up HTTPS can be intimidating - it takes many steps, requires specific knowledge of encryption and server configuration, and it sounds complicated in general.
There is tooling that can help with it, but even with this, the task is not a straight-forward one for the inexperienced user. In principle, the steps involved in setting up HTTPS are:

• generate an SSL certificate (and associated private key)
• configure the SSL certificate and the associated private key in your web server

The Nectar application catalogue offers solutions that handle HTTPS setup for you behind the scenes so you don't have to deal with it. This may be a good choice for you. In other cases you may want to (or have to) configure the server yourself.

The following examples cover options for setting up HTTPS for at least some common use-cases.

Jupyter Notebook Server

By default a Jupyter notebook server runs without HTTPS.

The easiest way to launch a Jupyter notebook server protected by HTTPS is probably by launching it from the Nectar application catalogue. Documentation about this application and how to launch it can be found here.
Note: HTTPS will only be set up and configured for your Jupyter notebook server if you choose a DNS zone in the dialogue to create the application. 

If you want to use this application, but want to configure your Notebook server with HTTPS yourself, you can follow this guide.

RStudio Server

The easiest way to launch an RStudio Server instance protected by HTTPS is probably by launching it from the Nectar application catalogue. Documentation about this application and how to launch it can be found here. This application will set up HTTPS as part of the launch process.

LAMP - Linux + Apache HTTP server + MySQL + PHP

The easiest way to launch a LAMP stack protected by HTTPS might be by launching it from the Nectar application catalogue. Documentation about this application and how to launch it can be found here. This application will set up HTTPS as part of the launch process.

Apache HTTP server

There is not yet a Nectar application for launching a plain Apache HTTP server with HTTPS support (the existing application doesn't include the HTTPS setup). But this guide explains how to set up HTTPS for the Apache HTTP server.