Web Server. Sophos v16.5
广告
广告
Sophos XG Firewall | Protect | 507
Specify the email sender name. Digest email will be sent with this name.
Send Test Email
Click this and provide an email address to which the message is to be sent for Email Address verification.
Reference User Portal IP
Select Interface/Port IP from the ‘Reference User Portal IP’ dropdown list.
The User Portal link in the digest mail will point to this IP Address. The user can click the link to access his quarantined messages and take the required action. Users who do not come under the specified Interface will have to access the quarantine email directly from their MyAccount.
Change User's Quarantine Digest Settings
Click to change the digest settings of the individual users.
This allows you to select the group and update the Quarantine Digest Setting of group members.
Overriding Quarantine Digest Settings for a Specific User(s)
Click Change User’s Quarantine Digest Settings to change the digest settings for individual users. This opens a new pop-up window named Manage Quarantine Digest, which allows you to search groups and users.
You can individually search for user and user groups.
Select the checkbox against a user to enable the Quarantine Digest. If it is enabled, the configured Quarantine Digest
Settings are applicable for the user.
Figure 477: Quarantine Digest
Web Server
Web Server Protection provides facilities to manage and add web servers, define protection policies for them and set up certificates.
The following pages are accessible:
•
on page 508: allows you to manage, add and delete settings of web servers connected to your
device.
Sophos XG Firewall | Protect | 508
•
on page 509: let you define methods to protect your web servers against malicious attacks.
•
on page 513: helps to set up authentication policies for direct access to Sophos
Firewall.
•
on page 516: sets up customized HTML login forms.
•
on page 84: manages certificates for authentication.
•
on page 87: manages certificate authorities which issue certificates.
•
on page 88: gives an overview of revoked certificates.
Web Servers
The Web Servers menu allows you to add web servers that are to be protected by the WAF.
This page displays all existing web servers. For each web server, the list shows:
Name
Name of the web server.
Host
Host name of the web server.
Type
Type of communication between Sophos XG Firewall and the web server.
Add Web Server
This page describes how to add a web server.
1. Go to Protect > Web Server > Web Servers and click Add.
2. Enter the following:
Name
Enter a unique name for the web server.
Description
Enter a description for the web server.
Host
Add or select a host, which can either be of the type IP Address or FQDN Host.
on page 64
on page 67
Note: FQDN Host is recommended here because hosts listed with their IP address transmit empty host headers which may lead to problems with some browsers.
Type
Select a server type, that is, whether you want the communication between Sophos XG Firewall and the web server to be encrypted (HTTPS) or plaintext (HTTP).
• Encrypted (HTTPS) - Browser-based access to the web server via HTTPS.
• Plaintext (HTTP) - Browser-based access to the web server via HTTP.
Default: Plaintext (HTTP)
Port
Enter a port number for the web server. By default the standard port of the selected web server type is selected.
Keep alive
Click the toggle switch Keep alive to keep the connection between Sophos XG Firewall and the web server open instead of opening a new connection for every single request.
Note: In some cases the web server does not support keep alive properly. This may cause reading errors or timeouts. In this case, keep alive should be disabled for the affected web server.
Sophos XG Firewall | Protect | 509
Timeout (available only if Keep alive is selected)
Enter a timeout for the Keep alive option.
Acceptable range: 1 to 65535 seconds
Default: 300 seconds
Disable backend connection pooling
Click the toggle switch Disable backend connection pooling to create a new connection to the backend server every time it is used, instead of reusing an old connection from the connection pool.
This option is disabled by default. Only use it only if you face connection problems because this may decrease system performance.
Figure 478: Add Webserver
3. Click Save.
Protection Policies
The Protection Policies menu allows you to define the modes and levels of protection for your web servers.
This page displays all existing web application protection objects. For each protection object, the list shows:
Name
Name of the protection policy.
Add Protection Policy
This page describes how to add an application protection policy.
1. Go to Protect > Web Server > Protection Policies and click Add.
2. Specify the following:
Name
Enter a unique name for the protection policy.
Description
Enter a description for the policy.
Pass Outlook Anywhere
Enable this to allow external Microsoft Outlook clients to access the Microsoft Exchange Server via theWeb Application Protection. Microsoft Outlook traffic will not be checked or protected by the
Web Application Protection.
Sophos XG Firewall | Protect | 510
Mode
Select a mode from the drop-down list:
• Monitor: HTTP requests are monitored and logged.
• Reject: HTTP requests are rejected.
Cookie Signing
Enable this to protect a web server against manipulated cookies. When the web server sets a cookie, a second cookie is added to the first cookie containing a hash built of the primary cookie's name, its value and a secret, where the secret is only known by the Web Application Protection. Thus, if a request cannot provide a correct cookie pair, there has been some sort of manipulation and the cookie will be dropped.
Static URL Hardening
Enable this to protect against URL rewriting. For that, when a client requests a website, all static
URLs of the website are signed. The signing uses a similar procedure as with cookie signing.
Additionally the response from the web server is analyzed regarding what links can be validly requested next. Moreover, static hardened URLs can furthermore be bookmarked and visited later.
Note: Static URL hardening affects all files with a HTTP content type of text/* or *xml*, where * is a wildcard. Make sure that other file types, e.g. binary files, have the correct HTTP content type, otherwise they may get corrupted by the URL hardening feature. It does not work for dynamic URLs created by client, for example:
JavaScript.
Note: You can find more information about Static URL Hardening and Form
Additional Information on Static URL Hardening and Form
on page 513
Entry URLs (only applicable if Static URL Hardening is enabled)
Specify a URL for static URL hardening:
Form Hardening
Enable this to protect against web form rewriting. Form hardening saves the original structure of a web form and signs it. Therefore, if the structure of a form has changed when it is submitted the
Web Application Protection rejects the request.
Note: Form hardening affects all files with a HTTP content type of text/* or *xml*, where * is a wildcard. Make sure that other file types, e.g. binary files, have the correct HTTP content type, otherwise they may get corrupted by the form hardening feature.
Note: You can find more information about static URL hardening and form hardening under:
Additional Information on Static URL Hardening and Form
on page 513
Anti-Virus
Enable this to protect a web server against viruses.
Mode
Select a mode from the available options.
• Avira
• Sophos
• Dual Scan
Direction
Select from the drop-down list whether to scan only uploads or downloads or both.
• Uploads
• Downloads
Sophos XG Firewall | Protect | 511
• Uploads and Downloads
Block unscannable content
Enable this to block files that cannot be scanned. The reason for that may be, among other things, that files are encrypted or corrupt.
Limit scan size
Enable this to enter the scan size limit into an additional field. Provide the limitation in megabytes.
Note: Please note that the scan size limit refers to the entire upload volume, not to a single file. If, for example, you limit the scan size to 50 MB and make an upload containing multiple files (45 MB, 5 MB and 10 MB), the last file will not be scanned.
Thus a virus being in the last file would not be detected due to the limitation.
Note: If you do not specify a limitation value at all, the limit scan size will be saved with '0' megabytes, which means the limitation is not active and every uploaded/ downloaded file will be scanned.
Block clients with bad reputation
Enable this to block clients which have a bad reputation according to their classification, based on
GeoIPClosed and RBLClosed information. Sophos uses the following classification providers: RBL sources:
• Commtouch IP Reputation (ctipd.org)
• http.dnsbl.sorbs.net
The GeoIP source is Maxmind. The WAF blocks clients that belong to one of the following
Maxmind categories:
• A1: Anonymous proxies or VPN services used by clients to hide their IP address or their original geographical location.
• A2: Satellite providers are ISPs that use satellites to provide Internet access to users all over the world, often from high risk countries.
Skip remote lookups for clients with bad reputation (only applicable if Block clients with bad reputation is enabled)
Enable to use GeoIP-based classification which uses cached information only and is therefore much faster. As reputation lookups include sending requests to remote classification providers, using reputation-based blocking may slow down your system.
Common Threat Filter
Enable this to protect your web servers from several threats. You can specify the threat filter categories you want to use in the Threat Filter Categories section below. All requests will be checked against the rule sets of the selected categories. Depending on the results, a notice or a warning will be shown in the live log or the request will be blocked directly.
Rigid Filtering
Enable this to tighten several of the selected rules. This may lead to false positives.
Skip Filter Rules
Some of the selected threat categories may contain rules that lead to false positives. To avoid false positives induced by a specific rule, add the rule number that you want to skip in this field.
Protocol Violations
Enforces adherence to the RFC standard specification of the HTTP protocol. Violating these standards usually indicates malicious intent.
Protocol Anomalies
Searches for common usage patterns. Lack of such patterns often indicates malicious requests.
These patterns include, among other things, HTTP headers like 'Host' and 'User-Agent'.
Request Limits
Sophos XG Firewall | Protect | 512
Enforces reasonable limits on the amount and ranges of request arguments. Overloading request arguments is a typical attack vector.
HTTP Policy
Narrows down the allowed usage of the HTTP protocol. Web browsers typically use only a limited subset of all possible HTTP options. Disallowing the rarely-used options protects against attackers aiming at these often less well-supported options.
Bad Robots
Checks for usage patterns characteristic of bots and crawlers. By denying them access, possible vulnerabilities on your web servers are less likely to be discovered.
Generic Attacks
Searches for attempted command executions common to most attacks. After having breached a webserver, an attacker usually tries to execute commands on the server like expanding privileges or manipulating data stores. By searching for these post-breach execution attempts, attacks can be detected that might otherwise have gone unnoticed, for example because they targeted a vulnerable service by the means of legitimate access.
SQL Injection Attacks
Checks for embedded SQL commands and escape characters in request arguments. Most attacks on web servers target input fields that can be used to direct embedded SQL commands to the database.
XSS Attacks
Checks for embedded script tags and code in request arguments. Typical cross-site scripting attacks aim at injecting script code into input fields on a target web server, often in a legitimate way.
Tight Security
Performs tight security checks on requests, like checking for prohibited path traversal attempts.
Trojans
Checks for usage patterns characteristic of trojans, thus searching for requests indicating trojan activity. It does not, however, prevent the installation of such trojans as this is covered by the antivirus scanners.
Outbound
Prevents web servers from leaking information to the client. This includes, among other things, error messages sent by servers which attackers can use to gather sensitive information or detect specific vulnerabilities.
Sophos XG Firewall | Protect | 513
Figure 479: Add Application Protection Policy
3. Click Save.
Additional Information on Static URL Hardening and Form Hardening
It is best practice always to enable both static URL hardening and form hardening. These two functions are complementary, especially in the way that they prevent the issues you may have if you enable just one of them:
• Only form hardening is activated: When a webpage contains hyperlinks with appended queries (which is the case with certain CMSs), e.g. http://example.com/?view=article&id=1, such page requests are blocked by form hardening because it expects a signature, which is missing.
• Only static URL hardening is activated: When a web browser appends form data to the action URL of the form tag of a web form (which is the case with GET requests), the form data becomes part of the request URL sent to the web server, thereby rendering the URL signature invalid.
Activating both functions helps to solve the problem s those issues because if either form hardening or static URL hardening consider a request to be valid, the Web Application Protection accepts the request.
Authentication Policies
The Authentication Policies menu allows you to configure policies for direct authentication.
You can use the Web Application Firewall (WAF) to authenticate users immediately instead of leaving the authentication to the web servers. Via authentication profiles, the reverse authentication can be used to assign specific authentication settings to each site path route.
Note: You can also view and manage the WAF status on the System > Hosts and Services > Services page.
This page displays all existing web application authentication profiles. For each authentication policy, the list shows:
Name
Name of the authentication policy.
Add Authentication Policy
This page describes how to add a web app authentication policy.
Sophos XG Firewall | Protect | 514
1. Go to Protect > Web Server > Authentication Policies and click Add.
2. Enter a unique Name for the authentication profile.
3. Enter a Description for the authentication policy.
4. Specify the Client Authentication details.
Mode
Select how the users should authenticate at the Web Application Firewall.
• Basic: Users authenticate with HTTP basic authentication, entering username and password. In this mode, no session cookies will be generated and a dedicated logout is not possible.
Note: As the credentials are sent unencrypted in this mode we strongly recommend that you use this mode over HTTPS.
• Form: Users will be presented with a form where they have to enter their credentials. In this mode, session cookies will be generated and a dedicated logout is possible. The form template to be used can be selected in the Web App Auth Template list. Besides the default form template,
the list shows the forms that have been defined on the
page
Basic Prompt (only available if Basic mode is selected)
The realm is a unique string that provides additional information on the login page and is used for user orientation.
Note: These characters are allowed for the Basic Prompt: A-Z a-z 0-9 , ; . : - _ ' + = )
( & % $ ! ^ < > | @
Web App Auth Template (only available if Form mode is selected)
Select the form template that will be presented to the users for authentication. Form templates are defined on the
Users or Groups
Select the users or user groups that should be assigned to this web app authentication profile or create a new one. After assigning this profile to a site path route, these users will have access to the site path with the authentication settings defined in this profile. Typically, this would be a backend user group.
You can create a new user directly from this page or from the Configure > Authentication > Users page.
You can create a new group directly from this page or from the Configure > Authentication >
Groups page.
Note: Sometimes users should be required to use the user principal name notation
'user@domain' when entering their credentials, for example when using Exchange servers in combination with Active Directory servers.
5. Specify the Authentication Forwarding details.
Mode
Select how the Web Application Firewall authenticates against the web servers. The mode has to match the web servers' authentication settings.
• Basic: Authentication works with HTTP basic authentication, providing username and password.
• None: There is no authentication between WAF and the web servers. Note that even if your web servers do not support authentication, users will be authenticated via the frontend mode.
Username affix (only available if authentication forwarding mode Basic is selected)
Select the type of affix for the username and specify a value for it. Affixes are useful when working with domains and email addresses.
Sophos XG Firewall | Protect | 515
• None
• Prefix
• Suffix
• Prefix & Suffix
Note: Prefix and suffix will be added automatically if the user only enters his username. Prefix and suffix will not be added if the user enters them. Example: If the suffix is @testdomain.de and the user only enters the username test.user the suffix
@testdomain.de will be added. If the user enters [email protected] the suffix will be ignored.
Remove Basic Header (only available if authentication forwarding mode None is selected)
Enable this if you do not want to send the basic header from Sophos XG Firewall to the web server.
6. Specify the User Session details (only available if client authentication mode Form is selected).
Session Timeout
Enable to set a timeout for the user session, which will confirm the user's credentials by requiring the user to log in again if he does not perform any action.
Default: ON
Limit to (only available if Session Timeout is selected)
Set an interval for the session timeout.
Default: 5 minutes.
Session Lifetime
Enable to limit the time users may remain logged in, regardless of the activity in the meantime.
Default: ON
Limit to (only available if Session Lifetime is selected)
Set a value for the session lifetime.
Default: 8 hours.
Sophos XG Firewall | Protect | 516
Figure 480: Add Web App Authentication Policy
7. Click Save.
Authentication Templates
The Authentication Templates menu allows you to upload HTML forms for reverse authentication.
A web application authentication template can be assigned to an authentication profile with frontend mode Form. The respective form will be presented when a user tries to access a site path to which the authentication profile is assigned.
This page displays all existing web application authentication templates. For each template, the list shows:
Name
Name of the template.
Template
Filename of the template.
Add Authentication Template
This page describes how to add a web application authentication template.
1. Go to Protect > Web Server > Authentication Templates and click Add.
2. Specify the following:
Name
Enter a unique name for the template.
Description
Enter a description for the template.
HTML template
Select an HTML template.
Images/Stylesheet
Select images, stylesheets, or JavaScript files that are used by the selected template.
3. Click Upload.
Sophos XG Firewall | Protect | 517
Figure 481: Add Web App Auth Template
4. Click Save.
SlowHTTP Protection
This page describes how to activate SlowHTTP protection and define the keys used for cookie signing and URL hardening.
The SlowHTTP Protection page helps to protect against Slow HTTP attacks by setting a timeout for request headers.
For more information, see
Sophos Knowledge Base
.
1. Go to Protect > Web Server > SlowHTTP Protection.
2. Specify the SlowHTTP Protection Settings:
Timeout for request headers
Click the toggle switch to activate SlowHTTP Protection.
Soft limit
Enter the minimum amount of time to receive a request header.
Default: 10 seconds
Note: The hard limit needs to be greater than the soft limit.
Hard limit
Enter the maximum amount of time to receive the request header.
Default: 30 seconds
Extension rate
Enter the amount of data volume which extends the timeout.
With the extension rate, you can increase the minimal timeout according to the data volume. For example, the soft limit allows at least 10 seconds to receive request headers, the extension rate is
500, and the hard limit is set to 30. If the client now sends data, the soft limit timeout increases 1 second for every 500 bytes received. After 30 seconds the client will be disconnected.
Default: 5000 Bytes
Skipped Networks/Hosts
Select or add networks/hosts that should not be affected by SlowHTTP Protection.
文档公共链接
广告
