QPR ProcessAnalyzer Security Hardening: Difference between revisions

From QPR ProcessAnalyzer Wiki
Jump to navigation Jump to search
 
(38 intermediate revisions by the same user not shown)
Line 1: Line 1:
The following list provides recommendations for improving (hardening) the security of QPR ProcessAnalyzer installation.
This article provides recommendations for improving (hardening) the security of QPR ProcessAnalyzer Server installation. In addition to the server hardening, there are also hardening instructions for [[QPR_ProcessAnalyzer_ScriptLauncher#Hardening_ScriptLauncher_Security|QPR ScriptLauncher]] installations.
 
== Disable SSL, TLS 1.0 and TLS 1.1 ==
Transport Layer Security (TLS) is used to encrypt connections with clients, such as web browsers. SSL 2.0, SSL 3.0, TLS 1.0 and TLS 1.1 are no longer adequately secure, so it's recommended to only allow clients to connect with TLS 1.2 or TLS 1.3 (preferred). However, some client devices might not support TLS 1.2, so you might need to keep TLS 1.0 and/or TLS 1.1 enabled.
 
Here is a Powershell script to disable TLS 1.0 and TLS 1.1 and enable TLS 1.2:
 
<pre>
New-Item -Path "HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client\" -Force
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client\" -Name Enabled -Type Dword -Value 0
New-Item -Path "HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server\" -Force
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server\" -Name Enabled -Type Dword -Value 0
New-Item -Path "HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client\" -Force
 
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client\" -Name DisabledByDefault -Type Dword -Value 1
New-Item -Path "HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server\" -Force
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server\" -Name DisabledByDefault -Type Dword -Value 1
 
New-Item -Path "HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client\" -Force
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client\" -Name DisabledByDefault -Type Dword -Value 0
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client\" -Name Enabled -Type Dword -Value 1
New-Item -Path "HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server\" -Force
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server\" -Name DisabledByDefault -Type Dword -Value 0
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server\" -Name Enabled -Type Dword -Value 1
</pre>
 
More information: https://support.microsoft.com/en-us/help/187498/how-to-disable-pct-1-0-ssl-2-0-ssl-3-0-or-tls-1-0-in-internet-informat
 
== Disable Weak Ciphers ==
Use only cipher suites that are considered secure. The up-to-date information regarding security of specific ciphers can be checked here: https://ciphersuite.info/ (use only the ciphers that are classified as ''recommended'' or ''secure''). The up-to-date list of the recommended ciphers (maintained by Mozilla) are also available as json format: https://ssl-config.mozilla.org/guidelines/5.6.json (use only the ciphers in the ''modern'' and ''intermediate'' sections).
 
PowerShell commands to manage ciphers:
* Get list of all allowed ciphers in computer: https://docs.microsoft.com/en-us/powershell/module/tls/get-tlsciphersuite
* Disable ciphers: https://docs.microsoft.com/en-us/powershell/module/tls/disable-tlsciphersuite
* Enable ciphers: https://docs.microsoft.com/en-us/powershell/module/tls/enable-tlsciphersuite
 
More information about how to configure ciphers on Windows systems: https://support.microsoft.com/en-us/help/245030/how-to-restrict-the-use-of-certain-cryptographic-algorithms-and-protoc


== Database User Least Privileges ==
== Database User Least Privileges ==
Line 28: Line 64:
* user defined role created earlier
* user defined role created earlier


== Disable SSL, TLS 1.0 and TLS 1.1, and Enable TLS 1.2 ==
==Disable 8.3 File Name Creation==
Transport Layer Security (TLS) is used to encrypt connections with clients, such as web browsers. SSL 2.0, SSL 3.0, TLS 1.0 and TLS 1.1 are no longer adequately secure, so we recommend to only allow clients to connect with TLS 1.2. However, some client devices might not support TLS 1.2, so you might need to keep TLS 1.0 and/or TLS 1.1 enabled.
In order to disable short names creation, add a registry key named '''NtfsDisable8dot3NameCreation''' to '''HKLM\SYSTEM\CurrentControlSet\Control\FileSystem''' and set its value to '''1'''. Note that in the computer, there may be other applications that require 8.3 file names and thus may stop working.
 
Here is a Powershell script to disable TLS 1.0 and TLS 1.1 and enable TLS 1.2:


Example Powershell script to disable 8.3 file name creation:
<pre>
<pre>
#Disable TLS 1.0 and TLS 1.1
Set-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Control\FileSystem -Name NtfsDisable8dot3NameCreation -Value 1
New-Item -Path "HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client\" -Force
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client\" -Name Enabled -Type Dword -Value 0
New-Item -Path "HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server\" -Force
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server\" -Name Enabled -Type Dword -Value 0
New-Item -Path "HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client\" -Force
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client\" -Name DisabledByDefault -Type Dword -Value 1
New-Item -Path "HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server\" -Force
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server\" -Name DisabledByDefault -Type Dword -Value 1
 
#Enable TLS 1.2
New-Item -Path "HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client\" -Force
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client\" -Name DisabledByDefault -Type Dword -Value 0
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client\" -Name Enabled -Type Dword -Value 1
New-Item -Path "HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server\" -Force
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server\" -Name DisabledByDefault -Type Dword -Value 0
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server\" -Name Enabled -Type Dword -Value 1
</pre>
</pre>


More information: https://support.microsoft.com/en-us/help/187498/how-to-disable-pct-1-0-ssl-2-0-ssl-3-0-or-tls-1-0-in-internet-informat
More information: https://support.microsoft.com/en-us/help/121007/how-to-disable-8-3-file-name-creation-on-ntfs-partitions


== Disable Weak Ciphers ==
==White-list allowed source IP addresses==
The Triple-DES cipher is no longer adequate to encrypt sessions on the internet. Specifically, running Triple-DES ciphers leaves the server vulnerable to information disclosure and denial of service attacks. You can learn more at the National Vulnerability Database webpage for [https://nvd.nist.gov/vuln/detail/CVE-2016-2183 CVE-2016-2183].
Security can be improved by restricting (white-listing) from which source IP addresses connections to the QPR ProcessAnalyzer UI and API can be established. This restriction is typically set in the firewall which can be part of the network infrastructure or it can be in the server machine. If taking this method into use, considered the effort to maintain the up-to-date list of allowed IP addresses versus the gained benefit of the restriction.


Here is a Powershell script to disable Triple-DES cipher:
==HTTP Response Headers==
<pre>
This chapter contains information about security related HTTP response headers that are added or removed in QPR ProcessAnalyzer. Thus, no actions are required regarding these HTTP response headers.
New-Item -path "HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\Triple DES 168" -Force
Set-ItemProperty  -path "HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\Triple DES 168" -Name Enabled -Type Dword -Value 0
</pre>


More information: https://support.microsoft.com/en-us/help/245030/how-to-restrict-the-use-of-certain-cryptographic-algorithms-and-protoc
=== Added HTTP Headers ===
 
Following security related HTTP headers are set:
== Add Security Related HTTP Headers in IIS ==
 
The HTTP Strict-Transport-Security response header (often abbreviated as HSTS) lets a web site tell browsers that it should only be accessed using HTTPS, instead of using HTTP. The HTTP Content-Security-Policy response header allows web site administrators to control resources the user agent is allowed to load for a given page.
 
# In '''Internet Information Services (IIS) Console''', click the top level in the left side hierarchy, double-click '''HTTP Response Headers''', click '''Add...''' on the right side pane, and define the following:
# Content-Security-Policy
# Content-Security-Policy
#* Name: '''Content-Security-Policy'''
#* Name: '''Content-Security-Policy'''
#* Value: '''default-src 'none';script-src 'self' 'unsafe-eval';style-src 'self' 'unsafe-inline';img-src 'self' data:;connect-src 'self';font-src 'self' data:;manifest-src 'self';child-src 'self' <nowiki>https://devnet.onqpr.com/</nowiki>;'''
#* Value: '''default-src 'none';script-src 'self' 'unsafe-eval';style-src 'self' 'unsafe-inline';img-src 'self' data: blob:;connect-src 'self';font-src 'self' data:;manifest-src 'self';child-src 'self';frame-src *;'''
# Strict-Transport-Security
# Strict-Transport-Security (Note: HTTPS is required)
#* Name: '''Strict-Transport-Security'''
#* Name: '''Strict-Transport-Security'''
#* Value: '''max-age=31536000; includeSubDomains'''
#* Value: '''max-age=31536000; includeSubDomains'''
# X-Frame-Options:
# X-Frame-Options:
#* Name: '''X-Frame-Options'''
#* Name: '''X-Frame-Options'''
#* Value: '''deny'''
#* Value: '''sameorigin'''
# X-Content-Type-Options:
# X-Content-Type-Options:
#* Name: '''X-Content-Type-Options'''
#* Name: '''X-Content-Type-Options'''
#* Value: '''nosniff'''
#* Value: '''nosniff'''
Here is a Powershell script to add the HTTP headers:
<pre>
Add-WebConfigurationProperty -pspath "MACHINE/WEBROOT/APPHOST/Default Web Site/" -filter "system.webServer/httpProtocol/customHeaders" -name "." -value @{name="Content-Security-Policy";value="default-src 'none';script-src 'self' 'unsafe-eval';style-src 'self' 'unsafe-inline';img-src 'self' data:;connect-src 'self';font-src 'self' data:;manifest-src 'self';child-src 'self' https://devnet.onqpr.com/;"}
Add-WebConfigurationProperty -pspath "MACHINE/WEBROOT/APPHOST/Default Web Site/" -filter "system.webServer/httpProtocol/customHeaders" -name "." -value @{name="Strict-Transport-Security";value="max-age=31536000; includeSubDomains"}
Add-WebConfigurationProperty -pspath "MACHINE/WEBROOT/APPHOST/Default Web Site/" -filter "system.webServer/httpProtocol/customHeaders" -name "." -value @{name="X-XSS-Protection";value="1; mode=block"}
Add-WebConfigurationProperty -pspath "MACHINE/WEBROOT/APPHOST/Default Web Site/" -filter "system.webServer/httpProtocol/customHeaders" -name "." -value @{name="X-Frame-Options";value="deny"}
Add-WebConfigurationProperty -pspath "MACHINE/WEBROOT/APPHOST/Default Web Site/" -filter "system.webServer/httpProtocol/customHeaders" -name "." -value @{name="X-Content-Type-Options";value="nosniff"}
</pre>


More information:
More information:
* https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
* https://content-security-policy.com/
* https://content-security-policy.com/
* https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
* https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
* https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection
* https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
* https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
* https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
* https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options


== Remove X-Powered-By HTTP Header in IIS ==
=== Removed HTTP Headers ===
Removing the X-Powered-By HTTP response header improved security, because the underlying technology is not revealed publicly. This step applies only when IIS is used as a [[Setting up IIS as Reverse Proxy for QPR UI|reverse proxy for QPR UI]].
By default, IIS returns the '''X-Powered-By''' HTTP response header that has been removed in QPR ProcessAnalyzer. More information: https://blogs.msdn.microsoft.com/varunm/2013/04/23/remove-unwanted-http-response-headers/
# In '''Internet Information Services (IIS) Console''', click the top level in the left side hierarchy:
# Double-click '''HTTP Response Headers'''
# Click on the '''X-Powered-By''' header
# Click '''Remove''' on the right side pane to remove it from the response.


Here is a Powershell script to remove X-Powered-By HTTP Response Header:
By default, IIS 10.0 returns '''Server''' header in http response that has been removed in QPR ProcessAnalyzer. More information: https://www.saotn.org/remove-iis-server-version-http-response-header/#removeserverheader-requestfiltering-in-iis-10-0
<pre>
Remove-WebConfigurationProperty -pspath "MACHINE/WEBROOT/APPHOST/Default Web Site/" -filter "system.webServer/httpProtocol/customHeaders" -name "." -AtElement @{name="X-Powered-By"}
</pre>
 
More information: https://blogs.msdn.microsoft.com/varunm/2013/04/23/remove-unwanted-http-response-headers/
 
== Remove Server HTTP Header in IIS ==
 
IIS 10.0 returns ''Server'' header in http response. It can be removed with the following PowerShell command:
<pre>
Set-WebConfigurationProperty -pspath "MACHINE/WEBROOT/APPHOST" -filter "system.webServer/security/requestFiltering" -name "removeServerHeader" -value "True"
</pre>
 
Note that this setting is not applicable to earlier versions than IIS 10.0.
 
More information: https://www.saotn.org/remove-iis-server-version-http-response-header/#removeserverheader-requestfiltering-in-iis-10-0
 
== Remove X-Aspnet-Version HTTP Header in IIS ==
 
Note: Starting from QPR ProcessAnalyzer 2020.8, this setting is already in place.
 
By default there is the X-Aspnet-Version HTTP response header in failed requests revealing the Asp.net version in use. It can be removed by adding attribute '''enableVersionHeader="false"''' into the '''httpRuntime''' element. Example:
<pre>
<httpRuntime maxRequestLength="2147483647" executionTimeout="3600" requestValidationMode="2.0" requestPathInvalidCharacters="" enableVersionHeader="false" />
</pre>
 
== Disable 8.3 File Name Creation==
In order to disable short names creation, add a registry key named '''NtfsDisable8dot3NameCreation''' to '''HKLM\SYSTEM\CurrentControlSet\Control\FileSystem''' and set its value to '''1'''. Note that in the computer, there may be other applications that require 8.3 file names and thus may stop working.
 
Example Powershell script to disable 8.3 file name creation:
<pre>
Set-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Control\FileSystem -Name NtfsDisable8dot3NameCreation -Value 1
</pre>
 
More information: https://support.microsoft.com/en-us/help/121007/how-to-disable-8-3-file-name-creation-on-ntfs-partitions


[[Category: QPR ProcessAnalyzer]]
[[Category: QPR ProcessAnalyzer]]

Latest revision as of 23:08, 27 December 2023

This article provides recommendations for improving (hardening) the security of QPR ProcessAnalyzer Server installation. In addition to the server hardening, there are also hardening instructions for QPR ScriptLauncher installations.

Disable SSL, TLS 1.0 and TLS 1.1

Transport Layer Security (TLS) is used to encrypt connections with clients, such as web browsers. SSL 2.0, SSL 3.0, TLS 1.0 and TLS 1.1 are no longer adequately secure, so it's recommended to only allow clients to connect with TLS 1.2 or TLS 1.3 (preferred). However, some client devices might not support TLS 1.2, so you might need to keep TLS 1.0 and/or TLS 1.1 enabled.

Here is a Powershell script to disable TLS 1.0 and TLS 1.1 and enable TLS 1.2:

New-Item -Path "HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client\" -Force
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client\" -Name Enabled -Type Dword -Value 0
New-Item -Path "HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server\" -Force
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server\" -Name Enabled -Type Dword -Value 0
New-Item -Path "HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client\" -Force

Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client\" -Name DisabledByDefault -Type Dword -Value 1
New-Item -Path "HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server\" -Force
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server\" -Name DisabledByDefault -Type Dword -Value 1

New-Item -Path "HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client\" -Force
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client\" -Name DisabledByDefault -Type Dword -Value 0
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client\" -Name Enabled -Type Dword -Value 1
New-Item -Path "HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server\" -Force
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server\" -Name DisabledByDefault -Type Dword -Value 0
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server\" -Name Enabled -Type Dword -Value 1

More information: https://support.microsoft.com/en-us/help/187498/how-to-disable-pct-1-0-ssl-2-0-ssl-3-0-or-tls-1-0-in-internet-informat

Disable Weak Ciphers

Use only cipher suites that are considered secure. The up-to-date information regarding security of specific ciphers can be checked here: https://ciphersuite.info/ (use only the ciphers that are classified as recommended or secure). The up-to-date list of the recommended ciphers (maintained by Mozilla) are also available as json format: https://ssl-config.mozilla.org/guidelines/5.6.json (use only the ciphers in the modern and intermediate sections).

PowerShell commands to manage ciphers:

More information about how to configure ciphers on Windows systems: https://support.microsoft.com/en-us/help/245030/how-to-restrict-the-use-of-certain-cryptographic-algorithms-and-protoc

Database User Least Privileges

While it's easiest to run QPR ProcessAnalyzer with a database user assigned the db_owner permissions, it's more safe to restrict the database permissions only to needed. The minimum permissions for QPR ProcessAnalyzer are the following:

  • db_datareader fixed database role
  • db_datawriter fixed database role
  • user defined role with the following permissions:
    • VIEW DATABASE STATE
    • EXECUTE on TYPE::PA_TABLETYPE_BigInt
    • EXECUTE on TYPE::PA_TABLETYPE_NVarCharMax
    • ALTER
    • REFERENCES

Configure QPR ProcessAnalyzer to run with minimum permissions as follows:

  1. In the QPR ProcessAnalyzer database, click Security > Roles > Database Roles > Create Database Role....
  2. Give a name to the role (e.g. AdditionalPermissions) and click OK.
  3. To give permissions to the role, run the following commands:
GRANT VIEW DATABASE STATE to AdditionalPermissions
GRANT EXECUTE on TYPE::PA_TABLETYPE_BigInt to AdditionalPermissions
GRANT EXECUTE on TYPE::PA_TABLETYPE_NVarCharMax to AdditionalPermissions
GRANT ALTER to AdditionalPermissions
GRANT REFERENCES to AdditionalPermissions

4. Assign needed roles to the database user by clicking Security > Users and double click the database user. Go to Membership tab and check that following roles are assigned:

  • db_datareader
  • db_datawrite
  • user defined role created earlier

Disable 8.3 File Name Creation

In order to disable short names creation, add a registry key named NtfsDisable8dot3NameCreation to HKLM\SYSTEM\CurrentControlSet\Control\FileSystem and set its value to 1. Note that in the computer, there may be other applications that require 8.3 file names and thus may stop working.

Example Powershell script to disable 8.3 file name creation:

Set-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Control\FileSystem -Name NtfsDisable8dot3NameCreation -Value 1

More information: https://support.microsoft.com/en-us/help/121007/how-to-disable-8-3-file-name-creation-on-ntfs-partitions

White-list allowed source IP addresses

Security can be improved by restricting (white-listing) from which source IP addresses connections to the QPR ProcessAnalyzer UI and API can be established. This restriction is typically set in the firewall which can be part of the network infrastructure or it can be in the server machine. If taking this method into use, considered the effort to maintain the up-to-date list of allowed IP addresses versus the gained benefit of the restriction.

HTTP Response Headers

This chapter contains information about security related HTTP response headers that are added or removed in QPR ProcessAnalyzer. Thus, no actions are required regarding these HTTP response headers.

Added HTTP Headers

Following security related HTTP headers are set:

  1. Content-Security-Policy
    • Name: Content-Security-Policy
    • Value: default-src 'none';script-src 'self' 'unsafe-eval';style-src 'self' 'unsafe-inline';img-src 'self' data: blob:;connect-src 'self';font-src 'self' data:;manifest-src 'self';child-src 'self';frame-src *;
  2. Strict-Transport-Security (Note: HTTPS is required)
    • Name: Strict-Transport-Security
    • Value: max-age=31536000; includeSubDomains
  3. X-Frame-Options:
    • Name: X-Frame-Options
    • Value: sameorigin
  4. X-Content-Type-Options:
    • Name: X-Content-Type-Options
    • Value: nosniff

More information:

Removed HTTP Headers

By default, IIS returns the X-Powered-By HTTP response header that has been removed in QPR ProcessAnalyzer. More information: https://blogs.msdn.microsoft.com/varunm/2013/04/23/remove-unwanted-http-response-headers/

By default, IIS 10.0 returns Server header in http response that has been removed in QPR ProcessAnalyzer. More information: https://www.saotn.org/remove-iis-server-version-http-response-header/#removeserverheader-requestfiltering-in-iis-10-0