General Security Guidelines for Veeam Self-Service Backup Portal

KB ID: 2376
Product: Veeam Managed Backup Portal
Version: All
Published:
Last Modified: 2017-11-10

Purpose

Self-Service Backup Portal is usually publicly available, this leads to increased risks associated with security. While it is generally safe to use this site, in order to reach maximum security it's recommended to apply certain Microsoft IIS and Windows settings.


More information:


The desired security settings can be divided in three categories:
  • Allowed protocols for secure communications
  • Allowed ciphers
  • Recommended Microsoft IIS settings
All of these settings should be applied on the Veeam Enterprise Manager server.

 

Solution

Step 1. Disable old security protocols in Windows registry


When IIS server receives HTTPS connection, a client and a server negotiate a common protocol to secure the channel. By default, Windows has a set of enabled protocols and if the client negotiates some old weak protocol (PCT 1.0, for example), it will be used for communication. In modern networks it?s recommended to use one of the latest protocols ( either TLS 1.1 or 1.2).
Windows Server stores information about channel protocols in the Windows registry key below:

[HKLM\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols]

This key may contain the following subkeys:

  • PCT 1.0
  • SSL 2.0
  • SSL 3.0
  • TLS 1.0

Each key holds information about the protocol and any of these protocols can be disabled on the server. The following registry values (and subkeys, if necessary) should be created to disable the old protocols:

  • [HKLM\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0]
    "Enabled" = DWORD:0x00000000
  • [HKLM\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0]
    "Enabled" = DWORD:0x00000000
  • ​[HKLM\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0]
    "Enabled" = DWORD:0x00000000
  • [HKLM\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0]
    "Enabled" = DWORD:0x00000000


​Step 2: Disable weak ciphers


By default, list of ciphers negotiated for given security protocol includes RC4 and 3DES. These ciphers are considered vulnerable, and it?s recommended to disable them completely.

Note: If you use any Windows version except Windows Server 2012R2, Server 2016 and Windows 10, the KB2868725 security update must be installed before applying the settings below.

In order to disable RC4 and 3DES, the following registry values should be created:

  • [HKLM\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 128/128]
    "Enabled" = DWORD:0x00000000

  • [HKLM\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 40/128]
    "Enabled" = DWORD:0x00000000

  • [HKLM\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 56/128]
    "Enabled" = DWORD:0x00000000

  • [HKLM\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\Triple DES 168]
    "Enabled" = DWORD:0x00000000


Step 3: Tweak website settings


The settings for Self-Service Backup Portal site are stored in the special Web.config file. The default Web.config file created after installation does not contain recommended security settings. In order to change this file according to recommendations, please follow the steps below:
  1. Browse to the web app installation folder (default is at C:\Program Files\Veeam\Backup and Replication\Enterprise Manager\WebApp)
  2. Copy original Web.config file someplace else to revert the changes if something goes wrong.
  3. Open Web.config file
  4. Find <system.web> section and add the following option to the httpRuntime settings: enableVersionHeader = "false". The httpRuntime settings should look like that afterwards:
<system.web>
  <httpRuntime requestValidationMode="2.0" targetFramework="4.5" executionTimeout="300" enableVersionHeader="false"/>
</system.web>
  1. Find <system.webServer> ---> <httpProtocol> ---> <customHeaders> section and add the following options:
<add name="Strict-Transport-Security" value="max-age=31536000"/>
<add name="X-XSS-Protection" value="1; mode=block"/>
<add name="X-Content-Type-Options" value="nosniff"/>
<remove name="X-Powered-By" />

The httpProtocol section should look like that afterwards:
 
<system.webServer>
...
<httpProtocol>
<customHeaders>
<add name="Strict-Transport-Security" value="max-age=31536000"/>
<add name="X-XSS-Protection" value="1; mode=block"/>
<add name="X-Content-Type-Options" value="nosniff"/>
<remove name="X-Powered-By" />
</customHeaders>
</httpProtocol>
</system.webServer>
  1. Open the Error.aspx file in the same folder.
  2. In the same folder there is an Error.aspx file. Copy it to someplace else as well, then open it and delete its contents.
Please restart the server after all of the changes listed above. If any issues appear after this configuration, please feel free to contact Veeam support.

4 / 5 (10 votes cast)

Couldn't find what you were looking for?

Below you can submit an idea for a new knowledge base article.

Request new content

Report a typo on this page:

Please select a spelling error or a typo on this page with your mouse and press CTRL + Enter to report this mistake to us. Thank you!

Orphus system