蜜豆视频

Security Checklist security-checklist

This section deals with various steps that you should take to ensure that your AEM installation is secure when deployed. The checklist is meant to be applied from top to bottom.

Main Security Measures main-security-measures

Run AEM in Production Ready Mode run-aem-in-production-ready-mode

For more information, see Running AEM in Production Ready Mode.

Enable HTTPS for transport layer security enable-https-for-transport-layer-security

Enabling the HTTPS transport layer on both author and publish instances is mandatory for having a secure instance.

Install Security Hotfixes install-security-hotfixes

Ensure that you have installed the latest .

Change Default Passwords For the AEM and OSGi Console Admin Accounts change-default-passwords-for-the-aem-and-osgi-console-admin-accounts

蜜豆视频 strongly recommends that after installation you change the password for the privileged AEM admin accounts (on all instances).

These accounts include:

These two accounts use separate credentials and having distinct, strong password for each is vital to a secure deployment.

Changing the AEM admin password changing-the-aem-admin-password

The password for the AEM admin account can be changed via the Granite Operations - Users console.

Here you can edit the admin account and change the password.

Importance of Changing the OSGi Web Console Password importance-of-changing-the-osgi-web-console-password

Aside from the AEM admin account, failing to change the default password for the OSGi web console password can lead to:

For more information on changing the web console password, see Changing the OSGi web console admin password below.

Changing the OSGi web console admin password changing-the-osgi-web-console-admin-password

You must also change the password used for accessing the Web console. This is done by configuring the following properties of the Apache Felix OSGi Management Console:

User Name and Password, the credentials for accessing the Apache Felix Web Management Console itself.
The password must be changed after the initial installation to ensure the security of your instance.

To do this:

Implement Custom Error Handler implement-custom-error-handler

蜜豆视频 recommends to define custom error handler pages, especially for 404 and 500 HTTP Response codes in order to prevent information disclosure.

Complete Dispatcher Security Checklist complete-dispatcher-security-checklist

AEM Dispatcher is a critical piece of your infrastructure. 蜜豆视频 strongly recommend that you complete the .

Verification Steps verification-steps

Configure replication and transport users configure-replication-and-transport-users

A standard installation of AEM specifies admin as the user for transport credentials within the default replication agents. Also, the admin user is used to source the replication on the author system.

For security considerations, both should be changed to reflect the particular use case at hand, with the following two aspects in mind:

Check the Operations Dashboard Security Health Checks check-the-operations-dashboard-security-health-checks

AEM 6 introduces the new Operations Dashboard, aimed at aiding system operators troubleshoot problems and monitor the health of an instance.

The dashboard also comes with a collection of security health checks. It is recommended you check the status of all the security health checks before going live with your production instance. For more information, consult the Operations Dashboard documentation.

Check if Example Content is Present check-if-example-content-is-present

All example content and users (e.g. the Geometrixx project and its components) should be uninstalled and deleted completely on a productive system before making it publicly accessible.

Check if the CRX development bundles are present check-if-the-crx-development-bundles-are-present

These development OSGi bundles should be uninstalled on both author and publish productive systems before making them accessible.

Check if the Sling development bundle is present check-if-the-sling-development-bundle-is-present

The AEM Developer Tools for Eclipse deployes the Apache Sling Tooling Support Install (org.apache.sling.tooling.support.install).

This OSGi bundle should be uninstalled on both author and publish productive systems before making them accessible.

Protect against Cross-Site Request Forgery protect-against-cross-site-request-forgery

The CSRF Protection Framework the-csrf-protection-framework

AEM 6.1 ships with a mechanism that helps protect agains Cross-Site Request Forgery attacks, called the CSRF Protection Framework. For more information on how to use it, consult the documentation.

The Sling Referrer Filter the-sling-referrer-filter

To address known security issues with Cross-Site Request Forgery (CSRF) in CRX WebDAV and Apache Sling you need to add configurations for the Referrer filter in order to use it.

The referrer filter service is an OSGi service that allows you to configure:

To configure the referrer filter service:

OSGI Settings osgi-settings

Some OSGI settings are set by default to allow easier debugging of the application. These need to be changed on your publish and author productive instances to avoid internal information leaking to the public.

For each of the following services the specified settings need to be changed:

For further details see OSGi Configuration Settings.

When working with AEM there are several methods of managing the configuration settings for such services; see Configuring OSGi for more details and the recommended practices.

Further Readings further-readings

Mitigate Denial of Service (DoS) Attacks mitigate-denial-of-service-dos-attacks

A denial of service (DoS) attack is an attempt to make a computer resource unavailable to its intended users. This is often done by overloading the resource; for example:

There are many points of configuration for preventing such attacks, here we only discuss those directly related to AEM.

Configuring Sling to Prevent DoS

Sling is content-centric. This means that processing is focused on the content as each (HTTP) request is mapped onto content in the form of a JCR resource (a repository node):

This approach makes Sling very powerful and very flexible, but as always it is the flexibility that needs to be carefully managed.

To help prevent DoS misuse you can:

Mitigate Against DoS Caused by Using Form Selectors

Since AEM does not provide out of the box indexes for the FormChooserServlet, using form selectors in queries will trigger a costly repository traversal, usually grinding the AEM instance to a halt. Form selectors can be detected by the presence of the *.form.* string in queries.

In order to mitigate this, please follow the below steps:

Mitigate Against DoS Caused by Asset Download Servlet

The default Asset Download Servlet in AEM allows authenticated users to issue arbitrarily-large, concurrent download requests for creating ZIP files of assets visible to them that can overload the server and/or network.

To mitigate potential DoS risks caused by this feature, AssetDownloadServlet OSGi component is disabled by default for publish instances on latest AEM versions.

If your setup requires that the Asset Download Server be enabled, please see this article for more information.

Disable WebDAV disable-webdav

WebDAV should be disabled on both the author and publish environments. This can be done by stopping the appropriate OSGi bundles.

Verify That You Are Not Disclosing Personally Identifiable Information In the Users Home Path verify-that-you-are-not-disclosing-personally-identifiable-information-in-the-users-home-path

It is important you protect your users by making sure that you do not expose any personally indetifiable information in the repository users home path.

Since AEM 6.1, the way user (also known as authorizable) ID node names are stored is changed with a new implementation of the AuthorizableNodeName interface. The new interface will no longer expose the user ID in the node name, but will generate a random name instead.

No configuration needs to be performed in order to enable it, as this is now the default way of generating authorizable IDs in AEM.

Although not recommended, you can disable it in case you need the old implementation for backwards compatibility with your exsiting applications. In order to do this, you need to:

Prevent Clickjacking prevent-clickjacking

To prevent clickjacking we recommend that you configure your webserver to provide the X-FRAME-OPTIONS HTTP header set to SAMEORIGIN.

For more .

Make Sure You Properly Replicate Encryption Keys When Needed make-sure-you-properly-replicate-encryption-keys-when-needed

Certain AEM features and authentication schemes require that you replicate your encryption keys across all AEM instances.

Before you do this, please take note that key replication is done differently between versions because the way in which keys are stored is different between 6.3 and older versions.

See below for more information.

Replicating Keys for AEM 6.3 replicating-keys-for-aem

Whereas in older versions the replication keys were stored in the repository, beginning with AEM 6.3 they are stored on the filesystem.

Therefore, in order to replicate your keys across instances you need to copy them from the source instance to the target instances鈥� location on the filesystem.

More specifically, you need to:

Replicating Keys for AEM 6.2 and Older Versions replicating-keys-for-aem-and-older-versions

In AEM 6.2 and older versions, the keys are stored in the repository under the /etc/key node.

The recommended way to securely replicate the keys across your instances is to only replicate this node. You can selectively replicate nodes via CRXDE Lite:

Perform a Penetration Test perform-a-penetration-test

蜜豆视频 strongly recommends to perform a penetration test of your AEM infrastructure before going on production.

Development Best Practices development-best-practices

It is critical that new development are following the Security Best Practices to ensure your AEM environement stays safe.