# Appliance security

> Follow your organization's information security best practices when protecting Cloud Management Platform (CMP)

---

Site [llms.txt](/llms.txt)

---

CMP is a highly sensitive piece of infrastructure because it often houses credentials with elevated privileges across multiple cloud environments. The appliance can be configured to meet different hardening guidelines depending on your regulatory environment. If you have specific hardening needs, [contact Support](https://support.cloudbolt.io/hc/en-us/requests/new).

## Encryption

CMP encrypts the secrets file with AES in CBC mode. The key is derived with Argon2.

## TLS and end-to-end transport encryption

Avoid unencrypted protocols during deployment when establishing connections to external providers, for example, resource handlers and configuration managers.

Ensure that SSL verification is enabled globally and on each TLS-encrypted connection to protect against man-in-the-middle attacks.

## Network segmentation and firewalls

Consider using network controls to limit the exposure of CMP services to the wider corporate network, as part of following best-practice security guidelines. Network controls can be used to limit connectivity to and from the appliance, ensuring only essential traffic is permitted. See [Network connectivity](/docs/cmp/system-architecture/network-connectivity/) for details.

## Audit logging and SIEM

Leverage the [SIEM integration](/docs/cmp/configure/access-and-security/security/siem/) and [multi-channel alerts](/docs/cmp/configure/access-and-security/security/multi-channel-alerts/) to send events outside of CMP, which helps ensure the integrity of audit logs.

## Hardening HTTPS redirects

The CMP appliance ships with an Apache configuration that automatically redirects insecure client requests (HTTP) to the secure version (HTTPS). However, the redirects use a generic template that does not validate the domain portion of the redirected URL, as that information is not available during installation. As a result, a man-in-the-middle attack could intercept a request during the HTTP-to-HTTPS redirection and arbitrarily inject another domain into the request's Host header, causing a redirect to that domain instead.

After installing CMP, once you know the application's fully qualified domain name (FQDN), follow the steps below to hard-code the domain in the redirect rules. This prevents arbitrary host header acceptance and man-in-the-middle attacks.

1. SSH into the appliance server and edit `/etc/httpd/conf.d/wsgi.conf`.
1. Find every instance of the following redirect rule. The shipped configuration contains more than one, so check the whole file.

   `RewriteRule ^.*$ https://%{SERVER_NAME}%{REQUEST_URI} [L,R]`

1. In each of those rules, change the `%{SERVER_NAME}` variable to your FQDN. For example:

   `RewriteRule ^.*$ https://example.com%{REQUEST_URI} [L,R]`

1. Save the changes to the file.
1. Restart the Apache server.

## Hardening the Apache server to disallow arbitrary host headers

We recommend hardening your Apache server to prevent it from accepting arbitrary host headers.

Add the following lines to `/etc/httpd/conf.d/ssl.conf`, in the section shown below:

```bash
<VirtualHost _default_:443>
RewriteEngine On
RewriteCond %{HTTP_HOST} !^<EXTERNAL_URL_HOST_NAME>$ [NC]
RewriteRule ^(.*)$ - [L,R=400]
```

Replace `EXTERNAL_URL_HOST_NAME` with the hostname you want to use in the URL.

## Single sign-on and multi-factor authentication

We recommend deploying [SAML-based SSO](/docs/cmp/configure/access-and-security/users/sso-saml/) rather than LDAP-based authentication where possible. Using single sign-on reduces password fatigue and susceptibility to phishing.

When deploying SSO, leverage your identity provider's conditional access policy, where available, to ensure that multi-factor authentication is enforced when necessary.

If you are using Microsoft Entra ID or Google Workspace, you may be able to leverage these directly for SSO. They provide the necessary SAML services if you are not using an auxiliary identity provider solution.

## Related

- [Network connectivity](/docs/cmp/system-architecture/network-connectivity/): Which ports to permit and which do not need a firewall rule.
- [Single sign-on and SAML](/docs/cmp/configure/access-and-security/users/sso-saml/): Configure SAML-based SSO against your identity provider.
- [SIEM integration](/docs/cmp/configure/access-and-security/security/siem/): Forward audit events to an external SIEM.