\pagebreak \tableofcontents \pagebreak
The out-of-the-box configuration for deaddrop is created to focus on security where parameters are selected to be as secure as possible. The setup also allows administrators to configure some of the system and application parameter values so the system can be compliant with internal policies.
The following configuration is static but it may enhance over time, depending on new releases of the platform where new web setup options are available in the base system components, e.g. apache.
The deaddrop service and the graphical administration interface uses the HTTPS, i.e. HTTP with the TLS protocol, to protect the communication.
As per the default setup, the following cipher suites is allowed in the TLS connection to the deaddrop server:
This list is a small subset of the full set of protocol cipher suites that TLS allows. The list is trimmed to just allow the more secure variants, but also at the same time versions that are compatible with the latest versions of the web browsers.
The following variants of the TLS protocol are allowed:
Older versions of the protocol, called TLS 1, TLS 1.1, and SSL, are not allowed in the default setup.
Deaddrop use HSTS1 to enforce encrypted communications once a secure connection has been made
Deaddrop can be configured to be protected behind a proxy
Deaddrop can be configured to use HKPK (i.e. certificate pinning)
The system is configured with a local firewall which only allows inbound access to the webservice on the following ports
It’s strongly recommended to block access, besides for the internal administrators access, to the following TCP/IP ports
For all firewall rules that may be needed, see the network diagram for deaddrop.
The following configuration is or should be configured
The private key for TLS must be generated on the appliance and the key must be trusted by the supported web browsers. This key is normally created at customer site during onsite installation
All configuration can be configured on the administrator web interface
© Copyright sysctl Aktiebolag 2013-2021. All rights reserved