nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

User name enumerations

htsubaie

Hello,

I want to share with you our cybersecurity team concern about user name enumerations for the directory of /portal/sharing/rest/community/users/(The name of the user),

we want to deploy our portal to be accessed from outside the local network but the cyber team did a penetration testing before authorizing posting the site on the internet.

We would like to lock anonymous access so the user names cannot be found by this method we have tried to create a rewrite rules by setting conditions to be met when trying to access the directory it works with the portal it self but not with ArcGIS pro the app crashes when trying to login, And ArcGIS field maps faces a problem after the login regarding the certificate, when the rule is disabled everything works normally.

Here is the report about the penetration testing

Penetration testing

Url rewrite Rule

Rewrite Rules

ArcGIS Field Maps Error

ArcGIS Field Maps

Any solution or suggestion would be appreciated.

Najděte více příspěvků označených jako

Accepted answers

htsubaie

Update:

Sorry for the late update,

The only way that we tested and worked is through a proxy where when the directory /portal/sharing/rest/community/users/ is triggered you make a rule to redirect to 403 Forbidden Access.

So far the rule is working well with ArcGIS Pro and ArcGIS Field Maps.

I hope this helps other concerned about the findings.

All comments

htsubaie

Update:

Sorry for the late update,

The only way that we tested and worked is through a proxy where when the directory /portal/sharing/rest/community/users/ is triggered you make a rule to redirect to 403 Forbidden Access.

So far the rule is working well with ArcGIS Pro and ArcGIS Field Maps.

I hope this helps other concerned about the findings.

htsubaie

Update:

The method used to disable the service directory is:

https://enterprise.arcgis.com/en/portal/11.4/administer/windows/disabling-the-arcgis-portal-directory.htm

Disabling the service directory doesn't help at all it only disables the html format of viewing so the page will be a blank html page, but it can be recalled using json format, you can check it out by entering the directory of portal/sharing/rest/community/users/(the name of the user)?f=json. it will show the information of the user in json format so it doesn't help at all.

htsubaie

Hello @MichaelVolz

Unfortunately it is possible to try different user names in the mentioned directory until you find an existing user without the need to be signed in, our cyber team didn't have any user names given to them and they gave us a screen shot for the information regrading the user, and there is no option in the portal that can prevent it.

Good day

htsubaie

Hey @CodyPatterson

Thanks for the reply,

It is concerning since the portal mentioned would not be possible to access without an employee credentials.

And we will try to disable the service directory and update regrading any findings.

Good day

MikeVolz

Do you have single sign-on enabled for your Portal? Wouldn't this prevent anonymous access to /portal/sharing/rest if it is to be accessed outside your network?

CodyPatterson

Hey @htsubaie

This is something that I actually wasn't aware of, and trying it out, it gave out quite a bit of information and ability to outside users that I had not considered! Looking around I did find this here:

https://enterprise.arcgis.com/en/server/latest/administer/linux/disabling-the-services-directory.htm

But it still allows for JSON access, which is said to be possible to restrict as well. I found a Reddit post that had mentioned this access is required for some WebGIS related items, but I'm not sure it was specifically mentioning this. I'm not able to test the disabling of the service directory until the weekend as I don't want it to have any adverse affects during the workday, but if you don't have an answer by then I can definitely check. I'll be opening a ticket with Esri support as well so they can guide me through this next week hopefully, thanks for bringing this up!

Cody

Připojte se k diskusi

Přihlášení členové mohou přispívat, sledovat aktualizace a další. Jste tu noví? Zaregistrujte si bezplatný účet.

Rychlé odkazy

Community Help
Find useful guides, FAQs, and documents to help you navigate and make the most of Esri Community.