Versions Compared

Old Version 2

changes.mady.by.user Kirstin Seidel-Gebert

Saved on

compared with

New Version 3

changes.mady.by.user Kirstin Seidel-Gebert

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: Published by Scroll Versions from space WINSTALLATION and version 1.0.2_bridge
Section
Column
width50%

Otp
Floatingfalse
maxHLevel1

Column
Rp

On Secure Bridge Setup, you can find operational concepts for a secure BRIDGE setup. Find here some additional security recommendations to consider for BRIDGE hardening.

Disabling TLS 1.0

Info
iconfalse

Bridge 7.2.0 As of BRIDGE 7.2.0, TLS 1.0 is disabled by default. Still, you can use this guide to re-enable it if necessary.

If you do not have any clients that need TLS 1.0, we recommend to disable this protocol for the BRIDGE from the security point of view. To be downwards compatible with MagicDraw 17 (see note), we did not implement this to the standard BRIDGE installation.

Note
iconfalse

MagicDraw 17 uses Java 6, and thus only supports protocols up to TLS 1.0. So, if you disable Tomcat TLS 1.0 on your BridgeBRIDGE, you will not be able to deploy services directly from MagicDraw 17 to this BRIDGE (a handshake error will occur).
This does not affect repositories that have been compiled with MagicDraw 17. They can be uploaded via the BRIDGE UI nevertheless.

...

LocationAttribute/PropertyExampleNotes
Tomcat

<your BRIDGE programs directory>/servlets/conf/server-dist.xml


sslEnabledProtocols sslEnabledProtocols="TLSv1.2,TLSv1.1,TLSv1,SSLv2Hello"
sslEnabledProtocols="TLSv1.2,TLSv1.1,SSLv2Hello"

This file will get overwritten on

Bridge

BRIDGE updates! The old configuration file is copied to server.xml.old.
So, after

an E2E Bridge

a BRIDGE update re-apply the changes from the backup copy of the file.

Apache

<your BRIDGE data directory>/proxies/templates/httpd.conf

SSLProtocol SSLProtocol All -SSLv2 -SSLv3 -TLSv1
SSLProtocol All -SSLv2 -SSLv3 -TLSv1

Copy the Apache templates that have been provided with your Bridge BRIDGE installation from folder <your BRIDGE data directory>/proxies/system_templates to folder <your BRIDGE data directory>/proxies/templates and modify the copy.

The actually used file <your BRIDGE data directory>/proxies/conf/httpd.conf is generated from this template file on Bridge shutBRIDGE start-downup. The Bridge BRIDGE will generate the configuration from the file in folder templates if available. If not, the Bridge BRIDGE will use the system templates.

Steps

  1. Apply changes to the three files as described above. Consider the notes!
  2. Restart the BRIDGE to apply the changed Apache configuration from the template file.