topic Re: 9.4 Web server port hardening in Administration and Deployment

9.4 Web server port hardening

RexDeus9 — Sun, 27 Feb 2022 19:58:55 GMT

Hi,

Just a process question I'm dealing with. With the task of deploying a new 9.4 platform, I'm currently dealing with a Network Security guy who wants to harden the server ports BEFORE the Mit-Tier server gets deployed. Shouldn't this step be done AFTER the deployment, when you can clearly analyze ALL the ports involved.

The install keeps failing because some ports are not made available.

Anyone experienced this? input appreciated!

Rex

Re: 9.4 Web server port hardening

SASKiwi — Sun, 27 Feb 2022 21:22:25 GMT

For a new SAS installation, typically a TCP port list is created containing all the required ports and server network flows. If this is done correctly it shouldn't matter whether you harden before or after installation as all the firewall rules should align with your SAS servers' network traffic.

If there are any additional installation-specific port requirements, these should be part of your implementation plan.

Re: 9.4 Web server port hardening

RexDeus9 — Sun, 27 Feb 2022 23:41:46 GMT

"A TCP port list is created", by who'm? The general port list offered by SAS is not even available in one coherent document.

Re: 9.4 Web server port hardening

SASKiwi — Mon, 28 Feb 2022 00:25:03 GMT

By the team implementing the installation. This doc is a good starting point, but obviously it will depend on what products and SAS architecture you are using.

Re: 9.4 Web server port hardening

Sajid01 — Wed, 02 Mar 2022 01:16:45 GMT

Typically SAS servers are a part of the corporate intranet behind firewalls and accessible from within the intranet.

Typically users cannot physically log into the servers. Typically https configuration takes post installation of mid tier.

With this being the fact, hardening the ports is a broad statement and depends upon what your "network guy" wants to do..
The best approach will be to approach SAS Tech Support with details of what your "network guy" wants to do.