Skip To Content

Scan ArcGIS Server for security best practices

ArcGIS Server comes with a Python script tool, serverScan.py, that scans for some common security issues. The tool checks for problems based on some of the best practices for configuring a secure environment for ArcGIS Server. It analyzes twelve criteria or configuration properties and divides them into three severity levels: Critical, Important, and Recommended. The descriptions of these criteria are as follows:

IDSeverityPropertyDescription

SS01

Critical

Web communication

Determines if HTTPS is enabled for ArcGIS Server. To prevent the interception of any communication, it is recommended that you configure ArcGIS Server and ArcGIS Web Adaptor (if installed) to enforce SSL encryption.

SS02

Critical

Standardized queries

Determines if standardized queries are enforced. To provide protection against SQL injection attacks, it is critical that this option be enabled.

SS03

Critical

Token requests

Determines if generate token requests via GET are supported. When generating tokens via GET, a user's credentials are sent as part of the URL and can be captured and exposed through browser history or network logs. This should be disabled unless required by other applications.

SS04

Critical

Token requests

Determines if generate token requests via POST with credentials in the query parameter are supported. When generating tokens, a user's credentials could be provided as part of the URL and may be exposed through browser history or network logs. This should be disabled unless required by other applications.

SS05

Critical

Filter web content enabled

Generates a list of feature services where the filter web content property is disabled. Disabling this property allows a user to enter any text into the input fields, which exposes the service to potential cross-site scripting (XSS) attacks. This property is enabled by default and unless unsupported HTML entities or attributes are required, it should not be disabled.

SS06

Critical

System folder permissions

Determines if non-default permissions are applied to the System folder in Server Manager. By default, only administrators and publishers should have access to the services in the System folder.

SS07

Important

REST services directory

Determines if the REST services directory is accessible through a web browser. Unless being actively used to search for and find services by users, this should be disabled to reduce the chance that your services can be browsed, found in a web search, or queried through HTML forms. This also provides further protection against cross-site scripting (XSS) attacks.

SS08

Important

Cross-domain limitations

Determines if cross-domain requests are limited to specific domains. To reduce the possibility of an unknown application sending malicious commands to your web services, it is recommended to restrict the use of your services to applications hosted only in domains that you trust.

SS09

Important

Dynamic workspace

Generates a list of services where the database can be accessed via a dynamic workspace. Unless appropriately safeguarded, this can expose the database/workspace to access by malicious 3rd parties over REST. Dynamic workspaces should be enabled only if the service and the dynamic layer/workspace capability is intended for active use in a web application. In these cases, it is important to ensure that the database connection used by the map service to connect to the workspace/database has the least privileges needed for the application, for example, read-only access to only those additional tables within the workspace that are needed.

SS10

Recommended

Web Adaptor over HTTPS

Determines if one or more Web Adaptors are registered over HTTPS. To allow Server Manager to successfully redirect to HTTPS, all Web Adaptors should be registered over HTTPS.

SS11

Recommended

Disable PSA account

Determines if the primary site administrator account is enabled. It is recommended that you disable this account to ensure that there is no other way to administer ArcGIS Server other than the group or role specified in your identity store.

SS12

Recommended

Feature service permissions

Returns a list of feature services that have the update or delete operations enabled and are open to anonymous access. This allows the feature service data to be changed or deleted without authentication.

The serverScan.py script is located in the <ArcGIS Server installation location>/tools/admin directory. Run the script from the command line or shell. You'll need to provide the ArcGIS Server URL as well as the username and password for an administrator.

The scan generates a report in HTML format that lists any of the above issues that were found in the specified ArcGIS Server site. The report is generated in the same folder where you run the script and is named serverScanReport_[hostname]_[date].html.


In this topic