ArcGIS Server comes with a Python script tool, serverScan.py, that scans for some common security issues. The tool checks for problems based on some of the best practices for configuring a secure environment for ArcGIS Server. It analyzes twelve criteria or configuration properties and divides them into three severity levels: Critical, Important, and Recommended. The descriptions of these criteria are as follows:
| ID | Severity | Property | Description |
|---|---|---|---|
SS01 | Critical | Web communication | Determines if HTTPS is enabled for ArcGIS Server. To prevent the interception of any communication, it is recommended that you configure ArcGIS Server and ArcGIS Web Adaptor (if installed) to enforce SSL encryption. |
SS02 | Critical | Standardized queries | Determines if standardized queries are enforced. To provide protection against SQL injection attacks, it is critical that this option be enabled. |
SS03 | Critical | Token requests | Determines if generate token requests via GET are supported. When generating tokens via GET, a user's credentials are sent as part of the URL and can be captured and exposed through browser history or network logs. This should be disabled unless required by other applications. |
SS04 | Critical | Token requests | Determines if generate token requests via POST with credentials in the query parameter are supported. When generating tokens, a user's credentials could be provided as part of the URL and may be exposed through browser history or network logs. This should be disabled unless required by other applications. |
SS05 | Critical | Filter web content enabled | Generates a list of feature services where the filter web content property is disabled. Disabling this property allows a user to enter any text into the input fields, which exposes the service to potential cross-site scripting (XSS) attacks. This property is enabled by default and unless unsupported HTML entities or attributes are required, it should not be disabled. |
SS06 | Critical | System folder permissions | Determines if non-default permissions are applied to the System folder in Server Manager. By default, only administrators and publishers should have access to the services in the System folder. |
SS07 | Important | REST services directory | Determines if the REST services directory is accessible through a web browser. Unless being actively used to search for and find services by users, this should be disabled to reduce the chance that your services can be browsed, found in a web search, or queried through HTML forms. This also provides further protection against cross-site scripting (XSS) attacks. |
SS08 | Important | Cross-domain limitations | Determines if cross-domain requests are limited to specific domains. To reduce the possibility of an unknown application sending malicious commands to your web services, it is recommended to restrict the use of your services to applications hosted only in domains that you trust. |
SS09 | Important | Dynamic workspace | Generates a list of services where the database can be accessed via a dynamic workspace. Unless appropriately safeguarded, this can expose the database/workspace to access by malicious 3rd parties over REST. Dynamic workspaces should be enabled only if the service and the dynamic layer/workspace capability is intended for active use in a web application. In these cases, it is important to ensure that the database connection used by the map service to connect to the workspace/database has the least privileges needed for the application, for example, read-only access to only those additional tables within the workspace that are needed. |
SS10 | Recommended | Web Adaptor over HTTPS | Determines if one or more Web Adaptors are registered over HTTPS. To allow Server Manager to successfully redirect to HTTPS, all Web Adaptors should be registered over HTTPS. |
SS11 | Recommended | Disable PSA account | Determines if the primary site administrator account is enabled. It is recommended that you disable this account to ensure that there is no other way to administer ArcGIS Server other than the group or role specified in your identity store. |
SS12 | Recommended | Feature service permissions | Returns a list of feature services that have the update or delete operations enabled and are open to anonymous access. This allows the feature service data to be changed or deleted without authentication. |
The serverscan script is located in the <ArcGIS Server installation location>/tools/admin directory. Run the script from the command line or shell. You have the option to specify parameters when running the script.
serverScan.py parameters
| Parameter | Description |
|---|---|
-n | The fully-qualified domain name of the machine where Server is installed (i.e.: gisserver.domain.com). The default is the hostname of the machine where the script is run. |
-u | The username of an administrator account. |
-p | The password of an administrator account. |
-o | The directory where the security scan report will be saved. The default directory is the same folder where you run the script. |
-t | A token can be generated and used in place of the username and password. If a Portal token is generated for a federated Server, the fully-qualified domain name of the Server being scanned should be input in the 'Webapp URL' field. If a token is generated for an un-federated Server, the token must be generated through the Administrator directory (arcgis/admin/generateToken) and the client must be 'Request IP'. When a token is provided, it overrides any username or password that is provided. |
-h or -? | Outputs a listing of the parameters that can be specified when running the script. |
Example: python serverScan.py -n gisserver.domain.com -u admin -p my.password -o C:\Temp
If the serverScan.py script is run without specifying any parameters, you will be prompted to enter them manually or select the default value. If you wish to use a token, it must be provided as a parameter when running the script.
The scan generates a report in HTML format that lists any of the above issues that were found in the specified ArcGIS Server site.
By default, the report is saved in the same folder where you run the script and is named serverScanReport_[hostname]_[date].html.