RabbitMQ Management and Qualys QID 11827

[jonmcal...@wellsfargo.com]

We are getting called out with a QID 11827 (Qualys Security Scan) against our RabbitMQ servers stating that the Security Headers are missing. I’ve been searching to no avail as to how to implement these in the Management configuration.

 

If that can’t be done, I’ve seen folks mentioning to put a reverse proxy in front of the RabbitMQ Management, but don’t see any details as to how to configure that. Does anyone have working instructions for using IIS with ARR and URLRewrite as the reverse proxy?

 

Thanks,

 

Dream * Excel * Explore * Inspire

Jon McAlexander

Senior Infrastructure Engineer

Asst. Vice President

He/His

 

Middleware Product Engineering

Enterprise CIO | EAS | Middleware | Infrastructure Solutions

 

8080 Cobblestone Rd | Urbandale, IA 50322
MAC: F4469-010

Tel 515-988-2508 | Cell 515-988-2508

 

jonmcal...@wellsfargo.com

This message may contain confidential and/or privileged information. If you are not the addressee or authorized to receive this for the addressee, you must not use, copy, disclose, or take any action based on this message or any information herein. If you have received this message in error, please advise the sender immediately by reply e-mail and delete this message. Thank you for your cooperation.

 

[jonmcal...@wellsfargo.com]

Hello,

I’m reposting this question. See below.

--
You received this message because you are subscribed to the Google Groups "rabbitmq-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to rabbitmq-user...@googlegroups.com.
To view this discussion on the web, visit https://groups.google.com/d/msgid/rabbitmq-users/62e36ae1cd9d472b8ec8d2128c0c2d80%40wellsfargo.com.

[Luke Bakken]

Hi Jon,

I'm assuming you're scanning the RabbitMQ management port (15672 by default).

• What is your RabbitMQ version?
• Which "security headers" are missing?

Thanks,

Luke

[jonmcal...@wellsfargo.com]

Correct on the port. The headers missing are the security headers. Basically these:

 

X-Frame-Options
SAMEORIGIN
X-Xss-Protection
1;mode=block
X-Content-Type-Options
nosniff
Content-Security-Policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload

 

Or similar.

 

Dream * Excel * Explore * Inspire

Jon McAlexander

Senior Infrastructure Engineer

Asst. Vice President

He/His

 

Middleware Product Engineering

Enterprise CIO | EAS | Middleware | Infrastructure Solutions

 

8080 Cobblestone Rd | Urbandale, IA 50322
MAC: F4469-010

Tel 515-988-2508 | Cell 515-988-2508

 

jonmcal...@wellsfargo.com

This message may contain confidential and/or privileged information. If you are not the addressee or authorized to receive this for the addressee, you must not use, copy, disclose, or take any action based on this message or any information herein. If you have received this message in error, please advise the sender immediately by reply e-mail and delete this message. Thank you for your cooperation.

 

--

You received this message because you are subscribed to the Google Groups "rabbitmq-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to rabbitmq-user...@googlegroups.com.

To view this discussion on the web, visit https://groups.google.com/d/msgid/rabbitmq-users/716be882-7db5-4d2d-98a6-6d114d1a2570n%40googlegroups.com.

[Luke Bakken]

Hi Jon,

The "Content-Security-Policy" header is set to the value that is required for the javascript library we use. You can customize it via a setting - https://www.rabbitmq.com/management.html#csp

Please note to adjust CSP carefully because you can disable the management UI with incorrect values.

The "Strict-Transport-Security" header is set in this manner - https://www.rabbitmq.com/management.html#hsts

As for the other headers, if you provide a complete list we can evaluate them for inclusion in the management plugin. Please see this issue where you can add input:

https://github.com/rabbitmq/rabbitmq-server/issues/5320

Thanks,

Luke

[Luke Bakken]

Be sure to see Michael's comments - https://github.com/rabbitmq/rabbitmq-server/issues/5320#issuecomment-1193157863

[Luke Bakken]

Hi Jon,

Please note that we have added support for several of the headers you mention:

https://github.com/rabbitmq/rabbitmq-server/pull/5323/files#diff-04a2ef79d4647c865051764547ed63b6aafe60d4da34f32eb6ffed810a25c84eR15-R17

You will have to enable them in the rabbitmq.conf file:

https://github.com/rabbitmq/rabbitmq-server/pull/5323#issue-1316508864

This change is available in RabbitMQ 3.10.7 -

https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.10.7

Thanks,

Luke

[jonmcal...@wellsfargo.com]

Thank you Luke. I had missed this message.

 

We really appreciate the assist!

 

Dream * Excel * Explore * Inspire

Jon McAlexander

Senior Infrastructure Engineer

Asst. Vice President

He/His

 

Middleware Product Engineering

Enterprise CIO | EAS | Middleware | Infrastructure Solutions

 

8080 Cobblestone Rd | Urbandale, IA 50322
MAC: F4469-010

Tel 515-988-2508 | Cell 515-988-2508

 

jonmcal...@wellsfargo.com

This message may contain confidential and/or privileged information. If you are not the addressee or authorized to receive this for the addressee, you must not use, copy, disclose, or take any action based on this message or any information herein. If you have received this message in error, please advise the sender immediately by reply e-mail and delete this message. Thank you for your cooperation.

 

From: rabbitm...@googlegroups.com <rabbitm...@googlegroups.com> On Behalf Of Luke Bakken

Sent: Wednesday, August 3, 2022 7:42 AM
To: rabbitmq-users <rabbitm...@googlegroups.com>

--

You received this message because you are subscribed to the Google Groups "rabbitmq-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to rabbitmq-user...@googlegroups.com.

To view this discussion on the web, visit https://groups.google.com/d/msgid/rabbitmq-users/d97393df-132b-417a-9772-8302c2108804n%40googlegroups.com.