How to configure Jira applications for Security Best Practices
プラットフォームについて: Data Center - この記事は、Data Center プラットフォームのアトラシアン製品に適用されます。
このナレッジベース記事は製品の Data Center バージョン用に作成されています。Data Center 固有ではない機能の Data Center ナレッジベースは、製品のサーバー バージョンでも動作する可能性はありますが、テストは行われていません。サーバー*製品のサポートは 2024 年 2 月 15 日に終了しました。サーバー製品を利用している場合は、アトラシアンのサーバー製品のサポート終了のお知らせページにて移行オプションをご確認ください。
*Fisheye および Crucible は除く
目的
This 'How to' guide gives instructions on how to setup JIRA server applications for security best practices. This list is not exhaustive but it shows some of the basic or common practices.
ソリューション
- Configure JIRA behind a reverse-proxy using SSL as per either of the following:
- Configure Jira to run behind a NGINX reverse proxy
- You can then use NGINX features to further increase security. Example: https://www.cyberciti.biz/tips/linux-unix-bsd-nginx-webserver-security.html
- SSL を利用して JIRA と Apache を統合する方法
- You can then use Apache features to further increase security. Example: https://www.wp-bridge.com/the-14-step-apache-security-best-practices-checklist/
- Configure Jira to run behind a NGINX reverse proxy
- Ensure the additional config is setup as detailed in https://mozilla.github.io/server-side-tls/ssl-config-generator/.
- Optional - may be required by security policy to prevent 'Clickjacking'. Add the X-Frame-Options header as per JRASERVER-25143 - Enable X-FRAME-Options header to implement clickjacking protection - this may, however, break things.
- Test the SSL with a SSL test suite, such as the one from Qualys SSL Labs and correct any problems.
- Setup a firewall.
- Configure automatic security updates.
- Subscribe to the security system mailing list of your operating system for security alerts.
- If using Linux, configure SSH to use public key authentication only and enable Fail2Ban.
- Update JIRA and the operating system regularly.
- Ensure that files in Jira Home directory and Jira Installation directory are not readable by everyone. Some files may contain sensitive information (eg. dbconfig.xml, attachments, etc)
- Ensure JIRA is run as a user that is not root.
- Evaluate if the permission scheme "Browse issues" permission makes sense, as it is "Any logged in user" by default. When public signup is enabled, this could enable any new user to see all issues if no changes are made.
Additionally, if using AppArmor there are some available, unsupported, profiles that can be installed as per https://bitbucket.org/asecurityteam/atlassian-apparmor-profiles.
最終更新日: 2025 年 2 月 10 日
Powered by Confluence and Scroll Viewport.