Mercurial > hg > orthanc-book
annotate Sphinx/source/faq/security.rst @ 805:d8ad5728a179
community
| author | Sebastien Jodogne <s.jodogne@gmail.com> |
|---|---|
| date | Mon, 24 Jan 2022 13:59:11 +0100 |
| parents | 11e536e70b37 |
| children | 49ec83c000e9 |
| rev | line source |
|---|---|
| 238 | 1 .. _security: |
| 2 | |
| 3 Securing Orthanc | |
| 4 ================ | |
| 5 | |
| 6 .. contents:: | |
| 7 | |
| 8 Orthanc is a microservice for medical imaging. Out-of-the-box, it | |
| 9 makes the assumption that it runs on the localhost, within a secured | |
| 10 environment. As a consequence, care must be taken if deploying Orthanc | |
| 11 in a insecure environment, especially if it is run as a public-facing | |
| 12 service on Internet. This page provides instructions to secure Orthanc | |
| 13 through its :ref:`configuration options <configuration>`. | |
| 14 | |
| 15 | |
| 16 General configuration | |
| 17 --------------------- | |
| 18 | |
| 19 As for any service running on a computer, you should: | |
| 20 | |
| 21 * Make sure to run the Orthanc service as a separate user. In | |
| 22 particular, never run Orthanc as the ``root`` user on GNU/Linux, or | |
| 23 as the ``Administrator`` user on Microsoft Windows. | |
| 24 | |
| 25 * Contact your network administrators to setup `Intranet firewalls | |
| 26 <https://en.wikipedia.org/wiki/Firewall_(computing)>`__, so that | |
| 27 only trusted computers can contact Orthanc through its REST API | |
| 28 or through the DICOM protocol. | |
| 29 | |
|
634
2571d7f4e135
protect configuration file
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
609
diff
changeset
|
30 * Make sure that the :ref:`configuration files <configuration>` |
|
2571d7f4e135
protect configuration file
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
609
diff
changeset
|
31 containing confidential information or private keys (typically |
|
2571d7f4e135
protect configuration file
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
609
diff
changeset
|
32 ``RegisteredUsers``) are only readable by the user that runs |
|
2571d7f4e135
protect configuration file
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
609
diff
changeset
|
33 Orthanc. |
|
2571d7f4e135
protect configuration file
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
609
diff
changeset
|
34 |
| 238 | 35 Care must also be taken about some configuration options specific to |
| 36 Orthanc: | |
| 37 | |
| 38 * ``LimitFindResults`` and ``LimitFindInstances`` should not be set to | |
| 39 zero to avoid making Orthanc unresponsive on large databases by a | |
| 40 malicious user that would make many lookups within Orthanc. A value | |
| 41 of ``100`` should be a good compromise. | |
| 42 | |
| 43 * ``HttpsVerifyPeers`` should be set to ``true`` to secure outgoing | |
| 44 connections to remote HTTPS servers (such as when Orthanc is acting | |
| 45 as a :ref:`DICOMweb client <dicomweb-client>`). | |
| 46 | |
| 47 * Make sure to understand the implications of the | |
| 48 ``OverwriteInstances`` option. | |
| 49 | |
| 50 * You might also be interested in checking the options related to | |
| 51 :ref:`performance optimization <scalability>`. | |
| 52 | |
| 526 | 53 |
| 54 .. _security_http: | |
| 238 | 55 |
| 56 Securing the HTTP server | |
| 57 ------------------------ | |
| 58 | |
| 59 .. highlight:: lua | |
| 60 | |
| 61 Orthanc publishes a :ref:`REST API <rest>` that provides full | |
| 62 programmatic access to its content, in read/write. This means for | |
| 63 instance that a malicious user could delete the entire content of the | |
| 64 server, or could inspect confidential medical data. | |
| 65 | |
| 66 By default, the HTTP server is restricted to the localhost to prevent | |
| 67 such attacks from the outside world. However, as soon as external | |
| 68 access is granted by setting the ``RemoteAccessAllowed`` configuration | |
| 69 option to ``true``, you should: | |
| 70 | |
| 71 * Set ``AuthenticationEnabled`` to ``true`` to force the users to | |
| 72 authenticate. The authorized users are listed in the option | |
| 73 ``RegisteredUsers``. | |
| 74 | |
| 75 * Enable :ref:`HTTPS encryption <https>` to prevent the stealing of | |
| 76 medical data or passwords, even on the Intranet. | |
| 77 | |
| 78 * If Orthanc is put on a server that can be contacted from Internet, | |
| 79 put Orthanc behind a :ref:`reverse proxy <https>`, and let this | |
| 80 reverse proxy take care of the HTTPS encryption. | |
| 512 | 81 |
| 82 * Enable :ref:`Client certificate authentication <https>` between multiple | |
| 83 Orthanc peers. | |
| 84 | |
| 526 | 85 * Consider turning of the :ref:`embedded WebDAV server <webdav>` by |
| 86 setting configuration option ``WebDavEnabled`` to ``false``. | |
| 87 | |
| 238 | 88 * Setup rules that define, for each authorized user, which resources |
| 89 it can access, and through which HTTP method (GET, POST, DELETE | |
| 90 and/or PUT). This can be done by defining a :ref:`filter written in | |
| 91 Lua <lua-filter-rest>`. Here is a sample Lua filter that | |
| 92 differentiates between an administrator user (``admin``) who has | |
| 93 full access on the localhost only, and a generic user (``user``) | |
| 94 that has only read-only access:: | |
| 95 | |
| 96 function IncomingHttpRequestFilter(method, uri, ip, username, httpHeaders) | |
| 97 if method == 'GET' and (username == 'user' or username == 'admin') then | |
| 98 -- Read-only access (only GET method is allowed) | |
| 99 return true | |
| 100 elseif username == 'admin' and ip == '127.0.0.1' then | |
| 101 -- Read-write access for administrator (any HTTP method is allowed on localhost) | |
| 102 return true | |
| 103 else | |
| 104 -- Access is disallowed by default | |
| 105 return false | |
| 106 end | |
| 107 end | |
| 108 | |
| 109 Very importantly, make sure to protect ``POST`` access to the | |
| 110 ``/tools/execute-script`` URI. This URI can indeed be used by a | |
| 111 malicious user to execute any system command on the computer as the | |
| 112 user that runs Orthanc. | |
| 113 | |
| 114 * Consider implementing a :ref:`higher-level application | |
| 289 | 115 <improving-interface>` (e.g. in PHP, Java, Django...) that takes |
| 116 care of user authentication/authorization, and that is the only one | |
| 117 to be allowed to contact the Orthanc REST API. In particular, you | |
| 118 must create a higher-level application so as to properly deal with | |
| 119 `CSRF attacks | |
| 120 <https://en.wikipedia.org/wiki/Cross-site_request_forgery>`__: | |
| 121 Indeed, as explained in the introduction, Orthanc is a microservice | |
| 122 that is designed to be used within a secured environment. | |
| 238 | 123 |
| 124 * For advanced scenarios, you might have interest in the | |
| 125 :ref:`advanced authorization plugin <authorization>`. Similarly, | |
| 126 developers of :ref:`plugins <plugins>` could be interested by the | |
| 127 ``OrthancPluginRegisterIncomingHttpRequestFilter2()`` function | |
| 128 provided by the Orthanc plugin SDK. | |
| 129 | |
| 130 | |
| 131 **Remark:** These parameters also apply to the :ref:`DICOMweb server plugin <dicomweb>`. | |
| 132 | |
| 133 | |
| 134 Securing the DICOM server | |
| 135 ------------------------- | |
| 136 | |
| 137 .. highlight:: json | |
| 138 | |
| 139 Besides its REST API that is served through its embedded HTTP/HTTPS | |
| 140 server, Orthanc also acts as a :ref:`DICOM server <dicom-protocol>` | |
| 141 (more precisely, as a DICOM SCP). | |
| 142 | |
| 248 | 143 In general, the DICOM protocol should be disabled if running Orthanc |
| 144 on a cloud server, except if you use a VPN (cf. `reference | |
| 517 | 145 <https://groups.google.com/d/msg/orthanc-users/yvHexxG3dTY/7s3A7EHVBAAJ>`__) |
| 146 or a SSH tunnel (cf. `reference | |
| 518 | 147 <https://www.howtogeek.com/168145/how-to-use-ssh-tunneling/>`__). Favor |
| 517 | 148 HTTPS for transfering medical images across sites (see above). You can |
| 149 turn off DICOM protocol by setting the configuration option | |
| 150 ``DicomServerEnabled`` to ``false``. | |
| 248 | 151 |
| 238 | 152 The DICOM modalities that are known to Orthanc are defined by setting |
| 153 the ``DicomModalities`` configuration option. Out-of-the-box, Orthanc | |
| 154 accepts C-ECHO and C-STORE commands sent by unknown modalities, but | |
| 155 blocks C-FIND and C-MOVE commands issued by unknown modalities. | |
| 156 | |
| 157 To fully secure the DICOM protocol, you should: | |
| 158 | |
| 159 * Set the ``DicomAlwaysAllowEcho`` configuration option to ``false`` | |
| 160 to disallow C-ECHO commands from unknown modalities. | |
| 161 | |
| 162 * Set the ``DicomAlwaysAllowStore`` configuration option to ``false`` | |
| 163 to disallow C-STORE commands from unknown modalities. | |
| 164 | |
| 165 * Set the ``DicomCheckModalityHost`` configuration option to ``true`` | |
|
683
11e536e70b37
ip addresses are mandatory if DicomCheckModalityHost is true
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
634
diff
changeset
|
166 to validate the IP address of the remote modalities (note that |
|
11e536e70b37
ip addresses are mandatory if DicomCheckModalityHost is true
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
634
diff
changeset
|
167 hostnames cannot be used in ``DicomModalities`` when this option is |
|
11e536e70b37
ip addresses are mandatory if DicomCheckModalityHost is true
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
634
diff
changeset
|
168 enabled: The ``Host`` values should only contain IP addresses). |
| 238 | 169 |
| 170 * For each modality that is defined in ``DicomModalities``, | |
| 171 selectively specify what DICOM commands are allowed to be issued by | |
| 172 the SCU of this modality by setting the suboptions ``AllowEcho``, | |
| 413 | 173 ``AllowFind``, ``AllowMove``, ``AllowStore`` and ``AllowGet``. For instance, a |
| 238 | 174 modality could be allowed to C-STORE images, but be disallowed to |
| 175 C-FIND the content of Orthanc. Here is a sample configuration to | |
| 176 define a single modality that is only allowed to send DICOM | |
| 177 instances to Orthanc:: | |
| 178 | |
| 179 { | |
| 180 "DicomModalities" : { | |
| 181 "untrusted" : { | |
| 182 "AET" : "CT", | |
| 183 "Port" : 104, | |
| 184 "Host" : "192.168.0.10", | |
| 185 "AllowEcho" : false, | |
| 186 "AllowFind" : false, | |
| 187 "AllowMove" : false, | |
| 413 | 188 "AllowGet" : false, |
| 238 | 189 "AllowStore" : true |
| 190 } | |
| 191 } | |
| 192 } | |
| 193 | |
| 194 **Note:** These configuration suboptions only affect the behavior of | |
| 195 the DICOM SCP of Orthanc (i.e. for incoming connections). Orthanc | |
| 196 will always be able to make outgoing DICOM SCU connections to these | |
| 197 modalities, independently of the value of these suboptions. | |
| 198 | |
| 199 * Consider implementing a :ref:`filter implemented in Lua | |
| 200 <lua-filter-rest>` to restrict which modalities can C-STORE images | |
| 201 within Orthanc, and which kind of images are accepted by Orthanc. | |
| 202 | |
| 203 * Consider setting ``DicomCheckCalledAet`` to ``true`` to force proper | |
| 204 configuration of remote modalities. | |
| 205 | |
| 206 | |
|
609
0dde82745e0d
documentation of DICOM TLS
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
588
diff
changeset
|
207 Starting with Orthanc 1.9.0, `DICOM TLS encryption |
|
0dde82745e0d
documentation of DICOM TLS
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
588
diff
changeset
|
208 <https://www.dicomstandard.org/using/security/>`__ is supported by |
|
0dde82745e0d
documentation of DICOM TLS
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
588
diff
changeset
|
209 Orthanc. If you need to share DICOM instances between sites, but if |
|
0dde82745e0d
documentation of DICOM TLS
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
588
diff
changeset
|
210 you don't want to use DICOMweb or Orthanc peers over HTTPS, you must |
|
0dde82745e0d
documentation of DICOM TLS
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
588
diff
changeset
|
211 enable :ref:`DICOM TLS in Orthanc <dicom-tls>` to ensure secure |
|
0dde82745e0d
documentation of DICOM TLS
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
588
diff
changeset
|
212 exchanges. |
|
0dde82745e0d
documentation of DICOM TLS
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
588
diff
changeset
|
213 |
|
0dde82745e0d
documentation of DICOM TLS
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
588
diff
changeset
|
214 As a workaround for the releases <= 1.8.2 of Orthanc that don't |
|
0dde82745e0d
documentation of DICOM TLS
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
588
diff
changeset
|
215 support DICOM TLS, `it has been reported |
|
544
d7ec7ea133b8
note about nginx to emulate dicom tls
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
528
diff
changeset
|
216 <https://www.digihunch.com/2020/11/medical-imaging-web-server-deployment-pipeline/>`__ |
|
d7ec7ea133b8
note about nginx to emulate dicom tls
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
528
diff
changeset
|
217 that the "*SSL Termination for TCP Upstream Servers*" feature of nginx |
| 546 | 218 can be used to emulate DICOM TLS. Another option is to use `stunnel |
|
609
0dde82745e0d
documentation of DICOM TLS
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
588
diff
changeset
|
219 <https://www.stunnel.org/>`__. |
|
586
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
220 |
|
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
221 |
|
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
222 Securing the storage |
|
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
223 -------------------- |
|
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
224 |
|
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
225 In general, for security, Orthanc should store its database index |
|
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
226 (PostgreSQL, SQLite...) and its :ref:`storage area <orthanc-storage>` |
|
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
227 for DICOM files on an `on-premises, self-hosted infrastructure |
|
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
228 <https://en.wikipedia.org/wiki/On-premises_software>`__ with `disk |
| 588 | 229 encryption |
| 230 <https://en.wikipedia.org/wiki/Disk_encryption>`__. Similarly, Orthanc | |
| 231 itself should ideally run on your own on-premises infrastructure, and | |
| 232 not on a virtual machine that is managed by a public cloud solution | |
| 233 provider. | |
|
586
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
234 |
| 588 | 235 Depending on your jurisdiction, it might be possible to move the |
| 236 storage area to a `cloud-based object storage | |
| 237 <https://en.wikipedia.org/wiki/Object_storage>`__, by using the | |
| 238 :ref:`dedicated storage plugins <object-storage>`. :ref:`Orthanc-side | |
| 239 encryption <client-side-encryption>` should be enabled in such a | |
| 240 situation. | |
|
586
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
241 |
|
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
242 In any case, make sure to get legal advice that is very specific to |
|
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
243 the legislation of the countries where you are active (for |
|
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
244 illustration, check out the recent debates over the `privacy shield |
|
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
245 <https://en.wikipedia.org/wiki/EU%E2%80%93US_Privacy_Shield>`__ in |
|
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
246 Europe). Make sure to understand the implications of using cloud-based |
|
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
247 object storage, of using virtual machines in the cloud to store health |
| 588 | 248 data, of using managed database servers (even with so-called |
| 249 "encryption-at-rest" features)... | |
|
586
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
250 |
|
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
251 As a free and open-source project, the Orthanc ecosystem cannot be |
|
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
252 taken as liable for any security breach or data leak in your |
|
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
253 deployments, for any misconfiguration, for any bad handling of |
|
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
254 personal/health data, for any bypassing of regulatory requirements, |
|
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
255 for not being compliant with your local legislation, or for any |
|
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
256 similar stuff: Orthanc is just software, security is your |
|
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
257 responsibility. |