Mercurial > hg > orthanc-book
annotate Sphinx/source/faq/security.rst @ 940:dec770139554
typo
| author | Sebastien Jodogne <s.jodogne@gmail.com> |
|---|---|
| date | Fri, 21 Apr 2023 09:19:40 +0200 |
| parents | 84a6892495f6 |
| children | 4a2b55b602fe |
| rev | line source |
|---|---|
| 238 | 1 .. _security: |
| 2 | |
| 3 Securing Orthanc | |
| 4 ================ | |
| 5 | |
| 6 .. contents:: | |
| 7 | |
| 8 Orthanc is a microservice for medical imaging. Out-of-the-box, it | |
| 9 makes the assumption that it runs on the localhost, within a secured | |
| 10 environment. As a consequence, care must be taken if deploying Orthanc | |
| 11 in a insecure environment, especially if it is run as a public-facing | |
| 12 service on Internet. This page provides instructions to secure Orthanc | |
| 13 through its :ref:`configuration options <configuration>`. | |
| 14 | |
| 15 | |
| 16 General configuration | |
| 17 --------------------- | |
| 18 | |
| 19 As for any service running on a computer, you should: | |
| 20 | |
| 21 * Make sure to run the Orthanc service as a separate user. In | |
| 22 particular, never run Orthanc as the ``root`` user on GNU/Linux, or | |
| 23 as the ``Administrator`` user on Microsoft Windows. | |
| 24 | |
| 25 * Contact your network administrators to setup `Intranet firewalls | |
| 26 <https://en.wikipedia.org/wiki/Firewall_(computing)>`__, so that | |
| 27 only trusted computers can contact Orthanc through its REST API | |
| 28 or through the DICOM protocol. | |
| 29 | |
|
634
2571d7f4e135
protect configuration file
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
609
diff
changeset
|
30 * Make sure that the :ref:`configuration files <configuration>` |
|
2571d7f4e135
protect configuration file
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
609
diff
changeset
|
31 containing confidential information or private keys (typically |
|
2571d7f4e135
protect configuration file
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
609
diff
changeset
|
32 ``RegisteredUsers``) are only readable by the user that runs |
|
2571d7f4e135
protect configuration file
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
609
diff
changeset
|
33 Orthanc. |
|
2571d7f4e135
protect configuration file
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
609
diff
changeset
|
34 |
| 238 | 35 Care must also be taken about some configuration options specific to |
| 36 Orthanc: | |
| 37 | |
| 38 * ``LimitFindResults`` and ``LimitFindInstances`` should not be set to | |
| 39 zero to avoid making Orthanc unresponsive on large databases by a | |
| 40 malicious user that would make many lookups within Orthanc. A value | |
| 41 of ``100`` should be a good compromise. | |
| 42 | |
| 43 * ``HttpsVerifyPeers`` should be set to ``true`` to secure outgoing | |
| 44 connections to remote HTTPS servers (such as when Orthanc is acting | |
| 45 as a :ref:`DICOMweb client <dicomweb-client>`). | |
| 46 | |
| 47 * Make sure to understand the implications of the | |
| 48 ``OverwriteInstances`` option. | |
| 49 | |
| 50 * You might also be interested in checking the options related to | |
| 51 :ref:`performance optimization <scalability>`. | |
| 52 | |
| 526 | 53 |
| 54 .. _security_http: | |
| 238 | 55 |
| 56 Securing the HTTP server | |
| 57 ------------------------ | |
| 58 | |
| 59 .. highlight:: lua | |
| 60 | |
| 61 Orthanc publishes a :ref:`REST API <rest>` that provides full | |
| 62 programmatic access to its content, in read/write. This means for | |
| 63 instance that a malicious user could delete the entire content of the | |
| 64 server, or could inspect confidential medical data. | |
| 65 | |
| 66 By default, the HTTP server is restricted to the localhost to prevent | |
| 67 such attacks from the outside world. However, as soon as external | |
| 68 access is granted by setting the ``RemoteAccessAllowed`` configuration | |
| 69 option to ``true``, you should: | |
| 70 | |
| 71 * Set ``AuthenticationEnabled`` to ``true`` to force the users to | |
| 72 authenticate. The authorized users are listed in the option | |
| 73 ``RegisteredUsers``. | |
| 74 | |
| 75 * Enable :ref:`HTTPS encryption <https>` to prevent the stealing of | |
| 76 medical data or passwords, even on the Intranet. | |
| 77 | |
| 78 * If Orthanc is put on a server that can be contacted from Internet, | |
| 79 put Orthanc behind a :ref:`reverse proxy <https>`, and let this | |
| 80 reverse proxy take care of the HTTPS encryption. | |
| 512 | 81 |
| 82 * Enable :ref:`Client certificate authentication <https>` between multiple | |
| 83 Orthanc peers. | |
| 84 | |
| 526 | 85 * Consider turning of the :ref:`embedded WebDAV server <webdav>` by |
| 86 setting configuration option ``WebDavEnabled`` to ``false``. | |
| 938 | 87 |
| 88 * Ensure that ``/tools/execute-script`` is disabled by leaving the configuration | |
| 89 ``ExecuteLuaEnabled`` to its default ``false`` value. | |
| 90 | |
| 91 * Ensure that the REST API can not write to the filesystem (e.g. in the | |
| 92 ``/instances/../export`` route) by leaving the configuration | |
| 940 | 93 ``RestApiWriteToFileSystemEnabled`` to its default ``false`` value. |
| 938 | 94 |
| 238 | 95 * Setup rules that define, for each authorized user, which resources |
| 96 it can access, and through which HTTP method (GET, POST, DELETE | |
| 97 and/or PUT). This can be done by defining a :ref:`filter written in | |
| 98 Lua <lua-filter-rest>`. Here is a sample Lua filter that | |
| 99 differentiates between an administrator user (``admin``) who has | |
| 100 full access on the localhost only, and a generic user (``user``) | |
| 101 that has only read-only access:: | |
| 102 | |
| 103 function IncomingHttpRequestFilter(method, uri, ip, username, httpHeaders) | |
| 104 if method == 'GET' and (username == 'user' or username == 'admin') then | |
| 105 -- Read-only access (only GET method is allowed) | |
| 106 return true | |
| 107 elseif username == 'admin' and ip == '127.0.0.1' then | |
| 108 -- Read-write access for administrator (any HTTP method is allowed on localhost) | |
| 109 return true | |
| 110 else | |
| 111 -- Access is disallowed by default | |
| 112 return false | |
| 113 end | |
| 114 end | |
| 115 | |
| 116 Very importantly, make sure to protect ``POST`` access to the | |
| 117 ``/tools/execute-script`` URI. This URI can indeed be used by a | |
| 118 malicious user to execute any system command on the computer as the | |
| 119 user that runs Orthanc. | |
| 120 | |
| 121 * Consider implementing a :ref:`higher-level application | |
| 289 | 122 <improving-interface>` (e.g. in PHP, Java, Django...) that takes |
| 123 care of user authentication/authorization, and that is the only one | |
| 124 to be allowed to contact the Orthanc REST API. In particular, you | |
| 125 must create a higher-level application so as to properly deal with | |
| 126 `CSRF attacks | |
| 127 <https://en.wikipedia.org/wiki/Cross-site_request_forgery>`__: | |
| 128 Indeed, as explained in the introduction, Orthanc is a microservice | |
| 129 that is designed to be used within a secured environment. | |
| 238 | 130 |
| 812 | 131 * Configuration option ``OrthancExplorerEnabled`` should be set to |
| 132 ``false`` in Internet-facing deployments. | |
| 133 | |
| 238 | 134 * For advanced scenarios, you might have interest in the |
| 135 :ref:`advanced authorization plugin <authorization>`. Similarly, | |
| 136 developers of :ref:`plugins <plugins>` could be interested by the | |
| 137 ``OrthancPluginRegisterIncomingHttpRequestFilter2()`` function | |
| 138 provided by the Orthanc plugin SDK. | |
| 139 | |
| 140 | |
| 141 **Remark:** These parameters also apply to the :ref:`DICOMweb server plugin <dicomweb>`. | |
| 142 | |
| 143 | |
| 144 Securing the DICOM server | |
| 145 ------------------------- | |
| 146 | |
| 147 .. highlight:: json | |
| 148 | |
| 149 Besides its REST API that is served through its embedded HTTP/HTTPS | |
| 150 server, Orthanc also acts as a :ref:`DICOM server <dicom-protocol>` | |
| 151 (more precisely, as a DICOM SCP). | |
| 152 | |
| 248 | 153 In general, the DICOM protocol should be disabled if running Orthanc |
| 154 on a cloud server, except if you use a VPN (cf. `reference | |
| 517 | 155 <https://groups.google.com/d/msg/orthanc-users/yvHexxG3dTY/7s3A7EHVBAAJ>`__) |
| 156 or a SSH tunnel (cf. `reference | |
| 518 | 157 <https://www.howtogeek.com/168145/how-to-use-ssh-tunneling/>`__). Favor |
| 517 | 158 HTTPS for transfering medical images across sites (see above). You can |
| 159 turn off DICOM protocol by setting the configuration option | |
| 160 ``DicomServerEnabled`` to ``false``. | |
| 248 | 161 |
| 238 | 162 The DICOM modalities that are known to Orthanc are defined by setting |
| 163 the ``DicomModalities`` configuration option. Out-of-the-box, Orthanc | |
| 164 accepts C-ECHO and C-STORE commands sent by unknown modalities, but | |
| 165 blocks C-FIND and C-MOVE commands issued by unknown modalities. | |
| 166 | |
| 167 To fully secure the DICOM protocol, you should: | |
| 168 | |
| 169 * Set the ``DicomAlwaysAllowEcho`` configuration option to ``false`` | |
| 170 to disallow C-ECHO commands from unknown modalities. | |
| 171 | |
| 172 * Set the ``DicomAlwaysAllowStore`` configuration option to ``false`` | |
| 173 to disallow C-STORE commands from unknown modalities. | |
| 174 | |
| 175 * Set the ``DicomCheckModalityHost`` configuration option to ``true`` | |
|
683
11e536e70b37
ip addresses are mandatory if DicomCheckModalityHost is true
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
634
diff
changeset
|
176 to validate the IP address of the remote modalities (note that |
|
11e536e70b37
ip addresses are mandatory if DicomCheckModalityHost is true
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
634
diff
changeset
|
177 hostnames cannot be used in ``DicomModalities`` when this option is |
|
11e536e70b37
ip addresses are mandatory if DicomCheckModalityHost is true
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
634
diff
changeset
|
178 enabled: The ``Host`` values should only contain IP addresses). |
| 238 | 179 |
| 180 * For each modality that is defined in ``DicomModalities``, | |
| 181 selectively specify what DICOM commands are allowed to be issued by | |
| 182 the SCU of this modality by setting the suboptions ``AllowEcho``, | |
| 413 | 183 ``AllowFind``, ``AllowMove``, ``AllowStore`` and ``AllowGet``. For instance, a |
| 238 | 184 modality could be allowed to C-STORE images, but be disallowed to |
| 185 C-FIND the content of Orthanc. Here is a sample configuration to | |
| 186 define a single modality that is only allowed to send DICOM | |
| 187 instances to Orthanc:: | |
| 188 | |
| 189 { | |
| 190 "DicomModalities" : { | |
| 191 "untrusted" : { | |
| 192 "AET" : "CT", | |
| 193 "Port" : 104, | |
| 194 "Host" : "192.168.0.10", | |
| 195 "AllowEcho" : false, | |
| 196 "AllowFind" : false, | |
| 197 "AllowMove" : false, | |
| 413 | 198 "AllowGet" : false, |
| 238 | 199 "AllowStore" : true |
| 200 } | |
| 201 } | |
| 202 } | |
| 203 | |
| 204 **Note:** These configuration suboptions only affect the behavior of | |
| 205 the DICOM SCP of Orthanc (i.e. for incoming connections). Orthanc | |
| 206 will always be able to make outgoing DICOM SCU connections to these | |
| 207 modalities, independently of the value of these suboptions. | |
| 208 | |
| 209 * Consider implementing a :ref:`filter implemented in Lua | |
| 210 <lua-filter-rest>` to restrict which modalities can C-STORE images | |
| 211 within Orthanc, and which kind of images are accepted by Orthanc. | |
| 212 | |
| 213 * Consider setting ``DicomCheckCalledAet`` to ``true`` to force proper | |
| 214 configuration of remote modalities. | |
| 215 | |
| 216 | |
|
609
0dde82745e0d
documentation of DICOM TLS
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
588
diff
changeset
|
217 Starting with Orthanc 1.9.0, `DICOM TLS encryption |
|
0dde82745e0d
documentation of DICOM TLS
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
588
diff
changeset
|
218 <https://www.dicomstandard.org/using/security/>`__ is supported by |
|
0dde82745e0d
documentation of DICOM TLS
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
588
diff
changeset
|
219 Orthanc. If you need to share DICOM instances between sites, but if |
|
0dde82745e0d
documentation of DICOM TLS
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
588
diff
changeset
|
220 you don't want to use DICOMweb or Orthanc peers over HTTPS, you must |
|
0dde82745e0d
documentation of DICOM TLS
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
588
diff
changeset
|
221 enable :ref:`DICOM TLS in Orthanc <dicom-tls>` to ensure secure |
|
0dde82745e0d
documentation of DICOM TLS
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
588
diff
changeset
|
222 exchanges. |
|
0dde82745e0d
documentation of DICOM TLS
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
588
diff
changeset
|
223 |
|
0dde82745e0d
documentation of DICOM TLS
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
588
diff
changeset
|
224 As a workaround for the releases <= 1.8.2 of Orthanc that don't |
|
0dde82745e0d
documentation of DICOM TLS
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
588
diff
changeset
|
225 support DICOM TLS, `it has been reported |
|
544
d7ec7ea133b8
note about nginx to emulate dicom tls
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
528
diff
changeset
|
226 <https://www.digihunch.com/2020/11/medical-imaging-web-server-deployment-pipeline/>`__ |
|
d7ec7ea133b8
note about nginx to emulate dicom tls
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
528
diff
changeset
|
227 that the "*SSL Termination for TCP Upstream Servers*" feature of nginx |
| 546 | 228 can be used to emulate DICOM TLS. Another option is to use `stunnel |
|
609
0dde82745e0d
documentation of DICOM TLS
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
588
diff
changeset
|
229 <https://www.stunnel.org/>`__. |
|
586
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
230 |
|
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
231 |
|
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
232 Securing the storage |
|
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
233 -------------------- |
|
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
234 |
|
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
235 In general, for security, Orthanc should store its database index |
|
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
236 (PostgreSQL, SQLite...) and its :ref:`storage area <orthanc-storage>` |
|
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
237 for DICOM files on an `on-premises, self-hosted infrastructure |
|
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
238 <https://en.wikipedia.org/wiki/On-premises_software>`__ with `disk |
| 588 | 239 encryption |
| 240 <https://en.wikipedia.org/wiki/Disk_encryption>`__. Similarly, Orthanc | |
| 241 itself should ideally run on your own on-premises infrastructure, and | |
| 242 not on a virtual machine that is managed by a public cloud solution | |
| 243 provider. | |
|
586
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
244 |
| 588 | 245 Depending on your jurisdiction, it might be possible to move the |
| 246 storage area to a `cloud-based object storage | |
| 247 <https://en.wikipedia.org/wiki/Object_storage>`__, by using the | |
| 248 :ref:`dedicated storage plugins <object-storage>`. :ref:`Orthanc-side | |
| 249 encryption <client-side-encryption>` should be enabled in such a | |
| 250 situation. | |
|
586
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
251 |
|
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
252 In any case, make sure to get legal advice that is very specific to |
|
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
253 the legislation of the countries where you are active (for |
|
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
254 illustration, check out the recent debates over the `privacy shield |
|
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
255 <https://en.wikipedia.org/wiki/EU%E2%80%93US_Privacy_Shield>`__ in |
|
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
256 Europe). Make sure to understand the implications of using cloud-based |
|
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
257 object storage, of using virtual machines in the cloud to store health |
| 588 | 258 data, of using managed database servers (even with so-called |
| 259 "encryption-at-rest" features)... | |
|
586
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
260 |
|
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
261 As a free and open-source project, the Orthanc ecosystem cannot be |
|
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
262 taken as liable for any security breach or data leak in your |
|
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
263 deployments, for any misconfiguration, for any bad handling of |
|
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
264 personal/health data, for any bypassing of regulatory requirements, |
|
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
265 for not being compliant with your local legislation, or for any |
|
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
266 similar stuff: Orthanc is just software, security is your |
|
5f5519f1491a
securing the storage
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
568
diff
changeset
|
267 responsibility. |