CIS policy on OTRS

Moderator: crythias

Post Reply
mohsinkhan009
Znuny newbie
Posts: 64
Joined: 02 Sep 2015, 08:47
Znuny Version: OTRS-Rel-5

CIS policy on OTRS

Post by mohsinkhan009 »

What is the support of CIS policy on OTRS?
One of the customer is interest in using the CIS policy for OTRS, needs to whether CIS policy is supported by OTRS or not. any input will be valuable.

regards,
Mohsin khan
jojo
Znuny guru
Posts: 15019
Joined: 26 Jan 2007, 14:50
Znuny Version: Git Master
Contact:

Re: CIS policy on OTRS

Post by jojo »

implementing CIS policies are typically a set of measures in a company and within IT services which might include hardeining of servers. So please be more precice with your question
"Production": OTRS™ 8, OTRS™ 7, STORM powered by OTRS
"Testing": ((OTRS Community Edition)) and git Master

Never change Defaults.pm! :: Blog
Professional Services:: http://www.otrs.com :: enjoy@otrs.com
mohsinkhan009
Znuny newbie
Posts: 64
Joined: 02 Sep 2015, 08:47
Znuny Version: OTRS-Rel-5

Re: CIS policy on OTRS

Post by mohsinkhan009 »

Whether OTRS will support the CIS hardening. Also please let us know the precise question so that it will be helpful.
jojo
Znuny guru
Posts: 15019
Joined: 26 Jan 2007, 14:50
Znuny Version: Git Master
Contact:

Re: CIS policy on OTRS

Post by jojo »

CIS hardening is about OS, Software Layer, monitoring, organisational processes etc.

So please elaborate what kind of hardening you would need for the OTRS software layer.
"Production": OTRS™ 8, OTRS™ 7, STORM powered by OTRS
"Testing": ((OTRS Community Edition)) and git Master

Never change Defaults.pm! :: Blog
Professional Services:: http://www.otrs.com :: enjoy@otrs.com
mohsinkhan009
Znuny newbie
Posts: 64
Joined: 02 Sep 2015, 08:47
Znuny Version: OTRS-Rel-5

Re: CIS policy on OTRS

Post by mohsinkhan009 »

Hi Jojo,

We have a customer implementation planned ahead, they have CIS hardening policy that will be implemented during infra setup and hardening will be done according to https://www.cisecurity.org/cis-benchmarks/.

Profile 2 of the above CIS policy will be implemented.

Can you please help to know whether it will impact on OTRS performance or functionality, where OTRS is on RHEL server.
jojo
Znuny guru
Posts: 15019
Joined: 26 Jan 2007, 14:50
Znuny Version: Git Master
Contact:

Re: CIS policy on OTRS

Post by jojo »

OTRS will not be useable out of the box with profile 2
"Production": OTRS™ 8, OTRS™ 7, STORM powered by OTRS
"Testing": ((OTRS Community Edition)) and git Master

Never change Defaults.pm! :: Blog
Professional Services:: http://www.otrs.com :: enjoy@otrs.com
mohsinkhan009
Znuny newbie
Posts: 64
Joined: 02 Sep 2015, 08:47
Znuny Version: OTRS-Rel-5

Re: CIS policy on OTRS

Post by mohsinkhan009 »

Hi Jojo,

Is there is any other alternative for hardening if level 2 is not supported.
bschmalhofer
Znuny newbie
Posts: 12
Joined: 30 Apr 2020, 15:16
Znuny Version: 6.0
Real Name: Bernhard Schmalhofer
Company: Bernhard Schmalhofer
Location: Munich
Contact:

Re: CIS policy on OTRS

Post by bschmalhofer »

Hi,
this might be nonsense, as I'm not really versed in security. Is running OTRS, or OTOBO, in Docker an option? There you would have a defined interface what the application can, and cannot, do. You can take a look at https://hub.docker.com/r/juanluisbaptiste/otrs and at https://hub.docker.com/r/rotheross/otobo.

Best regards,
Bernhard
jojo
Znuny guru
Posts: 15019
Joined: 26 Jan 2007, 14:50
Znuny Version: Git Master
Contact:

Re: CIS policy on OTRS

Post by jojo »

mohsinkhan009 wrote: 20 Aug 2020, 08:26 Hi Jojo,

Is there is any other alternative for hardening if level 2 is not supported.
Hardening and requirements have to be checked. So you should first analyse what kind of hardening of the application is missing for operations of OTRS
"Production": OTRS™ 8, OTRS™ 7, STORM powered by OTRS
"Testing": ((OTRS Community Edition)) and git Master

Never change Defaults.pm! :: Blog
Professional Services:: http://www.otrs.com :: enjoy@otrs.com
mohsinkhan009
Znuny newbie
Posts: 64
Joined: 02 Sep 2015, 08:47
Znuny Version: OTRS-Rel-5

Re: CIS policy on OTRS

Post by mohsinkhan009 »

Hi Jojo,

“how OTRS functionality will be impacted” if CIS hardening level 2 is implemented on OTRS servers.

can you please provide your input.
jojo
Znuny guru
Posts: 15019
Joined: 26 Jan 2007, 14:50
Znuny Version: Git Master
Contact:

Re: CIS policy on OTRS

Post by jojo »

Hi,

I'm not offering such kind of consultancy for free.
"Production": OTRS™ 8, OTRS™ 7, STORM powered by OTRS
"Testing": ((OTRS Community Edition)) and git Master

Never change Defaults.pm! :: Blog
Professional Services:: http://www.otrs.com :: enjoy@otrs.com
mohsinkhan009
Znuny newbie
Posts: 64
Joined: 02 Sep 2015, 08:47
Znuny Version: OTRS-Rel-5

Re: CIS policy on OTRS

Post by mohsinkhan009 »

Hi Jojo,

I appreciate your effort in helping out in OTRS issue which comes on the forum. as a expert advice your input are valuable
Post Reply