Security features at a glance

What it is for

Version 4.8.7 implements the findings of two security audits. Most changes take effect without any action: stricter checks of who a user, a phone or a location belongs to, verified TLS connections to CUCM and Unity Connection, security headers on all pages and a log of write actions.

Some features, however, require a decision or a manual step by the administrator. This chapter summarizes them and refers to the chapters with the respective instructions.

Prerequisites

An account with the access type Administrator (full access) (ROLE_APP_ADMIN) or the owner account (ROLE_OWNER). Only these accounts see the Administration menu.
For two-factor sign-in: the owner account and working e-mail delivery.
For the audit log: the permission Open logs and audit log (ROLE_APP_VIEW_LOG_PAGE) or an administrator account.

Step by step: basic hardening after installation or update

Change the password of the owner account through the user menu in the header, entry Change Password. After a password change, all other sessions of this account end.
Set up e-mail delivery under Administration → System & Operations → System Configuration → SMTP Configuration and send a test e-mail.
Switch on two-factor sign-in under Administration → System & Operations → System Configuration → 2FA.
Create a separate account for every person under Administration → Access & Appearance → Administrators & Roles. Assign Administrator (full access) only where it is needed.
For recurring tasks, create permission templates with exactly the permissions, clusters and locations required. Use Read only for accounts that should not change anything.
Under Administration → Integrations & Communication → API Access, check whether every key is still needed and delete the others.
For every webhook, check that Enable SSL verification is selected.
Open Logs → EasyUC Logs and familiarize yourself with the Audit log. It shows who changed what and when.

Step by step: confirming a new CUCM certificate

Open EasyUC Cisco → Dashboard.
In the area CUCM Information, find the card of the node with the note Certificate does not match.
Click Accept new certificate. The window Review certificate for <node> places Stored certificate and Current node certificate side by side.
Compare the Certificate fingerprint (SHA-256) with the certificate that the CUCM node actually uses. To do so, read the value on the CUCM through an independent channel.
Tick I have verified the fingerprint of the new certificate.
Click Accept new certificate. The message Certificate accepted. The status is being refreshed. confirms the operation.

Fields and options

Fields and options
Field / action	Meaning and use
Two-factor sign-in	One switch for all accounts of the administration. The code arrives by e-mail, is valid for 15 minutes and allows five attempts. See the chapter on two-factor sign-in.
Sign-in protection	After five failed attempts for one account within 15 minutes, EasyUC slows down further sign-ins. This applies to the administration, the end-user portal and sign-in with API keys. There is nothing to configure.
Sessions	A password change ends all other sessions of the account. Changed permissions and templates also take effect for users who are already signed in.
Access types and permission templates	Permissions, read-only mode, clusters and locations per account or per template. An account without an assigned connection sees no CUCM data.
Stored passwords	The interface no longer displays passwords for SMTP and external sources. Empty password fields keep the stored value only as long as the target stays the same. After a change of host or port, enter the password again.
TLS to CUCM and Unity Connection	EasyUC remembers the certificate of a node on first contact and verifies it on every further connection. A changed certificate has to be confirmed by an administrator.
SSL verification for webhooks	Can be set per webhook. Default: switched on.
Audit log	Records write actions in EasyUC and changes made directly on the CUCM. Separate permissions govern access to technical details such as IP addresses, the export and the retention settings.
API access	The secret is displayed only once. The API documentation can be retrieved only after sign-in.
End-user self-service	End users can use only their own numbers on line keys. The number plan search and the creation of new numbers from the number plan are blocked for end users.

Checking the result and narrowing down errors

Two-factor sign-in is in effect when the page Check 2 Factor Authentication Code appears after the password.
Note Certificate does not match on a CUCM node: the certificate of the node has changed, for example after a renewal. Confirm it as described above. Until then, queries to this node fail.
Note This certificate is already stored. The TLS error has another cause.: check the reachability, time and host name of the node.
The button Accept new certificate stays locked: the tick for the fingerprint check is missing or your account is not an administrator.
A sign-in is rejected despite the correct password: after several failed attempts the sign-in protection applies. Wait a few minutes.
A user no longer sees any clusters after the update: no connection is assigned to the account. Enter the allowed clusters under Administrators & Roles.
Saving the SMTP configuration or an external source asks for the password again: the host, port or encryption was changed.