1

My project currently uses GeoServer 2.6.2 to serve out a few WFS and WMS layers to our application.

The results of some penetration testing raised the fact that GeoServer can be called with GetCapabilities which will then give out some juicy information that could be used against us.

Is there a way, specifically from within GeoServer, that you can disable the GetCapabilities requests or block them?

There is currently no need for the operation as we only use it ourselves.

7
  • 2
    Use security docs.geoserver.org/latest/en/user/security/webadmin/… or GeoFence docs.geoserver.org/latest/en/user/community/geofence-server/…. But I wonder what secret information GetCapabilities can reveal, I think that it is just advertising which layers are available in the service.
    – user30184
    Commented Feb 18, 2016 at 9:47
  • What information you rely to that GetCapabilities reveals? Usually the actual data is much more security relevant. Are you scared someone could write you an email? Don´t provide your mail-adress. Commented Feb 18, 2016 at 10:22
  • The concern from the pen testing was about host names and other server information from getCapabilities and other functions
    – Tedd
    Commented Feb 18, 2016 at 10:30
  • @user30184 thanks for your comment, that is what I was looking for.
    – Tedd
    Commented Feb 18, 2016 at 10:34
  • 2
    Why don't you just set up a proxy, to hide the host names
    – nmtoken
    Commented Feb 18, 2016 at 11:08

3 Answers 3

8

The reason why GeoServer (as every server compliant to the OpenGIS Webservice-format) provides this function is to be able to determine what your WMS or WFS is able to do, which kind of data they use (spatial reference, accuracy, layers), what the extent for them (bounding box) is and who might be responsible for issues when having problems on dealing with the service (service-admin).

I strongly would not recommend do deactivate this, as it is needed for every kind of automatic search for your service. The function simply provides metadata about your services, I doubt there are security-issues which it hands out.

Even noticing that you´re using the service only yourself does not justify disabling this as there might be collegues that do not understand every single parameter or every method that is provided by your WFS for exapmle. Looking into the document simplifies the process on getting all those information.

However if you really have to do this you may simply deactivate the servlet which is related to the function. As GeoServer is a simple servlet-container it provides a web.xml-file which you may modify. Simply delete the mservlet-mapping for GetCapabilities and you´re done. See this doc from oracle for how to do this.

Anyway I doubt you can do much without the function, as many products (ArcGIS, OpenLayers, ...) use this information before even making any request for your actual data.

8
  • Since when does OpenLayers, do a GetCapabilities Request? Commented Feb 18, 2016 at 10:26
  • 1
    @DevdattaTengshe Not? Thought so from my memories. However long time ago, thanks for the hint. Commented Feb 18, 2016 at 10:28
  • We use ol3 in the application, and simply call the wms and wfs layers directly, so have no need for getCapabilities. Regarding your answer it is right, and was one way of solving the issue. But I was looking from within geoserver, and @user30184 comment is what I've used.
    – Tedd
    Commented Feb 18, 2016 at 10:32
  • I think the solution provided by @user30184 internally uses this technic, however glad to help you. Commented Feb 18, 2016 at 10:34
  • But if I use something like fiddler I'll be able to see the actual requests being sent to all those hosts, so you won't have gained anything.
    – nmtoken
    Commented Feb 18, 2016 at 11:10
2

To kill this thread what I did was follow the security docs that user30184 commented: How to disable getCapabilities in GeoSserver http://docs.geoserver.org/latest/en/user/security/webadmin/services.html

So within geoserver web interface > Services I added some rules to restrict some of the Services' functions.

So that when they are hit you get an authentication error.

I am aware that this is not necessarily to everyone's taste, but it is all that I needed for my situation.

None the less I think that the answers and comments on this thread will serve to help others down the line. Thank you too all contributors.

0

If you only use the service yourself then the solution would be to only serve fake metainformation.

What I think could be used against you is the contacts information and other metadata. Simply fake this, and your pentesters should be happy. That way you retain getCapabilities functionality, while not providing any identifying data to potential attackers.

You could also reveal a bit more on what exactly the pentest identified as possible attack vectors. Then we could better discuss mitigation stratgies.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.