www.tufin.club

Just a short reminder

As known by the most, TufinOS 4.x is available and should be deployed. Since July, 1st, TufinOS 3.x is no more supported since it's based on CentOS 7 which has been depreciated. So for this Linux, no more development or even security patches are available.

There are different ways to upgrade from TufinOS 3.x to TufinOS 4.x. All of them are documented in the Tufin Portal (authentication required)

• Upgrade of VMWare ESXi
• Upgrade of Tufin Appliances

Please be aware that a backup is required before upgrading. Additionally, TufinOS 4.x is based on Rocky Linux, so some configuration details are different to TufinOS 3.x

Tufin SecureChange offers results of the Designer for Access Request (AR) Workflows e.g. where to put a new rule, including definition of objects, comments, etc. The Designer can run in one of two modes.

As shown, the base configuration is done via SecureChange > Workflows > [workflow name] > Workflow properties. Please find some remarks about these two options below.

• Optimize policy for rule reuse
  Having this option active (default), the Designer tries to implement the changes in an existing rule, e.g. if SRC and DST are the same, but only the (new) service is not implemented yet, a change of the rule is assumed - "add Service xxx to rule yyy". This leads to a slimmer rule base, but changes cannot be found easily. So this option is useful for permanent changes and not for test situations. 
  
  
• Create new policy rule for each access request
  This option instructs the Designer to create new rules for each access request, i.e. even if there is a rule with same SRC and DST, a new rule will be proposed. It is the exact Access Request in the ticket. An advantage of this behavior is a good overview "rules per AR", so e.g. rules for testing can easily be removed. Some characteristics need to be considered when using this mode:
  
  • Even if a rule allows the required access completely, the Designer recommends to create a new rule for the exact Access Request. This might lead to shadowed and / or redundant rules. When using Check Point, the policy cannot be installed any more because of the verifier results.
  • When using SecureApp, a workflow having this option enabled, cannot be selected. In this case, Application Owners need to open the AR directly in SecureChange, without any help by SecureApp.

More information about the Designer can be found in the Tufin Portal (Authentication required).

Tufin has released TOS R24-1, the first version of the Tufin Orchestration Suite of 2024. It enforces the "new licensing" as R23-2 started to do. Licensing is enforced following the Solution Tiers. So before an upgrade be sure that you have all active devices licensed, the license activated and not using a temporary license.
TOS R24-1 is available as GA and can be downloaded from the Tufin Portal (authentication required).
Some improvements of TOS R24-1:

Change Monitoring, Automation, and Orchestration

• SecureTrack
  Some improvements have been integrated into Rule Viewer. It affects e.g. group rules or the increased limit for rule actions.
• SecureTrack
  The Rule Viewer allows a new TQL operator: "intersect". It locates rules whose SRC or DST intersect with a given IP, subnet, or range.
• SecureTrack
  Shadowed rules shown in Rule Viewer can now be selected to get further information.
• SecureTrack
  A USP template for PCI-DSS 4.0 is integrated, allowing to follow the latest PCI-DSS Standard.
• SecureTrack
  Regarding USPs, now violations of Azure Firewall Rules are considered.
  
  
• SecureChange
  Searching for tickets has been updated to a new look-and-feel. This affects "free search" as well as "detailed search".
• SecureChange
  Palo Alto Panorama and ACI integration with DAG-based ACI EPG tags in their Panorama security policies allow to automate changes with SecureChange workflow tools.
• SecureChange
  Palo Alto rules and access requests whose source includes both UserID (LDAP Groups) and IP addresses are supported now.
  
  
• SecureApp
  A custom validation script is available for SecureApp, allowing to ensure some important properties like e.g. object names, USP compliance.

Deployment

• TOS CLuster
  New default alerts are available to check e.g. file system usage and database status. These TOS Cluster Health Alerts offer simpler monitoring. 

Devices and Platforms

• Azure
  For Azure FW and NSG rules some enhancements for Cleanup have been published
  
  
• Cisco
  Cisco Meraki can be added to SecureTrack using proxy authentication
• Cisco
  Besides the on prem support of Cisco FMX, now Cisco Cloud-Delivered FMC is supported, too
  
  
• Google Cloud
  From this version on, GCP is incorporated into SecureTrack Topology
• Google Cloud
  GCP projects can be added to SecureTrack using proxy authentication
  
  
• Palo Alto
  Panorama Managed Prisma Access is incorporated into SecureTrack Topology
• Palo Alto
  Palo Alto Device Groups that manage Palo Alto Cloud NGFW on Azure are now supported
• Palo Alto
  Palo Alto VM series on GCP is supported, delivering full functionality

API Improvements

• SecureChange
  The SecureChange Reporting API has been introduced. It allows more granular reporting about tickets and step events

Further improvements, as well as corrections, are included in R24-1.
The latest version of the Tufin Orchestration Suite can be found at the Tufin Portal: https://portal.tufin.com

If users or administrators are not actively working on the command line or WebUI, the user is automatically logged out after a defined period of time.
This time can be configured.

Inactivity Timeout for CLI

An individual timeout can be configured for the console as well as for users connecting via SSH. To configure it for all users the file /etc/profile.d/autologout.sh needs to be adjusted. To set it to five minutes of inactivity, the file should look like this:

# set timeout for CLI
TMOUT=300
readonly TMOUT
export TMOUT

This file needs to be executable. To do so, the command

[tufin]# chmod +x /etc/profile.d/autologout.sh

is used. Checking the status is done by calling the variable

[tufin]# echo $TMOUT
300
[tufin]#

Since in TufinOS all users of the CLI are administrators, generally changing it is possible. This is documented in central logging that needs to be monitored.
For sure, setting the timeout individually per user is possible via the file .bash_profile, but not really useful in TufinOS.

If a connection to the command line is established with an SSH client, a separate time period applies here until the automatic inactivity logout. This needs to be adjusted in the /etc/ssh/sshd_config file.

ClientAliveInterval 300
ClientAliveCountMax 0

This configuration enforces a logout after 5 minutes of inactivity. To get it active, the sshd needs to be restarted

[tufin]# systemctl restart sshd

Inactivity Timeout for WebUI

The timeout for users of the WebUI needs to be configured also. It's done for SecureTrack by changing the configured parameter. It should first be checked using the CLI of the server.

[tufin]# tos config get -f | grep web.session.inactivityTimeout
  Global                          web.session.inactivityTimeout                   60m  
[tufin]#                       

It's also possible to use another flag

[tufin]# tos config get -p web.session.inactivityTimeout
  SERVICE  PROPERTY                       VALUE  DEFAULT  MESSAGE
  Global   web.session.inactivityTimeout  60m
[tufin]#     

In the case shown above, the timeout is 60 minutes. To change it to e.g. 120 minutes, this command shoult be used:

[tufin]# tos config set -p web.session.inactivityTimeout=120m

Besides the digit, the time period can be chosen - m for minutes, h for hours and d for days.

Please consider that this way to change the inactivity timeout works for SecureTrack only!
For SecureChange there is a hardcoded timeout of 30 minutes. Therefore, a changed configuration is disregarded
(Tufin SR[00134598])

A vulnerability has been found in TOS Aurora between TOS 20-2 PGA and TOS 23-2 PGA. Details have been published in the Tufin Portal (Auth required):
   https://portal.tufin.com/s/SecurityAdvisories/a86Tt000000006TIAQ/sa00009
Tufin points out that access to one API might be possible without authentication.
This issue is fixed in R23-2 PHF1.0.0, R23-1 PHF3.1.0, and R22-2 PHF4.1.0, respectively. For earlier versions it's recommended to upgrade to a supported one.