Security

Tranzman Security Features

Tranzman is equipped with multiple security features to ensure data integrity and system protection across all migration scenarios.
Security is enforced at the operating system, network, authentication, and application levels.

Operating System Security

• Tranzman Appliance (OVA/ISO deployment) is built on RHEL 8.6 sources.
• CLISH access is restricted to:
  • admin / P@ssw0rd (initial network setup)
  • srladmin / SRLP@ssw0rd (support & troubleshooting)
• SHELL access is exclusive to Stone Ram support.
• System disk encryption prevents unauthorized access and modification.
• Enhanced security enforcement blocks root disk access outside normal booting; tampering with the boot process causes startup failure.

Networking Security

• Single NIC connects to both ORIGIN and DESTINATION servers.
• Secure communication via SSL on port 55560; legacy (obfuscated FTP) uses ports 55501-55555.
• Administration:
  • WebUI over HTTPS (443)
  • CLISH via SSH (22)
  • NTP sync (UDP 123, bidirectional)
  • DNS (UDP/TCP 53)
  • NFS/CIFS shares for cross-vendor/recovery (139, 445, 137, 138)

Authentication Security

• Tranzman Agent (TZMTD): Uses client certificates for authentication, packaged within the agent installer. Operates under the Agent user role.
• WebUI (HTTPS): Uses Admin user role with username/password authentication, secured by mangled MD5 password hashing.

Web Application Security

• Broken Authentication: Agent/client authentication integrated into TLS; CA never leaves appliance. Trusted Agents only; GUI restricted to port 443.
• Sensitive Data Exposure: Metadata (hostnames, policies, backup size, storage configs, encrypted credentials) stored securely. Encryption keys/credentials not accessible via web interface.
• XML External Entities: Only REST API is used; XML content type rejected.
• Broken Access Control: Agents validated via certificate CN; each agent accesses only its designated data.
• Security Misconfiguration: Security measures are built-in, minimizing user misconfiguration risks.
• Known Vulnerabilities: Periodic vulnerability scans using Qualys.
• Cross-Site Request Forgery (CSRF): Not required for agent (uses CURL); GUI not publicly accessible and decommissioned after migration.

Authentication Flow

• Agent / TZMTD – Tranzman Transfer Daemon:
  TZMCURL Agent → TLS connection (client certificate authorization) → CN authentication → access granted.
• Web Browser User Interface / HTTPS:
  Browser → TLS connection → user/password authentication → Auth tokens issued (30 min) → requests sent with Auth header → access granted.
  Token expired → reissue token provided → new token issued (30 min) → requests sent with Auth header → access granted.

WebUI Certificate

• Tranzman employs a self-signed certificate for authentication.

    Previous

   Next