Security: FileMaker Server

Claris have advised that FileMaker Servers around the world have been under active password-spraying attacks since late last week affecting hosting providers overseas. This is a good reminder to review and check your KAMAR server is secure.

The following summarises the steps we have already taken and are continuing to take. If you self host KAMAR, there are checks you should also take.

KAMAR

We have already Implemented the key security recommendations in the Claris advisory, disabling accounts and services not needed (XML, OData, etc) and ensuring accounts for enabled services are limited and using secure passwords. Guest and full access accounts have been disabled.

Running Check Settings (Setup > Server) inside KAMAR checks your FileMaker Server, enabling the required services.

Cloud Hosted Schools

Our servers have undergone a third party security audit and we perform regular penetration testing (PEN) against them.

• We already limit access via FileMaker Pro client to New Zealand only and may extend this restriction to Web Direct access also if appropriate.
• Access to the Admin Console is restricted to localhost only.
• Our network firewall includes protection against DDoS and Intrusion protection.

Self Hosted Schools

 Below are the steps you can take on the server(s) you self-host:

• The N4L supplied firewall includes modern tools such as DDoS, Intrusion protection, etc. by default.
• Access via TCP port 5003 (FileMaker Pro/Go access) is limited to New Zealand IP addresses. 
• Access via htttps (TCP Port 443) is monitored and limited as appropriate.
• They have restricted access to the Admin Console to either localhost and optionally internal IP address only.
• Off-Site backups are implemented and tested.
• PHP has not been installed on the server (or has been removed if previously installed).
• Remote Desktop access is disabled or limited to local traffic only.

Signs of an attack

Review the server logs (C:\Program Files\FileMaker\FileMaker Server\Logs\wpe0.log )

• Bursts of failed logins in the Access and Event logs
• Repeated attempts from unfamiliar IP addresses
• Targets include the Admin Console, Data API, OData, WebDirect, and XML API on port 443

Note: It is normal to see errors like 101, 401, etc. in the logs - these indicate no records match a find query.