Network Security
Run the CODESYS 4 server only behind a TLS reverse proxy
Target group: System administrators
Description: The CODESYS 4 server itself does not provide TLS encryption and outside of localhost it is only accessible via unencrypted HTTP. Therefore, an upstream, external TLS reverse proxy – for example nginx – or portal proxy is required for operation over the network. The external TLS reverse proxy – for example nginx – or portal proxy terminates TLS and forwards both HTTP and WebSocket connections to the CODESYS 4 server. Without a secure context (HTTPS), the web application will refuse to run.
Action: In every network operation or productive operation, you absolutely need to set up an upstream TLS reverse proxy or portal proxy in front of the CODESYS 4 server. To do this, use the included nginx sample configuration or adapt it to your environment. A setup guide is located in the quickstart guide.
Reasoning: If there is no TLS encryption, then credentials, session information, and project data would be transmitted in plain text over the network and could be read or manipulated by an attacker with access to the network. Therefore, the web application absolutely requires a secure context (MSDN). As a result, network operation without upstream TLS encryption is technically impossible.
Set up additional protection against brute-force and (D)DoS attacks
Target group: System administrators
Description: CODESYS 4 internally restricts login attempts via multiple measures: a random delay during login, a maximum of 10 simultaneous logins per user and a maximum of 500 in total, as well as a cache for invalid user names. However, this does not provide comprehensive protection against brute-force and (D)DoS attacks.
Action: Also set up an upstream protection against brute-force and (D)DoS attacks at the infrastructure level – for example rate limiting and connection limits at the reverse proxy or at an upstream web application firewall (WAF). This upstream protection is your responsibility as the operator.
Reasoning: The internal restrictions of CODESYS 4 make attacks more difficult, but they cannot completely prevent targeted brute-force or (D)DoS attacks. Without upstream protection, an attacker can compromise the availability of the system for authorized users.
Isolate and safeguard your own portal proxy solutions
Target group: System administrators
Description: Instead of the supplied proxy of the CODESYS 4 server, you can use your own portal proxy or your own session isolation – for example, per session a separate Docker container with the CODESYS 4 backend. The security of such a configuration is entirely your responsibility and cannot be assessed by CODESYS. In this variant, the connection between the proxy and backend is currently neither authenticated nor encrypted.
Action: Isolate and safeguard the connection between your proxy and the CODESYS 4 backend – for example via separate hosts, containers, or networks so that it is not accessible to other local or remote users. Until further notice, run this variant exclusively in secure environments. Make sure that no secrets (passwords, tokens) are logged.
Reasoning: The connection between the proxy and backend is currently neither authenticated nor encrypted. As a result, an attacker with access to this connection could hijack sessions, impersonate another user, read or manipulate transmitted data, or block access to sessions.
Operate online connections to controllers only in secured networks
Target group: System administrators
Description: CODESYS 4 does not currently encrypt the online connection to the gateway and to the controller (runtime system). Only the controller password is cryptographically protected during transmission. The boot application – and therefore the intellectual property of your project – as well as live monitoring data and control data are currently transmitted in plain text over the network.
Action: Operate online connections to gateways and controllers exclusively in a secured or segmented network which is inaccessible to unauthorized users.
Reasoning: An attacker with access to the network could intercept unencrypted online traffic – and expose your project know-how, for example – or manipulate transmitted data and commands.
Maintain a secure TLS configuration on the reverse proxy
Target group: System administrators
Description: TLS encryption is performed during the operation of the CODESYS 4 server via the upstream reverse proxy (see also: Run the CODESYS 4 server only behind a TLS reverse proxy). This means that as the operator of this proxy, you are also responsible for selecting and maintaining the reverse proxy software, the permitted TLS versions, and the cipher suites.
Action: Configure the allowed TLS versions and cipher suites on your reverse proxy according to the current state of the art and keep this configuration up to date. Also make sure that you keep your reverse proxy software up-to-date in order to promptly close any security holes.
Reasoning: Outdated TLS versions or weak cipher suites can allow an attacker to break encryption and read or manipulate transmitted data.