Operating Mode

Target group: End users, system administrators

Description: For development purposes, the c4-cli application has the --no-window and --development-mode CLI options. The c4-server server version also has the --development-mode option. These should only be used for the purpose of developing and testing extensions.

Action: Never use the --no-window and --development-mode CLI options in productive environments. Use them only in test environments.

Reasoning: Using the --no-window and --development-mode options weakens the security measures which CODESYS 4 enforces. When the --no-window option is used, a check is disabled which makes sure that no other user with network access to your system can hijack access to your session. The --development-mode option disables the check of installed extensions and allows loading arbitrary extensions which may pose a security risk (see also: Install and use only trusted extensions).

Target group: System administrators

Description: CODESYS 4 does not have its own user management with its own credential storage. Logging in to the CODESYS 4 server is done from the user management of the operating system – for example PAM, LDAP, or IPA. Access is granted only to users who are members of the designated login group – codesys-4 by default, configurable via the --login-groups CLI option.

Action: Carefully set up and continuously maintain the user accounts and login group. Make sure that only authorized users are members of the login group and safeguard the accounts according to the policies of your organization.

Reasoning: Because the login to CODESYS 4 is entirely based on the user management of the operating system, the security of the access directly depends on safeguarding these accounts. Compromised or incorrectly authorized operating system accounts allow unauthorized access to CODESYS 4.

Target group: System administrators

Description: The CODESYS 4 server must be run under an unprivileged user account. Running as root is explicitly blocked by CODESYS 4. It is recommended to use the system user c4-server as described in the installation guide.

Action: Run the CODESYS 4 server exclusively under an unprivileged user account. To do this, set up the c4-server system user according to the installation guide.

Reasoning: If the server were to run under a privileged account, then after compromising the server process, an attacker would have immediate and extensive control over the entire system. An unprivileged account restricts the potential damage to the permissions of that account.

Target group: System administrators

Description: Users are granted access to the CODESYS 4 server via membership to the login group – by default codesys-4 (see also: Server mode: Safeguard user accounts and login groups of the operating system). User sessions run with the permissions of the currently logged-in operating system account.

Action: Make sure that no default privileged users – those who already have extended privileges without using sudo – are added to the login group.

Reasoning: When a default privileged user logs in, their CODESYS 4 sessions run with these extended permissions. Compromising such a session would immediately grant an attacker privileged access to the system.

Target group: System administrators

Description: Logging of CODESYS 4 can be configured via the appsettings.json file. The log size for individual components can be adjusted specifically.

Action: Never completely disable logging. If individual components are generating too many log messages, then selectively reduce the log level of these components in the appsettings.json file instead.

Reasoning: If logging is completely disabled, then security-relevant incidents will no longer be recorded. Attacks and unauthorized actions on the system can then neither be detected nor tracked afterwards.