Secure NetScaler ADC and Gateway with cnspec
Scan NetScaler ADC and NetScaler Gateway appliances against security and compliance best practices with cnspec.
Scan your NetScaler ADC and NetScaler Gateway appliances (formerly Citrix ADC and Citrix Gateway) to find security risks before they become incidents. cnspec reads the firmware version and release track, management access on every IP address, SSL/TLS profiles and certificates, Gateway and AAA virtual servers, authentication policies, system users and command policies, password policy, and syslog, NTP, and DNS settings.
NetScaler is one of the network devices cnspec can assess. For the full list of supported devices, see the network device scanning overview. New to cnspec? Start with the quickstart.
The NetScaler resources are experimental. Field names and behavior can change in a future cnspec release.
Supported products
cnspec connects directly to an appliance's NetScaler IP address (NSIP) and supports:
- NetScaler ADC and NetScaler Gateway on MPX, VPX, SDX instances, and CPX
- Firmware releases 13.1 and 14.1
- Standard, FIPS, and NDcPP firmware tracks
NetScaler Console (formerly ADM) fleet discovery and SDX management aren't supported. To scan many appliances, list each NSIP in an inventory file.
Prerequisites
To scan a NetScaler appliance with cnspec, you must have:
- cnspec installed on your workstation
- Network access to the appliance's NSIP over HTTPS (port 443 by default)
- A NetScaler user whose command policy allows the
showcommands cnspec runs
Give cnspec access to your NetScaler appliance
cnspec reads the appliance configuration through the NITRO REST API over HTTPS. It only sends read requests and never changes the configuration. cnspec doesn't open a NITRO session, so there's no session left behind to log out of.
Create a read account for cnspec
Create a command policy and user
The built-in read-only command policy denies the show system commands. With it, cnspec can't read system users, groups, command policies, or system parameters. Instead, create a dedicated user bound to a policy that allows every show and stat command except the ones that dump configuration files.
Connect to the appliance CLI as nsroot over SSH and run:
add system cmdPolicy mondoo-read ALLOW "(^show\s+(?!ns ns\.conf)(?!ns savedconfig)(?!ns runningConfig)(?!techsupport).*)|(^stat.*)"
add system user mondoo -allowedManagementInterface API -timeout 900
bind system user mondoo mondoo-read 100
save ns configadd system user prompts for the new user's password. The -allowedManagementInterface API option limits the account to the NITRO API, so it can't log in to the GUI or the CLI.
When the appliance denies a read, cnspec reports an access denied error on that field. It never reports a denied read as an empty list, so a missing permission can't pass a check by accident.
Test your connection
Before running a full scan, verify that cnspec can connect by opening a cnspec shell:
cnspec shell netscaler --hostname NSIP --username mondoo --ask-passcnspec verifies the appliance's TLS certificate against your system trust store. If the appliance still uses its default self-signed certificate, skip verification:
cnspec shell netscaler --hostname NSIP --username mondoo --ask-pass --insecureIf cnspec connects successfully and shows a prompt, you're ready to scan.
Connection options
| Option | Description |
|---|---|
--hostname | Hostname or IP address of the appliance's NSIP |
--port | NITRO API port (default: 443) |
--username | Username for authentication (default: nsroot) |
--password, -p | Password for authentication |
--ask-pass | Prompt for the password |
--insecure, -k | Skip TLS certificate verification |
--discover | auto (default) also scans the HA peer; none scans only the connected node |
Scanning more than one NetScaler appliance? Use an inventory file to define
every target and its credentials in one place, then scan them all with a single cnspec scan --inventory-file command.
Scan NetScaler appliances
To scan a NetScaler appliance, use the cnspec scan command:
cnspec scan netscaler --hostname NSIP --username mondoo --ask-passWhen the scan completes, cnspec prints a pass or fail result for each check and an overall risk score. To output results in other formats such as JSON, JUnit, or SARIF, read Report Results.
Scan high availability pairs
Each node of a high availability (HA) pair runs its own firmware, and after a partial upgrade the two nodes can run different builds. When you scan one node, cnspec also scans its HA peer as a separate asset, so each node reports its own firmware version and an unpatched peer can't hide behind an upgraded one.
cnspec reaches the peer on its own NSIP with the same credentials and port. If the peer can't be reached, it appears as a failed asset in the scan results rather than being dropped. To scan only the node you connect to, add --discover none:
cnspec scan netscaler --hostname NSIP --username mondoo --ask-pass --discover noneCluster nodes are listed in netscaler.clusterNodes, but cnspec doesn't scan them as separate assets.
Firmware version and release track
The asset's version uses the notation of NetScaler security bulletins, such as 14.1-43.56 for release 14.1, build 43.56. FIPS and NDcPP firmware is released and patched separately from standard firmware, so each track reports its own platform: netscaler, netscaler-fips, or netscaler-ndcpp. All three belong to the netscaler platform family.
If cnspec can't parse the firmware version, it leaves the asset version empty instead of guessing. The original string the appliance reported is always available in netscaler.system.rawVersion.
Write your own policies
Mondoo doesn't yet ship an out of the box NetScaler policy, so use the checks below as a starting point and create your own policies to meet your specific requirements. Run a policy with --policy-bundle:
cnspec scan netscaler --hostname NSIP --username mondoo --ask-pass \
--policy-bundle netscaler-security.mql.yamlExample checks
You can interactively explore and test checks using the cnspec shell. To open a shell connected to your NetScaler appliance:
cnspec shell netscaler --hostname NSIP --username mondoo --ask-passBelow are some example checks you can run from the shell.
Review the firmware version and release track
cnspec> netscaler.system { version edition model deploymentType }
netscaler.system: {
version: "14.1-43.56"
edition: "standard"
model: "NetScaler Virtual Appliance 450000"
deploymentType: "HA"
}Ensure no IP address allows Telnet or FTP
cnspec> netscaler.ipAddresses.none(telnet == true || ftp == true)
[ok] value: trueEnsure the management GUI is only reachable over HTTPS
cnspec> netscaler.ipAddresses.where(managementAccess == true).none(gui == "ENABLED")
[ok] value: trueEnsure SSL profiles disable SSLv3, TLS 1.0, and TLS 1.1
cnspec> netscaler.sslProfiles.none(ssl3 || tls1 || tls11)
[ok] value: trueEnsure no SSL certificate expires within 30 days
cnspec> netscaler.sslCertificates.all(daysToExpiration >= 30)
[ok] value: trueEnsure strong passwords are enforced for all users
cnspec> netscaler.systemParameters.strongPassword == "enableall"
[ok] value: "enableall"Ensure HTTP basic authentication to the management interface is disabled
cnspec> netscaler.systemParameters.basicAuth == false
[ok] value: falseEnsure Gateway virtual servers lock out users after failed logins
cnspec> netscaler.gatewayVirtualServers.all(maxLoginAttempts > 0)
[ok] value: trueEnsure logs are sent to a remote syslog server
cnspec> netscaler.syslogActions.length > 0
[ok] value: 1Ensure NTP time synchronization is enabled
cnspec> netscaler.ntpSyncEnabled == true
[ok] value: trueLearn more
-
To scan multiple NetScaler appliances at once instead of one at a time, read Remote Scanning with Inventory Files.
-
To learn about all the NetScaler resources and properties you can query, read the NetScaler Resource Pack Reference.
-
To learn more about how the MQL query language works, read Write Effective MQL.
-
For more information about NetScaler, see the NetScaler product documentation.