Monitor Security Blacklist

When capturing event context, Zend Monitor will save the values of all PHP super-globals (POST, GET, SESSION etc.) in the event database, and will present these values in event reports. Sometimes, it is unwise to store and present some values - for example, passwords or credit card numbers and other private information.

Zend Monitor allows you to filter out some super-global values by black-listing their keys in the Zend Monitor Security Blacklist. Filtered values will not be stored in the events database and will not be included in event reports (details) - instead, the string "<BLOCKED_VALUE>" will be presented.

Why Configure Security Settings?

The primary reason for securing information is to prevent the storage, handling and distribution of sensitive information such as user names, passwords and credit card numbers. This information is collected as part of the Zend Server diagnostic process. However, in most cases the context, and not the value, is important to understanding why the Event occurred. Therefore, sensitive information omitted from the Event Detail collection process.

An additional reason for using the Security Blacklist is to prevent inadvertently sending sensitive information by e-mail when using the Event Action option that automatically sends Event Details via email.

Black-listing sensitive information may be required in order to confirm with some security standards such as PCI Certification.

This procedure describes how to manually define a blacklist of keys that should not be collected, stored or displayed in Event reports.

To manually define a security Blacklist:

In Zend Server for IBM i, go to Server Setup | Components.
Locate the Zend Monitor component in the table and click on the Directives link.
This will guide you directly to the directives related to this component in Server Setup | Directives.
Locate the directive zend_monitor.security_black_list.
Add as a value any keys that should be blocked using a comma to separate between them.
Click "Save Changes"
Restart by clicking .

Each of the keys that you added to the list will now be replaced by '<BLOCKED_VALUE>'

Example:

For example, to blacklist HTTP passwords passed to PHP by the web server through the $_SERVER['PHP_AUTH_PW'] super-global variable, I would add it as follows: zend_monitor.security_black_list=PHP_AUTH_PW

Any subsequent keys added would be added using a comma to separate them as follows:

zend_monitor.security_black_list=PHP_AUTH_PW,cc_number,secret_token

Please note that if the same key exists in several super-globals (for example, if "cc_number" exists in both $_POST and $_SERVER) it will be removed from all of them. You can configure the list of super-global variables you want to secure using this feature by setting the value of the zend_monitor.super_globals_to_secure directive.