Security Best Practices¶

This guide covers security recommendations for SPSA deployments.

SPSA Security Architecture¶

SPSA is designed with security in mind as a hardened appliance:

Integrated Host Firewall¶

SPSA includes a pre-configured firewall that blocks all unnecessary network access.

Default Firewall Rules¶

Inbound (Allowed):

• TCP 443 (HTTPS - SPSA Portal)
• TCP 80 (HTTP - Let's Encrypt validation, public-facing only)

Inbound (Blocked by Default):

• TCP 22 (SSH - disabled unless sshon used)
• All other ports

Outbound (Allowed):

• TCP 3389 (RDP to targets)
• TCP 22 (SSH to targets)
• TCP 5900-5910 (VNC to targets)
• TCP 23 (Telnet to targets)
• UDP 53 (DNS)
• UDP 123 (NTP)
• TCP 80/443 (Appliance updates)

SSH Access Control¶

Default State: Disabled¶

SSH access to the SPSA appliance is disabled by default for security.

Enable SSH Temporarily¶

Only enable when required for maintenance:

# From VM console as spadmin
sudo sshon

Disable SSH After Use¶

Always disable when finished:

sudo sshoff

Valid Use Cases for SSH¶

• Installing SSL certificates
• Collecting logs for support
• Applying updates (when directed by Skillplan)
• Brief administrative access

Network Security¶

Network Placement¶

Place SPSA in a network segment that:

• Is protected by firewall from the internet
• Can reach target systems
• Is isolated from general user workstations

Recommended: DMZ or dedicated management VLAN

Firewall Rules (External)¶

Configure your network firewall:

Inbound to SPSA:

ALLOW TCP 443 from authorized user networks
ALLOW TCP 80 from internet (Let's Encrypt, if using)
DENY all other inbound

Outbound from SPSA:

ALLOW TCP 3389 to Windows targets
ALLOW TCP 22 to Linux targets
ALLOW TCP 5900-5910 to VNC targets
ALLOW TCP 23 to Telnet targets (if needed)
ALLOW UDP 53 to DNS servers
ALLOW UDP 123 to NTP servers
ALLOW TCP 80/443 to internet (appliance updates)
DENY all other outbound

Network Segmentation¶

For high-security environments:

• Place SPSA on a dedicated VLAN
• Use firewall rules to restrict which targets are accessible
• Log all traffic to/from SPSA for audit

Authentication Security¶

Strong Passwords¶

Console Account (spadmin): - Minimum 12 characters - Uppercase and lowercase letters - Numbers - Avoid Z and Y (keyboard layout issues)

Portal Accounts: - Follow your organization's password policy - Minimum 12 characters recommended - Unique password (not reused from other systems)

Multi-Factor Authentication¶

SPSA enforces TOTP-based MFA for all portal users:

• Google Authenticator
• Microsoft Authenticator
• Authy
• Any TOTP-compatible app

MFA cannot be disabled - this is by design for security.

User Account Security¶

Access Control¶

Principle of Least Privilege¶

• Grant only necessary connection access
• Users should see only the connections they need
• Review permissions regularly

Connection Security Settings¶

For high-security environments:

Security for Contaminated Zones¶

When accessing potentially compromised systems:

1. Disable all clipboard functionality
2. Disable all file transfer options
3. Enable read-only mode if only observation needed
4. Log all sessions (SPSA Pro)

SSL/TLS Configuration¶

Certificate Options¶

Production Requirements¶

• Replace self-signed certificate before production use
• Use certificates signed by a trusted CA
• Monitor certificate expiration
• Renew 30 days before expiry

Installing Certificates¶

Certificates are installed via SSH access to the appliance. Contact Skillplan support for certificate installation procedures.

Operational Security¶

Updates¶

• Keep SPSA appliance updated (contact Skillplan for update procedures)
• Apply security patches promptly
• Keep target systems updated

Monitoring¶

Backup¶

• Back up SPSA configuration regularly
• Test backup restoration procedures
• Store backups securely (encrypted, access-controlled)

Logging¶

SPSA maintains logs for:

• User authentication (success/failure)
• Session start/end times
• Connection usage
• Administrative actions

SPSA Pro adds session recording for full audit trail.

Compliance Considerations¶

SPSA supports common compliance frameworks:

Key Compliance Features¶

Security Checklist¶

Initial Deployment¶

• [ ] Console password changed (spadmin)
• [ ] Portal password changed (spadmin)
• [ ] MFA configured for admin accounts
• [ ] SSH disabled (sshoff confirmed)
• [ ] SSL certificate installed (production)
• [ ] Firewall rules configured (network)

Ongoing Operations¶

• [ ] User access reviewed (monthly)
• [ ] Unused accounts disabled/removed
• [ ] Session history reviewed
• [ ] Certificate expiration monitored
• [ ] Updates applied when available
• [ ] Backup verified

For High-Security Environments¶

• [ ] Clipboard disabled for sensitive connections
• [ ] File transfer disabled
• [ ] Session recording enabled (Pro)
• [ ] Time-based access restrictions used
• [ ] Network segmentation implemented
• [ ] Traffic logging enabled

Security Incident Response¶

Suspected Compromise¶

If you suspect SPSA has been compromised:

1. Isolate - Disconnect SPSA from network
2. Preserve - Do not modify or restart
3. Contact - Reach out to Skillplan support immediately
4. Document - Record timeline and observations

Contact¶