WG provides drivers for the
Thales HSM hardware. When you enable the Thales Hardware HSM feature or the
nfast.service, the MLOS package's
nfast service accepts connections on TCP-port 9004 for all interfaces.
Connections on the TCP-port 9004 are accepted only if you use the default configuration.
According to nCipher/Thales support, if TCP-port 9004 is accessible on proxy-traffic or internet-facing interfaces, a potential DoS attack or other vulnerabilities can be exploited.
The TCP-port 9004 needs to be open if you use the following:
- RFS—Remote File System = shared Security World = encrypted private keys
- Remote administration or other remote Thales features like nShield Connect.
NOTE: These features require an extra shell-based configuration or setup.
You don't need to open the port if you perform the following:
- Configure the Thales driver without RFS on each host
- Don't use the Thales tools for remote administration
Affected versions:
The following WG packages include the
nfast drivers:
- 7.6.2.x
- 7.7.2.x (up to 7.7.2.21)
- 7.8.2.x (up to 7.8.2.11)
- 8.1.x (up to 8.1.3)
