Policy Compliant Component Selection

NEXT-GEN FIREWALL

Prerequisites 

• IQ Server version 134+
• Nexus Repository Pro 3.38.1+
  
  • An npm repository
• Firewall License
  • Nexus Repository and IQ Server must be connected
  • Audit and Quarantine must be enabled 

Summary

In npm, you can request the latest version of a package or allow a range of versions in your package.json . Blindly requesting the latest version can introduce malware, compatibility issues, and other problems to your project.  Policy Compliant Component Selection is a feature in Nexus Firewall that audits all allowable versions of a dependency and delivers the most recent policy compliant version of each dependency. This makes requesting components from a Firewall protected repository safer and more reliable. 

Policy Compliant Component Selection assesses each component for policy compliance. If a policy compliant dependency component has a transitive dependency with no compliant version, Nexus Firewall will not reassess your dependency to find a version where all dependencies adhere to your policies. In this instance you will receive a component not found error for the transitive dependency. 

This feature also only assess versions allowable in your package.json . Here are some common examples:

latest  - Firewall will deliver most recent policy compliant version.

^1.0.0  - Firewall will deliver the most recent policy compliant version for major release 1

2.3.1 - 2.0.2  - Firewall will deliver the most recent policy compliant version between version 2.3.1 and 2.0.2. 

Configuration

To enable Policy Compliant Component Selection:

1. Navigate to Nexus Repository Pro
2. Select the Server Administration and Settings Cog
3. Select Repositories
4. Select the desired repository
5. Check Remove Quarantined Versions
6. Click Save

See this page for more information on the Remove Quarantined Versions option.

Configure Cache Settings

Performance for Policy Compliant Component Selection can be improved by reducing the Nexus Repository cache refresh to one hour. Here's how to set the cache:

1. Navigate to the sonatype-work directory for your instance of Nexus Repository.
2. Locate the nexus.properties  file in the sonatype-work/nexus3/etc directory.
3. Open the nexus.properties file with a text editor or IDE.

4. Add the following line to the file: nexus.npm.firewall.quarantined_versions_cache_duration_hours=1


   If the configuration option already exists, change the value to 1. This will set the cache duration to one hour.

   


5. Save your changes. 

Usage

This feature runs automatically when you request dependencies from a quarantine-enabled proxy repository. For example, when you run npm install . 

Firewall will then deliver policy compliant dependencies within the allowable version range. If there is no policy compliant version available for a component you will receive a component not found  error. 

Previous

Automatic Quarantine Release

Next

Preventing Namespace Confusion