# Secure and Harden Your Patch Manager Plus Deployment ![](https://www.manageengine.com/products/desktop-central/images/security-recom-banner.png) Patch Manager Plus is an all-round patch management tool that automates your Windows, macOS, Linux, and third-party patch management from a centralized console. This document outlines security hardening best practices to help you secure your Patch Manager Plus deployment. ## Best security practices ManageEngine Patch Manager Plus immediately releases the security fixes for identified security issues. Follow the [Security Updates Group](https://pitstop.manageengine.com/portal/en/community/patch-manager-plus/vulnerability-notification) and the [Security Updates on Vulnerabilities](https://www.manageengine.com/patch-management/knowledge-base/security-updates-on-vulnerabilities.html) section in our [Knowledge Base](https://www.manageengine.com/patch-management/knowledge-base/) to stay updated with the latest security patches. Furthermore, please subscribe to our [Data Breach Notification](https://www.manageengine.com/patch-management/breach-notification.html) to receive notifications on any security incident without delay. **Note: It is highly recommended to** 1. Update your Patch Manager Plus server to the latest build. 2. Grant access to the Patch Manager Plus folder only to authorized users. 3. Use proper firewall and Anti-virus software and keep them up-to-date to get accurate alarm. 4. Delete unused accounts: 1. **From Patch Manager Plus**: Delete unused user accounts from Patch Manager Plus server's product console and from the machine where the Patch Manager Plus server is installed. 2. **From MSSQL server**: If you have configured MSSQL, then it is recommended to remove any unused account from the MSSQL server installed machines as well. 5. Install Distribution Server in a dedicated machine with no other third party software in it. Only Authorized users should have access to this machine. ## Secure the access to Patch Manager Plus server Securing the login access to Patch Manager Plus, can prevent security issues involving roles and permissions. ## Security Settings To fortify the login access, go to the **Admin** tab, and click **Security Settings**. ### Under Secure Login - **Remove default admin account** The default admin account should be removed after the first login. This is because the technicians can use the default administrative credentials to access the Patch Manager Plus server. However, by disabling the default admin account, the technicians will only be able to access entities pertaining to their defined role. This in turn, reduces the security risks. - **Enable Secure Login (HTTPS).** All communication between the Patch Manager Plus server and the agents will take place using the HTTPS protocol after enabling this option. **Note**: In addition, disable the 8020 port in firewall in your network. - **Use Third Party SSL Certificate** It is recommended to configure Patch Manager Plus with a trusted third party certificate to ensure secured connections between desktops, mobile agents and servers. However, for secured communication using HTTPS, a default certificate will be provided along with the server. - **Enforce Two Factor Authentication** Having a second level of verification for technicians ensures that unauthorized access is prevented. - **Set Complex Password** Setting a complex password policy allows users to configure unique passwords that are tough to crack. The more complex a password policy is, the more combinations there will be. - **Secure your Software Repository (Local network share)** The local network share will contain all the software installation files. Access credentials are used to grant access to the share to authorized users only. - **Restrict users from Uninstalling the Agent from Control Panel** The agent monitors and executes the configurations and tasks deployed to a particular endpoint. That's why it is necessary to forbid users from uninstalling the agent. - **Restrict users from stopping the Patch Manager Plus Agent service** Preventing the users from stopping the Agent service ensures that the endpoint stays in contact with the server every 90 minutes. ### Under Secure agent server communication - **Enable secure communication (HTTPS) for LAN and WAN agents** HTTPS protocol for both LAN and WAN agents ensures that the communication between the agents and the server is always encrypted. - **Secure Remote Control and File Transfer operations** Enable this option to secure the communication during Remote Control sessions and File Transfer operations. - **Disable the older versions of TLS** For improved security, it is advisable to use the newer version of TLS, instead of using the older ones. Note: By default, SSLV2 and SSLV3 protocols are disabled in Patch Manager Plus. From version 11.2.2330.1 onward, TLS 1.2 is enabled by default, and TLS 1.0/1.1 are available only if you explicitly enable them for compatibility with older systems. On earlier builds, TLS 1.0 and 1.1 are enabled by default alongside TLS 1.2 — you can disable them from the Security Settings page unless you still need to manage outdated, unsupported operating systems. - **Use Secure Gateway Server** It is highly recommended to host the Patch Manager Plus server in a corporate network protected by firewall restrictions and other security measures. If there are several roaming users and remote offices, then you can use an additional component, called the Secure Gateway Server. Secure Gateway Server is a reverse proxy solution that acts as a bridge between the WAN agents and the Patch Manager Plus server. It prevents the need for the Patch Manager Plus server to be hosted as an EDGE device to manage roaming users. Refer this [document](https://www.manageengine.com/patch-management/how-to/forwarding-server.html) for more details. - **Enable Agent Server Trusted communication** Trusted Communication can be enabled only after importing a third party certificate. [Know more](https://www.manageengine.com/products/desktop-central/steps-to-enable-trusted-communication.html). - **Enable certificate-based authentication for agent-server communication** If enabled, the computers with the older agent versions will no longer be able to communicate. Ensure the agent versions are up to date. [Know more](https://www.manageengine.com/products/desktop-central/client-certificate-authentication.html). - **Disable 64-bit weak older ciphers** If your environment includes any legacy, unsupported operating systems, disable weak or outdated cipher suites and apply the latest available vendor security patches for those systems. ## Module-wise methodical steps to enhance security ### Linux & Patch Upload Security - Restrict root access on Linux/RedHat-managed machines to trusted technicians only, to prevent malicious actors from substituting legitimate patch metadata with malicious content. - Restrict root access on Linux agents to trusted technicians only, to prevent malicious actors from redirecting package URLs to malicious sources. - Scan the uploaded files in the Upload Patch option for any malicious files. It is highly recommended for Patch Manager Plus users to follow the guidelines in this document. In particular, the Security Settings. This proves to be a quick and effective move against cyber threats. Moreover, the steps provided for every module will help strengthen the security even further.