Sonatype Repository Firewall Reviews

My main use case for Sonatype Repository Firewall is to check dependencies for vulnerabilities, block any download content that poses a risk, and enforce and adhere to security policies in real-time. I check for any suspicious activity and prevent vulnerable and malicious code from entering the build. When application teams create images, I check for vulnerabilities, block critical and vulnerable-level content, and block packages if someone tries to download unauthorized images or engages in suspicious activities using vulnerability intelligence.

An example would be when a developer is building a Java-based application with Maven. As they write code and add dependencies, the build tool requests a package from Sonatype Repository Firewall, which is integrated with the proxy repository that connects to the internet to download packages. During this process, whenever a request goes to the Nexus repository, Sonatype Repository Firewall checks the component before downloading it. If any vulnerability is detected, such as one related to Log4j, the policies applied at the firewall level help block the component containing critical severity vulnerabilities. The actions taken include blocking the download, putting the component into quarantine, and informing the developer that it was locked due to a critical vulnerability.

Sonatype Repository Firewall immediately identifies vulnerable content and helps block it promptly. It stops bad components before they ever enter my environment and helps developers choose correct and safer versions. It detects problems early rather than after accidents happen, and applies automatic enforcement of policies. This protects against threats and helps reduce human errors.

The automatic enforcement happens at different stages. For instance, if an application team requests any dependency to the Nexus Sonatype repository proxy, it first goes to the firewall, which intercepts it before downloading and checks for vulnerabilities, malware signals, and policy rules. If safe, it allows the dependency to be downloaded. If anything risky is found, it blocks it instantly without human intervention. Once a component is downloaded, it gets stored in the cache, allowing faster downloads in the future since the component is already available in the local repository.

Since I started using Sonatype Repository Firewall more than five years ago, it has had a positive impact on security and development speed. It helps prevent security incidents, fixes vulnerabilities early, and enables stable releases for applications. It speeds up development with safer dependencies by eliminating manual security checks and helps reduce human error and knowledge gaps, standardizing my DevOps pipeline and framework according to security guidelines.

I recommend integrating artificial intelligence capabilities into Sonatype Repository Firewall for real-time intelligence updates regarding security risks. I also suggest enhancing policy control for improved granular policy settings and better integration with DevOps pipelines, especially in container-based workflows.

I find the documentation very good as I often refer to it for information. The user interface is also very good, but I have noticed some false positives where safe components get blocked, causing unnecessary delays for developers.

I have been using Sonatype Repository Firewall for over three years.

Sonatype Repository Firewall is stable, and although I explored alternatives like JFrog Artifactory and JFrog X-ray, I did not find them as valuable for my organization.

My product runs on a container-based platform on AWS, utilizing auto-scaling to handle distributed traffic. The policies are enforced in a stateless manner and shared across the system, which helps manage load on the primary nodes effectively during high traffic.

My experience with customer support has been minimal since I have not faced significant issues, and any past support requests during migration were handled well.

Sonatype Repository Firewall is stable, and although I explored alternatives like JFrog Artifactory and JFrog X-ray, I did not find them as valuable for my organization.

I advise others considering Sonatype Repository Firewall to ensure they have strong organization-wide policies that comply with security regulations. This product can handle large volumes of data and scale as needed, offering excellent scalability and security features. It is a good product, and I encourage others to use it for large-scale applications if they wish to implement it. I have rated this product 9 out of 10.

Many companies, including ours, use Nexus Repository due to concerns about malware and critical vulnerabilities. There should be a specific method to prevent malicious packages from entering the internal network, so our company uses Nexus Repository. We usually consider adding the firewall feature on top of the Repository, with the main purpose being to block malicious packages.

The firewall is the only solution that supports Nexus Repository. This firewall comes with an accurate database, which can identify most malicious code from entering. It relies on the Sonatype accurate database, so the accuracy is excellent. There is no other option except Sonatype deploy to the firewall.

There are several features lacking in the current offering, particularly concerning container support and AI packages, like humming phase support. However, I have heard that it is on the roadmap for 2025.

I have been using this solution for four years.

It is software, so there is always a possibility of bugs, however, they are quite fast in fixing these bugs. It is quite stable.

There is an option to scale the capacity using an external database, and then you also have support. I do not think there is any issue with scalability.

The customer service is fantastic. They provide the required responses and relevant support, which is the biggest advantage of using Sonatype.

Positive

I do not have handling experience with another firewall. Sonatype Firewall is the only one I have been using. There is only one other alternative.

The initial setup is quite straightforward and easy. It is not complicated.

Just a couple of staff members can complete the installation and configuration.

Also, I consider it average. Some people might consider it expensive, however, since it supports many beautiful features, I would say it is worth it.

We looked at Sonatype or Gather. There are not that many options.

I would give the solution eight out of ten. I would look at the comparison of Sonatype to some other firewalls. There is room for improvement, especially mentioning container support and AI packages. 

We use this tool for QA automation and QA quality checking. We check the quality of the code and the calls with SonarQube. If there is any kind of memory leak, it protects against that. When we want to move the code to the next level, we use Sonar Quality Gates. This is part of a QA automation process.

We only then promote the code to UAT and then the product once it passes 80% of the threshold that we set for it.

I believe this tool is being used by most of the product development team in the organization. It's part of the CI/CD pipeline. You can say it's a must-have kind of tool. Some other tools are commercially available, but using this as a freeware and commercial tool, it's really a good tool to have.

For the QA team, it's a really good tool. 

For those who are not on the QA team, it is also a good tool to use for SDL in the SDLC. It plays a very critical role of doing the automatic quality check recommendation. Meaning, when using this tool, people can easily rectify the issues in the environment itself, instead of going to a higher environment and identifying them.

This tool is quite easy to use and learn. We decided that there was no need to hire anyone new who would specialize in this. We had a team of about five to ten people who learned how to use this tool. There are some other automation tools like Jenkins, for example, that require a lot of effort to configure and write out the code, but you do not need to do such for this tool. I thought outside of the box and saw that there are many options available to us when using this tool. The plugins are there, you can download and use the tool at ease and you do not need to do any kind of development. Overall, it’s quite easy to use.

I suggest that Sonatype should add support for more computer languages. The product works well with languages such as Java and C#, but in my opinion, adding support for more languages would be really good. In addition, I believe that they should add some more functionality to improve the quality of the code.

I used the product for two or three projects, for about two and a half years, and the product is still a part of my company’s CI/CD pipeline. Although I am not managing it anymore, the support team and the whole development team are still using this tool.

From a scalability point of view, it's good. However, we were not heavily using this product so I cannot comment further about the scalability of this product.

I think we posted one or two queries on the development side, but the response was not that great. This may be due to the fact that we were not paying customers at the time.

Later on we bought some licenses. For license users, I think the support is good. For those who are using the open source version, it might take some time to get a proper response.

Positive

The setup is straightforward, but it is important to understand the tool first. For example, which functionalities you need to check and which plugins need to be installed. 

Product-wise, it's quite easy, and people can deploy it. However, configuration and setting the functionalities, etc. is quite a challenge. You will have to learn more about these features, depending on how effectively you would like to use this product. 

It took some time, one or two months, to set it up. The team had to configure the project, set up the proper quality case, and choose the correct options, which are the functionalities you want to use for this product or your own product. It’s a process that continuously improves.

We constantly check for upgrades and new versions of the product. We upgraded this product once or twice in the past and it was quite easy and we did not face any issues when doing so.

It definitely adds value to the code quality. In the long run, you will definitely get a good ROI. You will get clean code every time, and that's a great achievement. You won't face any issues in the production environment related to quality and bad coding. It's really, really good and helps our organization get a good ROI. I believe that a good ROI is very important.

The licensing is quite reasonable, I believe. I do see that it adds value. It means whatever part you want to use, you can just use that part and pay for that. I think the licensing is fair enough.

It’s good for long-term users. Using this product on a yearly basis would be great. However, if your development cycle is only two or three months long, you will likely want to go with the monthly basis only.

With the security concerns around open source, the management and vulnerability scanning, it's relatively new. In today's world more and more people are going through the open source arena and downloading code like Python, GitHub, Maven, and other external repositories. There is no way for anyone to know what our users, especially our data scientists and our developers, are downloading. We deployed Sonatype to give us the ability to see if these codes are vulnerable or not. Our Python users and our developers use Sonatype to download their repositories.

Given the confidentiality of our customer, we keep everything on-prem. We have four instances of Sonatype running, two Nexus Repositories and two IQ Servers, and they're both HA. If one goes down, then all the data will be replicated automatically.

We have visibility into what developers are downloading now. We had an incident recently where a few of the packages from PyPI were vulnerable, and we knew. Another example is that we were working on an open source project, enterprise-wide, and we wanted to do a PoC. When the company doing the PoC started downloading the packages, even they didn't know that those packages were vulnerable. Sonatype detected that.

Nexus Firewall has also significantly improved the time it takes us to release secure apps to market. Before, we needed to manually do a security evaluation for the static and dynamic code. While Sonatype does not do static analysis, it's been fine for dynamic. We don't have the headache of worrying about what our developers are downloading. Sonatype is taking care of all that. We have a very closed environment; nothing is allowed. Everything is "deny, deny." It used to be that for a user to request a package from PyPI, for example, they would need to submit a firewall request and to go through a CRV meeting. People would need to review it and approve it or reject it. Once that was done, we would need to whitelist that URL into the proxy. To download simple packages it would take users two weeks. Now, they can do it instantly.

It has helped developer productivity because they can do things right away now. For the majority of the code they're downloading, the URLs are already whitelisted through Sonatype. Our development has been pretty fast, as a result. Overall, the executives have been happy, because now we have something that is evaluating the open source code.

The Nexus Firewall itself, with its sheer ability to ensure that you're downloading safe code, is a big win for our environment. 

Another thing that I like about Sonatype is that if you download something today, and five days from today it becomes vulnerable, it will notify you.

When you go to the IQ Server dashboard, it will tell you, "Version 1.2 is not good. You should upgrade it to version 1.3." You have that visibility, and you can whitelist things based on your business justification, and you can add notes in there as well.

In terms of securing our software supply chain, what we're trying to do is set things up so that they're upstream from our developers' work stations. Aside from downloading the code safely through Sonatype, a second way is by pushing our developers' code into a repository and Sonatype will do the security evaluation. You can use it as a hosted repository, versus using ADO which does not provide security evaluation and scanning. It helps bring open source intelligence and policy enforcement across our SDLC.

I've been using Sonatype Nexus Firewall for two years.

The stability has been okay. I can't complain. It hasn't broken down on us.

It hasn't been hard to scale it. We're in the process of integrating with ADO and our CI/CD pipeline.

At the moment, any developer who needs to download anything from the open source world must do so through Sonatype. All other access is blocked on the servers themselves. The servers cannot directly go through to PyPI, for example. Everything has to go through Sonatype. I can confidently say that we are using it enterprise-wide and everything is coming through Sonatype.

I love the product and the team, and their support is phenomenal. You send them an email and they reply back to you within minutes. In general, they're responsive and helpful.

The guys from Sonatype who helped me build our dev environment for the PoC were on the ground with us, helping, running around the room, talking to people, and implementing it. But for the production, we had to do everything on our own.

If I have any questions in terms of implementation, or any high-level ideas, the guys from the customer success team that I'm good friends with, throughout this process, always schedule a time to meet or call. It does take them time, but they always make themselves available.

What I don't like is the lack of an option to pick up the phone and call someone for support. That is something they need to improve on. They need to have a professional services package, or they need to include that option with their services. If something breaks at the customer that we work with, I should be able to call someone at Sonatype, get them on the line, share a screen, and fix it right away. They don't have that at the moment.

We did not have a previous solution. This was the first solution we were introduced to. Open source security is new to everyone, and recently were finding a lot more security vulnerabilities in the open source stack. We saw what Sonatype was capable of, we saw that it was blocking stuff. We saw that we had a log of user XYZ downloading this package and, when it was blocked, we were able to whitelist it or blacklist it, and provide a justification for why it was blocked. So far, everything has been pretty good.

For people who don't have a lot of Linux knowledge—including myself, I'm purely a Windows guy—it can be very tricky. It did take us a long time to stand up the environment.

The fact they don't have professional services to implement it for you is a big gap. I have a good relationship with everyone on the Sonatype team. I sent them an email and they made time to jump on a call and help us build it. That is what is expected from a large, enterprise-level company. We have Azure Sentinel and F5 and these companies have professional services. They help you from end-to-end, starting with the implementation. Sonatype does not have been at the moment. It does become challenging when you're not a Linux guy and you need to learn and implement it and to make sure that you're deploying it securely.

To be fully ready, it took us two months. I was involved, along with one of my engineers, and we had the help from Sonatype team.

In terms of an implementation strategy, we had the whole high-level architecture set up, which was not very hard. But to engineer it and do it was a little challenging for me, but it could be different for people who have Linux knowledge.

There are about 200 people using it across our organization. Most of them are developers and data scientists. I take care of the day-to-day maintenance. The upgrades are easy, the directions are easy. If you do need help, you can reach out to the support.

From a security perspective, it has made a significant difference.

The pricing is reasonable if you're a large enterprise developing code. It's not super-expensive. There are no costs in addition to the standard fees.

I know there are others in the market, like JFrog, but it was quite an easy setup and then we just rolled with it. We didn't really bother looking at other products.

You should have some knowledge of Linux before implementing it, because to set up the rsync and to make sure your data is being replicated and that it's HA, you need to know Linux.

We took a look at the demo of Nexus Container and, although I haven't used it hands-on so I cannot say too much about it, it looks like a freaking awesome product. We are in the process of evaluating it and may do a PoC. It looks like it's easy to use, easy to integrate, and does not require a lot of RAM or storage. You can install it on existing Kubernetes clusters, so there's not a lot of infrastructure needed. Using it, I expect we'll find out if the images that we're downloading for the containers are secure or not. It's definitely worth taking a look at it.

Default policies are never really a good idea, anywhere. You need to adjust them based on your environment's needs. When we deployed Sonatype, the policies were not automatically configured so that if a packet is malicious it would block it. You need to manually set those up. But their policy engine provided the flexibility that we need. It was really a quick, easy setup.

The biggest lesson I've learned from using Sonatype is that open source security is very important and it's getting crazy these days, because there's so much hacking and so many breaches going on, so much vulnerability. Even Microsoft codes and some of the packages in PyPI are not secure. You trust a repository like Microsoft or PyPI, but there are still some vulnerabilities out there. That is why it was so important for Sonatype to be implemented in our environment.

The product helps with vulnerability and security assessment. It also helps with assessment at the configuration level. 

The product's network and intrusion protection features are valuable. It also has rules and compliance features for security. 

The tool needs to improve its file systems. The product should also include zero test feature. 

I have been working with the solution for eight years. 

I would rate the solution an eight out of ten.