Security

Setup HTTPS

Transport Layer Security (TLS) is a cryptographic protocol that provides communications security over a computer network. Websites, like the Web Management Console, are able to use TLS to secure all communications between their servers and web browsers.

The TLS protocol aims primarily to provide confidentiality (privacy) and data integrity between two communicating computer applications.

Steps to setup this feature:

1. Go to Inventory> Certificates

2. Click Add certificate

   1. To add a certificate using a file path, choose Add by path and enter the location of both the certificate and its corresponding private key file.

   2. To upload certificate file, select Upload file.

Certificate YML sample file:

3. Go to Settings > Security

4. On the Secure Connection section, click Details

5. Select Enable Certificate , then select your certificate added in step 2.

Password policies

Password Policy settings are accessible under Settings > Securitytab.

Local users' password can be enforced to meet requirements set by administrators, which includes following constraints:

• Enforce password policy:

  • Determines the number of unique new passwords that must be associated with a user account before an old password can be reused

  • Range: [0-24]

  • Default: 0 (to disable enforcement)

• Minimum password length:

  • The least number of characters that can make up a password for a user account

  • Range: [0-30]

  • Default: 0 (to disable enforcement)

• Password must meet complexity requirements:

  • Determines whether passwords must meet a series of guidelines that are considered important for a strong password.

  • Default: unchecked

Session policies

Administrators can enforce session policies for local users to ensure compliance with organizational requirements, using the following settings:

• Enable idle session timeout:

  • Idle timeout automatically terminates a user's session based on how long since their last recorded activity.

  • Default: 300 seconds.

• Enable session timeout

  • Absolute timeout terminates an individual user's session after a fixed duration, regardless of any user activity.

  • Default: 0 (to disable enforcement)

• Allow Duplicate Sessions

  • Permit the same user to log in and operate multiple sessions at once.

  • Default: Enabled.

• Allow Cross IP Sessions

  • Permit requests from sources other than the authenticated origin.

  • Default: Disabled.