If you want to secure Aspire access to the Administration UI using the ConfigFile method, the best and most secure way is by encrypting the passwords and validating them against policy rules. Complete the following steps.
Run bin/encryptPassword. This script will create passwords of the "administrator" and "developer" users to be encrypted inside the settings.xml file when you use the optional "username" parameter. The password you pass to the script for encryption will also be also validated against defined policy rules (see the explanation later in this article)
Enable the ConfigFile authentication on the settings.xml file:
Code Block | ||
---|---|---|
| ||
<authentication> <type>ConfigFile</type> </authentication> |
...
Code Block |
---|
<?xml version="1.0" encoding="UTF-8"?> <passwordPolicy> <rules> <!-- password must be between min and max chars long --> <lengthRule> <minimum>8</minimum> <maximum>15</maximum> </lengthRule> <!-- don't allow whitespace --> <whitespaceRule/> <!-- Control allowed characters --> <characterCharacteristicsRule> <!-- require at least 1 upper case char --> <uppercase>1</uppercase> <!-- require at least 1 lower case char --> <lowercase>1</lowercase> <!-- require at least 1 digit in passwords --> <digit>1</digit> <!-- require at least 1 non-alphanumeric char --> <nonalphanumeric>1</nonalphanumeric> <!-- require at least x of the previous rules be met --> <numberOfCharacteristics>3</numberOfCharacteristics> </characterCharacteristicsRule> <!-- don't allow alphabetical sequences --> <alphabeticalSequenceRule/> <!-- don't allow numerical sequences --> <numericalSequenceRule/> <!-- don't allow qwerty sequences --> <qwertySequenceRule/> <!-- don't allow 4 repeat characters --> <repeatCharacterRule/> <!-- do not allow matching against history --> <historyRule/> <!-- do not allow matching against Dictionary --> <dictionaryRule> <wordLength>4</wordLength> <matchBackwards>true</matchBackwards> </dictionaryRule> </rules> <!-- uncomment if you do not want default values --> <!--passwordHistory> <historyFile>config/security/passwordHistory.xml</historyFile> </passwordHistory--> <!--dictionary> <dictionaryFile>config/security/passwordDictionary</dictionaryFile> </dictionary--> <!-- maximum password age - The suffix of the value should be one of ms,s,m,h,d --> <maximumPasswordAge>5000d</maximumPasswordAge> </passwordPolicy> |
The file defines words which cannot be used in passwords if dictionaryRule is defined in passwordPolicy.
Code Block |
---|
ABI
ACL
ACPI
ADSL
AGP
AMD
API
APIC
ATAPI
ATX
AVI
AXP
AfterStep
AlphaBIOS
Appletalk
Athlon
.....
|
The file maintains history of used passwords. If historyRule is defined in passwordPolicy the password is validated against this file.
Code Block |
---|
<?xml version="1.0" encoding="UTF-8"?>
<passwordHistory>
<!-- last modified in ms; e.g. 1535712347811 = 08/31/2018 12:45 CET -->
<user name="admin" lastModified="1535712347811">
<password>MwRLPWHiwj49VmNSmTsSBeFECqk=</password>
</user>
<user name="developer" lastModified="1535712347811">
</user>
</passwordHistory> |
Note | ||
---|---|---|
| ||
In this version the function is considered to be preliminary as it still does not have any support regarding maintaining the list of used password automatically. It must be maintained manually following the next steps:
|