Difference between revisions of "QPR UI Security Hardening"
(Created page with "Follow these instructions to harden QPR UI security. Also steps for QPR ProcessAnalyzer Security Hardening are valid for QPR UI. == Check Latest Java Version Installed ==...") |
|||
| Line 1: | Line 1: | ||
Follow these instructions to harden QPR UI security. Also steps for [[QPR ProcessAnalyzer Security Hardening]] are valid for QPR UI. | Follow these instructions to harden QPR UI security. Also steps for [[QPR ProcessAnalyzer Security Hardening]] are valid for QPR UI. | ||
| − | == | + | == Latest Java Installed == |
Check that the [[QPR_UI_System_Requirements#Other Needed Server Components|latest version of Java 8]] is installed. Make sure also that the automatic updating of Java is enabled. | Check that the [[QPR_UI_System_Requirements#Other Needed Server Components|latest version of Java 8]] is installed. Make sure also that the automatic updating of Java is enabled. | ||
Revision as of 12:30, 23 December 2019
Follow these instructions to harden QPR UI security. Also steps for QPR ProcessAnalyzer Security Hardening are valid for QPR UI.
Latest Java Installed
Check that the latest version of Java 8 is installed. Make sure also that the automatic updating of Java is enabled.
Change Payara Administrator Password
Change Payara administrator password.
Here is a Powershell script to change Payara Administrator password:
#Change Payara Administrator Password (CMD popup will ask for password. Default Payara admin credentials: admin/admin) Start-Process -FilePath "C:\Program Files\QPR Software Plc\QPR UI\Glassfish\bin\asadmin" -ArgumentList "change-admin-password" -Wait Start-Process -FilePath "C:\Program Files\QPR Software Plc\QPR UI\Glassfish\bin\asadmin" -ArgumentList 'set configs.config.server-config.http-service.virtual-server.server.property.errorReportValve=""' -Wait
Allow Incoming Requests only from Localhost
This step applies only when IIS is used as a reverse proxy for QPR UI. In Payara allow incoming requests only from localhost.
Remove X-Powered-By HTTP Header
Removing the X-Powered-By HTTP response header improved security, because the underlying technology is not revealed publicly. You can disable this by turning off the XPowered By: header with your http-listener and by adding a JVM-Option -Dproduct.name="".
More information about Payara hardening: http://blog.eisele.net/2011/05/securing-your-glassfish-hardening-guide.html