Skip to end of metadata
Go to start of metadata
You are viewing an old version of this page. View the current version. Compare with Current ·  View Page History
 

The default security settings of TIM Enterprise allow for ease of installation and are suitable for the needs of most organisations. However, if your organisation's IT security policy demands it, or you plan to expose the system to an untrusted network such as the Internet, it is recommended you harden the security using the methods described below.

NOTE: After changing any of the following settings, you will need to restart the TIM Enterprise service before changes will take effect.

Blocking invalid login attempts

The system can blacklist the source IP address of a would-be attacker if a number of unsuccessful access attempts are made within a specified period of time. The following two Registry entries determine how many invalid login attempts are permissible before the source IP is blacklisted and, if so, for how long the blacklist will remain in place until further attempts are entertained:-

Registry String data value Description
FloodFailCount = 0 Number of attempts
FloodLockTime = 60 Lockout duration

All Registry keys for TIM Enterprise are located in the following hive:-

Windows registry

Changing the default web server port

If you would like to change the default port used for web traffic you can edit the "WWWServerPort" Registry key.

Registry String data value Description
WWWServerPort = port number Port address for webserver to listen on (Default is 80, unless changed during setup)

Enabling High Security mode

To enable High Security mode, add the following Registry String value:-

Within the Windows Registry, right click and select New ? String Value

Then, enter HighSecurity with a Value of True, as shown below:

HighSecurity Registry value

When the HighSecurity Registry value is set to True, the following restrictions are imposed:-

  1. Ability to block individual web scripts by including them in a blacklist file:
    1
    "\ssldata\{class}\blacklist.___"
  2. Enforce password complexity for web users (additional Registry entries required)
  3. Forbid direct SQL queries through web interface
  4. System alert messages are silently suppressed
  5. System database connection tests forbidden
  6. Ability to (re)create system database tables inhibited
  7. Cannot change or test web (HTTP) port
  8. Cannot send test emails
  9. Debug information suppressed if a XSL translation error occurs

 

 

 

 

Labels: