Skip to Content

Changes for page Security

Last modified by Arthur Heffern on 2021/09/09 20:55
From version 5.2
edited by Arthur Heffern
on 2021/09/09 18:14
Change comment: Updated parent field.
To version 6.2
edited by Arthur Heffern
on 2021/09/09 19:25
Change comment: Updated parent field.

Summary

Details

Page properties
Parent
... ... @@ -1,1 +1,1 @@
1 -xwiki:ISYMDOCS.Home.iSymphony Administrator's Guide
1 +xwiki:ISYMDOCS.Home.iSymphony Administrator's Guide.WebHome
Content
... ... @@ -1,7 +1,5 @@
1 1  **//On this page~://**
2 2  
3 -
4 -
5 5  {{toc/}}
6 6  
7 7  iSymphony opens several ports for communication with the outside world. These ports include the Web Ports used by the server to provide both the Administration and Client web interfaces, the REST API and Voicemail and Recording Agent file servers. The iSymphony server is broken up into several subsections call servlets. Each servlet can have several layers of security activated on them in order to prevent unauthorized access and man in the middle attacks.
... ... @@ -60,7 +60,7 @@
60 60  The following method requires the Oracle JDK.
61 61  )))
62 62  1. (((
63 -Run the following command to create your SSL keystore. (% style="line-height: 1.4285715;" %)Follow the prompts to finish creating the keystore.
61 +Run the following command to create your SSL keystore. (% style="line-height:1.4285715" %)Follow the prompts to finish creating the keystore.
64 64  
65 65  {{code language="bash"}}
66 66  keytool -keystore <filename> -alias <alias> -genkey -keyalg RSA -validity <number of days cert is valid>
... ... @@ -83,7 +83,6 @@
83 83  The default password for the cacerts truststore is: "changeit". For more information on the keytool please see the Oracle documentation :
84 84  [[https:~~/~~/docs.oracle.com/javase/8/docs/technotes/tools/unix/keytool.html>>url:https://docs.oracle.com/javase/8/docs/technotes/tools/unix/keytool.html||shape="rect"]]
85 85  
86 -
87 87  
88 88  {{warning}}
89 89  {{id name="cacerts"/}}
... ... @@ -131,7 +131,7 @@
131 131  Modify /opt/isymphony3/server/conf/security.xml to make iSymphony aware of the keystore by modifying the SSLKeystore XML element with the appropriate values:
132 132  
133 133  {{code}}
134 -<SSLKeystore filename="isymphony.jks" keystorePassword="isymphony" keyPassword="isymphony" certAlias="isymphony" />
131 +<SSLKeystore filename="isymphony.jks" keystorePassword="isymphony" keyPassword="isymphony" certAlias="isymphony" ></SSLKeystore>
135 135  {{/code}}
136 136  
137 137  Then enabling SSL on each context you would like to utilize SSL (More on this below) and restarting the iSymphonyServerV3 service should complete the configuration.
... ... @@ -140,7 +140,7 @@
140 140  
141 141  You can enable and disable entire **Security Contexts** by setting the **enabled** attribute to **true** or **false** in the **SecurityContext** tag in the **/opt/isymphony3/server/conf/security.xml** file. A disabled **Security Context** will apply no restrictions to the servlet despite any of the inner settings.
142 142  
143 -1. (((
140 +(((
144 144  == SSL ==
145 145  )))
146 146  
... ... @@ -150,21 +150,22 @@
150 150  If enabling SSL on the communication_manager servlet and you are using the iSymphony FreePBX module you must modify the module settings to use SSL. See [[doc:FreePBX Module Administration]] for more information.
151 151  {{/info}}
152 152  
153 -1. (((
150 +(((
154 154  == Realm Authentication ==
155 155  )))
156 156  
157 157  You can enable or disable HTTP realm authentication on a specific **Security Context** by setting the **enabled** attribute in the **RealmAuth** tag to **true** or **false**. You can add a new HTTP realm authentication user by adding a **RealmAuthUser** tag to the **RealmAuthUsers**. You can specify the user's credentials by populating the **username** and **password** attributes of the **RealmAuthUser** tag.
158 158  
159 -1. (((
156 +(((
160 160  == IP Access ==
161 161  )))
162 162  
163 163  You can enable IP access on a specific **Security Context** by setting the **enabled** attribute on the **IPAccess** tag to **true** or **false**. The **IPAccess** restriction will allow or deny connections from specific IP addresses based on the contents of the **WhiteList** and **BlackList** in the **IPAccess** tag.
164 164  
165 -1. (((
162 +(((
166 166  === Behavior ===
167 167  )))
165 +
168 168  1. IPs that are specified in the **WhiteList** will always be allowed to access the system unless the IP is specified in the **BlackList** as well.
169 169  1. IPs that are specified in the **BlackList** will never be allowed to access the system.
170 170  1. If no entries are specified in the **WhiteList** or **BlackList** all IPs will have access to the servlet.