Security Related PPM Server Configuration Parameters

This section contains reference to some of the PPM server configuration parameters that are relevant to security. Full details can be found in Administer Project and Portfolio Management.

Secure PPM Storage

PPM allows users to upload files to the server. All files uploaded to the server must be validated, since they can contain viruses, malicious code, or Trojan horses that could infect the entire system. An attacker or a malicious user can upload malicious files from one account and then download them to diverse clients.

It is strongly recommended to implement proper antivirus protection for the file storage allocated for the PPM repository.

In addition, the size of the file uploaded as an attachment can be limited by setting the MAX_WEB_ATTACHMENT_SIZE_IN_MB server configuration parameter.

Secure Debug Features

PPM provides a set of tools for troubleshooting and for providing better supportability. These features, which can expose sensitive internal information about the system and about activities performed on the system, are disabled by default and can be switched on by using the following server configuration parameters. It is recommended to validate that the parameters are reset to the default values immediately after using the debugging feature.

The debugging related server configuration parameters are:

  • MULTICAST_DEBUG
  • SHOW_DEBUGGING_CONSOLE_PER_USER
  • SQL-Debug
  • DISABLE_VERBOSE_ERROR_MESSAGES

JMX Console

JMX console is used to diagnose PPM internal services. It is important to limit the JMX console access to only authorized users. For details, see Administer Project and Portfolio Management.

Password Constraints

Admins can set PPM user password constraints to secure the PPM users.

The following parameters control the user password constraints:

  • USER_PASSWORD_MAX_LENGTH

    PPM recommends that admins set the value of this parameter to 16.

  • USER_PASSWORD_MIN_DIGITS

    PPM recommends that admins set the value of this parameter to 1.

  • USER_PASSWORD_MIN_LENGTH

    PPM recommends that admins set the value of this parameter to 8.

  • USER_PASSWORD_MIN_SPECIAL

    PPM recommends that admins set the value of this parameter to 0.

  • PASSWORD_EXPIRATION_DAYS

    PPM recommends that admins set the value of this parameter to 90.

  • PASSWORD_REUSE_RESTRICTION_DAYS

    PPM recommends that admins set the value of this parameter to 366.

  • USER_PASSWORD_MIN_UPPERCASE_LETTERS

    PPM recommends that admins set the value of this parameter to 1.

  • USER_PASSWORD_MIN_LOWERCASE_LETTERS

    PPM recommends that admins set the value of this parameter to 1.

Restrict access to cookies

You can ensure that cookies are sent securely and are not accessed by unintended parties or scripts in one of the following ways: with the HttpOnly attribute or with the Secure attribute.

HttpOnly attribute

HttpOnly is an additional attribute included in a Set-Cookie HTTP response header. Using the HttpOnly attribute when generating a cookie helps mitigate the risk of client side script accessing the protected cookie (if the browser supports it).

The HttpOnly parameter is

  • USE_HTTPONLY

Secure attribute

A cookie with the Secure attribute is only sent to the server with an encrypted request over the HTTPS protocol. Using the Secure attribute prevents the transmission of the cookie in clear text, thus prevents cookies being observed by unauthorized parties.

To set the Secure attribute:

  1. Open the server.conf file and set the BASE_URL parameter to start with https.
  2. In the server.conf file, set the SET_SESSION_COOKIE_SECURE_FLAG_IN_HTTPS parameter to true.
  3. Run the kUpdateHtml.sh script. For details, see the System Administration Guide.
  4. Restart PPM.

DMS

The followings are the DMS configuration parameters:

  • DMS_INSECURE_FILE_EXTENSION_CHECK

  • DMS_XSS_CHECK

We recommend that admins set the values of the above parameters to true.