Share this page

# Security Related PPM Server Configuration Parameters

This section contains reference to some of the PPM server configuration parameters that are relevant to security. Full details can be found in Administer Project and Portfolio Management.

In this topic:

## Secure PPM Storage

PPM allows users to upload files to the server. All files uploaded to the server must be validated, since they can contain viruses, malicious code, or Trojan horses that could infect the entire system. An attacker or a malicious user can upload malicious files from one account and then download them to diverse clients.

It is strongly recommended to implement proper antivirus protection for the file storage allocated for the PPM repository.

In addition, the size of the file uploaded as an attachment can be limited by setting the `MAX_WEB_ATTACHMENT_SIZE_IN_MB` server configuration parameter.

## Secure Debug Features

PPM provides a set of tools for troubleshooting and for providing better supportability. These features, which can expose sensitive internal information about the system and about activities performed on the system, are disabled by default and can be switched on by using the following server configuration parameters. It is recommended to validate that the parameters are reset to the default values immediately after using the debugging feature.

The debugging related server configuration parameters are:

- `MULTICAST_DEBUG`
- `SHOW_DEBUGGING_CONSOLE_PER_USER`
- `SQL-Debug`
- `DISABLE_VERBOSE_ERROR_MESSAGES`

## JMX Console

JMX console is used to diagnose PPM internal services. It is important to limit the JMX console access to only authorized users. For details, see Administer Project and Portfolio Management.

## Password Constraints

Admins can set PPM user password constraints to secure the PPM users.

The following parameters control the user password constraints:

-     USER_PASSWORD_MAX_LENGTH

  PPM recommends that admins set the value of this parameter to `16`.

-     USER_PASSWORD_MIN_DIGITS

  PPM recommends that admins set the value of this parameter to `1`.

-     USER_PASSWORD_MIN_LENGTH

  PPM recommends that admins set the value of this parameter to `8`.

-     USER_PASSWORD_MIN_SPECIAL

  PPM recommends that admins set the value of this parameter to `0`.

- `PASSWORD_EXPIRATION_DAYS`

  PPM recommends that admins set the value of this parameter to `90`.

- `PASSWORD_REUSE_RESTRICTION_DAYS`

  PPM recommends that admins set the value of this parameter to `366`.

- `USER_PASSWORD_MIN_UPPERCASE_LETTERS`

  PPM recommends that admins set the value of this parameter to `1`.

- `USER_PASSWORD_MIN_LOWERCASE_LETTERS`

  PPM recommends that admins set the value of this parameter to `1`.

## Restrict access to cookies

You can ensure that cookies are sent securely and are not accessed by unintended parties or scripts in one of the following ways: with the `HttpOnly` attribute or with the `Secure` attribute.

HttpOnly attribute

`HttpOnly` is an additional attribute included in a Set-Cookie HTTP response header. Using the `HttpOnly` attribute when generating a cookie helps mitigate the risk of client side script accessing the protected cookie (if the browser supports it).

The HttpOnly parameter is

- `USE_HTTPONLY`

Secure attribute

A cookie with the `Secure` attribute is only sent to the server with an encrypted request over the HTTPS protocol. Using the `Secure` attribute prevents the transmission of the cookie in clear text, thus prevents cookies being observed by unauthorized parties.

To set the `Secure` attribute:

1. Open the server.conf file and set the BASE_URL parameter to start with https.
2. In the server.conf file, set the SET_SESSION_COOKIE_SECURE_FLAG_IN_HTTPS parameter to true.
3. Run the kUpdateHtml.sh script. For details, see the System Administration Guide.
4. Restart PPM.

## DMS

The followings are the DMS configuration parameters:

- DMS_INSECURE_FILE_EXTENSION_CHECK

- DMS_XSS_CHECK

We recommend that admins set the values of the above parameters to `true`.

https://admhelp.microfocus.com PPM 8942
Tips to improve your search results... OpenText™ Project and Portfolio Management Help Center PPM Help 26.2-26.3 All View Local Help Center View Online Help Center Version: