View Source

 <p>The default security settings of TIM Enterprise allow for ease of 
installation and are suitable for the needs of most organisations.  
However, if your organisation's IT security policy demands it, or you 
plan to expose the system to an untrusted network such as the Internet, 
it is recommended you harden the security using the methods described 
below.</p>

NOTE: After changing any of the following settings, you will need to restart the TIM Enterprise service before changes will take effect.

<h2>Blocking invalid login attempts</h2>

<p>The system can blacklist the source IP address of a would-be attacker if
 a number of unsuccessful access attempts are made within a specified 
period of time.  The following two Registry entries determine how many 
invalid login attempts are permissible before the source IP is 
blacklisted and, if so, for how long the blacklist will remain in place 
until further attempts are entertained:-</p>

<table class="confluenceTable">
	<tbody>
		<tr>
			<th class="confluenceTh" width=166>Registry String data value</th>
			<th class="confluenceTh">Description</th>
		</tr>
		<tr>
			<td class="confluenceTd"><span class="keyword">FloodFailCount = 0</span></td>
			<td class="confluenceTd">Number of attempts</td>
		</tr>
		<tr>
			<td class="confluenceTd"><span class="keyword">FloodLockTime = 60</span></td>
			<td class="confluenceTd">Lockout duration</td>
		</tr>
	</tbody>
</table>

<p>All Registry keys for TIM Enterprise are located in the following hive:-</p>

HKEY_LOCAL_MACHINE\SOFTWARE\Tri-Line\TIM Enterprise

<img id="border" src="http://www.tri-line.com/common/img/documentation/tim_enterprise/windows_registry.png" alt="Windows registry" />

<h2>Changing the default web server port</h2>

<p>If you would like to change the default port used for web traffic you can edit the "WWWServerPort" Registry key.</p>

<table class="confluenceTable">
    <tbody>
        <tr>
            <th class="confluenceTh" width=166>Registry String data value</th>
            <th class="confluenceTh">Description</th>
        </tr>
        <tr>
            <td class="confluenceTd"><span class="keyword">WWWServerPort  = port number</span></td>
            <td class="confluenceTd">Port address for webserver to listen on (Default is 80, unless changed during setup)</td>
        </tr>
    </tbody>
</table>

<h2>Enabling High Security mode</h2>

<p>To enable High Security mode, add the following Registry String value:-</p>

HKEY_LOCAL_MACHINE\SOFTWARE\Tri-Line\TIM Enterprise\Main\HighSecurity = "True"

<p>Within the Windows Registry, right click and select <span class="keyword">New ? String Value</span> and name it <span class="keyword">HighSecurity</span>.</p>

<p> Then, double-click on it and enter the Value of <span class="keyword">True</span>, as shown below:</p>

<img src="http://www.tri-line.com/common/img/documentation/tim_enterprise/HighSecurity.png" alt="HighSecurity Registry value" />

<p>When the <span class="keyword">HighSecurity</span> Registry value is set to <span class="keyword">True</span>, the following restrictions are imposed:-</p>

<ol>
  	<li> Ability to block individual web scripts by including them in a blacklist file: 
		<div style="border-width: 1px;" class="code panel"><div class="codeContent panelContent">
		<div><div class="syntaxhighlighter  java" id="highlighter_500102"><div class="toolbar"><span><a class="toolbar_item command_help help" href="#">?</a></span></div>
		<table cellspacing="0" cellpadding="0" border="0"><tbody><tr><td class="gutter"><div class="line number1 index0 alt2">1</div></td><td class="code">
		<div title="Hint: double-click to select code" class="container"><div class="line number1 index0 alt2"><code class="java plain">"\ssldata\{class}\blacklist.___"</code></div></div></td></tr>
		</tbody></table></div></div>
		</div></div>
	</li>
  	<li> Enforce password complexity for web users (additional Registry entries required)</li>
  	<li> Forbid direct SQL queries through web interface</li> 
  	<li> System alert messages are silently suppressed</li>
  	<li> System database connection tests forbidden</li>
  	<li> Ability to (re)create system database tables inhibited</li>
  	<li> Cannot change or test web (HTTP) port</li>
  	<li> Cannot send test emails</li>
  	<li> Debug information suppressed if a XSL translation error occurs</li>
</ol>

<h2>Web interface protocols</h2>

<p>The default behaviour is to allow all protocols TLS1, SSL2 and SSL3.</p>

<p>You can change the type of connection that TIM will respond to by adding the Registry String Value <span class="keyword">WWWSSLProtocol</span>.</p>

<p>Note that this this is a case-insensitive string value with one of the following data values:</p>

<table class="confluenceTable">
    <tbody>
        <tr>
            <th class="confluenceTh" width=166>Registry String data value</th>
            <th class="confluenceTh">Description</th>
        </tr>
        <tr>
            <td class="confluenceTd"><span class="keyword">nossl</span></td>
            <td class="confluenceTd">No SSL protocols, behave like a standard HTTP server</td>
        </tr>
		<tr>
            <td class="confluenceTd"><span class="keyword">ssl23</span></td>
            <td class="confluenceTd">SSL2 and SSL3 protocols only</td>
        </tr>
		<tr>
            <td class="confluenceTd"><span class="keyword">ssl2</span></td>
            <td class="confluenceTd">SSL2 protocol only</td>
        </tr>
		<tr>
            <td class="confluenceTd"><span class="keyword">ssl3</span></td>
            <td class="confluenceTd">SSL3 protocol only</td>
        </tr>
		<tr>
            <td class="confluenceTd"><span class="keyword">tls1</span></td>
            <td class="confluenceTd">TLS1 protocol only</td>
        </tr>
	</tbody>
</table>

<h2>Password complexity</h2>

<p>You can configure TIM Enterprise web users with complex passwords to match your organisation's IT password policy.</p>

<p>To enable complex passwords, a Registry String Value <span class="keyword">PasswordComplexity</span> must be added.</p>

<p>The use of the following data string values, allows you to configure how complex the passwords are:</p>

"A"+{0-9}+"a"+{0-9}+"!"+{0-9}+"#"+{0-9}

<p>Each part of the complexity string is defined by a pair of 
characters, a single character denoting the type of policy, immediately 
followed by a numeric character (0-9) stipulating how many characters of
 that type are required to satisfy the password policy.</p>

<p>The Type characters are as follows:-</p>

<ul>
  <li><span class="keyword">A</span>:&nbsp; Upper- or lower-case characters</li>
  <li><span class="keyword">a</span>:&nbsp; Lower-case characters</li>
  <li><span class="keyword">!</span>:&nbsp; Symbol characters</li> 
  <li><span class="keyword">#</span>:&nbsp; Numeric characters</li>
</ul>

<p>For example, to impose a restriction of at least 6 characters with two numbers, the following Registry entry could be used:-</p>

HKEY_LOCAL_MACHINE\SOFTWARE\Tri-Line\TIM Enterprise\Main\PasswordComplexity = "A6a0!0#2"

<div class="panelMacro"><table class="noteMacro"><colgroup><col width="24"><col></colgroup><tbody><tr><td valign="top"><img width="16" height="16" border="0" align="absmiddle" alt="" src="/images/icons/emoticons/warning.png"></td><td><p><strong>NOTE:</strong> <strong>The value of <span class="keyword">PasswordComplexity</span> must always be 8 characters, otherwise the policy will not be implemented.</strong> The order of each Type pair (Type character and amount character) is not important.</p></td></tr></tbody></table></div>

<h2>Automatic expiry of Web user passwords</h2>

<p>You can force Web users to change the password after a predetermined age has been set. Note that this is a system wide setting.</p>

<p>The server running TIM Enterprise will email the web user advising 
that a password change is required. The web user must have an email 
address configured for notification to take place.</p>

<p>If the password is not changed by the expiry date then the account is automatically disabled.</p>