.. /* * This file is part of the SavaPage project . * Copyright (c) 2026 Datraverse B.V. * Author: Rijk Ravestein. * * SPDX-FileCopyrightText: (c) 2020 Datraverse B.V. * SPDX-License-Identifier: CC-BY-SA-4.0 * * For more information, please contact Datraverse B.V. at this * address: info@datraverse.com */ .. _ch-security: .. figure:: ../images/manual/savapage-logo-no-text-100px.png :width: 75px Security ======== .. admonition:: |ADMONITION_TABLE_OF_CONTENTS| - :numref:`{number}. {name} ` - :numref:`{number}. {name} ` - :numref:`{number}. {name} ` - :numref:`{number}. {name} ` - :numref:`{number}. {name} ` - :numref:`{number}. {name} ` - :numref:`{number}. {name} ` - :numref:`{number}. {name} ` - :numref:`{number}. {name} ` - :numref:`{number}. {name} ` - :numref:`{number}. {name} ` - :numref:`{number}. {name} ` - :numref:`{number}. {name} ` - :numref:`{number}. {name} ` - :numref:`{number}. {name} ` - :numref:`{number}. {name} ` - :numref:`{number}. {name} ` This chapter discusses how |PRODUCT_NAME| secures sensitive user and application data, and how it communicates with external Information Providers. .. _ch-security-httpfilters: HTTP Service Filters -------------------- .. contents:: :depth: 1 :local: HTTP Service Filters enforce access policies at the point where remote clients connect to the |PRODUCT_NAME| server. Connection requests may be delayed, throttled, rejected, aborted or denied. Statistics are shown in the Admin Web App. See :ref:`Filtered Requests `. .. note:: - Details of the filtered requests are persisted in the rotating log file: ``/opt/savapage/server/logs/security.log`` - This file has a tab separated value (TSV) format for easy import and manipulation into spreadsheet programs. See :ref:`log4j.properties ` for more information. - If your ``log4j.properties`` file does not contain the "Security Logger" section, copy it from the :ref:`log4j.properties.template `. .. _ch-security-httpfilters-dos: Denial of Service Filter ~~~~~~~~~~~~~~~~~~~~~~~~ A Denial of Service Filter keeps track of the number of requests from a connection to the |PRODUCT_NAME| server per second. If a limit is exceeded, the request is either delayed, throttled, rejected or aborted. A throttled request is placed in a queue and will only proceed when there is capacity. HTTP status code ``429`` is sent if there are too many requests. .. list-table:: Denial of Service Filter : Configuration Properties :width: 100% :header-rows: 1 * - Configuration property - Description * - system.dosfilter.enable - | Set to ``Y`` (default) or ``N`` to enable/disable the | Denial of Service Filter. * - system.dosfilter.delay-msec - | Delay (in milliseconds) that is applied to all requests over | the rate limit ``system.dosfilter.max-requests-per-sec``, | before they are considered at all. ``-1`` means just **reject** | request, ``0`` means no delay (**throttled**), otherwise it | is the **delay**. Default:``100``. * - system.dosfilter.max-idle-tracker-msec - | Maximum amount of time (in milliseconds) to keep track | ofrequest rates for a connection, before deciding that | the user has gone away, and discarding it. | Default: ``30000``. * - system.dosfilter.max-request-msec - | Maximum amount of time (in milliseconds) to allow the | request to process. Default: ``30000``. | | If a request exceeds this threshold it is interrupted and | HTTP status code ``503`` is returned. * - system.dosfilter.max-requests-per-sec - | Maximum number of requests from a connection per | second. Requests in excess of this are first delayed, | then throttled. Default: ``75``. | | Also see :ref:`HTTP/2 Settings `. * - system.dosfilter.throttle-msec - | Amount of time (in milliseconds) to async wait for | semaphore. Default: ``30000``. * - system.dosfilter.throttled-requests - | Number of requests over the rate limit able to be | considered at once. Default: ``5``. * - system.dosfilter.too-many-code - | HTTP status code to send if there are too many requests. | Default: 429 (too many requests). | 503 (service unavailable) is another option. * - system.dosfilter.whitelist - | Comma-separated list of host names, IPv4 addresses in | decimal notation ``A.B.C.D``, and canonical | (non-compressed) IPv6 addresses that will not be rate | limited. IPv4 CIDR notation ``A.B.C.D/M`` is supported, | IPv6 CIDR notation is **not**. | | Note: ``localhost`` , ``127.0.0.1`` and ``0:0:0:0:0:0:0:1`` | are implicitly whitelisted. * - system.dosfilter.warn-interval.applog.mins - | Interval (minutes) within which filter events are totaled | and written as warning in the :ref:`Application Log `. | The expiration of the interval is triggered by a filter | event. Default: ``5``. * - system.dosfilter.warn-interval.webapp.secs - | Interval (seconds) within which filter events are totaled | and send as :ref:`Real-time Activity ` warning with popup | message to the Admin Web App. Default: ``60``. See |RST_LINK_CONFIG_EDITOR| on how to set these properties. .. caution:: Please exercise extreme caution when configuring these properties, as doing so may result in losing access to all HTTP communication with |PRODUCT_NAME|. For example, setting ``system.dosfilter.max-request-msec`` too low can result in a permanent HTTP status code ``503``. If such a lockout occurs, you can enter the correct values using a :ref:`Database Command `, as in this example: .. code-block:: bash sudo su - savapage cd server/bin/linux-x64 ./savapage-db --db-config-set system.dosfilter.max-request-msec=30000 See :ref:`db-config-set `. *Restart SavaPage to apply the changes.* See :ref:`Stopping and Starting the Server `. .. _ch-security-httpfilters-inet: Inet Access Filter ~~~~~~~~~~~~~~~~~~ An Inet Access Filter allows/denies remote access to the |PRODUCT_NAME| server according to a list of IP addresses. HTTP error code ``403`` is sent if a request is denied. .. list-table:: Inet Access Filter : Configuration Properties :width: 100% :header-rows: 1 * - Configuration property - Description * - system.inetfilter.enable - | Set to ``Y`` or ``N`` (default) to enable/disable the | Inet Access Filter. * - system.inetfilter.whitelist - | A list of comma-separated list of IPv4/6 addresses, | individual or in CIDR notation that are allowed access. | Requests from remote addresses that do not match the | whitelist are denied with HTTP error code ``403``. | | Note: ``127.0.0.1`` and ``0:0:0:0:0:0:0:1`` are implicitly | whitelisted. * - system.inetfilter.whitelist.empty-allow-all - | Set to ``Y`` (default) or ``N`` to enable/disable empty white | list to be treated as "match all". | | If ``N``, an empty whitelist means that only ``127.0.0.1`` | and ``0:0:0:0:0:0:0:1`` are allowed. * - system.inetfilter.blacklist - | A list of comma-separated IPv4/6 addresses, individual | or in CIDR notation. Requests from remote addresses | that match the list are denied with HTTP error code | ``403``. | | Black list entries are always applied, so that even if | an entry matches the white list, a black list entry will | override it. | | Note: ``127.0.0.1`` and ``0:0:0:0:0:0:0:1`` are *not* allowed | on the list. * - system.inetfilter.warn-interval.applog.mins - | Interval (minutes) within which denied requests are | totaled and written as warning in the :ref:`Application Log `. | The expiration of the interval is triggered | by a InetAccessFilter event. Default: ``5``. * - system.inetfilter.warn-interval.webapp.secs - | Interval (seconds) within which denied requests are | totaled and send as :ref:`Real-time Activity ` warning | with popup message to the Admin Web App. | Default: ``60``. See |RST_LINK_CONFIG_EDITOR| on how to set these properties. .. _ch-security-httpfilters-http2: HTTP/2 Rate Control ~~~~~~~~~~~~~~~~~~~ |PRODUCT_NAME| supports both HTTP/1.1 and `HTTP/2 `__ communication protocols. HTTP/2 can be disabled or customized as desired. See :ref:`HTTP/2 Settings `.