17. Security

Table of Contents

• 17.1. HTTP Service Filters

• 17.2. User Authentication

• 17.3. Access over Internet

• 17.4. Web Sessions

• 17.5. Rate Limiting

• 17.6. SSL Certificate and Password

• 17.7. Secured JMX Connection

• 17.8. Encrypted Secrets

• 17.9. Document Signature

• 17.10. User Client

• 17.11. Server Commands

• 17.12. Web Services

• 17.13. Log Files

• 17.14. Network Card Reader

• 17.15. Internal Services

• 17.16. External Services

• 17.17. Vouchers

This chapter discusses how SavaPage secures sensitive user and application data, and how it communicates with external Information Providers.

17.1. HTTP Service Filters

HTTP Service Filters enforce access policies at the point where remote clients connect to the SavaPage server. Connection requests may be delayed, throttled, rejected, aborted or denied. Statistics are shown in the Admin Web App. See Filtered Requests.

Note

• Details of the filtered requests are persisted in the rotating log file: /opt/savapage/server/logs/security.log

• This file has a tab separated value (TSV) format for easy import and manipulation into spreadsheet programs. See log4j.properties for more information.

• If your log4j.properties file does not contain the “Security Logger” section, copy it from the log4j.properties.template.

17.1.1. Denial of Service Filter

A Denial of Service Filter keeps track of the number of requests from a connection to the SavaPage server per second. If a limit is exceeded, the request is either delayed, throttled, rejected or aborted. A throttled request is placed in a queue and will only proceed when there is capacity. HTTP status code 429 is sent if there are too many requests.

Denial of Service Filter : Configuration Properties

Configuration property	Description
system.dosfilter.enable	Set to Y (default) or N to enable/disable the Denial of Service Filter.
system.dosfilter.delay-msec	Delay (in milliseconds) that is applied to all requests over the rate limit system.dosfilter.max-requests-per-sec, before they are considered at all. -1 means just reject request, 0 means no delay (throttled), otherwise it is the delay. Default:100.
system.dosfilter.max-idle-tracker-msec	Maximum amount of time (in milliseconds) to keep track ofrequest rates for a connection, before deciding that the user has gone away, and discarding it. Default: 30000.
system.dosfilter.max-request-msec	Maximum amount of time (in milliseconds) to allow the request to process. Default: 30000. If a request exceeds this threshold it is interrupted and HTTP status code 503 is returned.
system.dosfilter.max-requests-per-sec	Maximum number of requests from a connection per second. Requests in excess of this are first delayed, then throttled. Default: 75. Also see HTTP/2 Settings.
system.dosfilter.throttle-msec	Amount of time (in milliseconds) to async wait for semaphore. Default: 30000.
system.dosfilter.throttled-requests	Number of requests over the rate limit able to be considered at once. Default: 5.
system.dosfilter.too-many-code	HTTP status code to send if there are too many requests. Default: 429 (too many requests). 503 (service unavailable) is another option.
system.dosfilter.whitelist	Comma-separated list of host names, IPv4 addresses in decimal notation A.B.C.D, and canonical (non-compressed) IPv6 addresses that will not be rate limited. IPv4 CIDR notation A.B.C.D/M is supported, IPv6 CIDR notation is not. Note: localhost , 127.0.0.1 and 0:0:0:0:0:0:0:1 are implicitly whitelisted.
system.dosfilter.warn-interval.applog.mins	Interval (minutes) within which filter events are totaled and written as warning in the Application Log. The expiration of the interval is triggered by a filter event. Default: 5.
system.dosfilter.warn-interval.webapp.secs	Interval (seconds) within which filter events are totaled and send as Real-time Activity warning with popup message to the Admin Web App. Default: 60.

See Config Editor on how to set these properties.

Caution

Please exercise extreme caution when configuring these properties, as doing so may result in losing access to all HTTP communication with SavaPage. For example, setting system.dosfilter.max-request-msec too low can result in a permanent HTTP status code 503.

If such a lockout occurs, you can enter the correct values using a Database Command, as in this example:

sudo su - savapage
cd server/bin/linux-x64
./savapage-db --db-config-set system.dosfilter.max-request-msec=30000

See db-config-set.

Restart SavaPage to apply the changes. See Stopping and Starting the Server.

17.1.2. Inet Access Filter

An Inet Access Filter allows/denies remote access to the SavaPage server according to a list of IP addresses. HTTP error code 403 is sent if a request is denied.

Inet Access Filter : Configuration Properties

Configuration property	Description
system.inetfilter.enable	Set to Y or N (default) to enable/disable the Inet Access Filter.
system.inetfilter.whitelist	A list of comma-separated list of IPv4/6 addresses, individual or in CIDR notation that are allowed access. Requests from remote addresses that do not match the whitelist are denied with HTTP error code 403. Note: 127.0.0.1 and 0:0:0:0:0:0:0:1 are implicitly whitelisted.
system.inetfilter.whitelist.empty-allow-all	Set to Y (default) or N to enable/disable empty white list to be treated as “match all”. If N, an empty whitelist means that only 127.0.0.1 and 0:0:0:0:0:0:0:1 are allowed.
system.inetfilter.blacklist	A list of comma-separated IPv4/6 addresses, individual or in CIDR notation. Requests from remote addresses that match the list are denied with HTTP error code 403. Black list entries are always applied, so that even if an entry matches the white list, a black list entry will override it. Note: 127.0.0.1 and 0:0:0:0:0:0:0:1 are not allowed on the list.
system.inetfilter.warn-interval.applog.mins	Interval (minutes) within which denied requests are totaled and written as warning in the Application Log. The expiration of the interval is triggered by a InetAccessFilter event. Default: 5.
system.inetfilter.warn-interval.webapp.secs	Interval (seconds) within which denied requests are totaled and send as Real-time Activity warning with popup message to the Admin Web App. Default: 60.

See Config Editor on how to set these properties.

17.1.3. HTTP/2 Rate Control

SavaPage supports both HTTP/1.1 and HTTP/2 communication protocols. HTTP/2 can be disabled or customized as desired. See HTTP/2 Settings.