Take extra care when SavaPage is accessible over public Internet, as a result of enabled Internet Print or explicit WAN to LAN routing, since authentication falls back to global defaults for User Authentication. At least make sure that access to the Admin Web App is solidly secured.
Internet access to each Web App can be restricted with configuration properties in the table below:
| Configuration property | Description |
|---|---|
|
webapp.internet.enable |
Set to |
|
webapp.internet.*.enable * = admin | jobtickets | mailtickets | payment | pos | printsite | user |
Set to |
|
webapp.internet.*.auth-mode.enable * = admin | jobtickets | mailtickets | payment | pos | printsite | user |
Set to Note: if webapp.internet.admin.auth-mode.enable =
|
|
webapp.internet.*.auth-modes * = admin | jobtickets | mailtickets | payment | pos | printsite | user |
A comma-separated list of authentication methods
( |
Table 17.1. Web App Internet Access Configuration Properties
See Section 4.11.14, “Config Editor” on how to set these items.
Exceptions to these generic restrictions can be configured by creating a Terminal Device for each trusted client IP address and configure Custom User Login methods.
security.txt
is a proposed standard which allows websites to define security policies. The
file is available via
https://your-savapage-server/.well-known/security.txt and its
content is set with configuration properties as outlined in the table
below:
| Configuration property | Description |
|---|---|
|
securitytxt.enable |
Set to |
|
securitytxt.contact.mailto |
E-mail address for people to contact you about security issues. |
| securitytxt.contact.tel |
Phone number for people to contact you about security issues. |
| securitytxt.contact.url |
URL for people to contact you about security issues.
Must start with At least one securitytxt.contact.* property must be configured. |
| securitytxt.encryption.uri |
URI to a key which security researchers should use to securely talk to you (optional). |
| securitytxt.acknowledgments.url |
URL to a web page where you say thank you to security
researchers who have helped you (optional). Must start
with |
| securitytxt.preferred-languages |
A comma-separated list of language codes that your security team speaks (optional). |
| securitytxt.securitytxt.policy.url |
URL to a policy detailing what security researchers
should do when searching for or reporting security
issues (optional). Must start with
|
| securitytxt.securitytxt.hiring.url |
URL to any security-related job openings in your
organisation (optional). Must start with
|
Table 17.2. Configuration Properties for security.txt
See Section 4.11.14, “Config Editor” on how to set these items.
The “Expires:” property in
security.txt is generated by SavaPage and
set one month in the future.