This page addresses various security related matters.
Database passwords
The default installation creates a MySQL database user named 'openvpms' with password 'openvpms'.
This password should be changed. This can be done with the mysql utility with the command:
set password for 'openvpms'@'localhost' = password('3f6iNF7m46w9vjc');
This should be done for each host that the openvpms user has been granted access from.
For more information see:
https://dev.mysql.com/doc/refman/5.5/en/set-password.html
The password is stored in configuration files that will also need to be updated:
Administrator password
The default installation creates an OpenVPMS user named 'admin', with password 'admin'.
This should be changed when installation is complete, via Administration|Users.
User passwords
User passwords are configured via Administration|Users. There is little restriction on what passwords may be entered, but it is recommended that strong passwords are used.
File permissions
The OpenVPMS and Tomcat installation directories should only be accessible to a single user with a strong password.
These directories contain files that could enable an attacker to gain access to the OpenVPMS web application, or the MySQL database.