Security
This page addresses various security related matters.
Database passwords
The database user name and password is configured via the toolbox configure command which stores the configuration in:
<OPENVPMS_HOME>/conf/openvpms.properties
When the database is created, these are used to create a corresponding MySQL database user.
If the database user name or password is changed*:
- toolbox configure needs to be re-run to update the openvpms.properties file
- toolbox war needs to be re-run to package the web application with the updated openvpms.properties
- the openvpms.war file needs to be redeployed
* For information on setting the MSQL password see:
https://dev.mysql.com/doc/refman/5.5/en/set-password.html
Administrator password
The default installation creates an OpenVPMS user named 'admin', with password 'admin'. This should be changed using either:
-
toolbox user --setpassword admin -p somestrongpassword
- Administration - Users in the web application
User passwords
User passwords can be configured using:
-
toolbox user --setpassword admin -p somestrongpassword
- Administration - Users in the web application
There is little restriction on what passwords may be entered, but it is recommended that strong passwords are used.
File permissions
The OpenVPMS and Tomcat installation directories should only be accessible to a single user with a strong password.
These directories contain files that could enable an attacker to gain access to the OpenVPMS web application, or the MySQL database.