Administer > Administer the ITOM Platform > Security > Installation Security

Installation Security

This section provides information on aspects of installation security.

Operating Systems

Harden SSH on OS

On each node, the SSH server is configured with weak cipher and weak KexAlgorithms by default.

Set the values of KexAlgorithms, Ciphers and MACs in file: /etc/ssh/sshd_config as follows:

  • KexAlgorithms ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256
  • Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
  • MACs hmac-sha2-256

Database Security Recommendations

For PostgreSQL, see http://www.openscg.com/postgresql-security-guidelines/ for information about PostgreSQL database security solutions.

Application Server Security Recommendations

Always change default passwords.

Always use the minimal possible permissions when installing and running the Suite Management Portal platform.

Action Permissions Needed for User
Installing/Running HPE Suite Management Portal platform You must install and run root permissions using the sudo command.