# Security Checklist

There are a number of precautions that should be taken before running Exago in a production environment.

- Set an external temp path
- Disable direct access
- Set a config password
- Remove the plain-text config
- Remove the admin console
- Encrypt scheduler data (if applicable)
- Disable SOAP (if applicable)

# Set an external temp path

The Temp directory contains working data, and may contain sensitive information. If the Temp Path config parameter is left blank, Exago will default to a Temp folder at the root of the install directory. This is not recommended because it could expose your temporary data to web access.

The Temp Path should be set to a location outside of the Exago installation (and behind the server's firewall).

( Main Settings Temp Path ) <temppath>

# Disable direct access

Access to Exago should be curated through the API so that user permissions can be set via Roles. Users should not be able to access the home page directly, which would bypass role restrictions. To disable direct access to Exago, set the following config setting to False:

( Main Settings Allow direct access to Exago (bypassing API) ) <allowhomedirect>

# Set a config password

A User ID, Password, and REST Key should be set in the config file. This safeguards access to the Admin Console and REST API. See REST API for information on accessing a password-protected web service.

( Other Settings User ID ) <userid>
( Other Settings Password ) <password>
( Other Settings Confirm Password )
( Other Settings REST Key ) <restkey>

# Remove the plain-text config

The Admin console generates two copies of the configuration whenever the OK or Apply button is pressed: a plain-text xml document, WebReports.xml by default, and an encrypted version, WebReports.xml.enc. Plain-text config files may contain sensitive information, such as database connection strings, schemas, usernames, and passwords.

When your config settings have been finalized, the plain-text config file should be removed from the Config folder and saved in a secure location.

# Remove the Admin Console

The Admin Console should not be accessible in a production environment. To permanently remove the Admin Console from your installation, remove the following file from the web application directory (in a web farm, do so for every application instance):

    Bin\admin.aspx.cdcab7d2.compiled

Note: You can delete the Admin.aspx page as well, or edit it to show a static error message.

# Encrypt scheduler data (if applicable)

Each scheduler stores working data in a local temporary folder. If you're using scheduler services for report scheduling or remote execution, you should set them to encrypt their data. For each scheduler, edit the WebReportsScheduler.xml configuration file and set the following setting to True:

    <encrypt_schedule_files>True</encrypt_schedule_files>

Then restart the service.

# Disable SOAP (if applicable)

If you are using the REST web service API, then you should disable the SOAP API to prevent any unauthorized web service requests. To do so, remove the following file from the web service directory (in a web farm, do so for every application instance):

    Bin\api.asmx.cdcab7d2.compiled

Note: If you are using the .NET API then you do not need the web service, and you can remove it from your environment.

Note: You can delete the Api.asmx page as well, or edit it to show a static error message.