Skip to content

Hardening Checklist

Work through this list after installation and before go-live; each item links to the page with the steps.

Keep a record

Copy this list into your change ticket and tick items as you complete them. Re-check it after every upgrade and after moving MetaMiner to a new server.

Network

  • Allow inbound TCP 49714 (or your MetaMiner Server port) only from the networks of MetaMiner Client users, and from BusinessObjects hosts that run the MetaMiner host agent. See Network Exposure.
  • Do not open the Web Apps port 49717 in the firewall. Browsers reach the web apps through the MetaMiner Server port.
  • Allow the MetaMiner Database port (49614 for the embedded database) only from the MetaMiner Server host and from hosts you allow to query the database directly.
  • Limit the rules in the embedded database's pg_hba.conf to the hosts that need access. See MetaMiner Database SSL.
  • If you use Pulse monitoring, allow the Pulse dashboard port only from the administrators who use it.

Transport encryption

  • Turn on SSL for the MetaMiner Server with a certificate from your company CA. See MetaMiner Server SSL.
  • Add your issuing CA to the trust store of every MetaMiner Client workstation. See Client to Server SSL.
  • Tell users to report any certificate warning in the MetaMiner Client instead of accepting it.
  • Turn on SSL between the MetaMiner Server and the MetaMiner Database when the database is on another host or is read over the network. See MetaMiner Database SSL.
  • Require SSL in ODBC and JDBC connections that read the MetaMiner Database. See Database External Connections.
  • Use HTTPS URLs for the BI launch pad and the BusinessObjects RESTful web service in each environment, and trust their CA. See Trusted Certificates.
  • If your BusinessObjects cluster uses CORBA SSL, configure it for MetaMiner. See Server to BusinessObjects SSL.
  • Use LDAPS for directory authentication. See Import Users from LDAP or AD.
  • Turn on SSL for the e-mail server connection. See Email.

Access control

  • Create named MetaMiner users, give each the least-privileged role per environment, then turn on MetaMiner Security. See User-Based Security and Users and Roles.
  • Give the Administrator role only to the people who administer MetaMiner. Use Read Only or a custom role for everyone else.
  • Authenticate users against LDAP or Active Directory where possible. See Import Users from LDAP or AD.
  • Set the password policy in Preferences > Settings > General: raise Min password length (default 4), turn on Enforce Password Complexity, and set Password expiration (days), Login failure threshold (default 3) and User Inactive threshold (default 90 days) to your policy.
  • Turn on Notify on any MM security changes in Preferences > Settings > Notifications and configure e-mail, so administrators hear about user, role and security changes.
  • Set BusinessObjects user logon to REQUIRED for environments where MMC actions must run as each user's own BusinessObjects account. See BusinessObjects User Logon.
  • Keep Enable BusinessObjects SSO off. It matches names and is not authentication. Use BusinessObjects user logon instead.
  • Keep the BO console sign-in at Required. See Web Console Sign-In.
  • Keep anonymous use of Meta Query on the web off, and keep sign-in over plain HTTP off.

Server host and secrets

  • Limit interactive and remote desktop logon on the MetaMiner Server host to MetaMiner administrators. MMA runs there with full control of the configuration.
  • Restrict NTFS permissions on server\config, server\security, server\data, server\logs, and on the backup, version and report validation folders to administrators and the MetaMiner service account. See What MetaMiner Stores.
  • Keep the MetaMiner Server SSL private key in a folder only administrators and the service account can read.
  • Use a strong password for the MetaMiner Database account.
  • Optionally encrypt the configuration file. See Encrypting the Configuration.
  • Run the MetaMiner services under a dedicated account if they need network shares. See Service Accounts.
  • Use a dedicated BusinessObjects account for each environment, with a strong password that is not shared with people.
  • If report validation outputs may contain sensitive data, set "validationEncryptInstances": "true" in the properties block of server\config\config.json so outputs are encrypted on disk. See Report Validation.
  • Store MetaMiner backups and MMDB dumps with the same protection as the BusinessObjects repository.
  • Install MetaMiner updates when they are released. See Installing New Releases.

TODO: supported procedure to change the embedded MMDB account password

The Configure MMDB dialog shows the account and password but has no change-password action in this release. Product team to confirm the supported procedure, then link it from the item above.

TODO: confirm customers may edit validationEncryptInstances by hand

No MMA setting writes this key in this release. Confirm the hand edit is supported (stop the service first) or add it to MMA.

Next steps