Security

This page collects the security points that affect how you set up a VisualCron Server, with links to the pages that explain them.

Checklist for a new Server

• Set a password for the default "admin" user: Users and groups
• Check which group new users and AD groups get, because Administrators is the default: Default groups
• Do not treat Viewers as read-only: Default groups
• Clear what a new group must not have, because it starts with nearly every right: Permissions and actions
• Give Import settings, Export settings and Task manager only to administrators: Supported Permissions
• Know what happens when Execute on a Credential is missing, and that Credentials reach every logged-on Client: Credentials permission
• Know which keys a user with Read can export: Global - Certificates, Global - PGP Key Rings, Global - SSH Keys
• Choose strong key settings when you create certificates and PGP keys: Global - Certificates, Global - PGP Key Rings
• Close the Server port in the firewall if only local logons are wanted, because Only allow local connections does not close it and does not refuse Web API logons: Settings - Users/Logon
• Use a secure port for the AD server, and check its certificate: When Test fails over secure LDAP
• Restrict the Web API: Settings - Web API
• Check the Local Security Policy settings for interactive logon: Archived Security

Task manager permissions for the Viewers group (13.2.1)

warning

The Viewers group is not read-only. Check what it allows before you use it (see Default groups).

As of VisualCron 13.2.1, the Viewers group created on a new Server does not have Delete on Task manager. Groups that already exist are not changed.

In the Task manager, End process needs Delete on Processes, and End process tree needs Delete on Task manager. To let a group end processes from the Task manager, give it those permissions. The desktop Client checks them, but the Server does not (see Supported Permissions).

Remote file explorer access

warning

Read on Remote file explorer is granted to every new group and to Viewers. It lets a user download any file the VisualCron service account can read. Clear it for groups that must not see the Server's files.

The remote file windows let a user browse the Server's file system:

• Read: browse and download files
• Add: create files and folders, paste and copy
• Edit: rename, move and change attributes
• Delete: delete files and folders

The Server checks these actions on every request, and the windows hide the commands a user is not allowed to use.

A new group gets Read only. On a new Server, Administrators also have Add, Edit and Delete. For least privilege, check that only the groups that need to change the Server's files have these actions.

Client and Server versions

note

Run the same VisualCron version on the Client and the Server. When the versions differ, the Client shows a "Version mismatch" warning after logon.

Stored passwords

VisualCron stores Credential passwords and Connection passwords encrypted.