Security defaults
Start from an environment where every password is generated and every request is recorded.
A new environment generates every password that you do not set, leaves auto-created channels inactive until you turn them on, and records traffic in the audit log from the first request.
Passwords and accounts
A password that you do not set is generated as a uuid4 or an equivalently strong secret, so a new environment has no published default.
The accounts that a new environment has, and where each is documented:
| Account | What it is for | Where |
|---|---|---|
admin | The Dashboard - its password is Zato_Dashboard_Password | Dashboard authentication |
zato | SSH access to the container - the user does not have and does not need sudo powers | Environment variables |
ide_publisher | Deploying code straight from an editor | Environment variables |
To change any of them later, see changing passwords.
API credentials
Default API users are HTTP Basic Auth definitions. You find them in the Dashboard under Security → HTTP Basic Auth, and each new security definition that you add joins them there. The /metrics Prometheus endpoint has a separate Basic Auth definition, with the password from Zato_Metrics_Password.
Channels
- Auto-created REST channels start inactive and have no security definition - an inactive channel does not respond at its URL at all. When you activate a channel, assign it a security definition or group, in the Dashboard or in enmasse.
- A channel that you create yourself is only as protected as the security definition you assign it - a channel with none is open to anyone who can reach its port. To assign one, see channel security.
- The built-in firewall is on with no configuration, blocking requests for the URL paths listed in the environment's blocked-paths file.
Recording
The audit log is on for every new channel, connection and topic, so there is a record from the first request - for what the log keeps and for how long, see the audit log.
What you configure yourself
These settings have no useful default, so you set them:
- Whether TLS is on and which ports are published
- Who reaches the Dashboard
- Which channels are open and which are rate limited
- How long payloads are retained and whether they leave the container
The production checklist lists them in the order in which to make them.
See also
| Page | What it covers |
|---|---|
| Production security checklist | The pre-production checks that follow from the defaults |
| Changing passwords | Replacing the generated passwords with your own |
| Channel security | Assigning security definitions to the channels that you create |