# Security defaults

Start from an environment where every password is generated and every request is recorded.

A new environment generates every password that you do not set and records traffic in the audit log from the first request.

## Passwords and accounts {#passwords-and-accounts}

A password that you do not set is generated as a uuid4 or an equivalently strong secret, so a new environment has no published default.

The accounts that a new environment has, and where each is documented:

| Account | What it is for | Where |
| --- | --- | --- |
| `admin` | The [Dashboard](https://zato.io/docs/admin/dashboard-auth.html) - its password is `Zato_Dashboard_Password` | [Dashboard authentication](https://zato.io/docs/admin/dashboard-auth.html) |
| `zato` | SSH access to the container - the user does not have and does not need sudo powers | [Environment variables](https://zato.io/tutorials/devops/env-variables.html) |
| `ide_publisher` | Deploying code [from an editor](https://zato.io/docs/dev/ide/index.html) | [Environment variables](https://zato.io/tutorials/devops/env-variables.html) |

To change any of them later, see [changing passwords](https://zato.io/docs/admin/security/change-password.html).

## API credentials {#api-credentials}

Default API users are HTTP [Basic Auth](https://zato.io/docs/security/basic-auth.html) definitions. You find them in the Dashboard under `Security → HTTP Basic Auth`, and each new [security definition](https://zato.io/docs/admin/security/channel.html) that you add joins them there. The `/metrics` Prometheus endpoint has a separate Basic Auth definition, with the password from `Zato_Metrics_Password`.

## Channels {#channels}

- A channel that you create yourself is only as protected as the security definition you assign it - a channel with none is open to anyone who can reach its port. To assign one, see [channel security](https://zato.io/docs/admin/security/channel.html).
- The [built-in firewall](https://zato.io/docs/admin/security/channel.html) is on with no configuration, blocking requests for the URL paths listed in the environment's blocked-paths file.

## Recording {#recording}

The audit log is on for every new channel, connection and topic, so there is a record from the first request - for what the log keeps and for how long, see the [audit log](https://zato.io/docs/admin/audit-log/index.html).

## What you configure yourself {#what-you-configure-yourself}

These settings have no useful default, so you set them:

- Whether TLS is on and which ports are published
- Who reaches the Dashboard
- Which channels are open and which are rate limited
- How long payloads are retained and whether they leave the container

The [production checklist](https://zato.io/docs/admin/production-checklist.html) lists them in the order in which to make them.

## See also {#see-also}

- [Production security checklist](https://zato.io/docs/admin/security/checklist.html) - The pre-production checks that follow from the defaults
- [Changing passwords](https://zato.io/docs/admin/security/change-password.html) - Replacing the generated passwords with your own
- [Channel security](https://zato.io/docs/admin/security/channel.html) - Assigning security definitions to the channels that you create

## Learn more {#learn-more}

- [Production checklist](https://zato.io/docs/admin/production-checklist.html) - What to confirm before an environment takes real traffic
- [Audit log](https://zato.io/docs/admin/audit-log/) - Every request, response and error, and what you can do with them afterwards
- [Health checks](https://zato.io/docs/admin/health-checks.html) - Have Zato ping your outgoing connections instead of waiting for traffic to fail
- [Logging](https://zato.io/docs/admin/logging.html) - What is written where, and how to ship it to Splunk, Loki, Elastic or Datadog
- [GitOps with enmasse](https://zato.io/docs/admin/enmasse.html) - Keep the whole environment in git as YAML and import it anywhere