Security Protection
In order to ensure system security, please be sure to pay attention to and implement the following points. ⚠️⚠️⚠️
Restrict unnecessary access
Restrict unnecessary access to ensure server security.
HAP system deployment relies on the manager. The manager listens to port 38881 by default. In addition to assisting the first installation, it also provides later online upgrades, restarts and other functions. Generally, except for system operations personnel, 38881 does not need to be accessed and used by others, so after the deployment is completed, it is recommended to set an access policy for 38881.
If you need to connect and access storage components through external client software, you need to pay attention to the whitelist control of exposed ports, especially when deploying cloud servers. If common ports (such as MySQL: 3306, MongoDB: 27017) are exposed to the Internet, coupled with weak passwords, there is basically no security at all. In addition to possible data leakage, it is also easier to be attacked by hackers. Attackers may delete database data (usually a README file will be left to prompt you to pay a fee to retrieve the data).
Use strong passwords
Change complex passwords regularly to prevent them from being cracked.
This includes the authentication passwords for the server and connected storage components. For example, components such as MySQL, MongoDB, and Redis are also used to strengthen protection when it is necessary to expose ports to the outside world. In standalone mode, please refer to Database Strong Password Configuration.
Encrypt data
Enable encryption protocols such as HTTPS to prevent data from being intercepted midway.
Regular backup
Automatically back up system data to ensure data recovery and prevent loss.
In [Stand-alone Deployment] mode, you can refer to Backup Method for backup. It is also recommended to take regular snapshots of the server.
In [Cluster Deployment] mode, the data directories of data storage server and middleware server need to be backed up regularly. It is also recommended to take regular snapshots of these two types of servers. If the system is deployed by an official implementation team, the official delivery document will describe the data directory.
Bug fixes
Update in time and regularly patch system vulnerabilities to reduce security risks.
Monitoring and alerting
Configure anomaly detection and alarm systems to detect potential threats in a timely manner and take measures.
DDoS Protection
If conditions permit, the DDoS protection function can be enabled to prevent malicious traffic attacks and effectively improve business continuity.