Securing your IBM Software Hub environment

After you install IBM Software Hub, complete set-up tasks to ensure that your environment is secure.

Changing the password for the default admin user
When you install an instance of IBM Software Hub, a default administrator is created.
Applying cluster HTTP proxy settings to IBM Software Hub
If you use HTTP proxy to manage inbound traffic to and outbound traffic from your Red Hat® OpenShift® Container Platform cluster, you can use the cpd-cli to apply the same HTTP proxy settings to an instance of IBM Software Hub.
Customizing and securing the route to the platform
IBM Software Hub exposes one HTTPS port as the primary access point for the web client and API requests. On Red Hat OpenShift Container Platform, the port is exposed as an OpenShift route.
Turning off the host header injection check
By default, IBM Software Hub rejects requests that contain invalid external routes to prevent host header injection attacks. However, if you use a load balancer and reverse proxy servers to manage host headers before requests are forwarded to IBM Software Hub, you must turn off the host header injection check to enable IBM Software Hub to accept incoming requests.
Integrating with the Identity Management Service
By default, IBM Software Hub user records are stored in an internal repository database. However, it is strongly recommended that you use an enterprise-grade password management solution, such as single sign-on (SSO) or LDAP.
Configuring single sign-on
You can use Security Assertion Markup Language (SAML) for single sign-on (SSO) to the IBM Software Hub web client.
Configuring vault usage
IBM Software Hub includes an internal vault. You can also connect to external vaults where you already store sensitive information as secrets.
Enabling users to upload JDBC drivers
JDBC driver upload is disabled by default. If you want to enable users to create Generic JDBC connections, create custom JDBC connectors, or use predefined connectors that require JDBC drivers, you must enable users to upload JDBC driver files.
Managing certificates
Set up custom TLS certificates for connecting to the platform and CA certificates to connect to internal servers from the platform.
Disabling shared credentials
An instance administrator can optionally disable the option to use shared credentials in connections in platform connections, projects, and catalogs.
Configuring API key expiration
IBM Software Hub API keys do not expire by default. If you want to improve application security, you can configure API keys to automatically expire. You can choose how long API keys are valid after they are created based on your company's security policies.
Setting the idle session timeout
You can adjust the idle session timeout for IBM Software Hub in accordance with your security and compliance requirements. If a user leaves their session idle in a web browser for the specified length of time, the user is automatically logged out of the web client.
Limiting the number of concurrent user sessions
By default, users can have an unlimited number of concurrent sessions. For example, a user could open IBM Software Hub in 3 different web browsers and have 3 concurrent sessions. You can optionally limit the number of concurrent sessions that a user can have.
Limiting the user information that is returned by usermgmt API calls
By default, a user without the Administer platform or Manage users permission can see detailed information about other IBM Software Hub users by running usermgmt API calls. You can set the usermgmt_limit_user_info parameter to limit the information that is returned by the API calls.
Displaying a terms and conditions prompt
If you need users to accept terms and conditions before they use the web client, you can enable a dialog that prompts users to accept the terms and conditions before they can log in to the web client. For example, you might need to enable the prompt to comply with the Federal Information Security Management Act (FISMA) regulations.
Monitoring IBM Software Hub user activity
User activity monitoring helps you detect and stop potentially harmful or malicious activities. If you have an RSYSLOG server, you can configure IBM Software Hub to forward user activity information to the server.
Enabling auditing for the Identity Management Service
If you are using the Identity Management Service provided by the IBM Cloud Pak foundational services, you must enable auditing if you want to audit events that are generated by the Identity Management Service.
Securing communication ports
To ensure secure transmission of network traffic to and from the IBM Software Hub cluster, you need to configure the communication ports used by the network.

Parent topic: Post-installation setup (Day 1 operations)