Gateway Security

By default, the Configure section of the Gateway is password protected, and this cannot be removed. You can also optionally protect the Status and the Home sections of the Gateway webpage. The roles that are required to access any of these sections can be changed in the Configure section of the Gateway webpage under System > Gateway Settings.

The default username and password for the Configure and Status sections of the Gateway is:
username: admin
password: password

Changing the 'admin' Password

When Ignition is first installed, a default "admin" user automatically gets created. Once you're logged into Ignition, you have access to everything in the system as the 'admin' user.  You can modify projects, add users and roles, add database connections, setup the Gateway, and literally do everything.

The first step in securing your Ignition installation is to change the default username/password for the 'admin' user.  

1. On the Gateway webpage under the Configure section, go to Security > Users, Roles. The default user source contains the 'admin/password' combination to access the Configure section.  
    
2. Click on manage users and you will see the admin user.
   
   
3. On the right side, click edit to change the password for the admin user. 
   
   
   
   
4. Click the checkbox to change the existing password.  
   Enter the new password, then re-type the new password to confirm it. 
   
   
   
   
5. When you're finished, click Save Changes. 
   
   
6. To test the new password, logout and log back in as the admin with the new password. 

Password Reset

Ignition provides you with the capability to reset the admin password from the Gateway Control Utility (GCU).  The default is user/password combination is 'admin/password,' and will grant access to the Gateway webpage. Normally, this is not considered a security risk because the GCU can only be used from the machine the software is installed on, which should be secure. However, it is important to know about this feature so that the GCU can be removed if the machine can't be properly secured, for example, when the server is also used as a client. 
 

Locking the Gateway

You can set up security for the Gateway webpage sections and the Designer. The Gateway can use any existing authentication profile independent of any projects. Each of the Status, Home, and Configure pages can be restricted by role. Outside of logging into a Client, the Designer as well can require a special role.

Here is where you should start thinking about your security policy. Roles play an important part. Roles allow you to provide access to different areas of the Gateway (and project). We recommend that you create separate roles for the Gateway Configure Page, Status Page, Home Page, and Designer so that individual users only have access to specified areas where they will be working.

To Setup Security for the Gateway

1. Go to the Configure section of the Gateway.
    
2. Choose System > Gateway Settings from the menu on the left.
   The Gateway Settings page is displayed. 
    
3. Enter the roles the user must have in order to access the Gateway Config Roles, Status Page Roles, Home Page Roles, and Designer Roles.
   Each option can accept any number of roles as long as they are separated by commas. Also, if the option is blank, any user can log in. The Global Resource Protection will shelter the Global Resources (like Alarm Pipelines or SFCs) from edits by users without a matching role. 
   
   
    

Enabling SSL

To enhance security in Ignition, you may opt to enable SSL encryption. This will affect all communication to and from the Gateway that is done over the HTTP protocol. This includes not only browsers interacting with the Gateway's web interface, but all Vision Client communication as well. Turning on SSL will encrypt all data sent over HTTP. This protects your installation from anyone "snooping" the data as it passes over the network. This may be important if data transferred between the Gateway and Clients is sensitive in nature. This also helps to thwart a security vulnerability known as "session hijacking".

To Turn On SSL

1. Go to the Configure section of the Gateway.
   
   
2. Choose System > Gateway Settings from the menus on the left.
   
   
3. Select the checkbox for Use SSL, and click on Save Changes at the very bottom of the page. 
   
   
   
   After SSL is enabled, all Clients, Designers, and web browsers are redirected to the SSL port if they try to use the standard HTTP port. By default, the SSL port is 8043. You can change it to the standard SSL port of 443. To do this, follow the directions in Setting the Port.
   If you are using a firewall, make sure to open the appropriate ports. 

You can now setup Ignition to use HTTP Strict Transport Security (HSTS) policy. To do this, there needs to be a change made to the ignition.conf file and the Gateway needs to be setup to use SSL. 

-Dignition.https.sts.maxAge="47474747"
-Dignition.https.sts.includeSubDomains="true/false"

Each of those lines need to be added as a Java Additional Parameter to the ignition.conf file. Each parameter needs to be added as the next available uncommented parameter in the list of parameters. So if the last uncommented parameter is 4, then these lines should be added like the following:

wrapper.java.additional.5=-Dignition.https.sts.maxAge="47474747"
wrapper.java.additional.6=-Dignition.https.sts.includeSubDomains="true/false"

Once these have been added and Use SSL turned on, the Gateway can be restarted, at which point it will be using HSTS properly.