Contents

Security Configuration Guide

• Introduction
• Configuring Strong Passwords on the Database
• Closing All Open Ports Not in Use
• Disabling the Telnet Service
• Disabling Other Unused Services
• Replacing Verbose Errors with Custom Messages
  • Creating the HTML Error Page
  • Editing the web.xml File
• Deleting or Disabling Demos
• Hiding Sensitive Information on the Apache Server
• Checking External Links that May Expose Account Data
• Providing Security for Session-Tracking Cookies
  • Configuring the Secure and HttpOnly Flags
  • Confirming the Secure and HttpOnly Flags Are Configured Properly
• Disabling Cross-site Tracing
• Change Record
• Documentation Accessibility