2025-06-06T07:58:07Z

Kpe: /* Special features */

Click to read [[What is Tempus Serva|graphic figure models]] or [http://www.tempusserva.dk/temptree/index.html Interactive feature map]

== Components ==
* [[Features/Dashboards|Dashboards (BI)]]
* [[Features/Relational database|Relational database]]
* [[Features/Workflow engine|Workflow engine]]
* [[Features/Access control|Access control]]
* [[Features/File managment|File managment]]

== User interface ==
* [[Features/Advanced input forms|Advanced input forms]]
* [[Features/Data reports|Data reporting]]
* [[Features/Customized design|Customized design]]
* [[Features/Questionaires|Questionaires]]
* [[Features/Internationalization|Multi language (I18N)]]
* [[Features/Multi device|Multi device (responsive design)]]

== Technical features ==
* [[Features/Compliance|Compliance]]
* [[Elastic_search#Install|Full-text search]]
* [[Integration/REST|REST webservice]]
* [[Features/Multi tenancy|Multi tenancy]]
* [[Security_setup#Compliance_built-in|Logging and history]]
* [[Features/Custom code|Custom code]]

== Integration ==
* [[Features/Single signon|Single Signon (SSO)]]
* [[Features/MitID og Eboks|MitID og Eboks]]
* [[Features/File_managment#Document_signing|Document signing]]
* [[Integration#Scheduled_data_imports|External data sources]]
* [[Features/Website integration|Website integration]]
* [[Data_import_and_export|Import / Export data]]

== Special features ==
* [[Features/QR and NFC actions|QR and NFC actions]]
* [[Features/AI conversion|AI conversion]]

Features

2025-06-06T07:56:32Z

Kpe: /* Special features */

Security setup

2025-06-06T07:55:19Z

Kpe: /* Multi-factor Authentication (recommended) */

== Security baseline ==

=== Security by design ===
The platform is security designed in accordance with [https://owasp.org/www-pdf-archive/OWASP_Application_Security_Verification_Standard_4.0-en.pdf OWASP version 4]:
* Level 2: Compliant
* Level 3: +90% supported

In addition the platform supports a wide range of security schemes and logging features, needed for support of ISO27001, ISAE3000 etc.

The platform is subject to periodic penetration testing. Last customer testing was july 2021.

===Default security ===
By default the Tempus Serva is verifiably secure to all common threat vectors, such as
* SQL injection
* Cross-Site Scripting
* Session highjacking
* Login replays
* [https://owasp.org/www-project-top-ten/ etc]

Protective measure includes common hardening efforts, such as
* Data sanitization
* Request throtling
* CSRF tokens
* [https://owasp.org/www-pdf-archive/OWASP_Application_Security_Verification_Standard_4.0-en.pdf etc]

In addition to this baseline additional features can be activated per installation.
* Built-in: Features in the product itself
* External: Measures controlled in application server or operating system

== Security built-in ==

=== Password Policies (recommended) ===
TS No-code Platform allows you to setup and enfoce the use of strong passwords through an appropriate password policy. Specify attribute requirements that control complexity and lifetime of passwords such as:
* Mimimum password length
* Special characters
* Maximum password age
* Maximum number of tries

The struictural restrictions will be honored when
* The user changes his password
* A new randow password is generated and sent

Passwords can also be set to expire after an amount of time.

'''How to:''' The polices can be changed in server configurations in the group ''Password policies''

'''Note:''' The password polices will have no impact on SSO authentication

=== Multi-factor Authentication (recommended) ===

==== Device MFA ====
TS No-code Platform offers native Multi-factor Authentication to protect against unauthrised access by requiring a user to provide multiple authentication factors to prove their identity. At present two different options are available:
* MFA using session-specific, one-time-passcodes sent to the users mobile phone via regular or Flash SMS
** You will need to create an account for sending SMS
** Cost is approx. 0,30 DKK per message)
* MFA using af dedicated app from
** Apple
** Google
** Microsoft

SMS requires very little of the users, while App based MFA is considered (slightly) more secure.

'''Note:''' If using singlesignon (SSO) the MFA will not be used

==== Location MFA====
IP can be used as factor. In some cases slightly less secure, but much easier for the user.

Options include
* Country whitelisting (via IP)
* Static whitelisting of IP's
* Adaptive whitelisting of IP's

Adaptive whitelisting happens when the same user logs in from the same IP multiple times (typically 5).

IP MFA can be used together with normal MFA, so that SMS/App check is only required in case the IP is not whitelistet.

=== Geolocation blocking (optional) ===
Geoblocking will allow the servers to deny requests from certain countries.

The geoblocking will match the clients IP against af Geo service. The county will be matched to the servers whitelist of country names.

'''How to:''' Change the system configurations starting with ''ipBlocker''
* Activate setting '''ipBlockerActive'''
* Set allowed countries in ''' ipBlockerAllowedCountries'''

=== Request throttling (optional) ===
As specified in OWASP v4 system should be able to limit the mount of request a user can carry out in a system.

Limitations can be set on
* Pages hit
* WebDAV requests
* Upload (size/count)
* REST operations

'''How to:''' Edit server configurations starting with ''limit''

=== Brute force prevention (optional) ===
This protection is handled by not serving too many requests to the login page, regardless of the source in question.
This will prevent brute force attacks on distributed accounts using multiple machines. In case the detection triggers, login requests will be ignored for at set amount of time, while allready logged in users can continue their work.

'''How to:''' Define systems configurations starting with ''bruteforce''

=== Additional configurations ===
* File whitelisting (uploadWhitelist)
* OWASP compliance (owaspCompliance)

== Security external ==

=== Virus scanning ===
Scanning of uploaded fiels are left to software installed on the system.

The upload feature will temporarily store the files on the file system, so that detection mechanisms can quarantine the files in case they are infected.

=== Storage encryption ===
Storage encryption is normally supported by the underlying technologies, with the possible exception of password hashes (handled with BCrypt).

MySQL (+8) supports multiple encryption schemes
* The whole database
* Single schema (each TS installation)

Read more about encryption for [https://mysqlserverteam.com/controlling-table-encryption-in-mysql-8-0/ MySQL] and [https://mariadb.com/kb/en/data-at-rest-encryption-overview/ MariaDB]

O/S level encryption technology includes
* Windows: BitLocker
* Linux: LUKS

=== Transport encryption (https) ===
Minimum requirements are SSL certificates. On Linux these can easily be obtained for free via LetsEncrypt.

Optionally the server can also apply to HSTS, using the following [https://www.javaprogramto.com/2018/09/adding-http-strict-transport.html guideline for Tomcat].

=== Denial of service attacks ===
Protection against DOS attacks are best handled using dedicated services such as Cloudflare.

== Compliance built-in ==

=== Activity and data logging (optional) ===
Activity and Data Logging includes the automatic creation of a series of log files. Logging can be set up for each entity in an application providing insight and transparency in relation to: user activity, creation, changes and status of different records in an application.
* '''Access Log''': Can be activated on an entity in an application. This automatically generates a log of which users have accessed and/or edited a given record.
* '''Status Log''': Can be activated for an entity in an application. This automatically generates a log of the history of the created records, which shows how long a record has been in each status
* '''Change Log''': Can be activated for an entity in an application. This automatically generates a log of what changes have been made to the individual records. Including who has changed what and when (timestamp).

'''How to:''' Each option is activated on the entity Advanced page.

'''Pro tip:''' Especially the status log can be used for setting up performance charts on dashboards, as it can give detailed information of how much time was spent in each step.

=== Versioning (optional) ===
By default file versioning is supported on the "Documents" and "Files" field types. In addition, data revisions can be supported on each entity. This automatically builds an audit log for each record.

In addition data revisions can be supported on each individual entity.

'''How to:''' Data revisions is activated on the entity Advanced page.

=== GDPR Deletion Policies (optional) ===
For each entity in a TS Application, a GDPR Deletion Policy can be set up, enabling automatic deletion or anonymization in accordance with the specified rules. The application will thus automatically delete or anonymize data and files in the application, cf. specified criteria.

'''How to:'''
# Set up an action on a entity status
# Check of deletion policy
# Choose between anonoumization or deletion
# Optionally select log data to also be deleted

In case you choose "anonoumization" you should define how each field should be handled
# Click on a field
# Click on Assignment
# Check of anoumization
# Optionally set value after change

=== Event and System Logging (recommended) ===
When Event and System Logging are turned on for an application, the following events are logged automatically:
* User logins
** Succesfull normal user logins are hidden
** Also contains client IP (used for MFA)
* System events
** User errors
** Scheduled services
** Administrator logins

Error events will include stacktraces if available.

The eventlog can be cleaned automatically on a regular schedule.

== Compliance external ==

=== Request logging ===
The webserver itself can be set up to do make detailed logs in file , containing for example
* Request timestamp, IP and session ID
* Stacktraces on errors

Depending on your security setup you might want to log these to a central repository

== Other optional security features ==
* [[Security/Data restrictions|Data restrictions]]
* [[Security/Encryption|SSL encryption]]
* [[Security/Bruteforce|Bruteforce countermeasures]]

Features

2025-06-06T07:25:56Z

Kpe: /* Special features */

Features

2025-06-06T07:24:50Z

Kpe: /* Special features */

2025-04-02T09:20:05Z

Kpe: /* Slides for today */

== Slides for today ==
https://www.tempusserva.dk/share/training/PFM300.pdf

https://builds.tsnocode.com/Debian12-Dev.ova

== Servers for today ==

Servers
* https://trainingv3.tsnocode.com/exopi1/login JONAS
* https://trainingv3.tsnocode.com/exopi2/login LAURITS
* https://trainingv3.tsnocode.com/exopi3/login CHRISTOFFER
* https://trainingv3.tsnocode.com/exopi4/login MARK
* https://trainingv3.tsnocode.com/exopi5/login MORTEN

Credentials
* username: admin
* password: [on whiteboard]

== Setting up DEV environment ==
Downloads
* https://omega.tempusserva.dk/nightly/tsnocodeApi.jar
* https://omega.tempusserva.dk/nightly/TempusServa.war

For placement in the lib folder (ALL)
* https://www.tempusserva.dk/install/driver/mysql-connector-java-5.1.45-bin.jar
* https://www.tempusserva.dk/install/driver/commons-logging-1.1.1.jar

== Related articles ==
* https://wiki.tempusserva.dk/index.php?title=Installation_Windows#MySQL_database

Sample create user SQL
* CREATE USER 'tsinstall'@'*' IDENTIFIED BY 'TempusServa';
* GRANT ALL PRIVILEGES ON *.* TO 'tsinstall'@'*' WITH GRANT OPTION;
* FLUSH PRIVILEGES;

Kpe: /* Connect to new server */

=== No SSL connections possible ===

==== Changes in AWS ====
# Make a snapshot of the running server
# Make a volume from the snap shot
# Name the volume: RESTORE COPY
# Create a NEW server
# Attatch the RESTORE COPY to NEW server on /dev/sdf

==== Connect to new server ====
# Install TS client tools
# ts quick-install
# ts stop-webserver
# ts stop-database
# mkdir /mnt/oldroot
# sudo mount /dev/nvme1n1p1 /mnt/oldroot
# sudo rm -r /var/lib/mysql
# sudo cp -r /mnt/oldroot/var/lib/mysql /var/lib
# ts start-database
# mysql -uroot -p -e "UPDATE applive.systempolicy SET PolicyValue='false' WHERE PolicyName LIKE 'securitySsl%'"
# sudo rm -r /mnt/sda/*
# sudo cp -r /mnt/oldroot/usr/tempusserva/sda/* /mnt/sda/
# sudo chmod 777 -R /mnt/sda/files
# sudo cp /mnt/oldroot/usr/share/tomcat8/conf/Catalina/localhost/* /usr/share/tomcat8/conf/Catalina/localhost
# ts start-webserver
# Ensure server is running

==== Changes in AWS ====
# Stop NEW server
# Detatch RESTORE COPY
# Stop OLD server
# Deassociate IP from OLD server
# Associate IP to NEW server
# Start NEW server

==== Connect to new server ====
# ts install-ssl
# mysql -uroot -p -e "UPDATE applive.systempolicy SET PolicyValue='true' WHERE PolicyName LIKE 'securitySsl%'"
# ts restart-webserver

==== Steps is using S3 filesystem ====
# [[Server_maintenence#Moving_files_to_S3_storage]]
#* Step: Add IAM role to server
#* Step: Install the mountpoint