ISISComputingGroup / ISISComputingGroup/IBEX

Script Server: Client access security

Open
#1,995 6 comments 0 reactions 0 assignees View on GitHub
Dominant language
No language data
Stars
6
Forks
2
Avg merge
16h 40m
Merged PRs (30d)
2

Description

At the moment, the script server password is hard coded within the GUI. When the server goes live, we don't want everyone with a client to have access to an instrument. We would also like to avoid distributing passwords.

Currently we restrict write-access to instruments access to clients on the same subnet. It seems sensible to use the same principle for the GUI. To achieve this, we can create an auto-generated PV with gateway access configured so that it is visible only from the same subnet as the server. The client will then only be able to obtain the password and connect to the script server if they are on the correct subnet.

In addition to this, the content of the PV can be auto-refreshed periodically to improve security further. This shouldn't have any meaningful impact on client-server communication.

Acceptance criteria:

- [ ] A PV exists containing a secure password that is auto-generated for each instrument.
- [ ] The PV is used for the Nicos passwords and the GUI
- [ ] The PV is readable only from the same subnet as the instrument server
- [ ] The PV is refreshed periodically. Check that this change is registered by both the client and server

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.