ISISComputingGroup / ISISComputingGroup/IBEX
Script Server: Client access security
- Dominant language
- No language data
- Stars
- 6
- Forks
- 2
- Avg merge
- 16h 40m
- Merged PRs (30d)
- 2
Description
At the moment, the script server password is hard coded within the GUI. When the server goes live, we don't want everyone with a client to have access to an instrument. We would also like to avoid distributing passwords.
Currently we restrict write-access to instruments access to clients on the same subnet. It seems sensible to use the same principle for the GUI. To achieve this, we can create an auto-generated PV with gateway access configured so that it is visible only from the same subnet as the server. The client will then only be able to obtain the password and connect to the script server if they are on the correct subnet.
In addition to this, the content of the PV can be auto-refreshed periodically to improve security further. This shouldn't have any meaningful impact on client-server communication.
Acceptance criteria:
- [ ] A PV exists containing a secure password that is auto-generated for each instrument.
- [ ] The PV is used for the Nicos passwords and the GUI
- [ ] The PV is readable only from the same subnet as the instrument server
- [ ] The PV is refreshed periodically. Check that this change is registered by both the client and server
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.