global registry user

Hello Everyone,

In the dfc.properties file ( we are using Dfc 6.5 btw ) there is an entry:

dfc.globalregistry.username = dm_bof_registry

dfc.globalregistry.password = 123_i_am_encrypted_asdfasdf

How secure is this usename/password ? is this user account likened to a super user, or just a regular consumer type user ?

Thanks!

Find more posts tagged with

Comments

XdctmX

dm_bof_registry user is a consumer user not a super user or administrator.

This is what it looks like from DA.

User	:	dm_bof_registry

State :

ActiveInactiveLockedLocked and Inactive

*Name :

dm_bof_registry

*User Login Name :

User Login Domain :

User Source :

NoneLDAPInline Passworddm_krb

Password :

Verify Password :

Description :

*E-Mail Address :

Home Repository :

none selected

Default Folder :

Select /dm_bof_registry

Default Group :

Selectnone selected

Default Permission Set :

Select dm_45002b678000020c

Db Name :

Privileges :

noneCreate TypeCreate CabinetCreate Cabinet and TypeCreate GroupCreate Group and TypeCreate Group and CabinetCreate Group, Cabinet and TypeSystem AdministratorSuperuser

Extended Privileges :

noneConfig AuditPurge AuditConfig and Purge AuditView AuditConfig and View AuditView and Purge AuditConfig, View and Purge Audit

Client Capability :

ConsumerContributorCoordinatorSystem Administrator

Alias Set :

Select none selected

Workflow Disabled

Turn off authentication failure checking

DavidHaveman

so by default this user can only really look around a bit and not change anything i guess.. so if someone who wasn't supposed to have it had the credentials for this account, it wouldn't be a major security issue, just a "you shouldn't be seeing .... " if i understand this correctly.

Thanks for your response!

XdctmX

The password should be encrypted. For e.g this is how it gets created -

To enable a repository as a global registry after configuration, you must activate the
dm_bof_registry user.
To enable a repository as a global registry:
1. Access Documentum Administrator in a browser and connect to the repository.
2. Click Administration- User Management- Users.
3. Locate the user named dm_bof_registry and click the Information icon.
4. Verify that the user name attribute is set to dm_bof_registry.
The value dm_bof_registry is required.
5. Optionally, change the user login name to a new value.
6. Change the user’s password.
7. Set the dm_bof_registry user’s status to Active.
8. Click Ok to save the user.
9. During DFC installation on client machines, such as the Webtop or Documentum Administrator hosts, provide the user login name and password.
This updates the dfc.properties file and enables that DFC installation to contact
the global registry as required.
10. To manually modify the dfc.properties file to designate a global registry repository
and user credentials:
a. On the DFC host, navigate to $DOCUMENTUM/config (UNIX or Linux) or
%DOCUMENTUM%\config (Windows).
b. From a command prompt, execute the following command to generate the
encrypted form of the global registry user’s password:
java -cp dfc.jar com.documentum.fc.tools.RegistryPasswordUtils
password_of_user
where password_of_user is the global registry user’s clear-text password. In
step d below, you will need to enter the encrypted form of this password in
the dfc.properties file.
c. Open the dfc.properties file in a text editor.
d. Modify the following attributes:
dfc.bof.registry.repository=global_registry_repository_name
dfc.bof.registry.username=user_login_name
dfc.bof.registry.password=encryped_password_of_user
where encryped_password_of_user is the encrypted password you generated in
step b above.
e. Save the dfc.properties file.

DCTM_Guru

How secure is this usename/password?

- The password is encrypted (via hash key) such that you cant just log into repository using encrypted password.

Is this user account likened to a super user, or just a regular consumer type user ?

- Regular user.

See Content Server Admin guide for more details of global registry user.

DavidHaveman

Thanks for your responses.

I'm basically trying to figure out if a person that wasn't supposed to had access to this user account that they could do anyting with it.

The unencrypted password is actually very easy to access if you have the these properties set in your dfc.properties file and Dfc installed on your local machine..