From 3f774b4cea795bf9ea70fd327f00f76b259312cf Mon Sep 17 00:00:00 2001 From: Adam Retter Date: Wed, 17 Jul 2019 12:13:37 +0300 Subject: [PATCH] Add details about system users and groups --- .../xar-resources/data/security/security.xml | 90 +++++++++++++++++-- 1 file changed, 84 insertions(+), 6 deletions(-) diff --git a/src/main/xar-resources/data/security/security.xml b/src/main/xar-resources/data/security/security.xml index b20791d8..e2984a77 100644 --- a/src/main/xar-resources/data/security/security.xml +++ b/src/main/xar-resources/data/security/security.xml @@ -15,10 +15,10 @@ This article discusses eXist-db's security features and how to manage authentication, users, groups, passwords, permissions and access controls. eXist-db's security infrastructure is built on a Unix permissions model (see ), which we have extended with . The security - infrastructure is very flexible and extensible, which enables the more advanced user, to - provide custom to enable different authentication - models. + linkend="unix-model"/>), which we have extended with . As far as + possible we try and adhere to the POSIX standard. The security infrastructure is very + flexible and extensible, which enables the more advanced user, to provide custom to enable different authentication models. As well as the mechanisms described in this article, you should also note the presence of the + + + + System Accounts and Groups + eXist-db has several built-in accounts which ensure the correct functioning of the system. These accounts and groups cannot be removed, however the admin and guest + accounts can be disabled if required. + + System Accounts + + + + + Name + Description + + + + + SYSTEM + + This is a DBA account under which the database executes internal privileged opertaions. + This account is not exported during backups. + + + + admin + This is the default DBA account. + + + guest + This is the account under which operations by un-authenticated users will be executed, for example users connecting to the REST Server without authenticating. + + + nobody + + This is an internal account and should not be used directly. + This account is not exported during backups. + + + + + + + + System Groups + + + + + Name + Description + + + + + DBA + + This is the DBA group, all DBA users should be members of this group. + + + + guest + This is the primary group of the guest. + + + nogroup + + This is an internal group and should not be used directly. In the case that users without a + primary group are imported from an older eXist-db backup, the users will be restored with this as their primary group. + This group is not exported during backups. + + + + + + + + @@ -639,8 +717,8 @@ As you can see, eXist-db does not store passwords in the clear. It stores - hashed values of the passwords (in base64 encoding), using the - RIPEMD-160 cryptographic hashing algorithm. + hashed values of the passwords (in Base64 encoding), using the + RIPEMD-160 cryptographic hashing algorithm. Whenever a user supplies account credentials for authentication, the database applies RIPEMD-160 hash to the password and compares it to the hash stored in the user's account document. Storing hashes of passwords is a best practice in