Limiting Physical Access to Synchronizer Servers

Servers where Synchronizer data resides should be kept physically secure, in locations where unauthorized persons cannot gain access to the server consoles.

Securing File System Access

Encrypted file systems should be used on all Synchronizer servers. Only Synchronizer administrators should have direct access to Synchronizer data.

Setting Up SSL Connections

Secure SSL connections should be used between your Synchronizer system and the following external components:

For instructions, see Section 5.1, Security Administration.

Setting Up a Device Password Security Policy

To increase your control over mobile device access to your Synchronizer system, you should establish a device password security policy to ensure that users set up secure passwords on their mobile devices. For instructions, see Enabling a Device Password Security Policy in Mobility Connector Configuration in the Mobility Connector Configuration Guide.

Securing Synchronizer Web Admin

One Synchronizer administrator is established when you install the Mobility Pack. Additional users can be granted Synchronizer administrator rights, as described in Section 2.3.2, Setting Up Multiple Synchronizer Administrator Users, but this should be done carefully.

Synchronizer Web Admin can be integrated with a single sign-on solution, as described in Section 2.3.8, Using Synchronizer Web Admin with a Single Sign-On Solution.

Protecting Synchronizer Configuration Files

The configuration files for all Synchronizer components should be protected from tampering. Configuration files are found in the following default locations:

/etc/datasync/syncengine/engine.xml

/etc/datasync/webadmin/server.xml

/etc/datasync/configengine/configengine.xml

/etc/datasync/syncengine/connectors.xml

Protecting Synchronizer Log Files

The log files for all Synchronizer components should be protected against unauthorized access. Some log files contain very detailed information about your Synchronizer system and users. Synchronizer log files are found in the following locations:

/var/log/datasync/syncengine/engine.log

/var/log/datasync/webadmin/server.log

/var/log/datasync/configengine/configengine.log

/var/log/datasync/syncengine/connector-manager.log

/var/log/datasync/connectors/
       default.pipeline1.connector_name.log
       default.pipeline1.connector_name-AppInterface.log