How to configure Titan for enhanced security

This article describes the recommended steps to configure Titan family of products (Titan SFTP, Titan MFT, Titan DMZ, Titan Syslog, Titan ICAP, Titan Neo).

Service Configuration

When Titan is installed onto a Window or Linux system by default the service runs under the Local System (Windows) or system(Linux) user context. We highly recommend changing this to a specific user that has only the needed privileges and access to specific data folders needed for Titan.

1. Create a new user in your operating system, i.e. "TITANUSER"

2. Give this user Modify permissions to the following folders:

Windows

1. C:\ProgramData\SouthRiverTechnologies for files and subdirectories. This is where the admin database is stored
2. C:\SrtData - this is where user data is stored by default, you can always configure this to be a UNC path or Azure file storage etc. But make sure the service has access to this folder where data is stored
3. C:\SrtLogs - log files are stored here
4. Whatever Database your server instance is using, i.e. SQL Server, MySQL, Postgres

Linux

1. /var/southriver - this is where admin database and data directories are stored
2. Access to the server instance database of choice

Certificates and Keys

Create your own PGP, SSSH, and TLS keys/certificates. The default Tls certificate provided is self-signed. In order for the browser to not display a warning error you need to provide a valid non self-signed certificate provided by a certificate authority. For the SFTP and PGP keys please create new keys for your server instances and don't use the default ones created for you.

Protocols

1. FTP - Use only FTPS for secure FTP.

2. HTTPS - Use only HTTPS for web UI and WebDAV protocols

3. SFTP - consider using host key authentication

4. MFA - consider using multi-factor authentication for enhanced security
5. LDAP - enable Tls for secure authentication to your LDAP/ADSI server