Skip to main content
Version: 4.5.x LTS

Securing nevisAdmin 4

Using HTTPS

After installing nevisAdmin 4, perform the following steps to configure HTTPS:

  1. Configure the key material.
  2. Use standard port 443.

Configuring Key Material​

Follow the next instructions to configure the key material:

  1. Install the private key and the host certificate that you want to use on the machine where nevisAdmin 4 runs.

For convenience, you can use nevisKeybox to create the key material for HTTPS. For more information, see How to create a secure, trusted connection between two nodes in the nevisKeybox technical documentation. 2. Verify whether the ownership of the key and certificate files is set correctly, so that the admin4 process is able to read these files. It should be chown. Correct the settings, if necessary. 3. Configure nevisAdmin 4 to use the key material via /var/opt/nevisadmin4/conf/nevisadmin4.yml:

server:
  port: 8443                                                                       
  tls:
    keystore: /var/opt/neviskeybox/default/default/node_keystore.p12
    keystore-passphrase: password
    keystore-type: pkcs12
    key-alias: node
  1. To test your settings, temporarily stop the nevisAdmin 4 systemd service. Follow the testing instructions in [Initial Setup].

Using Standard Port 443​

nevisAdmin 4 runs as nvbuser. However, this user cannot listen on port 443. Use iptables to redirect port 443 to 8443:

iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-port 8443
iptables-save > /etc/sysconfig/iptables
systemctl enable iptables
systemctl start iptables

Protecting the Default admin Account

To configure a secure password for the default admin user:

  1. Log in using your web browser.
  2. Change the admin password with the top right User menu. Alternatively, use the REST API: [Managing in

Configuring further User Accounts

We recommend that you avoid using the admin account for your daily work.

Instead, set up further accounts as follows: to create user accounts locally or manage groups and permissions to automatically create users from Active Directory data when they log in