Verify that the passwords for the Administrator and Replicator accounts and the master password for outbound password encryption have been changed from the default values assigned by webMethods Integration Server.

If you want to prevent a user from inadvertently accessing the Integration Server Administrator, edit the following file:

Integration Server_directory \instances\instance_name\packages\Default\pub\index.html

Change the SRC in the <frame src="/WmRoot/index.dsp"\> tag to some innocuous page you have created (perhaps one that displays an error message with alternate links).

You can prevent users from seeing all DSP files on Integration Server by using the watt.server.displayDirectories server configuration parameter.

Note that if you edit the index.html file, you will not be able to invoke the Integration Server Administrator in the standard way (i.e., simply connecting to the Integration Server's listening port). Instead, you will need to type the Integration Server Administrator's complete URL as shown below:

where:

Server is the name of the Integration Server, and

Port is the port on which it listens for HTTP requests.

Verify that all user accounts have passwords as required.

Verify that all secure services have correct ACL assignments.

Verify that proxy server settings and bypass list are correct.

Configure allow/deny lists to restrict inbound requests as necessary.

If your server sits behind a routing, load-balancing, or URL-filtering system, consult with the administrator of that system to ensure that it will pass inbound requests to the Integration Server.

Provide only specific administrator users with write permissions to the maskSessionID.properties file. The remaining administrator users must have only read permissions to the particular file.

The security of your Integration Server depends on the security of your operating system. Therefore, make sure your operating system is properly configured, that all security patches have been applied, and that unnecessary network services, such as telnet or mail, have been removed.