35
Meddream VideoStation functionalities v4.6.1 Install Manual
Security considerations
MedDream VideoStation is stand-alone application and it is intended to communicate with background applications via
HTTP or TCP/IP localhost. Background applications must run as administrator and have access to Windows API.
API restriction
MedDream VideoStation JAVA background application API restricted access just by IP address. In
/jhttp/application.properties
file add property “server.allowIps” with the list of IP’s. By default it always allows just local IP –
127.0.0.1.
Other restriction can be setup by defining properties:
•
server.denyEndpoints - deny multiple end-points for all requests
•
server.connect.strict=1
– forbid to connect multiple clients. If this option is absent - always allow connect (if already
connected other clients - disconnect older client)
User can add more secure connection by defining properties:
•
server.port =4444
– set specific port
•
server.ssl.enabled=true - enable https
•
server.ssl.key-store-type=PKCS12
– certificate type
•
server.ssl.key-store=someCertificateFile.p12
– valid certificate file path
•
server.ssl.key-store-password=someCertificateFilePassword
– certificate password
WebSocket can be connected just with “clientId”, that will be received after connection to JAVA background application. This
will ensure just one active client. WebSocket is also restricted by IP address.
Password
During MedDream VideoStation installation will offer to enter
passwords for “root” user (have full access to database) and
“vsuser” user (access to DICOM viewer web application). Passwords is randomized, but can be changed. Manually
passwords should be generated at least 12 characters with uppercase, lowercase,numbers, special characters, and not
listed in
https://haveibeenpwned.com/Passwords
Every installation, database password (root user) will offer to change.
Database passwords is saved in “/database/users.ini” and it is used for reinstalling MedDream VideoStation – do not remove
this file.
DICOM viewer login information is saved in “login.txt” file.
Password can be changed only during installation process. Manfully password change is not recommended, because it
requires to update database and configuration files, to ensure working software and future updates.
Firewall
MedDream VideoStation background application will add/update firewall rules, to allow access application internet or open
required ports (access PACS, Worklist server or DICOM web viewer 80 port).
Manually changing DICOM web viewer port
– requires manually update firewall.
Licensing address
might need to be whitelisted in a corporate firewall
, to ensure ability to
register software.
When using API from remote computer, must open application port manually in firewall.
