vania-janet/multiturn-rag-retrieval-data huggingface dataset:
SSH provides better security solution than password authentication. See [Getting started with SSH keys](https://cloud.ibm.com/docs/ssh-keys?topic=ssh-keys-getting-started-tutorialgetting-started-tutorial).





 Record IP addresses and credentials 

Keep a log of IP addresses and credentials for the server in a safe location so that you can access them quickly without having to log in to the IBM Cloud console.



* Individual device IP addresses can be viewed from the Device List.
* Individual device root passwords can be viewed in the device’s Snapshot View. Click the arrow next to the device name to expand the view.
* Multiple device IP addresses can be viewed by using the Download CSV action within the Device List. Select Download CSV from the Settings cog to download a full list of devices and details in spreadsheet format.







 Update software credentials 

All software that was loaded onto your device during the provisioning process was assigned temporary credentials. These credentials are viewed and managed on the Passwords tab of each device in the IBM Cloud console. Use these temporary credentials to access your software for the first time. As a best practice, change the password to your software after you access it for the first time. Use a strong password that consists of a combination of letters, numbers, and symbols.

Optionally, password updates can be stored on the Passwords tab for each device; however, understand that when you store passwords within the IBM Cloud console, any person with access to the account and appropriate permissions can view passwords that are stored on the Passwords screen.

For more information about viewing and managing your software credentials, see [Managing classic infrastructure access](https://cloud.ibm.com/docs/virtual-servers?topic=account-mngclassicinfra).





 Access your server on the private network 

The private network is the precursor to interacting with your devices through remote desktop (RDP) using SSH and KVM over IP. The VPN Access tool allows for private network connection to either the closest SSL VPN endpoint or to the endpoint of your choice. VPN access is also required to interact with several services that are offered.
"no_pre_shared_key_characters": 30,
"dns_port": 60,
"vm_nic_count": 1,
"no_of_admins_for_container_registry ": 3,
"no_of_service_id_admins_for_container_registry": 3,
"no_of_managers_for_container_registry": 0,
"no_of_service_id_managers_for_container_registry": 0,
"access_tokens_expire": 120
}
}
Show more







 Security and Compliance Center goals 

The Terraform Analyzer supports the following Security and Compliance Center goals:

3000001 - Check whether IBMid password policy requires at least one uppercase letter
3000002 - Check whether IBMid password policy requires at least one lowercase letter
3000003 - Check whether IBMid password policy requires at least one number
3000004 - Check whether IBMid password policy requires minimum length of 12 characters
3000005 - Check whether IBMid password policy prevents password reuse below the minimum of 
3000006 - Check whether IBMid password may contain only printable ASCII characters (in the range 33 - 126)
3000007 - Check whether IBMid password policy contains spaces or any of the following characters: ;:(""?)<>"
3000008 - Check whether IBMid uses a password meter that coaches users to create strong passwords that exceed the minimum requirements
3000009 - Check whether IAM roles are used to create IAM policies for IBM resources
3000010 - Check whether a support role has been assigned in IAM to manage cases in the IBM Cloud Support Center
3000011 - Check whether API keys are not created in IAM during the initial setup of IAM users
3000015 - Check whether IAM users are attached to at least one access group
3000016 - Check whether IAM policies for users are attached only to groups or roles
3000030 - Check whether IAM policies for service IDs are attached only to groups or roles
3000017 - Check whether multifactor authentication (MFA) is enabled at the account level
* [TLS](https://cloud.ibm.com/docs/codeengine?topic=codeengine-configmap-secretsecret-create-cli-tls)





 Creating a basic authentication secret with the CLI 

A basic authentication secret contains a username and password key and is used to access a service that requires basic HTTP authentication. The following example creates a basic authentication secret with credentials for myusername and the associated password is provided in a file on the local workstation

ibmcloud ce secret create --name mysecret-basicauth --format basic_auth --username myusername --password-from-file ./password.txt

To display the details of this secret,

ibmcloud ce secret get --name mysecret-basicauth

Example output

Getting secret 'mysecret-basicauth'...
OK

Name: mysecret-basicauth
ID: abcdefgh-abcd-abcd-abcd-1a2b3c4d5e6f
Format: basic_auth
Project Name: myproject
Project ID: 01234567-abcd-abcd-abcd-abcdabcd1111
Age: 66s
Created: 2021-03-10T18:44:18-05:00

Data:
---
password: REDACTED
username: bXl1c2VybmFtZQ==

Notice that the value of the key username for this basic authentication secret is encoded, and the value of password is redacted. To display the secret data as decoded, use the --decode option with the secret get command.





 Creating a generic secret with the CLI 

A generic secret stores simple key-value pairs and Code Engine makes no assumptions about the defined key-value pairs nor about the intended use of the secret.

You can create a generic secret with the secret create command in one of the following ways. By default, a generic secret is created when the --format option is not specified.
However, a plain text copy of your password appears in the terminal log.



An alternative approach is to use a hashed version of your username and password combination, and supply that data in your curl command. The next section on [authorized curl](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-working-with-curlauthorized-curl-acurl-) explains how to create a more complex acurl command that uses this technique.





 Authorized curl - acurl 

(The following section is based on a blog article that was written by Samantha Scharr: [ "Authorized curl, also known as acurl"] originally published 27 November 2013.)

You no longer need to write a simple GET request to a database as https://$ACCOUNT:$PASSWORD@$ACCOUNT.cloudant.com/foo. Instead, you can use, https://$ACCOUNT.cloudant.com/foo.

Not only does this cut down on annoyingly long URLs, but the acurl alias is also more secure. It prevents someone from reading your password over your shoulder as you type. It also makes sure that your password isn’t sent in plain text over the network by enforcing HTTPS.

It takes the following three steps:



1. [Encode username and password](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-working-with-curlencode-user-name-and-password).
2. [Create an alias](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-working-with-curlcreate-an-alias).
3. [Activate the alias](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-working-with-curlactivate-the-alias).



If you're using a Windows™ computer, you can specify your username and password from the command line.



 Encode username and password 

First, you base64-encode your IBM Cloudant username and password. This encoding gives us a base64 character sequence as output.
* [IBM® Key Protect for IBM Cloud®](https://cloud.ibm.com/docs/key-protect?topic=key-protect-getting-started-tutorial)
* [IBM Cloud® Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-get-started)
* [HashiCorp Vault](https://www.vaultproject.io/)



For more information about secure DevOps best practices, see [DevOps Security](https://www.ibm.com/cloud/learn/devops-a-complete-guide?mhsrc=ibmsearch_a&mhq=Secure%20DevOpstoc-security-j2-0639C).





 Protecting your credentials by using secrets references 

Many of the properties that you can configure when you are working with Continuous Delivery toolchains and delivery pipelines, such as passwords, API keys, certificates, or other tokens, are classified as secrets or credentials. To set the value of a secure property, you can either use plain text or a secrets reference. Using a secrets reference is the recommended method for setting the value of a secure property.

When you set a secure property with a plain text secret value, Continuous Delivery actively encrypts and stores the value internally. Although the value is kept secure within the Continuous Delivery service, the service cannot protect the value on the client side. When you set a secure property by using the console in your browser, by calling an API, or by configuring a Terraform resource, the plain text secret might be exposed on your local systems. Plain text secrets are also more difficult to rotate. When a secret, such as an API key, must be rotated, all secure properties that carry the secret value must also be located and updated.
The private part of the signature key is owned by the crypto unit administrator, while the public part is placed in a certificate that is used to define an administrator and never leaves the crypto unit.

This design ensures that no one can get full access of the master key, even the crypto unit administrators.
* What is a 140-2 FIPS Level 4 Certification and how can I validate it?

The Federal Information Processing Standard (FIPS) Publication 140-2 is a US government computer security standard that is used to approve cryptographic modules.



* [Security Requirements for Cryptographic Modules](https://csrc.nist.gov/publications/detail/fips/140/2/final).
* [Cryptographic Module Validation Program](https://csrc.nist.gov/Projects/cryptographic-module-validation-program).
* FIPS 140-2 defines four levels of security, including FIPS 140-2 Level 1, 2, 3, and Level 4.



* What is the difference between FIPS 140-2 Level 1, 2, 3, and Level 4?



* Level 1: The lowest level of security. No specific physical security mechanisms are required in a Security Level 1 cryptographic module beyond the basic requirement for production-grade components.
* Level 2: Improves the physical security mechanisms of a Level 1 cryptographic module by requiring features that show evidence of tampering including tamper-evident coatings or seals that must be broken to attain physical access to the plaintext cryptographic keys and critical security parameters (CSPs) within the module, or pick-resistant locks on covers or doors to protect against unauthorized physical access. Security Level 2 requires, at minimum, role-based authentication in which a cryptographic module authenticates the authorization of an operator to assume a specific role and perform a corresponding set of services.
* Level 3: Provides a high probability of detecting and responding to attempts at physical access, use, or modification of the cryptographic module. The physical security mechanisms can include the use of strong enclosures and tamper-detection and response circuitry that zeroizes all plain text CSPs when the removable covers or doors of the cryptographic module are opened. Security Level 3 requires identity-based authentication mechanisms, enhancing the security provided by the role-based authentication mechanisms specified for Security Level 2.
The object store uses this value to validate the key passes in the x-amz-server-side-encryption-customer-key has not been corrupted during transport and encoding process. The digest must be calculated on the key BEFORE the key is base 64 encoded. 



A [cURL command](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-curl) might look like the following:

curl -v -T $FILE https://$ENDPOINT/$BUCKET 
-H "Authorization: bearer $TOKEN" 
-H "Content-MD5: $MD5_OBJECT_HASH" 
-H "x-amz-server-side-encryption-customer-algorithm: AES256" 
-H "x-amz-server-side-encryption-customer-key:$ENCRYPTION_KEY" 
-H "x-amz-server-side-encryption-customer-key-MD5:$MD5_KEY_HASH"
After the user password expires, you have 30 days to change your password. If you don't change your password within the 30 days, your account becomes inactive and it is no longer possible to log in thru SSH even if you are using SSH-keys. For information, see [Protecting a virtual server](https://cloud.ibm.com/docs/hp-virtual-servers?topic=hp-virtual-servers-protect_vs).

As soon as you create a virtual server instance, a virtual LAN (VLAN) is transparently created or assigned. One VLAN is used within one region for one account. Each VLAN can contain up to five virtual servers per data center. A VLAN is deleted as soon as you delete the last virtual server instance that is assigned to this VLAN.

To store any data that is important and is required at all times, use the /data folder. If you have files of a large size in other folders, it is recommended that you move them to the /data folder and create a symlink as required.



 Creating a virtual server in the UI 



1. [Log in to your IBM Cloud account](https://cloud.ibm.com).
2. Click Catalog from the menu bar, then browse for the Compute category.
3. In the displayed selection of services, look for the Hyper Protect Virtual Servers tile. If you don't see the tile, enter virtual server in the search field. Then, click the tile. The Hyper Protect Virtual Servers page opens.

Zoom

![Creating a virtual server](https://cloud.ibm.com/docs-content/v1/content/29e0ddc9fd7149f916889ba6a4d131cc3528c9bc/hp-virtual-servers/image/hpvs_create_instance.jpg)

Figure 1. Creating a virtual server
4. In section Select a region, you can select the data center in which to create the virtual server instance, or you can accept the preselected default data center.
5.
Secure Shell (SSH) 

A network protocol for secure data exchange between two networked devices. The client can use public-key and private-key authentication, or password authentication, to access the remote server.





 Secure Sockets Layer (SSL) 

A security protocol that provides communication privacy. With SSL, client/server applications can communicate in a way that is designed to prevent eavesdropping, tampering, and message forgery. See also [certificate authority](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx2016383).





 security definition 

A specification of the settings for a particular aspect of API security; for example, the user registry that authenticates access to the API.





 security group 

A resource that provides rules to filter IP traffic to resources in a virtual private cloud. Rules are stateful, such that packets in response to allowed packets are automatically permitted.





 select availability 

A production-ready product that is available for sale and accessible to select customers.





 service 

A cloud extension that provides ready-for-use functionality, such as database, messaging, and web software for running code, or application management or monitoring capabilities. Services usually do not require installation or maintenance and can be combined to create applications.





 service binding 

An association between an application and a service instance that contains the application credentials that are used to communicate with the service instance.





 service endpoint 

The physical address of a service that implements one or more interfaces.





 service ID 

An identity that authenticates a service or an application to a cloud environment and other services. A service ID can be assigned access policies and used to enable an application that is deployed to a cloud environment access to cloud services.





 session 

The period of time after an app is started on a mobile device and the quality assurance product is notified to begin collecting app behavior, issues, and problems.





 signature key 

An encryption key that is used by the crypto unit administrator to sign commands that are issued to the crypto unit.





 signCert 

A certificate that any entity, such as an organization or admin, attaches to their proposals or proposal responses.
Basic authentication A secret that contains a username and password key. <br>Use basic authentication secrets when you access a service that requires basic HTTP authentication. 
 Generic A secret that stores simple key-value pairs and Code Engine makes no assumptions about the defined key-value pairs nor about the intended use of the secret. <br>Use generic secrets when you want to define your own key-value pairs to access a service. 
 Registry A secret that stores credentials to access a container registry. <br>Use registry secrets when you work with Code Engine apps or jobs to access a container image. Or, you use Code Engine to build a container image and the registry secret is used by Code Engine to access the registry to store the built container image. <br>This secret is also used as a Registry access secret in the CLI and console. 
 Service access A secret that stores credentials to access an IBM Cloud service instance. <br>Use service access secrets when you work with [service bindings](https://cloud.ibm.com/docs/codeengine?topic=codeengine-service-binding) in Code Engine. Code Engine can automatically generate this secret or you can create your own custom service access secret. 
 SSH A secret that stores credentials to authenticate to a service with an SSH key, such as authenticating to a Git repository, such as GitHub or GitLab. <br>Use SSH secrets when you want Code Engine to build a container image for you. Code Engine uses this secret to access your source code in a code repository. For example, use this secret with build runs to access your source code in a repository, such as GitHub or GitLab. <br>This secret is also used as a Git repository access secret in the CLI and Code repo access in the console. 
 Transport Layer Security (TLS) A secret that contains a signed TLS certificate, including all its intermediate certificates, and its corresponding private key from a certificate authority (CA). <br>Use TLS secrets when you work with [custom domain mappings](https://cloud.ibm.com/docs/codeengine?topic=codeengine-domain-mappings) in Code Engine. 









 Creating secrets
The private part of the signature key is owned by the crypto unit administrator, while the public part is placed in a certificate that is used to define an administrator and never leaves the crypto unit.

This design ensures that no one can get full access of the master key, even the crypto unit administrators.





 What is a 140-2 FIPS Level 4 Certification and how can I validate it? 

The Federal Information Processing Standard (FIPS) Publication 140-2 is a US government computer security standard that is used to approve cryptographic modules.



* [Security Requirements for Cryptographic Modules](https://csrc.nist.gov/publications/detail/fips/140/2/final).
* [Cryptographic Module Validation Program](https://csrc.nist.gov/Projects/cryptographic-module-validation-program).
* FIPS 140-2 defines four levels of security, including FIPS 140-2 Level 1, 2, 3, and Level 4.







 What is the difference between FIPS 140-2 Level 1, 2, 3, and Level 4? 



* Level 1: The lowest level of security. No specific physical security mechanisms are required in a Security Level 1 cryptographic module beyond the basic requirement for production-grade components.
* Level 2: Improves the physical security mechanisms of a Level 1 cryptographic module by requiring features that show evidence of tampering including tamper-evident coatings or seals that must be broken to attain physical access to the plaintext cryptographic keys and critical security parameters (CSPs) within the module, or pick-resistant locks on covers or doors to protect against unauthorized physical access. Security Level 2 requires, at minimum, role-based authentication in which a cryptographic module authenticates the authorization of an operator to assume a specific role and perform a corresponding set of services.
* Level 3: Provides a high probability of detecting and responding to attempts at physical access, use, or modification of the cryptographic module. The physical security mechanisms can include the use of strong enclosures and tamper-detection and response circuitry that zeroizes all plain text CSPs when the removable covers or doors of the cryptographic module are opened. Security Level 3 requires identity-based authentication mechanisms, enhancing the security provided by the role-based authentication mechanisms specified for Security Level 2.
The value must match regular expression /.+/.

--description (string)
: Optional. Return only keystores whose description contains the string. The length must be between 1 and 200 characters. The value must match regular expression /.+/.

--group (string)
: Optional. The keystore group. This query parameter cannot be used in conjunction with the groups[] query parameter.

--groups ([]string)
: Optional. Keystore groups.

--vault-id ([]string)
: Optional. The UUID of the vault. The list items must match the regular expression /^[-0-9a-z]+$/.

--location (string)
: Optional. Keystore location.

--limit (int64)
: Optional. The number of keystores to retrieve. The value must between 1 and 1000.

--offset (int64)
: Optional. The number of keys to skip. The minimum value is 0.

--sort ([]string)
: Optional. The sorting order. The default value is ["-updated_at"]. The list items must match regular expression /^-?[a-z0-9_.\[\],-]+$/.

--all-pages (bool)
: Optional. Invoke multiple requests to display all pages of the collection for keystores.
* Example

ibmcloud hpcs uko keystores --output json
* Output

The command returns the output similar to the following example:

{
"total_count": 3,
"limit": 20,
"offset": 0,
"first": {
"href": "https://uko.us-south.hs-crypto.cloud.ibm.com:9549/api/v4/keystores?limit=20"
},
"last": {
System.setProperty("javax.net.ssl.trustStore", "<trustStoreName>.jks");
System.setProperty("javax.net.ssl.trustStorePassword", "<trustStorePassword>");



* <trustStorePassword> - this is the same password created to protect the key database.









 Step 8: Rerun the JMS application 

Once these changes have been made, save the program and re-compile it and follow by running the following command:



* Windows



* Recompile javac -cp .com.ibm.mq.allclient-9.0.4.0.jar;.javax.jms-api-2.0.1.jar comibmmqsamplesjmsJmsPutGet.java
* Run java -cp .com.ibm.mq.allclient-9.0.4.0.jar;.javax.jms-api-2.0.1.jar;. com.ibm.mq.samples.jms.JmsPutGet



* Linux



* Recompile javac -cp ./com.ibm.mq.allclient-9.0.4.0.jar:./javax.jms-api-2.0.1.jar com/ibm/mq/samples/jms/JmsPutGet.java
* Run java -cp ./com.ibm.mq.allclient-9.0.4.0.jar:./javax.jms-api-2.0.1.jar:. com.ibm.mq.samples.jms.JmsPutGet





This time, the program should be able to successfully 'put' and 'get' messages from the queue manager.

The messages travelling over the network are now encrypted and the client now trusts the server.







 Securing Applications with Mutual (Two Way) TLS 

Standard TLS is commonly used when connecting to servers or websites. Using standard TLS, a client can be sure that it is connecting to the trusted server. In addition, mutual TLS ensures that the server only accepts connections from trusted clients.