Encrypt Database Password

Mirth® Connect by NextGen Healthcare User Guide

Encryption Settings

You can change the default encryption settings for Mirth® Connect as you see fit. The following can be set in mirth.properties: Property Default Value Description encryption.algorithm AES/CBC/PKCS5Padding The algorithm to use for symmetric encryption. This applies to messages, exports, and anything that is used along with the keystore to encrypt / decrypt. You must include the explicit mode and padding settings with the algorithm. The mode must also require an initialization vector. Note: The default value is updated in version 4.3. If you did not explicitly set this property, then no action is needed. Mirth® Connect will automatically start using the new default. If you did explicitly set this property, then NextGen Healthcare highly recommends you to update it to include the mode/padding options as well. Support for "AES" (without any mode/padding specified) will be removed in a future version. encryption.charset UTF-8 The charset to use when encoding textual data into bytes before e

Mirth® Connect by NextGen Healthcare User Guide

Password Requirements

The following properties can be set in mirth.properties to enforce requirements on user passwords: Property Default Value Description password.minlength 0 Minimum password length, 0 for no minimum. password.minupper 0 Minimum uppercase characters, 0 for no minimum. password.minlower 0 Minimum lowercase characters, 0 for no minimum. password.minnumeric 0 Minimum numeric characters, 0 for no minimum. password.minspecial 0 Minimum special characters, 0 for no minimum. password.retrylimit 0 Maximum number of times a user may retry a failed login, 0 for no maximum. If specified, the lockout period must be specified as well. password.lockoutperiod 0 Amount of time (in hours) to lockout user when the retry limit has been exceeded, 0 for no lockout. password.expiration 0 After this amount of time (in days), passwords will expire. password.graceperiod 0 If user's password is expired, the amount of time (in days) to give the user to change password after the next login. password.reuseperiod 0 Th

Mirth® Connect by NextGen Healthcare User Guide

Installation Directory

In general, the principle of least privilege should be followed, and only Administrators should have access to the installation directory that Mirth® Connect is installed into. If installed on a dedicated machine, that machine should only be accessible to said administrators. If installed on a shared machine, it should be done in such a way that the Connect installation directory is only accessible by administrators. Notes on specific folders inside the installation directory: appdata: The Application Data Directory stores configuration and temporary files used by Mirth® Connect during runtime. Take note of: configuration.properties: By default this file is used to store the current state of the Configuration Map. However in mirth properties you can choose to store the configuration map in the database, or you can select a different file location. For example if you have a separate network storage location specifically for secure files, you could choose to store the configuration map f

Mirth® Connect by NextGen Healthcare User Guide

Secure Configuration

Encryption Settings Encrypt Database Password Plain HTTP Main Web Server Default TLS/SSL Settings Default Supported Cipher Suites Password Requirements SSL Manager Extension Encryption Settings Encrypt Database Password Plain HTTP Main Web Server Default TLS/SSL Settings Default Supported Cipher Suites Cipher Suites Removed From Earlier Versions New Protocol/Cipher Suite Support in Java 11 Password Requirements SSL Manager Extension Parent topic: Security Best Practices

Mirth® Connect by NextGen Healthcare User Guide

SQL Server

Using the built-in jTDS JDBC driver, you can enable SSL/TLS by using the "ssl" option: jdbc:jtds:sqlserver://localhost:1433/mirthdb?ssl=authenticate The above option will require SSL/TLS traffic and require that the server certificate is trusted. If you want to accept self-signed certs, you can reduce the security level and use "ssl=require" instead. Using the Microsoft JDBC driver, you can enable SSL/TLS by using the "encrypt" option: jdbc:sqlserver://localhost:1433;databaseName=mirthdb;encrypt=true;trustServerCertificate=true Consult these online documentation pages for more information: http://jtds.sourceforge.net/faq.html https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/enable-encrypted-connections-to-the-database-engine https://docs.microsoft.com/en-us/sql/connect/jdbc/using-ssl-encryption Parent topic: Connect to Database using SSL/TLS

Mirth® Connect by NextGen Healthcare User Guide

Update the Digest Algorithm

To ensure you can still log on with your existing credentials (which used the old digest settings), you want to make sure to set the "fallback" digest settings in the mirth.properties file. Set the "fallback" digest settings in the mirth.properties file. For example:digest.fallback.algorithm = SHA256digest.fallback.saltsizeinbytes = 8digest.fallback.iterations = 1000digest.fallback.usepbe = 0digest.fallback.keysizeinbits = 256 Update the digest.* settings to the new algorithm you want to use. After Mirth® Connect, is retarted, the new digest settings are used for all new digest values. The "fallback" settings to verify old digest values are also used. To use the new digest value for your stored password hash in the database, update your user password in the Administrator. Parent topic: mirth.properties File

Encrypt Database Password

Recommendations

Encryption Settings

Password Requirements

Installation Directory

Secure Configuration

SQL Server

Update the Digest Algorithm

Encryption Settings

Password Requirements

Installation Directory

Secure Configuration

SQL Server

Update the Digest Algorithm