In the enterprise environment using exec:// protocol can present significant security risks. The ability to execute operating system commands by remote users may potentially lead to compromise of the entire enterprise network, destruction of vital data, etc.
Therefore extreme care must be taken in ensuring that only verified commands can be executed by SpectX. For that purpose SpectX Server installations using SpectX Enterprise License provide following controls in the system-wide configuration:
The entry engine.exec.allowed_paths defines the list of directories for trusted programs allowed to be executed by SpectX. The list may consist of one or more absolute paths to directories, separated by commas. Note that every listed path enables also its subdirectories for execution.
An empty list or missing configuration entry prohibits the use of exec://.
The entry engine.da.protocol.exec defines the roles allowed to specify the location of trusted programs.
Assigning the value
managedenables users with Administrator role to define datastores using exec://.
unmanagedallows every user to define datastores using exec://.
disabledprohibits the use of exec://.
The configuration changes must be applied and SpectX restarted to enable using the exec:// protocol.
1. SpectX executes commands in the role of OS user it has been set-up to run. Make sure that it has appropriately restricted permissions on local file system in order to prevent sensitive data compromise.
2. Make sure that only dedicated and trusted users at operating system level have the permissions to change SpectX configuration and write in the directories (and their subdirectories) of trusted programs. It is highly recommended to set-up a process for verifying programs before submitting them in trusted directories.