<!DOCTYPE chapter PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN" "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
<chapter id="administration">
	<title>RCE Administration</title>
	
	<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="administration/services_daemons.xml"/>
	
	<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="administration/uplink.xml"/>
	
	<section>
		<title>Notes and Recommendations: RCE's Default Network ("LocalNet") Connections </title>
		<para>For default connections, an arbitrary number of incoming network ports can be configured.<note>
				<para>TODO This section will be expanded in a future version of this guide; please
					refer to the User Guide for additional information.</para>
			</note></para>
	</section>
	<section>
		<title>Notes and Recommendations: SSH/Uplink Account management</title>
		<para>It is <emphasis role="bold">strongly</emphasis> recommended to use the RCE console's
				"<code>keytool uplink-pw</code>" command to generate secure passwords for Uplink
			accounts. This command creates a random password with approximately 80 bits of entropy,
			which is considered secure for accounts based on remote login attempts. Alternatively,
			you can also use SSH key files -- please refer to the RCE User Guide for this.</para>
		<para>In both cases, the login credentials (the password or the SSH key pair) should be
			generated on the client side, ideally by individual users themselves to minimize the
			transfer of credential data. The relay server's administrator should only receive either
			the password's bcrypt hash, or the public part of the SSH key pair.</para>
	<para><emphasis role="italic">(Deprecated approach:) </emphasis>When using the built-in
			administration text mode UI to create SSH accounts, there is an issue when entering
			passwords including the "@" character. This does not weaken security in any way, but can
			be confusing for end users when their correctly entered password does not work. It may
			be advisable to inform users about this. </para>
	<para>Hashing SSH passwords with external BCrypt tools has been successfully tested and may be
			documented in a future version of this guide. Please note, however, that this is only
			ever useful in automated testing or deployment approaches. For normal user operation,
			the "<code>keytool uplink-pw</code>" console command mentioned above is strongly
			preferred.</para>
		<note>
			<para>This section is planned to be expanded once the Uplink feature leaves the
				experimental stage; for example, how to dynamically add SSH/Uplink accounts without
				a server restart, setting proper Uplink account roles etc.</para>
		</note>
	</section>
</chapter>
