Your achievements

Level 1

0% to

Level 2

Tip /
Sign in

Sign in to Community

to gain points, level up, and earn exciting badges like the new
Bedrock Mission!

Learn more

View all

Sign in to view all badges

SOLVED

OSGi Web Console Password

ClintLundmark
Level 3
Level 3

I am doing a security review of our AEM instance and going through the Security Checklist.   It is not clear to me what "Changing the OSGi Web Console Password" actually does.  I changed the AEM admin user password to "rainyday".  I changed the OSGi Web Console password to something distinct per the instructions - "sunnyday".  To get to the OSGi Web Console the AEM admin user password "rainyday" allows access NOT the password set for OSGi Web Console. 

  1. Why is is recommended to set an OSGi Web Console password?
  2. When is the password used?
  3. What is the consequence of not setting the OSGi Web Console password?
  4. What is the consequence of setting them to the same thing? "rainyday".

...

clint

1 Accepted Solution
Nikhil-Kumar
Correct answer by
Community Advisor
Community Advisor

@ClintLundmark 

As mentioned in the docs under security checks.
We usually update the admin credentials to secure the crx and system/console(OSGI Web Console) as it has all the confidential information on code and jars.
So once you update the admin password let's suppose to sunnyday then in that case using the same password you can login to crx as well as OSGI web console.

Thanks,
Nikhil

View solution in original post

3 Replies
ClintLundmark
Level 3
Level 3

Somewhat as a follow up to my original set of questions...

 

How do I test the OSGI Password?  If I set it to something like "sunnyday" how do I know it was actually set or set to what I think it is?

 

Any help to better understand this is appreciated!

 

Thanks.

..

clint

kautuk_sahni
Community Manager
Community Manager
Request you to create a separate Questions for follow up Qs. It helps in SEO.
Nikhil-Kumar
Correct answer by
Community Advisor
Community Advisor

@ClintLundmark 

As mentioned in the docs under security checks.
We usually update the admin credentials to secure the crx and system/console(OSGI Web Console) as it has all the confidential information on code and jars.
So once you update the admin password let's suppose to sunnyday then in that case using the same password you can login to crx as well as OSGI web console.

Thanks,
Nikhil

View solution in original post