1"use strict";(globalThis.webpackChunkpassbolt_docs||=[]).push([[1047],{24086(e,i,t){t.r(i),t.d(i,{assets:()=>T,contentTitle:()=>P,default:()=>_,frontMatter:()=>S,metadata:()=>n,toc:()=>A});const n=JSON.parse('{"id":"admin/passbolt-api-status","title":"Passbolt API Status","description":"What does the healthChecks means?","source":"@site/docs/admin/passbolt-api-status.mdx","sourceDirName":"admin","slug":"/admin/passbolt-api-status","permalink":"/docs/admin/passbolt-api-status","draft":false,"unlisted":false,"editUrl":"https://github.com/passbolt/passbolt-docs/blob/main/docs/admin/passbolt-api-status.mdx","tags":[],"version":"current","lastUpdatedAt":1787568134000,"frontMatter":{"title":"Passbolt API Status","sidebar_label":"Passbolt API Status","description":"What does the healthChecks means?","hide_table_of_contents":false,"toc_min_heading_level":3},"sidebar":"adminGuideSidebar","previous":{"title":"Internationalisation","permalink":"/docs/admin/internationalisation"}}');var s=t(74848),r=t(28453),a=t(42987),o=t(83457),l=t(25515);const c=[];function h(e){const i={admonition:"admonition",p:"p",strong:"strong",...(0,r.R)(),...e.components};return(0,s.jsx)(i.admonition,{type:"info",children:(0,s.jsxs)(i.p,{children:["The location and the webserver user will depend on the distribution, for this example it uses Debian. You might want to change www-data to ",(0,s.jsx)(i.strong,{children:"nginx"})," if you are using a RPM distribution."]})})}function d(e={}){const{wrapper:i}={...(0,r.R)(),...e.components};return i?(0,s.jsx)(i,{...e,children:(0,s.jsx)(h,{...e})}):h(e)}const p=[];function u(e){const i={admonition:"admonition",p:"p",strong:"strong",...(0,r.R)(),...e.components};return(0,s.jsx)(i.admonition,{type:"info",children:(0,s.jsxs)(i.p,{children:["The webserver user will depend on the distribution, for this example it uses Debian. You might want to change www-data to ",(0,s.jsx)(i.strong,{children:"nginx"})," if you are using a RPM distribution. If you are on Docker or Helm, restarting the container or the pods should work."]})})}function g(e={}){const{wrapper:i}={...(0,r.R)(),...e.components};return i?(0,s.jsx)(i,{...e,children:(0,s.jsx)(u,{...e})}):u(e)}const f=[];function v(e){const i={admonition:"admonition",p:"p",strong:"strong",...(0,r.R)(),...e.components};return(0,s.jsx)(i.admonition,{type:"info",children:(0,s.jsxs)(i.p,{children:["The webserver user and the keyring location will depend on the distribution, for this example it uses Debian. You might want to change www-data to ",(0,s.jsx)(i.strong,{children:"nginx"})," if you are using a RPM distribution."]})})}function b(e={}){const{wrapper:i}={...(0,r.R)(),...e.components};return i?(0,s.jsx)(i,{...e,children:(0,s.jsx)(v,{...e})}):v(e)}const m=[];function y(e){const i={admonition:"admonition",code:"code",p:"p",...(0,r.R)(),...e.components};return(0,s.jsx)(i.admonition,{title:"PRO TIP",type:"tip",children:(0,s.jsxs)(i.p,{children:["If you are on Docker or Helm, consider sourcing the environment variable with ",(0,s.jsx)(i.code,{children:"source /etc/environment"})]})})}function x(e={}){const{wrapper:i}={...(0,r.R)(),...e.components};return i?(0,s.jsx)(i,{...e,children:(0,s.jsx)(y,{...e})}):y(e)}const j=[];function k(e){return(0,s.jsx)(o.A,{children:'sudo su -s /bin/bash -c "/usr/share/php/passbolt/bin/cake passbolt install" www-data'})}function w(e={}){const{wrapper:i}={...(0,r.R)(),...e.components};return i?(0,s.jsx)(i,{...e,children:(0,s.jsx)(k,{...e})}):k()}const S={title:"Passbolt API Status",sidebar_label:"Passbolt API Status",description:"What does the healthChecks means?",hide_table_of_contents:!1,toc_min_heading_level:3},P=void 0,T={},A=[{value:"Colour-coded legend",id:"colour-coded-legend",level:2},{value:"What could trigger an error?",id:"what-could-trigger-an-error",level:2},{value:"Environment",id:"environment",level:3},{value:"Kernel",id:"kernel",level:4},{value:"System architecture",id:"system-architecture",level:4},{value:"PHP Version",id:"php-version",level:4},{value:"Gnupg Version",id:"gnupg-version",level:4},{value:"PCRE",id:"pcre",level:4},{value:"Temporary directory",id:"temporary-directory",level:4},...c,{value:"Logs directory",id:"logs-directory",level:4},...c,{value:"GD or Imagick",id:"gd-or-imagick",level:4},{value:"Intl",id:"intl",level:4},{value:"Mbstring",id:"mbstring",level:4},{value:"NTP",id:"ntp",level:4},{value:"Config Files",id:"config-files",level:3},{value:"Application Configuration File",id:"application-configuration-file",level:4},{value:"Passbolt Configuration File",id:"passbolt-configuration-file",level:4},{value:"Core config",id:"core-config",level:3},{value:"Debug mode",id:"debug-mode",level:4},{value:"Cache",id:"cache",level:4},{value:"Unique value for security.salt",id:"unique-value-for-securitysalt",level:4},{value:"Full Base URL",id:"full-base-url",level:4},{value:"Full Base URL validation",id:"full-base-url-validation",level:4},{value:"Healthcheck Status",id:"healthcheck-status",level:4},{value:"TLS Certificate",id:"tls-certificate",level:3},{value:"Peer certificate",id:"peer-certificate",level:4},{value:"Hostname",id:"hostname",level:4}
1,{value:"Self-signed certificate check",id:"self-signed-certificate-check",level:4},{value:"Database",id:"database",level:3},{value:"Connection to the database",id:"connection-to-the-database",level:4},{value:"Numbers of table",id:"numbers-of-table",level:4},...p,...j,{value:"Default content",id:"default-content",level:4},...p,...j,{value:"MariaDB/MySQL version deprecation",id:"mariadbmysql-version-deprecation",level:4},{value:"GPG Configuration",id:"gpg-configuration",level:3},{value:"GPG Module",id:"gpg-module",level:4},{value:"GNUPGHOME",id:"gnupghome",level:4},...f,{value:"GPG Keyring",id:"gpg-keyring",level:4},...f,{value:"Server Public Key",id:"server-public-key",level:4},{value:"Server Private Key",id:"server-private-key",level:4},{value:"Server Key Fingerprint",id:"server-key-fingerprint",level:4},...f,{value:"Server key in the keyring",id:"server-key-in-the-keyring",level:4},...f,{value:"Server Email Id",id:"server-email-id",level:4},{value:"Encryption check for Public Key",id:"encryption-check-for-public-key",level:4},...p,{value:"Signing check for Public Key",id:"signing-check-for-public-key",level:4},...p,{value:"Encryption and signing check for Private and Public Keys",id:"encryption-and-signing-check-for-private-and-public-keys",level:4},...m,{value:"Decryption and verification for Private Key",id:"decryption-and-verification-for-private-key",level:4},...m,{value:"Verification for Public Key",id:"verification-for-public-key",level:4},...m,{value:"Gopengpg compatibility for Public Key",id:"gopengpg-compatibility-for-public-key",level:4},{value:"Gopengpg compatibility for Private Key",id:"gopengpg-compatibility-for-private-key",level:4},{value:"Application configuration",id:"application-configuration",level:3},{value:"Passbolt version",id:"passbolt-version",level:4},{value:"Database schema",id:"database-schema",level:4},...c,{value:"Force TLS (SSL)",id:"force-tls-ssl",level:4},{value:"Full Base URL HTTPS",id:"full-base-url-https",level:4},{value:"Selenium API endpoints",id:"selenium-api-endpoints",level:4},{value:"Search engine robots",id:"search-engine-robots",level:4},{value:"Self Registration Plugin",id:"self-registration-plugin",level:4},{value:"Registration Closed",id:"registration-closed",level:4},{value:"Deprecated self registration public settings",id:"deprecated-self-registration-public-settings",level:4},{value:"Host availability",id:"host-availability",level:4},{value:"Compiled version of the javascript application",id:"compiled-version-of-the-javascript-application",level:4},{value:"Email notifications",id:"email-notifications",level:4},{value:"SMTP Settings",id:"smtp-settings",level:3},{value:"SMTP Settings Plugin",id:"smtp-settings-plugin",level:4},{value:"SMTP Settings Configuration",id:"smtp-settings-configuration",level:4},{value:"SMTP Settings Source",id:"smtp-settings-source",level:4},{value:"SMTP Settings endpoints",id:"smtp-settings-endpoints",level:4},{value:"Directory Sync",id:"directory-sync",level:3},{value:"SSO",id:"sso",level:3},{value:"JWT Authentication",id:"jwt-authentication",level:3},{value:"JWT Authentication plugin",id:"jwt-authentication-plugin",level:4},{value:"JWT directory not writable",id:"jwt-directory-not-writable",level:4},...c,{value:"Valid JWT key pair",id:"valid-jwt-key-pair",level:4},{value:"Metadata",id:"metadata",level:3},{value:"Active metadata key",id:"active-metadata-key",level:4},{value:"Server access to the metadata key",id:"server-access-to-the-metadata-key",level:4},{value:"Server metadata private key decryption",id:"server-metadata-private-key-decryption",level:4},{value:"Server metadata private key validity",id:"server-metadata-private-key-validity",level:4},{value:"Zero-knowledge mode",id:"zero-knowledge-mode",level:4}];function I(e){const i={a:"a",admonition:"admonition",code:"code",em:"em",h2:"h2",h3:"h3",h4:"h4",li:"li",p:"p",strong:"strong",ul:"ul",...(0,r.R)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsxs)("div",{style:{display:"flex",gap:"1rem"},children:[(0,s.jsx)(l.A,{link:"https://www.passbolt.com/ce/",isUnderMainTitle:!0,children:"Ce"}),(0,s.jsx)(l.A,{link:"https://www.passbolt.com/pricing/pro",isUnderMainTitle:!0,children:"Pro"})]}),"\n",(0,s.jsxs)(i.p,{children:["Since Passbolt v4.6, it is now possible for both Passbolt PRO and Passbolt CE to run the ",(0,s.jsx)(i.a,{href:"/hosting/maintenance/diagnostics/collect-info/#healthcheck",children:"healthCheck"})," from the user interface in ",(0,s.jsx)(i.em,{children:"Administration > Passbolt API Status"}),"."]}),"\n",(0,s.jsx)(a.A,{src:"/img/help/2025/04/healthcheck.png",caption:"fig. Passbolt API Status",alt:"Passbolt API Status"}),"\n",(0,s.jsx)(i.h2,{id:"colour-coded-legend",children:"Colour-coded legend"}),"\n",(0,s.jsx)(i.p,{children:"You will see on the right side that we've introduced a colour-coded legend."}),"\n",(0,s.jsxs)(i.ul,{children:["\n",(0,s.jsx)(i.li,{children:"Green: OK \u2705"}),"\n",(0,s.jsx)(i.li,{children:"Orange: OK after ensuring it is \ud83d\udd0d"}),"\n",(0,s.jsx)(i.li,{children:"Red: Something is not OK. \ud83d\udea8"}),"\n",(0,s.jsx)(i.li,{children:"Blue: This is just for information. \u270f\ufe0f"}),"\n"]}),"\n",(0,s.jsx)(i.h2,{id:"what-could-trigger-an-error",children:"What c
1ould trigger an error?"}),"\n",(0,s.jsx)(i.h3,{id:"environment",children:"Environment"}),"\n",(0,s.jsxs)(i.p,{children:["These checks are related to the environment itself e.g. ",(0,s.jsx)(i.strong,{children:"PHP version, PHP module"}),", etc."]}),"\n",(0,s.jsx)(i.h4,{id:"kernel",children:"Kernel"}),"\n",(0,s.jsx)(i.p,{children:"The kernel version check ensures that your system is running a modern and stable Linux kernel. A recent and maintained kernel version helps provide security updates, bug fixes, and compatibility with required software dependencies."}),"\n",(0,s.jsx)(i.h4,{id:"system-architecture",children:"System architecture"}),"\n",(0,s.jsx)(i.p,{children:"This checks whether your system is running on a 64-bit architecture. A 64-bit system provides better performance, allowing full compatibility with PHP and GPG requirements."}),"\n",(0,s.jsx)(i.h4,{id:"php-version",children:"PHP Version"}),"\n",(0,s.jsx)(i.p,{children:'It helps to ensure you are not running an unsupported PHP version. It should be green if you are running PHP 8.2 or higher, the minimum version required to run passbolt. Older versions, including PHP 7.4, fail this check with "PHP version is too low, passbolt need PHP 8.2 or higher."'}),"\n",(0,s.jsxs)(i.p,{children:["If your operating system cannot provide PHP 8.2 or higher, consider ",(0,s.jsx)(i.a,{href:"/hosting/migrate/server/",children:"migrating to a new server"}),". A second, warning-level line announces the next minimum PHP version whenever passbolt plans to raise it."]}),"\n",(0,s.jsx)(i.h4,{id:"gnupg-version",children:"Gnupg Version"}),"\n",(0,s.jsx)(i.p,{children:"The software relies on gnupg for cryptographic operations, such as key management and encryption. Ensuring that you are running an up-to-date version of GPG is essential for security and performance."}),"\n",(0,s.jsx)(i.h4,{id:"pcre",children:"PCRE"}),"\n",(0,s.jsx)(i.p,{children:"You should not face any compiling issues with PCRE by default, however if PCRE has not been completed with unicode support, while reconfiguring you should add:"}),"\n",(0,s.jsx)(o.A,{children:"--enable-unicode-properties"}),"\n",(0,s.jsx)(i.h4,{id:"temporary-directory",children:"Temporary directory"}),"\n",(0,s.jsx)(i.p,{children:"The temporary directory and its content should be writable and not executable, if you see some errors you should ensure that the temporary directory and its content are writable by the webserver user."}),"\n",(0,s.jsx)(d,{}),"\n",(0,s.jsx)(o.A,{children:"sudo chown -R www-data:www-data /var/lib/passbolt/tmp\nsudo chmod -R 775 $(find /var/lib/passbolt/tmp -type d)\nsudo chmod -R 664 $(find /var/lib/passbolt/tmp -type f)"}),"\n",(0,s.jsx)(i.h4,{id:"logs-directory",children:"Logs directory"}),"\n",(0,s.jsx)(i.p,{children:"The logs directory and its content have to be writable, if you see some error there is a high chance that it is not the case yet."}),"\n",(0,s.jsx)(d,{}),"\n",(0,s.jsx)(o.A,{children:"sudo chown -R www-data:www-data /var/log/passbolt\nsudo chmod -R 775 $(find /var/log/passbolt -type d)\nsudo chmod -R 664 $(find /var/log/passbolt -type f)"}),"\n",(0,s.jsx)(i.h4,{id:"gd-or-imagick",children:"GD or Imagick"}),"\n",(0,s.jsxs)(i.p,{children:["GD ",(0,s.jsx)(i.strong,{children:"or"})," Imagick module have to be installed in order for passbolt to manipulate images. If you have some errors with this check, you can take a look at ",(0,s.jsx)(i.a,{href:"https://secure.php.net/manual/en/book.image.php",children:"this documentation"})]}),"\n",(0,s.jsx)(i.h4,{id:"intl",children:"Intl"}),"\n",(0,s.jsxs)(i.p,{children:["The Intl module is needed for the internationalisation. If you have any error with this check, you should take a look ",(0,s.jsx)(i.a,{href:"https://secure.php.net/manual/en/book.intl.php",children:"this documentation"})]}),"\n",(0,s.jsx)(i.h4,{id:"mbstring",children:"Mbstring"}),"\n",(0,s.jsxs)(i.p,{children:["Mbstring is designed for safe and efficient handling of multibyte strings, allowing passbolt to work with textual data in various encodings. If you encounter some errors related to this module, you can take a look at ",(0,s.jsx)(i.a,{href:"https://secure.php.net/manual/en/book.mbstring.php",children:"this documentation"})]}),"\n",(0,s.jsx)(i.h4,{id:"ntp",children:"NTP"}),"\n",(0,s.jsx)(i.p,{children:"The server requires accurate system time for cryptographic operations and security measures. If the system clock is not synchronised, it may lead to authentication errors, expiration issues, and other unexpected behaviour."}),"\n",(0,s.jsxs)(i.p,{children:["If the check fails, it means that NTP could be inactive, and your system clock may not be synchronised. You can take a look at our ",(0,s.jsx)(i.a,{href:"/hosting/ntp/",children:"dedicated documentation"})," for that."]}),"\n",(0,s.jsx)(i.h3,{id:"config-files",children:"Config Files"}),"\n",(0,s.jsx)(i.admonition,{title:"PRO TIP",type:"tip",children:(0,s.jsx)(i.p,{children:"If you are on Docker or Helm, you should not manually iterate on the configuration files. Restarting the container or the pod should resolve the file conflicts except if they have been mounted."})}),"\n",(0,s.jsx)(i.p,{children:"This section is there to ensure that both application and passbolt configuration file are present."}),"\n",(0,s.jsx)(i.h4,{id:"application-configuration-file",children:"Application Configuration File"}),"\n",(0,s.jsx)(i.p,{children:"This file is critical for the application, if it is missing, you should do a copy of the default file."}),"\n",(0,s.jsx)(o.A,{children:"sudo cp /etc/passbolt/app.default.php /etc/passbolt/app.php"}),"\n",(0,s.jsx)(i.h4,{id:"passbolt-configuration-file",children:"Passbolt Configuration File"}),"\n",(0,s.jsx)(i.p,{children:"This is the passbolt configuration file, it is needed to ensure that passbolt have been completely configured."}),"\n",(0,s.jsx)(o.A,{children:"sudo cp /etc/passbolt/passbolt.default.php /etc/passbolt/passbolt.php"}),"\n",(0,s.jsx)(i.h3,{id:"core-config",children:"Core config"}),"\n",(0,s.jsx)(i.p,{children:"These verification are for the basic application settings, such as URL and security configurations, are properly set and operational."}),"\n",(0,s.jsx)(i.h4,{id:"debug-mode",children:"Debug mode"}),"\n",(0,s.jsxs)(i.p,{children:["We highly not recommend to use the debug mode on a prod or pre-prod environment. If you see ",(0,s.jsx)(i.strong,{children:"Debug mode is on"}),", update the configuration file in ",(0,s.jsx)(i.em,{children:"/etc/passbolt/passbolt.php"}
1)," and set debug to false, or set the ",(0,s.jsx)(i.code,{children:"DEBUG"})," environment variable to false if you are on Docker or Helm."]}),"\n",(0,s.jsx)(a.A,{src:"/img/help/2024/06/disable_debug_mode.png",caption:"fig. Disable debug mode",alt:"Disable debug mode"}),"\n",(0,s.jsx)(i.h4,{id:"cache",children:"Cache"}),"\n",(0,s.jsxs)(i.p,{children:["It verifies that the cache mechanism is working, this can help with performances issues. If the cache is somehow not working, you should consider taking a look at the settings in ",(0,s.jsx)(i.em,{children:"/etc/passbolt/app.php"})]}),"\n",(0,s.jsx)(i.h4,{id:"unique-value-for-securitysalt",children:"Unique value for security.salt"}),"\n",(0,s.jsxs)(i.p,{children:["It helps to ensure that the ",(0,s.jsx)(i.strong,{children:"security.salt"})," value used for the hash is unique and correctly configured. If you have any error you will need to edit the ",(0,s.jsx)(i.code,{children:"security.salt"})," in ",(0,s.jsx)(i.em,{children:"/etc/passbolt/app.php"}),", or set the ",(0,s.jsx)(i.code,{children:"SECURITY_SALT"})," environment variable if you are on Docker or Helm."]}),"\n",(0,s.jsx)(i.h4,{id:"full-base-url",children:"Full Base URL"}),"\n",(0,s.jsx)(i.admonition,{type:"info",children:(0,s.jsxs)(i.p,{children:["If you are on Docker or Helm, you will need to set the ",(0,s.jsx)(i.code,{children:"APP_FULL_BASE_URL"})," environment variable."]})}),"\n",(0,s.jsxs)(i.p,{children:["Helps to confirm that the fullBaseUrl is defined, if it is not defined yet, you will need to edit ",(0,s.jsx)(i.code,{children:"App.fullBaseUrl"})," in ",(0,s.jsx)(i.em,{children:"/etc/passbolt/passbolt.php"})]}),"\n",(0,s.jsx)(a.A,{src:"/img/help/2024/06/update-fullbaseurl.png",caption:"fig. Update the fullBaseUrl in the passbolt configuration file",alt:"Update the fullBaseUrl in the passbolt configuration file"}),"\n",(0,s.jsx)(i.h4,{id:"full-base-url-validation",children:"Full Base URL validation"}),"\n",(0,s.jsx)(i.p,{children:"It checks that the fullBaseUrl is correct and match the expectation, if there is any error with the validation here is the two things you might want to do:"}),"\n",(0,s.jsxs)(i.ul,{children:["\n",(0,s.jsxs)(i.li,{children:["Edit ",(0,s.jsx)(i.code,{children:"App.fullBaseUrl"})," in ",(0,s.jsx)(i.em,{children:"/etc/passbolt/passbolt.php"}),", or the ",(0,s.jsx)(i.code,{children:"APP_FULL_BASE_URL"})," environment variable if you are on Docker or Helm"]}),"\n",(0,s.jsxs)(i.li,{children:["Select a valid domain name as defined by section 2.3.1 of ",(0,s.jsx)(i.a,{href:"https://www.ietf.org/rfc/rfc1035.txt",children:"RFC 1035"})]}),"\n"]}),"\n",(0,s.jsx)(i.h4,{id:"healthcheck-status",children:"Healthcheck Status"}),"\n",(0,s.jsx)(i.p,{children:"It checks that the status url is reachable. If you have any error with this check, the good news is that this warning should not limit you for running passbolt, however, in order to get rid of this warning, you will need to ensure a few things:"}),"\n",(0,s.jsxs)(i.ul,{children:["\n",(0,s.jsxs)(i.li,{children:[(0,s.jsx)(i.code,{children:"App.fullBaseUrl"})," is correct inside ",(0,s.jsx)(i.em,{children:"/etc/passbolt/passbolt.php"})," or with the environment variable ",(0,s.jsx)(i.code,{children:"APP_FULL_BASE_URL"})," if you are on Docker or Helm."]}),"\n",(0,s.jsxs)(i.li,{children:["The server is able to ping the domain with ",(0,s.jsx)(i.code,{children:"ping YOUR_DOMAIN"})]}),"\n"]}),"\n",(0,s.jsxs)(i.p,{children:["If the server is not able to ping the domain, this might the cause of the issues, you will need to edit the ",(0,s.jsx)(i.em,{children:"/etc/hosts"})," file and add the domain resolution."]}),"\n",(0,s.jsx)(o.A,{children:"127.0.0.1 YOUR_DOMAIN"}),"\n",(0,s.jsx)(i.h3,{id:"tls-certificate",children:"TLS Certificate"}),"\n",(0,s.jsx)(i.p,{children:"These checks verify that the TLS certificate is valid and correctly configured to secure communications."}),"\n",(0,s.jsx)(i.h4,{id:"peer-certificate",children:"Peer certificate"}),"\n",(0,s.jsx)(i.p,{children:"This check helps to ensure that the certificate is still valid, if this check is failing there is three potential reasons:"}),"\n",(0,s.jsxs)(i.ul,{children:["\n",(0,s.jsx)(i.li,{children:"The certificate is expired"}),"\n",(0,s.jsx)(i.li,{children:"It's a self-signed certificate that is not trusted on the server."}),"\n",(0,s.jsx)(i.li,{children:"It's a wildcard certificate"}),"\n"]}),"\n",(0,s.jsx)(i.p,{children:"Since the certificate is not val
1idating the hostname when using a wildcard, we are throwing an error but if you are confident with the certificate and your configuration, you can consider this as a false negative."}),"\n",(0,s.jsx)(i.admonition,{type:"info",children:(0,s.jsx)(i.p,{children:"The location of the trusted certificated depends on the distribution, for this example it uses Debian."})}),"\n",(0,s.jsxs)(i.p,{children:["In order to trust the certificate on the server, you will need to create a ",(0,s.jsx)(i.code,{children:"cert.crt"})," file which contain the chain of trust of the certificate (more information in ",(0,s.jsx)(i.a,{href:"/hosting/tls/troubleshooting/",children:"TLS troubleshooting"}),") and move this file in ",(0,s.jsx)(i.em,{children:"/usr/share/ca-certificates"})]}),"\n",(0,s.jsx)(o.A,{children:"sudo cp cert.crt /usr/share/ca-certificates/cert.crt\nsudo dpkg-reconfigure ca-certificates"}),"\n",(0,s.jsxs)(i.p,{children:["Then you will see three options, we recommend choosing ",(0,s.jsx)(i.strong,{children:"ask"})," and manually approve the imported certificate."]}),"\n",(0,s.jsxs)(i.p,{children:["The domain resolution should be also completed in ",(0,s.jsx)(i.em,{children:"/etc/hosts/"})," file"]}),"\n",(0,s.jsx)(o.A,{children:"127.0.0.1 YOUR_DOMAIN"}),"\n",(0,s.jsx)(i.h4,{id:"hostname",children:"Hostname"}),"\n",(0,s.jsxs)(i.p,{children:["It verifies that the hostname from the certificate match ",(0,s.jsx)(i.code,{children:"App.fullBaseUrl"})," in ",(0,s.jsx)(i.em,{children:"/etc/passbolt/passbolt.php"})," or the environment variable ",(0,s.jsx)(i.code,{children:"APP_FULL_BASE_URL"})]}),"\n",(0,s.jsx)(i.h4,{id:"self-signed-certificate-check",children:"Self-signed certificate check"}),"\n",(0,s.jsx)(i.p,{children:"It helps to identify if you are using a self-signed certificate or not, this is likely a warning and should not be considered as a failure if you are confident with your certificate configuration."}),"\n",(0,s.jsx)(i.h3,{id:"database",children:"Database"}),"\n",(0,s.jsx)(i.p,{children:"The database checks ensure that the application can connect to the database and that the necessary tables and default content are present."}),"\n",(0,s.jsx)(i.h4,{id:"connection-to-the-database",children:"Connection to the database"}),"\n",(0,s.jsx)(i.admonition,{title:"PRO TIP",type:"tip",children:(0,s.jsxs)(i.p,{children:["If you are on Docker or Helm, you might want to double-check the values for ",(0,s.jsx)(i.code,{children:"DATASOURCES_DEFAULT_*"}),". More information in the ",(0,s.jsx)(i.a,{href:"/hosting/environment-reference/",children:"environment variables reference"})]})}),"\n",(0,s.jsx)(i.p,{children:"It helps to ensure that the application is able to connect to the database. If you encounter some issues with this check, there is a few potentials reasons:"}),"\n",(0,s.jsxs)(i.ul,{children:["\n",(0,s.jsxs)(i.li,{children:["Ensure that the driver defined for ",(0,s.jsx)(i.code,{children:"Datasources.default.driver"})," in ",(0,s.jsx)(i.em,{children:"/etc/passbolt/passbolt.php"}),", or with the ",(0,s.jsx)(i.code,{children:"DATASOURCES_DEFAULT_DRIVER"})," environment variable on Docker or Helm, is one of the following:","\n",(0,s.jsxs)(i.ul,{children:["\n",(0,s.jsx)(i.li,{children:"'Cake\\Database\\Driver\\Mysql'"}),"\n",(0,s.jsx)(i.li,{children:"'Cake\\Database\\Driver\\Postgres'"}),"\n"]}),"\n"]}),"\n",(0,s.jsxs)(i.li,{children:["Double-check that the database credentials for ",(0,s.jsx)(i.code,{children:"Datasources.default"})," in ",(0,s.jsx)(i.em,{children:"/etc/passbolt/passbolt.php"})]}),"\n",(0,s.jsx)(i.li,{children:"Make sure that the database exists and is accessible for the given database user"}),"\n",(0,s.jsx)(i.li,{children:"Make sure that the database is reachable from the server"}),"\n"]}),"\n",(0,s.jsx)(a.A,{src:"/img/help/2024/06/database-credentials.png",caption:"fig. Database credentials configuration",alt:"Database credentials configuration"}),"\n",(0,s.jsx)(i.h4,{id:"numbers-of-table",children:"Numbers of table"}),"\n",(0,s.jsx)(i.p,{children:"It checks that the necessary tables exists in the database. If there is any error with this checks, you should run the installation scripts to install the database tables."}),"\n",(0,s.jsx)(g,{}),"\n",(0,s.jsx)(w,{}),"\n",(0,s.jsx)(i.h4,{id:"default-content",children:"Default content"}),"\n",(0,s.jsx)(i.p,{children:"Ensure that default content are present in the database. If there is any error, you should consider running the installation script ot install the database tables."}),"\n",(0,s.jsx)(g,{}),"\n",(0,s.jsx)(w,{}),"\n",(0,s.jsx)(i.h4,{id:"mariadbmysql-version-deprecation",children:"MariaDB/MySQL version deprecation"}),"\n",(0,s.jsx)(i.p,{children:"Since version 5.9.0, this warning-level check reports when the database engine runs a version passbolt plans to stop supporting: it warns below MariaDB 10.6 or MySQL 8.0. Plan a database engine upgrade to clear the warning."}),"\n",(0,s.jsx)(i.h3,{id:"gpg-configuration",children:"GPG Configuration"}),"\n",(0,s.jsx)(i.p,{children:"These checks helps to confirm the correct setup and functionality of GPG keys used for encrypting and signing messages. This is critical for Passbolt to work properly."}),"\n",(0,s.jsx)(i.h4,{id:"gpg-module",children:"GPG Module"}),"\n",(0,s.jsx)(i.p,{children:"It ensure that the GPG module for PHP is installed and loaded, if it is not the case and you are seeing an error there is two things to be considered."}),"\n",(0,s.jsxs)(i.ul,{children:["\n",(0,s.jsxs)(i.li,{children:["Install ",(0,s.jsx)(i.a,{href:"https://php.net/manual/en/gnupg.installation.php",children:"php-gnupg"})]}),"\n",(0,s.jsxs)(i.li,{children:["Make sure to add ",(0,s.jsx)(i.co
1de,{children:"extension=gnupg"})," in the ",(0,s.jsx)(i.em,{children:"/path/to/php.ini"})," configuration files for both php-cli and php."]}),"\n"]}),"\n",(0,s.jsx)(a.A,{src:"/img/help/2024/06/add-gnupg-to-php.png",caption:"fig. Add the gnupg extension to php.ini",alt:"Add the gnupg extension to php.ini"}),"\n",(0,s.jsx)(i.h4,{id:"gnupghome",children:"GNUPGHOME"}),"\n",(0,s.jsx)(i.p,{children:"This check helps to verify that the variable GNUPGHOME is set and point to the right directory. If you have any errors, you should ensure the keyring location exists and is accessible by the webserver user."}),"\n",(0,s.jsx)(b,{}),"\n",(0,s.jsx)(o.A,{children:"sudo mkdir -p /var/lib/passbolt/.gnupg\nsudo chown -R www-data:www-data /var/lib/passbolt/.gnupg\nsudo chmod 700 /var/lib/passbolt/.gnupg"}),"\n",(0,s.jsxs)(i.p,{children:["You can also change the location of the keyring by editing the ",(0,s.jsx)(i.code,{children:"GPG.env.setenv"})," and ",(0,s.jsx)(i.code,{children:"GPG.env.home"})," variable in ",(0,s.jsx)(i.em,{children:"/etc/passbolt/passbolt.php"}),", or with the ",(0,s.jsx)(i.code,{children:"GNUPGHOME"})," environment variable if you are on Docker or Helm."]}),"\n",(0,s.jsx)(i.h4,{id:"gpg-keyring",children:"GPG Keyring"}),"\n",(0,s.jsx)(i.p,{children:"It helps to ensure that the keyring is writable by the webserver, if you face any error please consider running these commands"}),"\n",(0,s.jsx)(b,{}),"\n",(0,s.jsx)(o.A,{children:"sudo mkdir -p /var/lib/passbolt/.gnupg\nsudo chown -R www-data:www-data /var/lib/passbolt/.gnupg\nsudo chmod 700 /var/lib/passbolt/.gnupg"}),"\n",(0,s.jsx)(i.h4,{id:"server-public-key",children:"Server Public Key"}),"\n",(0,s.jsx)(i.p,{children:"It helps to ensure that the server public key is defined and readable. If you face any error there is few potentials things to do:"}),"\n",(0,s.jsxs)(i.ul,{children:["\n",(0,s.jsxs)(i.li,{children:["Ensure the public key file is defined by the variable ",(0,s.jsx)(i.code,{children:"passbolt.gpg.serverKey.public"})," in ",(0,s.jsx)(i.em,{children:"/etc/passbolt/passbolt.php"}),", or by the ",(0,s.jsx)(i.code,{children:"PASSBOLT_GPG_SERVER_KEY_PUBLIC"})," environment variable if you are on Docker or Helm."]}),"\n",(0,s.jsx)(i.li,{children:"Ensure there is a public key armored block in the key file."}),"\n",(0,s.jsxs)(i.li,{children:["Ensure the public key defined in ",(0,s.jsx)(i.em,{children:"/etc/passbolt/passbolt.php"})," exists and is accessible by the webserver user."]}),"\n"]}),"\n",(0,s.jsx)(a.A,{src:"/img/help/2024/06/serverkeys.png",caption:"fig. Ensure the public key is defined",alt:"Ensure the public key is defined"}),"\n",(0,s.jsx)(i.h4,{id:"server-private-key",children:"Server Private Key"}),"\n",(0,s.jsx)(i.p,{children:"It helps to ensure that the server private key is defined and readable. If you face any error there is few potentials things to do:"}),"\n",(0,s.jsxs)(i.ul,{children:["\n",(0,s.jsxs)(i.li,{children:["Ensure the private key file is defined by the variable ",(0,s.jsx)(i.code,{children:"passbolt.gpg.serverKey.private"})," in ",(0,s.jsx)(i.em,{children:"/etc/passbolt/passbolt.php"}),", or by the ",(0,s.jsx)(i.code,{children:"PASSBOLT_GPG_SERVER_KEY_PRIVATE"})," environment variable if you are on Docker or Helm."]}),"\n",(0,s.jsx)(i.li,{children:"Ensure there is a private key armored block in the key file."}),"\n",(0,s.jsxs)(i.li,{children:["Ensure the private key defined in ",(0,s.jsx)(i.em,{children:"/etc/passbolt/passbolt.php"})," exists and is accessible by the webserver user."]}),"\n"]}),"\n",(0,s.jsx)(a.A,{src:"/img/help/2024/06/serverkeys.png",caption:"fig. Ensure the private key is defined",alt:"Ensure the private key is defined"}),"\n",(0,s.jsx)(i.h4,{id:"server-key-fingerprint",children:"Server Key Fingerprint"}),"\n",(0,s.jsx)(i.p,{children:"It checks that the fingerprint from the server key match the one defined in the configuration file or environment variable. If you face any errors double-check the key fingerprint."}),"\n",(0,s.jsx)(b,{}),"\n",(0,s.jsx)(o.A,{children:'sudo su -s /bin/bash -c "gpg --list-keys --fingerprint --home /var/lib/passbolt/.gnupg" www-data | grep -i -B 2 SERVER_KEY_EMAIL'}
1),"\n",(0,s.jsxs)(i.p,{children:["Replace ",(0,s.jsx)(i.code,{children:"SERVER_KEY_EMAIL"})," with the email you've used when you generated the server key."]}),"\n",(0,s.jsx)(i.h4,{id:"server-key-in-the-keyring",children:"Server key in the keyring"}),"\n",(0,s.jsx)(i.p,{children:"It checks that the server public key is present in the keyring. If it is not in the keyring, you should import the private server key in the keyring of the webserver user."}),"\n",(0,s.jsx)(b,{}),"\n",(0,s.jsx)(o.A,{children:'sudo su -s /bin/bash -c "gpg --home /var/lib/passbolt/.gnupg --import /etc/passbolt/gpg/serverkey_private.asc" www-data'}),"\n",(0,s.jsx)(i.h4,{id:"server-email-id",children:"Server Email Id"}),"\n",(0,s.jsxs)(i.p,{children:["This will ensure that the ",(0,s.jsx)(i.code,{children:"emailId"})," related to the server keys is valid, if there is an error please edit or generate another key with a valid ",(0,s.jsx)(i.code,{children:"emailId"}),"."]}),"\n",(0,s.jsx)(i.h4,{id:"encryption-check-for-public-key",children:"Encryption check for Public Key"}),"\n",(0,s.jsx)(i.p,{children:"Checks that the server public key can be used to encrypt a message, if there is any issues with this check there is multiple things to consider:"}),"\n",(0,s.jsxs)(i.ul,{children:["\n",(0,s.jsx)(i.li,{children:"Make sure that the server private key is valid and that there is no passphrase."}),"\n",(0,s.jsx)(i.li,{children:"Make sure you imported the private server key in the keyring of the webserver user."}),"\n"]}),"\n",(0,s.jsx)(g,{}),"\n",(0,s.jsx)(o.A,{children:'sudo su -s /bin/bash -c "gpg --home /var/lib/passbolt/.gnupg --import /etc/passbolt/gpg/serverkey_private.asc" www-data'}),"\n",(0,s.jsx)(i.h4,{id:"signing-check-for-public-key",children:"Signing check for Public Key"}),"\n",(0,s.jsx)(i.p,{children:"This check help to ensure that the server public key can be used to sign a message, if there is any issues with this check there is multiple things to consider:"}),"\n",(0,s.jsxs)(i.ul,{children:["\n",(0,s.jsx)(i.li,{children:"Make sure that the server public key is valid and that there is no passphrase."}),"\n",(0,s.jsx)(i.li,{children:"Make sure you imported the public server key in the keyring of the webserver user."}),"\n"]}),"\n",(0,s.jsx)(g,{}),"\n",(0,s.jsx)(o.A,{children:'sudo su -s /bin/bash -c "gpg --home /var/lib/passbolt/.gnupg --import /etc/passbolt/gpg/serverkey.asc" www-data'}),"\n",(0,s.jsx)(i.h4,{id:"encryption-and-signing-check-for-private-and-public-keys",children:"Encryption and signing check for Private and Public Keys"}),"\n",(0,s.jsx)(x,{}),"\n",(0,s.jsx)(i.p,{children:"It helps to ensure that both the private key and the public key can be used to encrypt and sign a message, if there is any error with this you might consider generate new keys."}),"\n",(0,s.jsx)(i.h4,{id:"decryption-and-verification-for-private-key",children:"Decryption and verification for Private Key"}),"\n",(0,s.jsx)(x,{}),"\n",(0,s.jsx)(i.p,{children:"It helps to ensure that the private key can be used to decrypt and verify a message, if there is any error with this you might consider generate new keys."}),"\n",(0,s.jsx)(i.h4,{id:"verification-for-public-key",children:"Verification for Public Key"}),"\n",(0,s.jsx)(x,{}),"\n",(0,s.jsx)(i.p,{children:"It helps to ensure that the public key can be used to verify a message, if there is any error with this you might consider generate new keys."}),"\n",(0,s.jsx)(i.h4,{id:"gopengpg-compatibility-for-public-key",children:"Gopengpg compatibility for Public Key"}),"\n",(0,s.jsx)(i.p,{children:"It ensures that the public server key format is compatible with Gopengpg, errors are usually related to the format. Remove all empty new lines above the end block line"}),"\n",(0,s.jsx)(a.A,{src:"/img/help/2024/06/end_pgp_public.png",caption:"fig. Remove above end of public key block line",alt:"Remove above end of public key block line"}),"\n",(0,s.jsx)(i.h4,{id:"gopengpg-compatibility-for-private-key",children:"Gopengpg compatibility for Private Key"}),"\n",(0,s.jsx)(i.p,{children:"Ensure that the private server key format is compatible with Gopengpg, errors are usually related to the format. Remove all empty new lines above the end block line"}),"\n",(0,s.jsx)(a.A,{src:"/img/help/2024/06/end_pgp_private.png",caption:"fig. Remove above end of private key block line",alt:"Remove above end of private key block line"}),"\n",(0,s.jsx)(i.h3,{id:"application-configuration",children:"Application configuration"}),"\n",(0,s.jsx)(i.p,{children:"These verifications validate various application settings, including SSL enforcement, versioning, and plugin configurations."}),"\n",(0,s.jsx)(i.h4,{id:"passbolt-version",children:"Passbolt version"}),"\n",(0,s.jsx)(i.p,{children:"It helps to identify which version are running and if it is the latest version. You could face some errors while having an updated version if the server is in an air gap environment and it could not connect to the passbolt repository to check versions."}),"\n",(0,s.jsxs)(i.p,{children:["If the server is not up-to-date, unless you have an internal good reason, please consider ",(0,s.jsx)(i.a,{href:"/hosting/update/",children:"updating"})," to the latest version."]}),"\n",(0,s.jsx)(i.h4,{id:"database-schema",children:"Database schema"}),"\n",(0,s.jsx)(i.p,{children:'It checks that no database migration is pending. On failure, it reports "The database schema is not up to date." together with the command to run:'}),"\n",(0,s.jsx)(o.A,{children:'sudo su -s /bin/bash -c "/usr/share/php/passbolt/bin/cake migrations migrate --no-lock" www-data'}),"\n",(0,s.jsx)(d,{}),"\n",(0,s.jsxs)(i.p,{children:["If the pending migrations come from a partially applied update, follow the ",(0,s.jsx)(i.a,{href:"/hosting/update/",children:"update guide"}),"."]}),"\n",(0,s.jsx)(i.h4,{id:"force-tls-ssl",children:"Force TLS (SSL)"}),"\n",(0,s.jsxs)(i.p,{children:["We recommend using TLS (SSL) with passbolt, this checks verify if passbolt has been configured to force TLS (SSL). If you have this error, you will need to set ",(0,s.jsx)(i.co
1de,{children:"passbolt.ssl.force"})," to true in ",(0,s.jsx)(i.em,{children:"/etc/passbolt/passbolt.php"}),", or the ",(0,s.jsx)(i.code,{children:"PASSBOLT_SSL_FORCE"})," environment variable to true if you are on Docker or Helm."]}),"\n",(0,s.jsx)(a.A,{src:"/img/help/2024/06/force-ssl.png",caption:"fig. Add forcing TLS (SSL) to the passbolt configuration file",alt:"Add forcing TLS (SSL) to the passbolt configuration file"}),"\n",(0,s.jsx)(i.h4,{id:"full-base-url-https",children:"Full Base URL HTTPS"}),"\n",(0,s.jsxs)(i.p,{children:["This is verifying if Passbolt is running in HTTPS. If you have an issues and think it is an error please consider checking ",(0,s.jsx)(i.code,{children:"App.fullBaseUrl"})," scheme in ",(0,s.jsx)(i.em,{children:"/etc/passbolt/passbolt.php"})," or the environment variable set for ",(0,s.jsx)(i.code,{children:"APP_FULL_BASE_URL"})," if you are on Docker or Helm."]}),"\n",(0,s.jsx)(i.h4,{id:"selenium-api-endpoints",children:"Selenium API endpoints"}),"\n",(0,s.jsxs)(i.p,{children:["Selenium API endpoints are disabled by default and should remain disabled. This setting should be used for testing only. If you have it enabled, you should set ",(0,s.jsx)(i.code,{children:"passbolt.selenium.active"})," to false in ",(0,s.jsx)(i.em,{children:"/etc/passbolt/passbolt.php"}),"."]}),"\n",(0,s.jsx)(a.A,{src:"/img/help/2024/06/disable-selenium-endpoints.png",caption:"fig. Disable Selenium API endpoints",alt:"Disable Selenium API endpoints"}),"\n",(0,s.jsx)(i.h4,{id:"search-engine-robots",children:"Search engine robots"}),"\n",(0,s.jsxs)(i.p,{children:["Ensure that the search engine robots are configured to not index the content, if it is not the case, set ",(0,s.jsx)(i.code,{children:"passbolt.meta.robots"})," to false in ",(0,s.jsx)(i.em,{children:"/etc/passbolt/passbolt.php"}),", or the ",(0,s.jsx)(i.code,{children:"PASSBOLT_META_ROBOTS"})," environment variable if you are on Docker or Helm."]}),"\n",(0,s.jsx)(a.A,{src:"/img/help/2024/06/search-engine-robots.png",caption:"fig. Disable Search Engine Robots",alt:"Disable Search Engine Robots"}),"\n",(0,s.jsx)(i.h4,{id:"self-registration-plugin",children:"Self Registration Plugin"}),"\n",(0,s.jsxs)(i.p,{children:["Enabled by default, it check if the self registration plugin is enabled as expected. You can disable the plugin in ",(0,s.jsx)(i.em,{children:"/etc/passbolt/passbolt.php"})," through ",(0,s.jsx)(i.code,{children:"passbolt.plugins.selfRegistration.enabled"})," and set it to false, or with the ",(0,s.jsx)(i.code,{children:"PASSBOLT_PLUGINS_SELF_REGISTRATION_ENABLED"})," environment variable if you are on Docker or Helm."]}),"\n",(0,s.jsx)(a.A,{src:"/img/help/2024/06/disable-self-registration-plugin.png",caption:"fig. Disable Self Registration Plugin",alt:"Disable Self Registration Plugin"}),"\n",(0,s.jsx)(i.h4,{id:"registration-closed",children:"Registration Closed"}),"\n",(0,s.jsxs)(i.p,{children:["This check is following the self registration plugin. It checks if the open registration is closed and only the admins are allowed to create users or if the self registration plugin is enabled and it has been configured in the user interface through ",(0,s.jsx)(i.em,{children:"Administration > Self registration"}),". You should be able to see which self registration provider is set."]}),"\n",(0,s.jsx)(i.h4,{id:"deprecated-self-registration-public-settings",children:"Deprecated self registration public settings"}),"\n",(0,s.jsxs)(i.p,{children:["This check ensure that the self registration public settings are not present in the passbolt configuration file in ",(0,s.jsx)(i.em,{children:"/etc/passbolt/passbolt.php"}),", if it is still there you may remove the ",(0,s.jsx)(i.code,{children:"passbolt.registration.public"})," settings."]}),"\n",(0,s.jsx)(i.h4,{id:"host-availability",children:"Host availability"}),"\n",(0,s.jsxs)(i.p,{children:["The passbolt server will verify the email domain names. This means that passbolt will query DNS for an MX record associated with the email addresses used. ",(0,s.jsx)(i.strong,{children:"This is disabled by default"}),"."]}),"\n",(0,s.jsx)(i.p,{children:"When it is enabled, it won't be possible to proceed to a user creation using a local email address, if you are confident about using trusted email domain addresses, you may want to enable it."}),"\n",(0,s.jsxs)(i.ul,{children:["\n",(0,s.jsxs)(i.li,{children:["Set ",(0,s.jsx)(i.co
1de,{children:"PASSBOLT_EMAIL_VALIDATE_MX"})," environment variable to true if you are on Docker or Helm"]}),"\n",(0,s.jsxs)(i.li,{children:["Set ",(0,s.jsx)(i.code,{children:"passbolt.email.validate.mx"})," to true in ",(0,s.jsx)(i.em,{children:"/etc/passbolt/passbolt.php"})]}),"\n"]}),"\n",(0,s.jsx)(a.A,{src:"/img/help/2024/06/host_availability.png",caption:"fig. Enable host availability",alt:"Enable host availability"}),"\n",(0,s.jsx)(i.h4,{id:"compiled-version-of-the-javascript-application",children:"Compiled version of the javascript application"}),"\n",(0,s.jsxs)(i.p,{children:["It will ensure that the compiled version of the application is served, you should not face any errors, however if there is any, you should set ",(0,s.jsx)(i.code,{children:"passbolt.js.build"})," to production in ",(0,s.jsx)(i.em,{children:"/etc/passbolt/passbolt.php"}),", or with the ",(0,s.jsx)(i.code,{children:"PASSBOLT_JS_BUILD"})," environment variable if you are on Docker or Helm, otherwise passbolt will be slower."]}),"\n",(0,s.jsx)(a.A,{src:"/img/help/2024/06/serve_js_app.png",caption:"fig. Serve compiled version of javascript",alt:"Serve compiled version of javascript"}),"\n",(0,s.jsx)(i.h4,{id:"email-notifications",children:"Email notifications"}),"\n",(0,s.jsxs)(i.p,{children:["It checks if some email notifications are disabled by the administrator, this just there as a warning. ",(0,s.jsx)(i.strong,{children:"This is usually a good practice to monitor the email notifications"}),"."]}),"\n",(0,s.jsx)(i.h3,{id:"smtp-settings",children:"SMTP Settings"}),"\n",(0,s.jsx)(i.p,{children:"These SMTP settings checks ensure that the configuration is working for sending emails are correctly configured and operational."}),"\n",(0,s.jsx)(i.h4,{id:"smtp-settings-plugin",children:"SMTP Settings Plugin"}),"\n",(0,s.jsxs)(i.p,{children:["Ensure that the SMTP plugin is enabled. It is enabled by default in order to configure the SMTP settings through the user interface in ",(0,s.jsx)(i.em,{children:"Administration > Email server"}),"."]}),"\n",(0,s.jsx)(i.h4,{id:"smtp-settings-configuration",children:"SMTP Settings Configuration"}),"\n",(0,s.jsx)(i.p,{children:"This check helps to ensure that the SMTP settings are coherent. If there is any error, it will be displayed."}),"\n",(0,s.jsx)(i.h4,{id:"smtp-settings-source",children:"SMTP Settings Source"}),"\n",(0,s.jsxs)(i.p,{children:["Display which SMTP settings source are used, e.g. through the configuration file in ",(0,s.jsx)(i.em,{children:"/etc/passbolt/passbolt.php"}),", environment variables if you are on Docker or Helm or through the interface which is the database. It should be using ",(0,s.jsx)(i.strong,{children:"database"})," by default."]}),"\n",(0,s.jsx)(i.h4,{id:"smtp-settings-endpoints",children:"SMTP Settings endpoints"}),"\n",(0,s.jsxs)(i.p,{children:["It helps to verify that the SMTP plugins endpoints are enabled, this is needed in order to configure the SMTP settings through the user interface, ",(0,s.jsx)(i.strong,{children:"this is enabled by default"}),"."]}),"\n",(0,s.jsx)(i.h3,{id:"directory-sync",children:"Directory Sync"}),"\n",(0,s.jsx)(i.p,{children:"It verifies that the endpoints for synchronising user directory configurations are enabled and functioning."}),"\n",(0,s.jsxs)(i.p,{children:["This is needed in order to configure LDAP through the user interface in ",(0,s.jsx)(i.em,{children:"Administration > Users Directory"})," instead of using ",(0,s.jsx)(i.em,{children:"/etc/passbolt/ldap.php"})," which is only recommended if you are using multiple LDAP servers to synchronise the trees structure."]}),"\n",(0,s.jsxs)(i.p,{children:["If you are not using LDAP with Passbolt, you can disable this plugin through ",(0,s.jsx)(i.em,{children:"/etc/passbolt/passbolt.php"})," with ",(0,s.jsx)(i.code,{children:"passbolt.security.directorySync.endpointsDisabled"})," or with the environment variable ",(0,s.jsx)(i.code,{children:"PASSBOLT_SECURITY_DIRECTORY_SYNC_ENDPOINTS_DISABLED"})," if you are on Docker or Helm."]}),"\n",(0,s.jsx)(a.A,{src:"/img/help/2024/06/disable_ldap.png",caption:"fig. Disable LDAP Plugin",alt:"Disable LDAP Plugin"}),"\n",(0,s.jsx)(i.h3,{id:"sso",children:"SSO"}),"\n",(0,s.jsx)(i.p,{children:"This help with the TLS (SSL) certification validation for the Single Sign-On (SSO) instance is enabled and properly configured. There is a few things to consider if you are manually disabling it."}),"\n",(0,s.jsxs)(i.ul,{children:["\n",(0,s.jsxs)(i.li,{children:["Disabling the TLS (SSL) verification check can lead to security attacks.","\n",(0,s.jsxs)(i.ul,{children:["\n",(0,s.jsx)(i.li,{children:"Attacker can alter the certificate and can perform man-in-the-middle attack."}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,s.jsxs)(i.p,{children:["If you want to fix this, set ",(0,s.jsx)(i.co
1de,{children:"PASSBOLT_SECURITY_SSO_SSL_VERIFY"})," environment variable to true if you are on Docker or Helm or set ",(0,s.jsx)(i.code,{children:"passbolt.security.sso.sslVerify"})," to true in ",(0,s.jsx)(i.em,{children:"/etc/passbolt/passbolt.php"}),"."]}),"\n",(0,s.jsx)(a.A,{src:"/img/help/2024/06/enable_sso_cert_validation.png",caption:"fig. Enable TLS (SSL) certificate validation for SSO",alt:"Enable TLS (SSL) certificate validation for SSO"}),"\n",(0,s.jsx)(i.h3,{id:"jwt-authentication",children:"JWT Authentication"}),"\n",(0,s.jsx)(i.p,{children:"These checks verify the JWT authentication setup, which is required for the mobile and desktop apps and the JWT API."}),"\n",(0,s.jsx)(i.h4,{id:"jwt-authentication-plugin",children:"JWT Authentication plugin"}),"\n",(0,s.jsx)(i.p,{children:'This warning-level check verifies that the JWT Authentication plugin is enabled. A disabled plugin is reported as "The JWT Authentication plugin is disabled."'}),"\n",(0,s.jsx)(i.h4,{id:"jwt-directory-not-writable",children:"JWT directory not writable"}),"\n",(0,s.jsxs)(i.p,{children:["The ",(0,s.jsx)(i.em,{children:"/etc/passbolt/jwt/"}),' directory must not be writable by the webserver user. The check fails with "The /etc/passbolt/jwt/ directory should not be writable." Fix the permissions:']}),"\n",(0,s.jsx)(d,{}),"\n",(0,s.jsx)(o.A,{children:"sudo chown -Rf root:www-data /etc/passbolt/jwt/\nsudo chmod 750 /etc/passbolt/jwt/\nsudo chmod 640 /etc/passbolt/jwt/jwt.key\nsudo chmod 640 /etc/passbolt/jwt/jwt.pem"}),"\n",(0,s.jsx)(i.h4,{id:"valid-jwt-key-pair",children:"Valid JWT key pair"}),"\n",(0,s.jsx)(i.p,{children:'It ensures that a valid JWT key pair is present, otherwise the check fails with "A valid JWT key pair is missing." Create the key pair:'}),"\n",(0,s.jsx)(o.A,{children:'sudo su -s /bin/bash -c "/usr/share/php/passbolt/bin/cake passbolt create_jwt_keys" www-data'}),"\n",(0,s.jsxs)(i.p,{children:["See the ",(0,s.jsx)(i.a,{href:"/hosting/openpgp/generate-keys-jwt/",children:"JWT key pair generation guide"})," for the full procedure."]}),"\n",(0,s.jsx)(i.h3,{id:"metadata",children:"Metadata"}),"\n",(0,s.jsx)(i.p,{children:"These checks verify the encrypted metadata keys used by the v5 resource format. The active metadata key, server access and key validity checks were introduced in version 5.4.0. The decryption check is older, version 4.10.0, where it was added as preparatory work before v5 metadata became generally available, and the zero-knowledge check was added in version 5.7.0."}),"\n",(0,s.jsx)(i.admonition,{type:"note",children:(0,s.jsx)(i.p,{children:"An instance that does not use v5 metadata still reports most of these checks, and it reports them as passing rather than as skipped. The active metadata key, decryption and validity checks each display a green line, and the server access check has no v5 condition at all, so it runs whatever metadata format is in use. Only the zero-knowledge check is reported as skipped."})}),"\n",(0,s.jsx)(i.h4,{id:"active-metadata-key",children:"Active metadata key"}),"\n",(0,s.jsxs)(i.p,{children:['At least one active metadata key must exist, otherwise the check fails with "No active metadata key found." Create or activate a metadata key from the ',(0,s.jsx)(i.a,{href:"/admin/resource-types/metadata-key/",children:"encrypted metadata administration"}),"."]}),"\n",(0,s.jsx)(i.h4,{id:"server-access-to-the-metadata-key",children:"Server access to the metadata key"}),"\n",(0,s.jsx)(i.p,{children:'When zero-knowledge mode is off, the server must hold a copy of the metadata private key, otherwise it cannot share it with users. The check fails with "The server does not have access to metadata key."'}),"\n",(0,s.jsx)(i.h4,{id:"server-metadata-private-key-decryption",children:"Server metadata private key decryption"}),"\n",(0,s.jsx)(i.p,{children:'The server copy of the metadata private key must be decryptable with the server GPG key, otherwise the check fails with "Unable to decrypt the metadata private key." A classic cause is a server GPG key that was changed or rotated after the metadata key was shared.'}),"\n",(0,s.jsx)(i.h4,{id:"server-metadata-private-key-validity",children:"Server metadata private key validity"}),"\n",(0,s.jsx)(i.p,{children:'The decrypted key must also be structurally valid, otherwise the check fails with "The server metadata private key is not val
1id."'}),"\n",(0,s.jsx)(i.p,{children:"For the access, decryption and validity checks alike, the remedy is an administrator sharing the metadata key with the server again, from an administrator's client: the server cannot grant itself access."}),"\n",(0,s.jsx)(i.h4,{id:"zero-knowledge-mode",children:"Zero-knowledge mode"}),"\n",(0,s.jsx)(i.p,{children:'The reverse check: when zero-knowledge mode is enabled, the server must not have access to the metadata private key. The check fails with "The server has access to the server metadata private key while in Zero-knowledge mode." Remove the server access, or disable zero-knowledge mode if it is not intended.'}),"\n",(0,s.jsxs)(i.p,{children:["Zero-knowledge mode also changes the four checks above: all four are skipped once it is enabled. This check is skipped when v5 metadata is disabled, and skipped again when zero-knowledge sharing is disabled, so it appears in the report only when both are enabled. See the ",(0,s.jsx)(i.a,{href:"/admin/resource-types/encrypted-metadata/",children:"encrypted metadata documentation"}),"."]})]})}function _(e={}){const{wrapper:i}={...(0,r.R)(),...e.components};return i?(0,s.jsx)(i,{...e,children:(0,s.jsx)(I,{...e})}):I(e)}},25515(e,i,t){t.d(i,{A:()=>d});var n=t(28774),s=t(5556),r=t.n(s);const a="chips_cpy_",o="link_WvDp",l="under-main-menu_SavF";var c=t(74848);const h=({children:e,link:i="",isUnderMainTitle:t=!1})=>{if(!e)return null;const s=i.length>0;return(0,c.jsx)("div",{className:`${t?l:""}`,children:s?(0,c.jsx)(n.A,{className:`${a} ${o}`,to:i,target:"_blank",children:e}):(0,c.jsx)("span",{className:a,children:e})})};h.propTypes={children:r().oneOfType([r().arrayOf(r().node),r().node]).isRequired,isUnderMainTitle:r().bool,link:r().string};const d=h},42987(e,i,t){t.d(i,{A:()=>c});var n=t(86025),s=t(5556),r=t.n(s);const a="root_Qk78";var o=t(74848);const l=({src:e,alt:i,caption:t=null,size:s={}})=>{const r=(0,n.Ay)(e),l=s.width||s.height?{width:s.width,height:s.height}:{};return(0,o.jsxs)("figure",{className:a,children:[(0,o.jsx)("img",{src:r,alt:i,style:l}),t&&(0,o.jsx)("figcaption",{children:t})]})};l.propTypes={src:r().string.isRequired,alt:r().string.isRequired,caption:r().string,size:r().shape({width:r().oneOfType([r().string,r().number]),height:r().oneOfType([r().string,r().number])})};const c=l}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.