Making Jira available publicly, what should I do to secure it?

Mac_Attack

I want to expose JIRA to the internet, What steps should I take to properly secure it? I have it running on the same machine as confluence with a reverse proxy using nginx A request to JIRA from the internet would pas through to reverse proxies. I was going to add a DNS record to redirect mydomain/JIRA to a high numbered port and have nginx proxy that to the machine running JIRA and morph the url to jira.mydomain.

 

Auth for JIRA is through my AD as well.

Nic Brough -Adaptavist-

Not an exhaustive list, but off the top of my head

• Make sure you're on https, there's no question of that. 
• If you allow sign-up, make sure you have "captcha" enabled (it's a compromised system, but still enough to dissuade a lot of simple attacks)
• Check all your permission schemes for the use of the group "anyone", make sure it's appropriate, and never used for anything other than "browse project" (or you will be spammed)