Best practices

Not everything in this guide will be applicable to your environment, but the principles described can be adapted to most environments.

It's worth noting that none of these practices can provide 100% security. They are measures to reduce impact and to slow down an intruder in case your system does become compromised.

Subscribe to advisory alerts

Subscribe to advisory alerts and keep technical contact details up to date to make sure you receive security advisory alerts and other important technical updates. 

Atlassian email and privacy preferences 

Secure your installation and data directories

It's important to make sure your Confluence installation directory, home directory, and any storage locations you may define for attachments, space exports, or data pipeline exports are secure. 

We strongly recommend you to:

• run Confluence with a dedicated non-root user account.
• limit the user accounts that can access any Confluence directories. 

To find out how to do this, see Creating a Dedicated User Account on the Operating System to Run Confluence. 

You should also monitor your binaries. If an attacker compromises an account on your system, they will usually try to gain access to more accounts. This is sometimes done by adding malicious code, such as by modifying files on the system. Consider how you might regularly verify that no malicious changes have been made.

Secure your database

Make sure the Confluence database user (and all datasource database users) only have the amount of database privilege they really need.

Limit database access to just the Confluence host (using iptables or built in database security tools). Refer to your database documentation to find out how to do this.

Limit access to administrator functions

As a general rule, you should keep the number of Confluence administrators as low as possible, and review these user accounts every so often to make sure the access level is still appropriate. 

• Avoid shared administrator or user accounts, and easily guessed usernames like “admin”.
    
  
• Provide administrators with two separate accounts to allow them to separate day-to-day work, such as creating pages, from administration tasks.
  
  
• Limit the number of people in the confluence-administrators group. Members of this “super group” can access all admin functions and access all content, including restricted pages. Consider limiting the members of this group and instead create a new group with system administrator global permissions. 
  Learn about the confluence-administrators super group
   
• Use secure administrator sessions to require admins to re-enter their password to access admin functions, and set a short timeout for the administrator session. 
  Learn how to turn on secure administrator sessions
   
• Use Apache to lock down the administration interface to specific IP addresses. This can be used as a template for your reverse proxy of choice.
  Using Apache to limit access to the Confluence administration interface

Limit incoming and outgoing connections

There are a number of ways you can limit incoming and outgoing connections, including using firewalls and proxy servers. 

• Use the allowlist to limit incoming and outgoing connections to avoid Server-Side Request Forgery (SSRF) attacks. Confluence relies on the allowlist for things like macros that may be displaying content from external sites. 
  Learn how to turn on the allowlist
  

Manage user accounts

Good user management practices can help prevent user accounts from being compromised. 

• Consider integrating Confluence with an identity provider for single sign-on and two-factor authentication.
  Learn about the various SSO options available
  
  

• Enable two-step verification for users. This second login step, requiring a code from a registered authenticator app, ensures that the login is secure even if the password is compromised.
  Learn how to enable two-step verification

• 
  

  Configure a strong password requirement.
  Learn how to manage password strength
  
  

• Use personal access tokens (PAT) for integrations. This provides your users with a more secure way to authenticate API requests than basic authentication (username and password)
  Learn how to manage personal access tokens
   
• Disable basic authentication. If you've configured single sign-on, you can disable basic authentication for login and REST requests. Basic authentication is less secure than single sign-on and personal access tokens. Learn how to disable basic authentication
   
• Disable user accounts when people leave your organization. If required, you can also delete user accounts which will replace their name with an anonymized ID.  
  Delete and disable users
   
• Restrict the number of users with powerful roles or group memberships. If only one department should have access to particularly sensitive data, then restrict access to the data to only those users. Do not let convenience overrule security. Do not give all staff access to sensitive data when there is no need.

Limit login attempts and monitor access and activity

There are several things you can do to reduce the risk of brute force or denial of service (DoS) attacks: 

• Fail2Ban can help you reduce the risk of brute-force attacks. 
  Using Fail2Ban to limit login attempts
   
• Use rate limiting to block REST API requests from anonymous users if you don't have a reason to allow them, or limit the number of requests to reduce the risk of DoS attacks. 
  Learn how to use rate limiting to block requests
   
• Review your audit log settings, to make sure you're logging important administrator and end user actions.
  Learn which events you can write to the audit log
   
• Access logs can help you identify unusual activity. Logs are written to the install directory, and you may want to monitor these logs using your preferred monitoring tool.  
  Learn about access logging

Perform regular security audits

Regular security audits can help you identify potential threats, and also provide an opportunity to review your security policies and procedures. 

• Know who can help if a security breach occurs. What is the process if a potential threat is identified?
   
• Perform “what if” planning exercises. Consider questions like “What is the worst thing that could happen if a privileged user's password were stolen while on vacation? What can we do to minimize damage?”.
   
• Document your security measures, and regularly monitor that all measures are still in place, and are adequate. For example, after upgrading or migrating, someone may forget to apply the rule to the new system or version. 
   
• Perform a security check-up when preparing for a major upgrade. It's a good time to compare your current configuration against our current recommendations.