DAIS - Digital Archive of the Serbian Academy of Sciences and Arts: Security

Trap — Tue, 24 Mar 2026 18:53:17 GMT

← Older revision		Revision as of 18:53, 24 March 2026
Line 13:		Line 13:

	== Technology ==		== Technology ==
	DAIS is hosted by the University of Belgrade Computer Centre (RCUB) on a virtual machine in a [https://www.proxmox.com/en/proxmox-ve Proxmox VE environment] with a [https://~~www~~.~~centos~~.~~org/ CentOS~~ operating system]. The repository database is ~~stored on~~ a [https://www.postgresql.org/docs/9.5/server-start.html PostgreSQL 9.5 ~~server~~] ~~inside a production-level virtual machine~~. Database export is ~~enabled~~.		DAIS is hosted by the University of Belgrade Computer Centre (RCUB) on a virtual machine in a [https://www.proxmox.com/en/proxmox-ve Proxmox VE environment] with a [https://releases.ubuntu.com Ubuntu SE LTS operating system]. The repository database is hosted within a locally installed [https://www.postgresql.org/docs/9.5/server-start.html PostgreSQL 9.5 instance]. Database export is available on demand.

	The software platform of DAIS is based on the open-source software [https://wiki.lyrasis.org/display/DSPACE/DSpace+Release+5.10+Status DSpace 5.10]. The core DSpace code and Java code have not been modified, in order to facilitate the implementation of DSpace patches, updates, and upgrades. Major modifications have been made to the configuration, localization files and the [https://wiki.lyrasis.org/display/DSDOC5x/XMLUI+Configuration+and+Customization XMLUI configuration]. The system has been enriched with additional applications (displaying citation counts from the Web of Science, Scopus, Dimensions and Altmetric Attention Scores; displaying recommended citation; full [https://orcid.org/ ORCID] integration; displaying human-readable funding information in the selected interface language).		The software platform of DAIS is based on the open-source software [https://wiki.lyrasis.org/display/DSPACE/DSpace+Release+5.10+Status DSpace 5.10]. The core DSpace code and Java code have not been modified, in order to facilitate the implementation of DSpace patches, updates, and upgrades. Major modifications have been made to the configuration, localization files and the [https://wiki.lyrasis.org/display/DSDOC5x/XMLUI+Configuration+and+Customization XMLUI configuration]. The system has been enriched with additional applications (displaying citation counts from the Web of Science, Scopus, Dimensions and Altmetric Attention Scores; displaying recommended citation; full [https://orcid.org/ ORCID] integration; displaying human-readable funding information in the selected interface language).

	The customized version of DSpace and a set of additional applications are part of the software and workflow package developed by RCUB for institutional repositories. [~~[Repositories~~/en-~~gb\|Thirty~~ institutional repositories]] have been set up using this package. The service is provided to publicly funded research institutions in line with the [[Policy for Transparent Access to Research Infrastructures at the Computer Centre of the University of Belgrade: TRAP-RCUB IT solution and organizational model for the implementation of institutional or thematic repositories]] (TRAP-RCUB Policy for Transparent Access).		The customized version of DSpace and a set of additional applications are part of the software and workflow package developed by RCUB for institutional repositories. [https://trapist.rcub.bg.ac.rs/spira/#/ Forty-five institutional repositories] have been set up using this package. The service is provided to publicly funded research institutions in line with the [[Policy for Transparent Access to Research Infrastructures at the Computer Centre of the University of Belgrade: TRAP-RCUB IT solution and organizational model for the implementation of institutional or thematic repositories]] (TRAP-RCUB Policy for Transparent Access).

	== Documentation ==		== Documentation ==
	The source code of the customized version of DSpace and all additional applications~~. It~~ is stored on a local Git server accessible only to the repository development team. Detailed documentation about software, installation, configuration, maintenance, and troubleshooting available on Confluence is accessible only to the development team. This documentation enables easy replication of procedures and ensures continuity in case of staff changes.		The source code of the customized version of DSpace and all additional applications is stored on a local Git server accessible only to the repository development team. Detailed documentation about software, installation, configuration, maintenance, and troubleshooting available on Confluence is accessible only to the development team. This documentation enables easy replication of procedures and ensures continuity in case of staff changes.

	The following main procedures are covered in the documentation:		The following main procedures are covered in the documentation:
Line 51:		Line 51:

	== Backup and monitoring ==		== Backup and monitoring ==
	Backups are regularly performed at the virtual machine level. Both live instances and their passive backups reside on physically separated hardware-enabled and redundant RAID setups. The monitoring and alerting service MONIT, maintained by the RCUB team, constantly monitors the operation of the repository and sends alerts to system administrators in case of unexpected events. RCUB also performs regular [https://rcub.bg.ac.rs/en/usluge/monitoring.html traffic monitoring].		Backups are regularly performed at the virtual machine level. Both live instances and their passive backups reside on physically separated hardware-enabled and redundant RAID setups. The monitoring and alerting service MONIT, maintained by the RCUB team, constantly monitors the operation of the repository and sends alerts to system administrators in case of unexpected events.

			RCUB also performs regular [https://rcub.bg.ac.rs/en/usluge/monitoring.html traffic monitoring]. This helps us better track network traffic that could potentially overwhelm the repository. The service operates continuously, 24/7, and immediately alerts us to any significant increase in traffic that may affect repository performance or availability. In addition, the monitoring system provides detailed traffic history, which is particularly useful in emergency situations for backtracking and identifying the root cause of issues.

			To distinguish legitimate human interactions via web browsers from unauthorized automated bot activity, we integrated a customized solution based on Google reCAPTCHA. The service is available 24/7, supported by Google, and designed to be fully simplified so as not to confuse regular users. This approach helps us better understand newly established internet connections and effectively filter out unauthorized access attempts that could negatively impact repository availability and stability.

	The repository follows a regular upgrade cycle and, where possible, existing and widely accepted best practices.		The repository follows a regular upgrade cycle and, where possible, existing and widely accepted best practices.
Line 66:		Line 70:
	Two external applications ([[Ellena/en-gb\|Ellena]] and [[NomadLite]]) for repository managers require authentication and authorization. To be able to use these applications, users must be registered in the repository. Passwords and permissions are assigned by the DAIS Administrator & RCUB user support coordinator in the Ellena Dashboard. Passwords are encrypted using the SHA-512 hashing algorithm. The same credentials are used to log in to Ellena and NomadLite. Authentication in these applications is independent from the one used in the repository.		Two external applications ([[Ellena/en-gb\|Ellena]] and [[NomadLite]]) for repository managers require authentication and authorization. To be able to use these applications, users must be registered in the repository. Passwords and permissions are assigned by the DAIS Administrator & RCUB user support coordinator in the Ellena Dashboard. Passwords are encrypted using the SHA-512 hashing algorithm. The same credentials are used to log in to Ellena and NomadLite. Authentication in these applications is independent from the one used in the repository.

	Password handling is guided by the [[DAIS - Digital Archive of the Serbian Academy of Sciences and Arts: Terms of Service\|Terms of Service]] and standard institutional policies applying to credentials for services (e.g. institutional email, intranet, subscribed services, etc.). The credentials for the service backed, project management system and documentation, Git server and back-up facilities are managed in line with the internal document Staff Guidelines (UP 101), adopted by RCUB. Passwords, authorization procedures, access to services, and related security measures are defined in Article 3.10 of this document.		Password handling is guided by the [[DAIS - Digital Archive of the Serbian Academy of Sciences and Arts: Terms of Service\|Terms of Service]] and standard institutional policies applying to credentials for services (e.g. institutional email, intranet, subscribed services, etc.). The credentials for the service backed, project management system and documentation, Git server and back-up facilities are managed in line with the internal document Staff Guidelines (UP 101), adopted by RCUB. Passwords, authorization procedures, access to services, and related security measures are defined in Article 3.10 of this document.

			The repository is secured with an TLS certificate provided by trusted sources, ensuring that all communications between end-users and the server (including interactions with external applications) are encrypted and protected over the internet. By encrypting data during transmission, the TLS certificate prevents unauthorized access and mitigates various security risks, safeguarding user data. This protection extends to the authentication and authorization processes, making them secure and reliable, and ensuring that sensitive information is not compromised during these critical steps.
	== Hardware security ==		== Hardware security ==
	Hardware security is ensured based on the SLA between SASA and RCUB. The computer hardware that runs the repository is the property of RCUB. A dedicated team at RCUB takes care of the configuration, maintenance, security, software updates and development. RCUB has a dedicated team responsible for infrastructure security. RCUB security officers are responsible for general network security, server security, and service maintenance and they collaborate closely with the repository development team. Servers and network devices are kept in a dedicated area with physical access strictly limited to the authorized staff. Access to the backup facilities is strictly limited. The premises are equipped with fire alarms and a fire retardant system. An uninterrupted power supply is ensured using an automatic stand-by electric power generator.		Hardware security is ensured based on the SLA between SASA and RCUB. The computer hardware that runs the repository is the property of RCUB. A dedicated team at RCUB takes care of the configuration, maintenance, security, software updates and development. RCUB has a dedicated team responsible for infrastructure security. RCUB security officers are responsible for general network security, server security, and service maintenance and they collaborate closely with the repository development team. Servers and network devices are kept in a dedicated area with physical access strictly limited to the authorized staff. Access to the backup facilities is strictly limited. The premises are equipped with fire alarms and a fire retardant system. An uninterrupted power supply is ensured using an automatic stand-by electric power generator.
Line 82:		Line 88:
	'''Measures to prevent''' hardware failure are described under [[DAIS - Digital Archive of the Serbian Academy of Sciences and Arts: Security#Hardware security\|Hardware security]].		'''Measures to prevent''' hardware failure are described under [[DAIS - Digital Archive of the Serbian Academy of Sciences and Arts: Security#Hardware security\|Hardware security]].

	'''Response:''' The repository systems are virtualized, regularly ~~backedup~~, and can easily be replicated to a secondary site in the event of failure. RCUB uses a monitoring and alert system to receive notifications when servers have failed. (Responsibility: TRAP-RCUB Team)		'''Response:''' The repository systems are virtualized, regularly backed up, and can easily be replicated to a secondary site in the event of failure. RCUB uses a monitoring and alert system to receive notifications when servers have failed. (Responsibility: TRAP-RCUB Team)

	In case such a need arose, RCUB could use additional resources provided through AMRES. (Responsibility: RCUB management)		In case such a need arose, RCUB could use additional resources provided through AMRES. (Responsibility: RCUB management)
Line 91:		Line 97:
	'''Measures to prevent''' software failure:		'''Measures to prevent''' software failure:

	* Local firewall appliances, such as [https://wiki.centos.org/HowTos/Network/IPTables Iptables] ~~and~~ [https://www.fail2ban.org/wiki/index.php/Main_Page Fail2ban], are used to protect and restrict access to the DAIS instance. (Responsibility: TRAP-RCUB Team)		* Local firewall appliances, such as [https://wiki.centos.org/HowTos/Network/IPTables Iptables,] [https://www.fail2ban.org/wiki/index.php/Main_Page Fail2ban], and and [https://nginx.org/en/ nginx], are used to protect and restrict access to the DAIS instance. (Responsibility: TRAP-RCUB Team)
			* [https://www.google.com/recaptcha/about/ reCAPTCHA] integration provides protection against web crawlers and bot detection with purpose of filtering network traffic and avoiding bottlenecks (Responsibility: TRAP-RCUB Team)
	* Software is regularly updated. (Responsibility: TRAP-RCUB Team)		* Software is regularly updated. (Responsibility: TRAP-RCUB Team)
	* Software is documented and stored on a secure Git server. (Responsibility: TRAP-RCUB Team)		* Software is documented and stored on a secure Git server. (Responsibility: TRAP-RCUB Team)

TRAP-RCUB - Recent changes [en-gb]

DAIS - Digital Archive of the Serbian Academy of Sciences and Arts: Security