Carbonite Server Backup Portal 8.5. Installation and Configuration Guide

Transcription

1 Carbnite Server Backup Prtal 8.5 Installatin and Cnfiguratin Guide

2 2018 Carbnite, Inc. All rights reserved. Carbnite makes n representatins r warranties with respect t the cntents heref and specifically disclaims any implied warranties f merchantability r fitness fr any particular purpse. Furthermre, Carbnite reserves the right t revise this publicatin and t make changes frm time t time in the cntent heref withut bligatin f Carbnite t ntify any persn f such revisin f changes. All cmpanies, names and data used in examples herein are fictitius unless therwise nted. N part f this dcument may be reprduced, transmitted, transcribed, stred in a retrieval System r translated int any language including cmputer language, in any frm r by any means electrnic, mechanic, magnetic, ptical, chemical r therwise withut prir written permissin f: Carbnite, Inc. Tw Avenue de Lafayette Bstn, MA Carbnite and the Carbnite lg are registered trademarks, and Carbnite Server Backup, Carbnite Server Backup SaaS, and Carbnite Server Backup DeltaPr, are trademarks, f Carbnite, Inc. All ther prducts r cmpany names mentined in this dcument are trademarks r registered trademarks f their respective wners. Acknwledgements: Tw encryptin methds, DES and TripleDES, include cryptgraphic sftware written by Eric Yung. The Windws versins f these algrithms als include sftware written by Tim Hudsn. Bruce Schneier designed Blwfish encryptin. Part f the sftware embedded in this prduct is gsoap sftware. Prtins created by gsoap are Cpyright Rbert A. van Engelen, Genivia Inc. All Rights Reserved. THE SOFTWARE IN THIS PRODUCT WAS IN PART PROVIDED BY GENIVIA INC AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. The Carbnite Server Backup Agent, Carbnite Server Backup CentralCntrl, and Carbnite Server Backup Directr applicatins have the encryptin ptin f AES (Advanced Encryptin Standard). Advanced Encryptin Standard algrithm (named Rijndael, prnunced Rain Dll ) was develped by cryptgraphers Dr. Jan Daemen and Dr. Vincent Rijmen. This algrithm was chsen by the Natinal Institute f Standards and Technlgy (NIST) f the U.S. Department f Cmmerce t be the new Federal Infrmatin Prcessing Standard (FIPS). The Carbnite Server Backup Agents and Carbnite Server Backup Directr applicatins als have the added security feature f an ver the wire encryptin methd. Versin Date Descriptin Dcument Histry 1 March 2018 Initial installatin and cnfiguratin guide fr Prtal 8.5x. 2 May 2018 Added Change the privacy plicy URL prcedure. Mentined script fr enabling centrally-cnfigured backup ntificatins in Cnfigure ntificatins fr backups n multiple cmputers. This infrmatin was added fr Prtal

3 Cntents 1 Intrductin t Prtal System Overview Frnt-end system (web accessible) Back-end cmpnents (nt externally accessible) Carbnite Server Backup Reprts cmpnents (ptinal) Prtal Distributed System (recmmended) Prtal Single System Prerequisites and recmmendatins Sftware prerequisites Sftware prerequisites fr a distributed system Sftware prerequisites fr a single system Default prts SQL Server requirements Security recmmendatin Install Prtal Install Prtal as a distributed system Install back-end system cmpnents Install frnt-end system cmpnents Install the Prxy and Redirectr Cnfigure Windws authenticatin fr database access Install Prtal n a single system Integrate Prtal with Reprts Assciate custmer shrt names Enable and set up reprts in Prtal Set up autmatic s Cnfigure passwrd reset s Custmize passwrd reset s Cnfigure ntificatins fr backups n multiple cmputers Custmize backup ntificatin s iii

4 5.3 Cnfigure ntificatins fr encryptin passwrd changes Custmize s fr encryptin passwrd changes Cnfigure Prtal Cnfigure Prtal t use SSL Change the privacy plicy URL Cnfigure a web farm Enable tw-factr accunt verificatin Enter the TeleSign API key in a Prtal cnfiguratin file Cnfigure single sign-n (SSO) Cnfigure Prtal t use a federated identity server Install IdP Signing Certificate n the machine where Prtal is installed Username in the SAML tken User rle in the SAML tken User site in the SAML tken SAML tken/expected claims Trubleshting single sign-n Mdify Prtal Cnvert Prtal frm a single system t a tw-server distributed system Upgrade Prtal Prepare fr a Prtal upgrade Upgrade Prtal cmpnents (Optinal) Upgrade the perating system t Windws Server Make the upgraded Prtal available t users Rll back databases after a failed upgrade Validate the Prtal installatin Lg in t Prtal fr the first time Create a site Create an Admin user Add a cmputer Add a backup jb View the Reprts tab iv

5 10 Trubleshting and Maintenance Redirecting Prts SQL database installatin failure Agent desn t register t Redirectr Unauthrized prxy errrs Agents g ffline spradically Cannt lad type when lading Prtal lgin page NT AUTHORITY\SYSTEM lgin fails when navigating t Prtal Users cannt lg in using Internet Explrer errr when attempting t pen the Prtal website IIS default page appears instead f Prtal sign-in page Database transactin lg files require mnitring Prtal Disaster Recvery Back up Prtal data and settings Recver a Prtal instance Rebuild Prtal cmpnent infrmatin Carbnite Server Backup Supprt Cntacting Carbnite v

6 1 Intrductin t Prtal Carbnite Server Backup Prtal is a web-based interface that prvides a centralized pint f cntrl fr managing backups and restres f servers n large cmputer netwrks. Prtal is scalable, and can accmmdate a variety f different-sized rganizatins. A simple system can run n a single cmputer and efficiently handle apprximately 500 cmputers. A distributed farm system can handle much larger rganizatins with tens f thusands f cmputers. The legacy Web CentralCntrl UI is n lnger available. Users wh previusly used the Web CentralCntrl UI can use Prtal withut recnfiguring their Agents. This guide describes hw t install and cnfigure Prtal. Infrmatin n creating backups and restres is nt part f this guide but can be fund in the Prtal nline help. 1.1 System Overview Prtal includes the frnt-end and back-end cmpnents described in the fllwing tables. These cmpnents can be installed as a distributed system (recmmended) r n a single server Frnt-end system (web accessible) Cmpnent Prtal UI AMP Redirectr Service Lad Balancer AMP Prxy Prtal Service Cnnectr Hst Prtect Service Descriptin Brwser-based interface that allws users t manage backups and restres f servers n large cmputer netwrks. Prtal UI als allws fr reprts generatin as well as access t status feeds and cllabrative capability between users in the same cmpany. Nte: The legacy Web CentralCntrl UI is n lnger available. Accepts Agent registratins and balances the number f authrized Agents between available prxies in the Prtal envirnment. A Lad Balancer (nt prvided with Prtal) can be installed t balance the lad acrss multiple Prtal frnt-end systems. Acts as the access pint fr Agents t cnnect t the Prtal envirnment. It passes messages between the Agent and the backend services as well as messages frm the UI t the Agent allwing fr cnfiguratin f the Agent as well as status uplads frm the Agent. Multiple AMP prxy servers can be used t increase the number f Agents the verall envirnment can supprt. A maximum f 1000 Agents per AMP Prxy is recmmended. Prvides internal cmmunicatin between the Prtal UI and the backend services/database. Prvides internal cmmunicatin between the Prtal UI and the backend services/database. 6

7 Cmpnent API Scheduler Task Scheduler Descriptin Perfrms database maintenance wrk. Executes scheduled reprts as well as ther back end tasks that are executed n a schedule Back-end cmpnents (nt externally accessible) Cmpnent Descriptin SQL Databases WebCC database Cntains Agent cntent infrmatin. UserManagement database Cntains User Management infrmatin. SiteManagement database Cntains site-specific cntent infrmatin. EVaultWeb database Cntains user cntent infrmatin. Task Service Ntificatin Service Registratin Service Status Flags scheduled backups that are missed. This cmpnent is installed with the SQL databases. Allws Agents t ntify the UI f Agent cnfiguratins, jbs statuses, and ther infrmatin. Allws Agents t register with Prtal. Reprts n the running state f sme f the back-end services. Nte: The Prpagatin Service is n lnger available r necessary Carbnite Server Backup Reprts cmpnents (ptinal) Carbnite Server Backup Reprts is a separate prduct that can be integrated with Prtal. If yu want t integrate Reprts with Prtal, yu can install the fllwing cmpnents using the Reprts installatin kit. Cmpnent Reprts Database Lader (Web Service) Reprts Manager Reprts Viewer Tken Manager (Web Service) Descriptin Creates a variety f user strage, data, and usage reprts Receives vault metadata fr reprts generatin. Used t cnfigure reprt grups and subscriptins fr EVault Reprts. This cmpnent is ptinal when integrating EVault Reprts with the Prtal UI. Used t view and print reprts. Creates and distributes authenticatin tkens which are used t prvide authenticatin and scping arund the custmers included in reprts that are generated fr Prtal. Imprtant: Reprts cmpnents shuld nt be installed int the Prtal website. 7

8 Figure Prtal Distributed System (recmmended) The distributed web farm system can be scaled ut t handle a large number f Agents and Users, as shwn in Figure 1. Nte: The Lad Balancer is ptinal, and is nt prvided by Carbnite. Prtal Distributed System 8

9 1.3 Prtal Single System The single system, shwn in Figure 2, is nt recmmended, but can be used fr envirnments with fewer than 500 Agents. Figure 2 Prtal Single System 9

10 2 Prerequisites and recmmendatins As described in System Overview, Prtal cmpnents can be installed as a distributed system (recmmended) r n a single server. All cmpnents must be installed n a supprted 64-bit perating system. Fr a list f supprted platfrms, see the Prtal release ntes. On each system where Prtal cmpnents will be installed, d the fllwing: Turn ff IPV6. Use IPV4 addresses when prviding settings fr IP addresses. Make sure all servers are set t the same timezne and have the same time. Install required sftware prerequisites. See Sftware prerequisites. If Prtal cmpnents are installed as a distributed system, pen the required prts. Fr mre infrmatin, see Default prts. Fr increased security we recmmend disabling lder cipher suites n systems where Prtal cmpnents are installed. See Security recmmendatins. 10

11 2.1 Sftware prerequisites Sftware prerequisites fr a distributed system If yu are installing Prtal cmpnents as a distributed system (recmmended), the fllwing table shws prerequisites that are required n each system. System Prtal UI (frnt-end) Prerequisite Internet Infrmatin Services (IIS) 7.0 r later, including all rle services that are installed by default, plus the fllwing available rle services: Under Cmmn HTTP Features: Static Cntent HTTP Errrs HTTP Redirectin Under Applicatin Develpment:.NET Extensibility 3.5.NET Extensibility 4.5 ASP.NET 3.5 ASP.NET 4.5 ISAPI Extensins ISAPI Filters Under Security: Windws Authenticatin Under.NET Framewrk Features: HTTP Activatin.NET Framewrk NET Framewrk 3.5 AMP prxy and Redirectr.NET Framewrk NET Framewrk 3.5 Databases Micrsft SQL Server r SQL Server Express 2014, 2012 r 2008 R2 (64-bit) installed with mixed mde authenticatin and case-insensitive cllatin and running. Fr detailed infrmatin, see SQL Server Requirements..NET Framewrk

12 System Prerequisite.NET Framewrk 3.5 Web services, including Ntificatin, Registratin and Status (back-end) Internet Infrmatin Services (IIS) 7.0 r later, including all rle services that are installed by default, plus the fllwing available rle services: Under Cmmn HTTP Features: Static Cntent Under Applicatin Develpment:.NET Extensibility 3.5.NET Extensibility 4.5 ASP.NET 3.5 ASP.NET 4.5 ISAPI Extensins ISAPI Filters.NET Framewrk NET Framewrk Sftware prerequisites fr a single system The fllwing sftware must be installed befre yu can install Prtal n a single system: Micrsft Internet Infrmatin Services (IIS) 7.0 r later, including all rle services that are installed by default, plus the fllwing available rle services and features: Under Cmmn HTTP Features: Static Cntent HTTP Errrs HTTP Redirectin Under Applicatin Develpment:.NET Extensibility 3.5.NET Extensibility 4.5 ASP.NET 3.5 ASP.NET 4.5 ISAPI Extensins ISAPI Filters 12

13 Nte: Make certain that ASP.NET and.net Extensibility are turned n in Windws features, particularly if IIS is installed befre ASP.NET. Under Security: Windws Authenticatin Under.NET Framewrk Features: HTTP Activatin.NET Framewrk NET Framewrk 3.5 On Windws 2012, HTTP Activatin must be installed under bth.net Framewrk 3.5 Features and.net Framewrk 4.5 Features. On Windws 2008, HTTP Activatin must be installed under.net Features. Micrsft SQL Server r SQL Server Express 2014, 2012 r 2008 R2 (64-bit) installed with mixed mde authenticatin and case-insensitive cllatin and running. Fr detailed infrmatin, see SQL Server requirements. 2.2 Default prts The fllwing table shws default prts that must be pen t enable cmmunicatin between Prtal cmpnents installed as a distributed system (recmmended). System Prt Cmmunicatin Prtal UI (frnt-end) Outbund: 6502 T AMP Prxy Outbund: 1433 Outbund: 80 Outbund: 1433 T Database T Carbnite Server Backup Reprts tken manager (if used) T Carbnite Server Backup Reprts database (if used) AMP prxy Outbund: 80 T Web services (back-end) Outbund: 1433 Inbund: 6502 Inbund: 8087 T Database Frm Prtal UI Frm Agents (cmputers) Redirectr Outbund:80 T Web services Outbund: 1433 Inbund: 8086 T Database Frm Agents 13

14 System Prt Cmmunicatin Databases Frm Prtal UI Inbund: 1433 Frm AMP prxy Frm Redirectr Web services, including Ntificatin and Registratin (back-end) Outbund: 6502 Inbund: 80 T AMP prxy Frm AMP prxy Frm Redirectr Agents (cmputers) Outbund: 8087 T AMP prxy Outbund: 8086 T Redirectr 2.3 SQL Server requirements Fr new Prtal installatins, a supprted Micrsft SQL Server versin must be installed and running, with the fllwing requirements: SQL Server Optin Instance feature Authenticatin Cllatin Instance name Requirement Database Engine Services Mixed Mde (SQL Server and Windws authenticatin) Any case-insensitive cllatin Any instance name; n restrictins SQL Server shuld be installed n a system that is nt externally visible, cnfigured with default settings, and ready fr use. When SQL Server and Prtal services are installed n different servers, TCP/IP must be enabled fr the database instance. SQL credentials must als be specified fr cnnecting t the database frm remte servers. During installatin, yu must specify a user fr cnnecting t SQL Server. This user must have permissin t access the master, mdel, Msdb and tempdb databases (DBOwner). When Windws authenticatin is used fr cnnecting t SQL Server during installatin, the sysadmin server rle must be enabled fr the NT AUTHORITY/SYSTEM lgin. The passwrd fr the SQL Server user shuld nt include semiclns, single qutatin marks r duble qutatin marks. 14

15 Prtal can use the same SQL Server instance as Carbnite Server Backup Reprts. Hwever, fr scalability and envirnments with many Agents and vaults, it is preferable t use separate SQL Server instances fr Prtal and Reprts. 2.4 Security recmmendatin On Prtal systems which are expsed t the internet, we recmmend disabling cipher suites which include RSA encryptin. Typically, systems where the Prtal UI, Prxy r Redirectr are installed are expsed t the internet. Hwever, if a lad balancer handles https cnnectins t the Prtal UI, yu d nt need t disable cipher suites n the Prtal UI system. We recmmend disabling cipher suites with names that start with TLS_RSA_*. Yu d nt need t disable cipher suites that use RSA signatures and include DHE r ECDHE in their names (i.e., names that begin with TLS_ECDHE_RSA_ r TLS_DHE_RSA_ ). Nte: Disabling these cipher suites culd cause lder Agents t lse cnnectin with Prtal, but newer Agent versins will remain cnnected. Disabling cipher suites culd als cause prblems with ther sftware n the web servers. Fr instructins n disabling cipher suites, see Micrsft dcumentatin: 15

16 3 Install Prtal We recmmend installing Prtal as a distributed system, with cmpnents n multiple systems. See Install Prtal n a distributed system. Yu can als install all Prtal cmpnents n ne machine. The single system is nt recmmended, but can be used fr envirnments with fewer than 500 Agents. See Install Prtal n a single system. The Windws user that runs the Prtal installer has full access t the Prtal databases. 3.1 Install Prtal as a distributed system T install Prtal as a distributed system, d the fllwing: Install back-end system cmpnents. Back-end system cmpnents include the databases, Ntificatin service and Registratin service. Install frnt-end system cmpnents. Frnt-end system cmpnents include the Prtal UI. Install prxy systems. Install the AMP Prxy n each prxy system, and install the Redirectr n ne f the prxy systems. (Recmmended) Cnfigure Windws authenticatin fr database access After installing Prtal, we recmmend that yu validate the installatin. See System validatin fr the steps t d this. If all that is successful, the installatin is functinal and ready t g. If there are any prblems, see Trubleshting and Maintenance fr pssible slutins Install back-end system cmpnents When installing Prtal n a distributed system, yu must first install the back-end system cmpnents: Databases Ntificatin service Registratin service The website where the Ntificatin and Registratin services are installed must nly be accessible frm within the lcal netwrk (specifically, frm the systems where the Prxy and the Redirectr are installed). It must nt be available ver the internet. The Agents d nt need t cnnect t these services directly. T install back-end system cmpnents: 1. On the system where yu want t install back-end Prtal cmpnents, lg in as an administratr and run the Prtal installatin kit. 2. On the Welcme page, click Next. 3. On the View Ntes page, click Next. 4. On the License Agreement page, read the license agreement. Select I accept the terms f the license agreement, and then click Next. 16

17 5. On the SQL Server Setup page, chse the SQL Server instance where the databases will be installed. Specify the authenticatin methd, and then click Next. Yu can ptinally click Test Cnnectin t validate yur cnnectin with the database server. Nte: The SQL Server instance must have been installed with mixed mde authenticatin. The database can be installed using Windws authenticatin. The SQL Server instance must nt cntain existing EVaultWeb, WebCC, UserManagement, r SiteManagement databases. Nte: If yu want t install Prtal with a remte SQL Server, install SQL Management Studi n the machine where yu are installing Prtal. Otherwise, a failure t create database errr might ccur during the installatin. 6. On the Select Features page, select the fllwing cmpnents, and then click Next: SQL Databases Nte: The Task Service is installed with the SQL databases. Ntificatin Service Registratin Service 7. On the Ntificatin and Registratin Cnfiguratin page, enter the IP address that the Prxy and Redirectr will use t access the Ntificatin and Registratin services, and then click Next. 8. On the Ntificatin Service Lcatins and Virtual Directry page, specify the fllwing Ntificatin service infrmatin, and then click Next: Installatin lcatin Lg file lcatin. Fr security reasns, the lg files shuld nt be under the same path where the Ntificatin service is installed. 17

18 Virtual Directry Name. Change this name if it will cnflict with anther already installed website/service. If yu change the virtual directry name, recrd it. Yu will need t enter it when installing the prxy. 9. On the Registratin Service Lcatins and Virtual Directry page, specify the fllwing infrmatin, and then click Next: Installatin lcatin Lg file lcatin Virtual Directry Name. Change this name if it will cnflict with anther already installed website/service. If yu change the virtual directry name, recrd it. Yu will need t enter it when installing the prxy. 10. On the Services/Supprt Files page, specify the lcatin fr installing services and supprt files, and then click Next. 11. In the cnfirmatin dialg bx, click Yes. After the cmpnents are installed, a Cmpnent Status page appears. This page indicates which cmpnents have been installed and which cmpnents need t be installed befre the system will be peratinal. The page als indicates if ne f the cmpnents is nt at the same versins as the ther cmpnents and will need t be upgraded. Cmpnents which are currently installed, but are nt up t the current versin, may shw as missing. T save a cpy f the Cmpnent Status infrmatin, enter a lcatin fr saving the file, and then click Save. 12. Click Next. 13. On the Prtal Installatin Successful page, click Finish Install frnt-end system cmpnents After installing back-end system cmpnents n ne server in a distributed system, yu can install frnt-end system cmpnents n anther server. Frnt-end cmpnents include the Prtal UI. The fllwing cmpnents are als installed when yu install the Prtal UI: Prtal Service Cnnectr, Hst Prtect Service, and Task Scheduler. T install frnt-end system cmpnents: 1. On the system where yu want t install frnt-end Prtal cmpnents, lg in as an administratr and run the Prtal installatin kit. 2. On the Welcme page, click Next. 3. On the View Ntes page, click Next. 4. On the License Agreement page, read the license agreement. Select I accept the terms f the license agreement, and then click Next. 5. On the SQL Server Setup page, specify the SQL Server instance where the databases are installed. Specify the authenticatin methd, and then click Next. Yu can ptinally click Test t validate yur cnnectin with the database server. 6. On the Select Features page, select Prtal UI, and then click Next. 18

19 7. On the Language Selectin page, select languages fr displaying Prtal text, and then click Next. In additin t the default English, yu can select French, German and Spanish If yu d nt install a language nw, yu can add it later by rerunning the installatin in Mdify mde. Yu can als remve a language this way. 8. On the Dmain Name page, specify the Prtal dmain name and prt, and then click Next. On this page, yu can prvide the dmain name fr Prtal, as well as the prtcl t use (http/https). This is the address which yur end users will use t cnnect t Prtal. It is highly recmmended that https be used. Fr a seamless user experience, a signed certificate shuld be applied t the website where this applicatin is installed. This will need t be dne after the installatin is cmplete. When cnfiguring the system fr external access, the dmain name that is prvided here shuld be the name which is registered n the internet fr Prtal. If the system is being set up befre external access is cnfigured, the applicatin will nly wrk after yu successfully set up the dmain name that has been prvided here. If the dmain name changes after installatin, the installed cmpnents will need t be manually updated. 9. On the Prtal Select Installatin and Lg Paths page, specify the Prtal installatin lcatin and Lgs lcatin, and then click Next. 10. On the Prtal Service Cnnectr Lcatin and Virtual Directry page, specify the fllwing infrmatin, and then click Next: Installatin lcatin Lg file lcatin Virtual Directry Name. Change this name if it will cnflict with anther already installed website/service. 11. On the Hst Prtect Lcatin and Virtual Directry page, specify the fllwing infrmatin, and then click Next: Installatin lcatin 19

20 Lg file lcatin Virtual Directry Name. Change this name if it will cnflict with anther already installed website/service. 12. On the API Scheduler Installatin page, specify the fllwing infrmatin, and then click Next: Installatin lcatin Lg file lcatin 13. On the Task Scheduler Select Installatin Path page, specify the Task Scheduler installatin lcatin and lg file lcatin, and then click Next. 14. In the cnfirmatin dialg bx, click Yes. After the cmpnents are installed, a Cmpnent Status page appears. This page indicates which cmpnents have been installed, and which cmpnents need t be installed befre the system will be peratinal. The page als indicates if ne f the cmpnents is nt at the same versins as the ther cmpnents and will still need t be upgraded. Cmpnents which are currently installed, but are nt up t the current versin, may shw as missing. T save a cpy f the Cmpnent Status infrmatin, enter a lcatin fr saving the file, and then click Save. 15. Click Next. 16. On the Prtal Installatin Successful page, click Finish. A dialg bx asks if yu want t pen a brwser t the Prtal sign in page Install the Prxy and Redirectr When installing Prtal n a distributed system, the final system t be installed is the Prxy/Redirectr system. Only a single Redirectr service needs t be installed, but multiple prxy systems can be setup fr the same Prtal envirnment. Each prxy supprts up t 1000 Agent cnnectins. The Redirectr and any Prxies installed need t be accessible by all Agents cnnecting t yur envirnment. Fr envirnments which will supprt bth lcal netwrk (LAN) internet cnnected Agents, all Agents need t have access t the same dmain names/ip addresses fr the Prxy. T install the Prxy and Redirectr: 1. On the server where yu want t install the Prxy, lg in as an administratr and run the Prtal installatin kit. 2. On the Welcme page, click Next. 3. On the View Ntes page, click Next. 4. On the Sftware License Agreement page, read the license agreement. Select I accept the terms f the license agreement, and then click Next. 5. On the SQL Server Setup page, specify the SQL Server instance where the databases are installed, and prvide SQL credentials fr the remte database. Click Next. Yu can ptinally click Test t validate yur cnnectin with the database server. 20

21 6. On the Select Features page, select AMP Prxy. If yu als want t install the Redirectr, select AMP Redirectr Service. Click Next. 7. On the AMP Service Cnfiguratin page, enter the web address f the Ntificatin service, and then click Next. The recmmendatin is t use the internal IP address f the system where the Ntificatin service is installed in the URL. This will avid any issues with the name reslving t an IPV6 IP address instead f an IPV4 address. The Prxy is unable t cnnect t the Ntificatin service when using an IPV6 address. 8. On the Cnfigure AMP Prxy page, specify the AMP Prxy dmain name and IP address, and then click Next. The dmain name prvided here shuld be the name that is accessible and reslvable by all Agents. Fr cnfiguratins where the Agents will be lcated utside yur netwrk, this address wuld be the external dmain name registered fr yur envirnment. Fr cnfiguratins where the Agents are nly lcated within yur lcal netwrk (LAN), the name can be the system name fr the system where the Prxy is installed. The address that is prvided fr the Prtal is the internal IP address fr the system where the prxy installed. 9. On the AMP Redirectr Service Cnfiguratin page, enter the Registratin Service web address, and then click Next. The same recmmendatins given fr the Ntificatin service als apply t the registratin service. 10. On the Services/Supprt Files page, enter the lcatin fr installing services and supprt files, and then click Next. 11. In the cnfirmatin dialg bx, click Yes. After the cmpnents are installed, a Cmpnent Status page appears. This page indicates which cmpnents have been installed and which cmpnents need t be installed befre the system will be peratinal. The page als indicates if ne f the cmpnents is nt at the same versins as the ther cmpnents and will still need t be upgraded. Cmpnents which are currently installed, but are nt up t the current versin, may shw as missing. 21

22 T save a cpy f the Cmpnent Status infrmatin, enter a lcatin fr saving the file, and then click Save. 12. Click Next. 13. On the Prtal Installatin Successful page, click Finish Cnfigure Windws authenticatin fr database access By default, Prtal cmpnents in a distributed system use SQL Server authenticatin t access the database. We recmmend cnfiguring Windws authenticatin fr database access. Prerequisite: Systems where Prtal cmpnents are installed must all be members f the same dmain. T cnfigure Windws authenticatin fr database access: 1. Install Prtal using SQL Server authenticatin. 2. Create a dmain grup. Add accunts t the dmain grup fr all systems where Prtal cmpnents are installed. Fr example: 3. Add the grup created in Step 2 as a Lgin t SQL Server, and add the sysadmin rle t the grup. 22

23 4. In each cnfiguratin file listed in Table B: Cnfiguratin files t update fr Windws authenticatin, find the fllwing cnnectin string: <add name="evaultweb" cnnectinstring="data Surce='dataSurce';Database='EVaultWeb';User ID='user';Passwrd='passwrd';Pling=False" prvidername="system.data.sqlclient" /> Replace the User ID and Passwrd elements with: Integrated Security=SSPI and save the cnfiguratin file. Fr example: <add name="evaultweb" cnnectinstring="data Surce='W12SQL14DB\SQLEXPRESS';Database='EVaultWeb'; Integrated Security=SSPI;Pling=False" prvidername="system.data.sqlclient" /> 23

24 Table B: Cnfiguratin files t update fr Windws authenticatin Cmpnent Cnfiguratin file Back-end cmpnents Task Service C:\Prgram Files\Carbnite Server Backup\Prtal Services\TaskService\TaskService.exe.cnfig Ntificatin Service C:\inetpub\Prtal Services Website\Ntificatin\web.cnfig Registratin C:\inetpub\Prtal Services Website\Registratin\web.cnfig Service Frnt-end cmpnents Prtal UI C:\inetpub\Prtal Website\web.cnfig Redirectr C:\Prgram Files\Carbnite Server Backup\Prtal Services\AMP Redirectr Service\RedirectrService.exe.cnfig OR (fr upgraded systems) C:\Prgram Files\EVault Sftware\Prtal Services\AMP Redirectr Service\RedirectrService.exe.cnfig Prxy C:\Prgram Files\Carbnite Server Backup\Prtal Services\AMP Prxy Service\AmpService.exe.cnfig OR (fr upgraded systems) C:\Prgram Files\EVault Sftware\Prtal Services\AMP Prxy Service\AmpService.exe.cnfig Service Cnnectr C:\inetpub\Prtal Services API Website\Prtal_Service_Cnnectr\web.cnfig Hst Prtect API C:\inetpub\Prtal Services Website\Hst_Prtect\web.cnfig API Task Scheduler C:\Prgram Files\Carbnite Server Backup\Prtal Services\API Scheduler\EVaultSDK.Scheduler.exe.cnfig OR (fr upgraded systems) C:\Prgram Files\EVault Sftware\Prtal Services\API Scheduler\EVaultSDK.Scheduler.exe.cnfig Prtal Task C:\Prgram Files\Carbnite Server Backup\Prtal Services\Task Scheduler Scheduler\EVault.Web.TaskScheduler.exe.cnfig OR (fr upgraded systems) C:\Prgram Files\EVault Sftware\Prtal Services\Task Scheduler\EVault.Web.TaskScheduler.exe.cnfig 3.2 Install Prtal n a single system Yu can install all Prtal cmpnents n a single server. Hwever, this cnfiguratin is nly suitable fr small deplyments (fewer than 500 Agents). T install Prtal n a single system: 1. Sign in as an administratr, and run the Prtal installatin kit. 2. On the Welcme page, click Next. 3. On the View Ntes page, click Next. 24

25 4. On the License Agreement page, read the license agreement. Select I accept the terms f the license agreement, and then click Next. 5. On the SQL Server Setup page, chse the SQL Server instance where the databases will be installed. Specify the authenticatin methd, and then click Next. We recmmend using Windw authenticatin fr the database cnnectin. Yu can ptinally click Test Cnnectin t validate yur cnnectin with the database server. Nte: The SQL Server instance must have been installed with mixed mde authenticatin. The database can be installed using Windws authenticatin. The database cannt cntain existing EVaultWeb, WebCC, UserManagement, r SiteManagement databases. Nte: If yu want t install Prtal with a remte SQL Server, install SQL Management Studi n the machine where yu are installing Prtal. Otherwise, a failure t create database errr might ccur during the installatin. 6. On the Select Features page, select the fllwing items, and then click Next. SQL Databases Nte: The Task Service is installed with the SQL databases. Prtal UI Ntificatin Service AMP Prxy AMP Redirectr Service Registratin Service 7. On the Language Selectin page, select languages fr displaying Prtal text, and then click Next. In additin t the default English, yu can select French, German and Spanish. If yu d nt install a language, yu can add it later by rerunning the installatin in Mdify mde. Yu can als remve a language this way. 25

26 8. On the Dmain Name page, specify the Prtal dmain name and prt, and then click Next. On this page, yu can prvide the dmain name fr Prtal, as well as the prtcl t use (http/https). This is the address which yur end users will use t cnnect t Prtal. It is highly recmmended that https be used. Fr a seamless user experience, a signed certificate shuld be applied t the website where this applicatin is installed. This will need t be dne after the installatin is cmplete. When cnfiguring the system fr external access, the dmain name that is prvided here shuld be the name which is registered n the internet fr Prtal. If the system is being set up befre external access is cnfigured, the applicatin will nly wrk after yu successfully set up the dmain name that has been prvided here. If the dmain name changes after installatin, the installed cmpnents will need t be manually updated. 9. On the Prtal Select Installatin and Lg Paths page, specify the Prtal installatin lcatin and Lgs lcatin, and then click Next. 10. On the Prtal Service Cnnectr Lcatin and Virtual Directry page, specify the fllwing infrmatin, and then click Next: Installatin lcatin Lg file lcatin Virtual Directry Name. Change this name if it will cnflict with anther already installed website/service. 11. On the Hst Prtect Lcatins and Virtual Directry page, specify the fllwing infrmatin, and then click Next: Installatin lcatin Lg file lcatin Virtual Directry Name. Change this name if it will cnflict with anther already installed website/service. 12. On the API Scheduler Installatin page, specify the fllwing infrmatin, and then click Next: Installatin lcatin Lg file lcatin 13. On the Task Scheduler Select Installatin Path page, specify the Task Scheduler installatin lcatin and lg file lcatin, and then click Next. 14. On the Ntificatin Service Lcatins and Virtual Directry page, specify the fllwing Ntificatin service infrmatin, and then click Next: Installatin lcatin Lg file lcatin. Fr security reasns, the lg files shuld nt be under the same path where the Ntificatin service is installed. Virtual Directry Name. Change this name if it will cnflict with anther already installed website/service. If yu change the virtual directry name, recrd it. Yu will need t enter it when installing the prxy. 26

27 15. On the Registratin Service Lcatins and Virtual Directry page, specify the fllwing infrmatin, and then click Next: Installatin lcatin Lg file lcatin Virtual Directry Name. Change this name if it will cnflict with anther already installed website/service. If yu change the virtual directry name, recrd it. Yu will need t enter it when installing the prxy. 16. On the AMP Prxy IP Cnfiguratin page, specify the AMP Prxy dmain name and IP address, and then click Next. The dmain name prvided here shuld be the name that is accessible and reslvable by all Agents. Fr cnfiguratins where the Agents will be lcated utside yur netwrk, this address wuld be the external dmain name registered fr yur envirnment. Fr cnfiguratins where the Agents are nly lcated within yur lcal netwrk (LAN), the name can be the system name fr the system where the Prxy is installed. The address that is prvided fr the Prtal is the internal IP address fr the system where the prxy installed. 17. On the Services/Supprt Files page, enter the lcatin fr installing services and supprt files, and then click Next. 18. In the cnfirmatin dialg bx, click Yes. After the cmpnents are installed, a Cmpnent Status page appears. This page indicates which cmpnents have been installed and which cmpnents need t be installed befre the system will be peratinal. The page als indicates if ne f the cmpnents is nt at the same versins as the ther cmpnents and will still need t be upgraded. Cmpnents which are currently installed, but are nt up t the current versin, may shw as missing. T save a cpy f the Cmpnent Status infrmatin, enter a lcatin fr saving the file, and then click Save. 19. Click Next. 20. On the Prtal Installatin Successful page, click Finish. A dialg bx asks if yu want t pen a brwser t the Prtal lgin page. At this pint it is recmmended that yu validate the installatin. See Validate the Prtal installatin. If all that is successful then the installatin is functinal and ready t g. If there are any prblems, see Trubleshting and Maintenance fr pssible slutins. 27

28 4 Integrate Prtal with Reprts Prtal can be integrated with EVault Reprts. T allw yur users t access reprts, yu must assciate Custmer shrt name values (frm the vault) and Reprt Grup Name values (frm Reprts Manager) with Prtal sites. If these values are nt prperly cnfigured, users cannt access reprts thrugh Prtal, even if EVault Reprts has been integrated. Yu can assciate custmer shrt names with reprt grup names using Prtal. See Assciate custmer shrt names. Yu must als enable and set up reprts in Prtal befre the Reprts tab will appear. See Enable and set up reprts in Prtal. Nte: Carbnite Server Backup Reprts is a separate installatin. See the Reprts User Guide fr detailed infrmatin. Imprtant: Reprts cmpnents shuld nt be installed int the Prtal website. 4.1 Assciate custmer shrt names T assciate custmer shrt names: 1. Lg in t Prtal as a super user. 2. On the navigatin bar, click Sites. 3. In the grid, pen the site by clicking its rw. 4. Click the Shrt Names tab. 5. In the Shrt Name t add bx, type the shrt name (frm the vault) t assciate with the site. 6. Click Add. 7. Click Save. Nw the users in the cmpany can access the reprts that are assciated with their Cmpany shrt name and Reprt grup name settings. Fr details abut Custmer shrt name values frm the vault, and Reprt Grup Name settings in Reprts, refer t the Directr Operatins Guide and the Reprts User Guide. 4.2 Enable and set up reprts in Prtal T enable and set up reprts in Prtal: 1. Lg in t Prtal as a super user. 28

29 2. On the navigatin bar, click Glbal Settings. 3. Click the Reprt Settings tab. 4. On the Reprt Settings tab, click the Enable Reprts tab. 5. In the Cnnectivity sectin, enter reprts database infrmatin and SQL Server credentials. 6. In the Tken Manager Cnfiguratin sectin, enter the URL fr the Tken Manager service. 7. In the Ntificatins sectin, enter an address fr sending a ntificatin if a custmer shrtname is missing. Custmer shrt name values (frm the vault) must be assciated with Reprt Grup Name values (frm Reprts Manager). 8. Click Save. 29

30 5 Set up autmatic s We recmmend using authenticated SMTP fr autmatic s frm Prtal. Enter SMTP settings in the cnfiguratin files shwn in Table A: Cnfiguratin files with SMTP settings. Table A: Cnfiguratin files with SMTP settings Cmpnent Prtal UI Hst Prtect API API Scheduler Prtal Task Scheduler Prtal Service Cnnectr Cnfiguratin file C:\inetpub\Prtal Website\web.cnfig C:\inetpub\Prtal Services Website\Hst_Prtect\web.cnfig C:\Prgram Files\Carbnite Server Backup\Prtal Services\API Scheduler\EVaultSDK.Scheduler.exe.cnfig OR (fr upgraded systems) C:\Prgram Files\EVault Sftware\Prtal Services\API Scheduler\EVaultSDK.Scheduler.exe.cnfig C:\Prgram Files\Carbnite Server Backup\Prtal Services\Task Scheduler\EVault.Web.TaskScheduler.exe.cnfig OR (fr upgraded systems) C:\Prgram Files\EVault Sftware\Prtal Services\Task Scheduler\EVault.Web.TaskScheduler.exe.cnfig C:\inetpub\Prtal Services Website\Prtal_Service_Cnnectr\web.cnfig Fr additinal infrmatin abut cnfiguring s in Prtal, see Cnfigure passwrd reset s and Cnfigure ntificatins fr encryptin passwrd changes. 5.1 Cnfigure passwrd reset s Users wh submit passwrd reset requests thrugh Prtal autmatically receive passwrd reset request s. After resetting their passwrds, users receive cnfirmatin s. T cnfigure autmatic passwrd reset s, yu must specify SMTP settings. We recmmend using authenticated SMTP. Yu can als specify a Supprt phne number t include in the s. By default, passwrd reset s d nt include yur rganizatin s text r branding. Hwever, yu can custmize the s. See Custmize passwrd reset s. T cnfigure passwrd reset settings: 1. Open the web.cnfig file fr the Hst Prtect service (in C:\inetpub\Prtal Services Website\Hst_Prtect, by default) in a text editr. 2. In the web.cnfig file, find the fllwing lines: <mailsettings> <smtp deliverymethd="netwrk" frm=""> <netwrk hst="" passwrd="" prt="25" username="" /> </smtp> </mailsettings> 30

31 Type values fr the fllwing attributes in the qutatin marks: frm="" address that yu want t appear as the Frm address in passwrd reset s (e.g., frm="user@yurdmain.cm"). hst="" Fully qualified dmain name fr yur SMTP server (e.g., hst=" mail.yurdmain.cm"). prt="25" If yur SMTP server des nt use prt 25 fr sending s, replace 25 with the prt number fr sending s. username="" type the SMTP server user name (e.g., username="supprt"). passwrd="" type the SMTP server passwrd (e.g., passwrd="pwd"). The resulting mailsettings element will be smething like: <mailsettings> <smtp deliverymethd="netwrk" frm="user@yurdmain.cm"> <netwrk hst="mail.yurdmain.cm" passwrd="pwd" prt="25" username="supprt" /> </smtp> </mailsettings> 3. In the web.cnfig file, find the fllwing line: <add key="supprttelephnenumber" value=" " /> This phne number will be shwn in passwrd reset s as the phne number fr cntacting Supprt. Replace with the Supprt number that yu want t include. The resulting line will be smething like: <add key="supprttelephnenumber" value=" " /> 4. Save the web.cnfig file Custmize passwrd reset s Yu can custmize passwrd reset s t include yur rganizatin s text and branding. If yu d nt custmize passwrd reset s, users receive the fllwing unbranded after submitting passwrd reset requests thrugh Prtal. The subject line f the is Prtal passwrd reset request. 31

32 Nte: Yu can change the phne number that appears in passwrd reset s withut changing the text and branding. See Set up passwrd reset s. If yu d nt custmize passwrd reset s, a user receives the fllwing unbranded after resetting a passwrd. The subject line f the is Yur prtal passwrd has been reset. T custmize passwrd reset s: 1. Find the BrandedTemplates.zip file in the \Hst_Prtect\bin\ Templates subflder (C:\inetpub\Prtal Services Website\Hst_Prtect\bin\ Templates, by default). The BrandedTemplates.zip file cntains Carbnite-branded templates and subject lines. 2. Extract all files frm the BrandedTemplates.zip file. D nt extract the files int the Templates flder (C:\inetpub\Prtal Services Website\Hst_Prtect\bin\ Templates, by default) befre yu custmize the files, r users will receive Carbnite branded s. 32

33 3. T change the text r appearance f the Passwrd Reset Request , edit the PasswrdResetRequest.html file. T include an image in the , hst the image n a website r save the image file in Prtal Website\assets\images (C:\inetpub\Prtal Website\assets\images, by default), and include a link in the html file. Nte: If Prtal is hsted n a web farm, and yu save the lg image file lcally, yu must save the image file n every UI nde in the farm. If yu d nt edit the PasswrdResetRequest.html file, users receive the fllwing after a passwrd reset request: 4. T change the subject line f the Passwrd Reset Request , edit the PasswrdResetRequestSubject.txt file. If yu d nt edit the PasswrdResetRequestSubject.txt file, the Passwrd Reset Request subject line is Carbnite Server Backup passwrd reset request. 5. T change the text r appearance f the Passwrd Reset Cnfirmatin , edit the PasswrdResetCnfirmatin.html file. T include an image in the , hst the image n a website r save the image in Prtal Website\assets\images (C:\inetpub\Prtal Website\assets images, by default), and include a link in the html file. If yu d nt edit the PasswrdResetCnfirmatin.html file, users receive the fllwing after a passwrd reset: 33

34 6. T change the subject line f the Passwrd Reset Cnfirmatin , edit the PasswrdResetCnfirmatinSubject.txt file. If yu d nt edit the PasswrdResetCnfirmatinSubject.txt file, the Passwrd Reset Cnfirmatin subject line is Yur Carbnite Server Backup passwrd has been reset. 7. Save the edited templates in the Templates flder (C:\inetpub\Prtal Services Website\Hst_Prtect\bin\ Templates, by default). If yu d nt save the templates in the Templates flder, users will receive unbranded s. 5.2 Cnfigure ntificatins fr backups n multiple cmputers Admin users can receive centrally-cnfigured ntificatins when backups finish r fail n Windws systems where Agent versin 8.0 r later is installed, Linux systems where Agent versin 8.10a r later is installed, and vsphere envirnments prtected by vsphere Recvery Agent 8.40 r later. T cnfigure ntificatins fr backups n these cmputers, yu must specify SMTP settings, as described in this sectin. We recmmend using authenticated SMTP. Yu must als run an EnableUserNtificatin.sql script n the SQL Server instance where Prtal databases are installed. This SQL script is prvided with Prtal, and enables backup ntificatin s in the Prtal instance. By default, ntificatins fr backups include Carbnite branding. Hwever, yu can custmize the s. See Custmize backup ntificatin s. 34

35 T cnfigure ntificatins fr backups n multiple cmputers: 1. Open the EVaultSDK.Scheduler.exe.cnfig file fr the API Scheduler (in \Prtal Services\API Scheduler) in a text editr. Fr fresh Prtal installatins, the default lcatin is C:\Prgram Files\Carbnite Server Backup\Prtal Services\API Scheduler. Fr upgraded Prtal installatins, the default lcatin is C:\Prgram Files\EVault Sftware\Prtal Services\API Scheduler. 2. In the EVaultSDK.Scheduler.exe.cnfig file, find the fllwing line: <add key="deliveryadapterimplementatin" value="evault.onin.infrastructure. adapters.ses adapter" /> Replace Ses Adapter in this line with DtNetSmtp. The resulting line is: <add key="deliveryadapterimplementatin" value="evault.onin.infrastructure. adapters.dtnetsmtp" /> 3. In the EVaultSDK.Scheduler.exe.cnfig file, find the fllwing lines: <system.net> <mailsettings> <smtp deliverymethd="netwrk" frm=""> <netwrk hst="" prt="" username="" passwrd="" /> </smtp> </mailsettings> </system.net> Type values fr the fllwing attributes in the qutatin marks: frm="" address that yu want t appear as the Frm address in encryptin passwrd change ntificatin s (e.g., frm="user@yurdmain.cm"). hst="" Fully qualified dmain name fr yur SMTP server (e.g., hst=" mail.yurdmain.cm"). prt="25" If yur SMTP server des nt use prt 25 fr sending s, replace 25 with the prt number fr sending s. username="" type the SMTP server user name (e.g., username="supprt"). passwrd="" type the SMTP server passwrd (e.g., passwrd="pwd"). The resulting mailsettings element will be smething like: <mailsettings> <smtp deliverymethd="netwrk" frm="user@yurdmain.cm"> <netwrk hst="mail.yurdmain.cm" passwrd="pwd" prt="25" username="supprt" /> </smtp> </mailsettings> 35

36 5.2.1 Custmize backup ntificatin s Yu can custmize backup ntificatin s t include yur rganizatin s text and branding. If yu d nt custmize backup ntificatin s, Admin users receive Carbnite-branded s when backups finish r fail n Windws systems where Agent versin 8.0 r later is installed, Linux systems where Agent versin 8.10a r later is installed, and vsphere envirnments prtected by vsphere Recvery Agent 8.40 r later. Fr example: T custmize backup ntificatin s: 1. T replace Carbnite Server Backup in backup ntificatin subject lines and text with yur prduct r service name, d the fllwing: a. On the server where the Prtal UI is installed, g t the Prtal Services\API Scheduler flder. 36

37 Fr fresh Prtal installatins, the default lcatin is C:\Prgram Files\Carbnite Server Backup\Prtal Services\API Scheduler. Fr upgraded Prtal installatins, the default lcatin is C:\Prgram Files\EVault Sftware\Prtal Services\API Scheduler. b. In a text editr, pen the EVaultSDK.Scheduler.exe.cnfig file frm the Prtal Services\API Scheduler flder. c. Lk fr the <appsettings> cnfiguratin element. d. In the <appsettings> element, add the fllwing line: <add key="prductname" value="yurprductname" /> Where yurprductname is the text that will replace Carbnite Server Backup in backup ntificatin subject lines and text. e. Save the EVaultSDK.Scheduler.exe.cnfig file. 2. T change the lg and branded text in backup ntificatin s: a. On the server where the Prtal UI is installed, g t the \Prtal Services\API Scheduler\UserNtificatins\Templates flder. This flder cntains the fllwing file: BackupTemplate.html Fr fresh Prtal installatins, the default lcatin is C:\Prgram Files\Carbnite Server Backup\Prtal Services\API Scheduler\UserNtificatins\Templates. Fr upgraded Prtal installatins, the default lcatin is C:\Prgram Files\EVault Sftware\Prtal Services\API Scheduler\UserNtificatins\Templates. b. Make a cpy f the BackupTemplate.html file. c. Open the cpied BackupTemplate.html file in a text editr, and make the fllwing changes: IMPORTANT: D nt edit anything in the BackupTemplate.html file that is nt mentined in this prcedure. Backup ntificatin s may fail if yu make ther changes in the file. T replace the Carbnite lg at the tp f the , find the fllwing lines: <a href=##lglinkurl## target= _blank > <img alt=##altlgtext## brder= 0 src= ##LgUrl## style= display:blck!imprtant; width:100%; max-width: 160px; height: aut; width= 160 /> Replace ##LgLinkURL## with the URL t link t if smene clicks the lg. Replace ##AltLgText## with alternate text t display fr the lg. Replace ##LgUrl## with a link t the lg image file hsted n a website r saved in Prtal Website\assets\images (C:\inetpub\Prtal Website\assets images, by default). The lg can have a maximum width f 184 px, and a maximum height f 30 px. 37

38 Nte: If Prtal is hsted n a web farm, and yu save the lg image file lcally, yu must save the image file n every UI nde in the farm. T replace the wrd Carbnite, Inc. in the cpyright line, find ##ServicePrviderLegalName## in the file, and replace it with yur cmpany s name. T replace the Carbnite name and address at the end f the , find ##ServicePrviderAddress## in the file, and replace it with yur cmpany s name and address. T replace the Carbnite name and privacy plicy link, find ##ServicePrviderName## in the file, and replace it with yur cmpany s name. Find ##LinkTPrivacyPage## in the file, and replace it with the link Nte: When replacing values in the cpied BackupTemplate.html file, d nt leave ## at the start r end f the new values. d. When satisfied with the edited template, rename the riginal BackupTemplate.html file s that it will nt be used as the template. Fr example, yu culd change the file name t BackupTemplate-riginal.html. e. Rename the edited template file t BackupTemplate.html. Backup ntificatin s will then use this template. f. Make a backup cpy f the edited template file s that it will nt be verwritten during future Prtal upgrades. 3. Restart the API Scheduler service. 5.3 Cnfigure ntificatins fr encryptin passwrd changes Admin users can receive s when jb encryptin passwrds change in their sites. T cnfigure ntificatins fr encryptin passwrd changes, yu must specify SMTP settings. We recmmend using authenticated SMTP. In additin, Super users must specify whether Admin users in each Prtal site are allwed t receive ntificatins. Fr mre infrmatin, see the Prtal nline help r Administratin guide. By default, ntificatins fr encryptin passwrd changes d nt include yur rganizatin s text r branding. Hwever, yu can custmize the s. See Custmize s fr encryptin passwrd changes. T cnfigure ntificatins fr encryptin passwrd changes: 1. Open the web.cnfig file fr the Prtal Service Cnnectr service (in C:\inetpub\Prtal Services Website\Prtal_Service_Cnnectr, by default) in a text editr. 38

39 2. In the web.cnfig file, find the fllwing lines: <system.net> <mailsettings> <smtp deliverymethd="netwrk" frm=""> <netwrk hst="" prt="" username="" passwrd="" /> </smtp> </mailsettings> </system.net> Type values fr the fllwing attributes in the qutatin marks: frm="" address that yu want t appear as the Frm address in encryptin passwrd change ntificatin s (e.g., frm="user@yurdmain.cm"). hst="" Fully qualified dmain name fr yur SMTP server (e.g., hst=" mail.yurdmain.cm"). prt="25" If yur SMTP server des nt use prt 25 fr sending s, replace 25 with the prt number fr sending s. username="" type the SMTP server user name (e.g., username="supprt"). passwrd="" type the SMTP server passwrd (e.g., passwrd="pwd"). The resulting mailsettings element will be smething like: <mailsettings> <smtp deliverymethd="netwrk" frm="user@yurdmain.cm"> <netwrk hst="mail.yurdmain.cm" passwrd="pwd" prt="25" username="supprt" /> </smtp> </mailsettings> Custmize s fr encryptin passwrd changes Yu can custmize s fr encryptin passwrd changes t include yur rganizatin s text and branding. If yu d nt custmize encryptin passwrd change s, users receive the fllwing unbranded s after an encryptin passwrd change in Prtal. The subject line f the is Prtal Jb Encryptin Passwrd Change. 39

40 T custmize s fr encryptin passwrd changes: 1. G t the fllwing flder: \Prtal_Service_Cnnectr\bin\JbEncryptin\Templates subflder (C:\inetpub\Prtal Services Website\Prtal_Service_Cnnectr\bin\JbEncryptin\ Templates, by default). This flder cntains tw files: JbEncryptinPasswrdChangeSubject.txt Cntains the subject line fr encryptin passwrd change ntificatin s. JbEncryptinPasswrdChange.html Template fr encryptin passwrd change ntificatin s. 2. T change the subject line f encryptin passwrd change ntificatin s, edit the JbEncryptinPasswrdChangeSubject.txt file. If yu d nt edit the JbEncryptinPasswrdChangeSubject.txt file, the encryptin passwrd change ntificatin subject line is Prtal Jb Encryptin Passwrd Change. 3. T change the text r appearance f encryptin passwrd change ntificatin s: a. Make a cpy f the JbEncryptinPasswrdChange.html file. Edit this cpied template file t change the text and/r appearance. 40

41 T include an image in the , hst the image n a website r save the image in Prtal Website\assets\images (C:\inetpub\Prtal Website\assets\images, by default), and include a link in the html file. Nte: If Prtal is hsted n a web farm, and yu save the lg image file lcally, yu must save the image file n every UI nde in the farm. b. When satisfied with the edited template, rename the riginal JbEncryptinPasswrdChange.html file s that it will nt be used as the template. Fr example, yu culd change the file name t JbEncryptinPasswrdChange-riginal.html. c. Rename the edited template file t JbEncryptinPasswrdChange.html. Encryptin passwrd change ntificatin s will then use this template. d. Make a backup cpy f the edited template file s that it will nt be verwritten during future Prtal upgrades. 41

42 6 Cnfigure Prtal 6.1 Cnfigure Prtal t use SSL By default, Prtal is nt cnfigured t use Secure Sckets Layer (SSL). Hwever, yu can cnfigure Prtal t use SSL. T cnfigure Prtal t use SSL: 1. Make sure yu have a certificate that matches the dmain name which yu will be using fr Prtal, and imprt the certificate int IIS. 2. Open Windws Explrer and g t the installatin flder fr the Prtal website. 3. Open the web.cnfig file in that flder. 4. Change the URL in the line starting with <add key="externaluri" t have https instead f http. 5. Find the fllwing line in the web.cnfig file: <httpckies httponlyckies="true" requiressl="false" /> Change the requiressl value t "True". The resulting line shuld be: <httpckies httponlyckies="true" requiressl="true" /> 6. Find the fllwing line in the web.cnfig file: <frms lginurl="~/accunt/lgon" name="prtalauth" requiressl="false" /> Change the requiressl value t True. The resulting line shuld be: <frms lginurl="~/accunt/lgon" name="prtalauth" requiressl="true" /> 7. Save the web.cnfig file. 6.2 Change the privacy plicy URL Beginning with Prtal 8.5.1, a message at the bttm f the Prtal sign-in page infrms users that the Prtal website uses ckies. This message, shwn belw, appears n the sign-in page until a user clicks "Clse" in the message bx. The message includes a privacy plicy link. By default, the privacy plicy URL is Yu can change the URL t yur cmpany s privacy plicy. T change the privacy plicy URL: 1. Open the web.cnfig file fr the Prtal Website (in C:\inetpub\Prtal Website, by default) in a text editr. 42

43 2. In the <appsettings> element, add the fllwing line: <add key="privacyplicyurl" value="yurprivacyplicyurl" /> Where yurprivacyplicyurl is the URL fr yur cmpany s privacy plicy (e.g., 3. Save the web.cnfig file. 6.3 Cnfigure a web farm A web farm uses multiple web servers t distribute yur UI prcessing lad acrss several servers. If yu need mre prcessing pwer, yu can simply add anther server withut needing t change yur Prtal cnfiguratin r installatin. The web farm uses a virtual IP address (t which yur UI applicatin pints) that is then reslved int physical addresses fr the servers. The Agents must be registered t the IP f the cmputer hsting the AMP Redirectr service. The Administratr is respnsible fr installing and cnfiguring the web farm. This includes setting the IP addresses, masks and gateways, and Netwrk Lad Balancing. These functins are nt cvered here. The installatin is dne in tw parts. One server (which is nt part f the farm) has all the cmpnents except the UI applicatin installed. The servers in the farm are then each installed with their wn cpies f the UI applicatin n each server. There can be multiple AMP Prxy servers, each f which can supprt up t 1000 registered Agents. Each AMP Prxy shuld be installed n its wn system (nt the UI system). All cmpnents n a web farm must be the same versin. If yu are upgrading, yu must upgrade all cmpnents n all servers t the same versin. Nte: The UI Web applicatin can supprt up t 50 cncurrent user cnnectins per server. If yu need mre, yu must use a web farm fr multiple servers. Nte: The Lad Balancer must be cnfigured t use sticky sessins. T cnfigure a web farm: 1. Install the Ntificatin Service, Registratin Service and SQL Server all n ne machine (nt a part f the farm). This server des nt expse anything t the internet s des nt need t be accessible by the Agents. 2. Install the Prxy and Redirectr n a server which is externally accessible. Run the installatin n each machine. Select Custm Installatin, and chse the AMP Prxy and Redirectr features t install. Agents will need t cnnect t this server ver prts 8086 and If yu have mre than 1000 Agents cnnecting t this envirnment, yu will need t set up additinal prxies. Each prxy shuld be n its wn system. 3. Install the UI cmpnent n each f the farm servers. Run the installatin n each machine. Select Custm Installatin, and chse nly the User Interface feature t install. 4. When using Prtal in a web farm cnfiguratin, all f the Prtal UIs invlved require the same machine key element in their cnfig files. Typically, the Prtal uses sticky sessins, s 43

44 the nly change required t the Prtal cnfig files is the additin f the machinekey element. T d this, n ne system in the farm, pen the IIS Manager. Select Prtal Website and under the Features View, duble click n Machine key (in the ASP.NET sectin). On the page that pens, uncheck the Autmatically generate at runtime and Generate a unique key fr each applicatin ptins fr bth the validatin key and decryptin key sectins. Fr the Encryptin Methd, select SHA1. Fr the decryptin methd, select AES. Then click Generate Keys and Apply. Open the web.cnfig file fr this applicatin and lcate the line in the file that starts with <machine key Cpy this line and paste it int the web.cnfig file fr the Prtal Website n all servers in the web farm. The line shuld be put after the line </pages> in the web cnfig file. This will ensure it is in the crrect sectin f the file (<cnfiguratin> <system.web>) If yu view the Machine Key settings thrugh the IIS manager fr any f thse web sites after saving the web.cnfig file, yu shuld see that all f the sites n all f the systems have the exact same settings with the exact same keys. 44

45 6.4 Enable tw-factr accunt verificatin When tw-factr accunt verificatin is enabled in Prtal, each user will be prmpted t prvide a phne number fr receiving an accunt verificatin cde when they first sign in. Users wh set up tw-factr accunt verificatin will be prmpted t enter a cde peridically (currently every 30 days) when they sign in t Prtal and when they reset their passwrds. Prtal uses TeleSign t send verificatin cdes t users in text messages and autmated vice calls, and t verify cdes entered in Prtal. T enable tw-factr accunt verificatin in a Prtal instance: 1. Obtain a TeleSign API key. T d this, a TeleSign accunt administratr must lg in t the Telesign prtal ( and create a TeleSign API key. 2. Enter the TeleSign API key in a Prtal cnfiguratin file. See Enter the TeleSign API key in a Prtal cnfiguratin file. 3. Run the EnableMultiFactrAuthenticatin.sql script n the SQL Server instance where Prtal databases are installed. This SQL script is prvided with Prtal, and enables tw-factr accunt verificatin in the Prtal instance Enter the TeleSign API key in a Prtal cnfiguratin file T enter the TeleSign API key in a Prtal cnfiguratin file: 1. On the system where the Prtal UI is installed, g t the Hst_Prtect flder (C:\inetpub\Prtal Services Website\Hst_Prtect), and pen the Web.cnfig file in a text editr. 2. Find the fllwing lines in the <appsettings> element: <add key="telesigncustmerid" value="custmerid" /> 45

46 <add key="telesignsecretkey" value="apikey" /> 3. Replace the custmerid with the new ID frm Telesign teleprtal. 4. Replace the APIkey with the new Telesign API key frm Telesign teleprtal. 5. Save the Web.cnfig file. 6.5 Cnfigure single sign-n (SSO) By default, users are created in Prtal and authenticated thrugh a web frm. Hwever, users can be managed and authenticated using an external federated identity server (e.g., Active Directry Federatin Services). A Prtal instance can use nly ne authenticatin methd at a time: either Prtal web frm r federated identity server. Nte: If a Prtal instance is cnfigured t use Active Directry authenticatin, this cnfiguratin is intended t be permanent. If an instance must be changed frm federated identity server t Prtal web frm authenticatin, user recrds must be recreated in Prtal. When a federated identity server is used, a user is directed t the external server fr authenticatin. Once authenticated, the user is directed back t Prtal with a SAML tken. The tken includes infrmatin frm the identity server fr autmatically creating a user in Prtal. This autmaticallycreated user specifies the user s type and rights in Prtal. It cannt be used t sign in t Prtal. Infrmatin fr an autmatically-created user in Prtal is nt necessarily up-t-date with infrmatin in the federated identity server. Fr example, if a user is deleted frm Active Directry, the crrespnding user is nt autmatically deleted frm Prtal. The fllwing requirements must be met fr Prtal single sign-n: The federated identity server must supprt WS-Federatin (e.g., Active Directry Federatin Services). Prtal must be cnfigured t use the federated identity server. See Cnfigure Prtal t use a federated identity server. The SAML tken must cntain all f the infrmatin required t autmatically create r update the crrespnding user in Prtal. See Username in the SAML tken, User rle in the SAML tken, User site in the SAML tken, and SAML tken/expected claims Cnfigure Prtal t use a federated identity server T cnfigure Prtal t use a federated identity server, make the fllwing changes in the Prtal web.cnfig file: Disable frms authenticatin Enable federated authenticatin, which will handle incming SAML tkens Cnfigure identity prvider settings IMPORTANT: Other cnfiguratin changes may be required, depending n the identity server that yu use. T cnfigure Prtal t use a federated identity server: 1. Lcate the Prtal Web.cnfig file. By default, this file is saved in c:\inetpub\prtal Website. 46

47 2. Open the Prtal Web.cnfig file in a text editr. 3. Disable frms authenticatin by ding the fllwing: e. Lcate the fllwing lines: <authenticatin mde="frms"> <frms lginurl="~/accunt/lgon" timeut="30" /> </authenticatin> f. Replace the lines shwn abve with the fllwing lines: <authenticatin mde="nne" /> <authrizatin> <deny users="?" /> </authrizatin> 4. Enable federated authenticatin by ding the fllwing: a. Lcate the <add name="httprespnseheadersanitizer" > line r lines. This line culd appear mre than nce in the Web.cnfig file. b. Directly after each ccurrence f the <add name="httprespnseheadersanitizer" > line, add the fllwing lines: <remve name="frmsauthenticatin" /> <add name="wsfederatinauthenticatinmdule" type="evault.web.ui.wsfederatinauthenticatin, EVault.Web.UI" precnditin="managedhandler" /> 5. Cnfigure identity prvider settings by ding the fllwing: a. Lcate the </cnfiguratin> line. b. Directly befre </cnfiguratin> line, add the fllwing sectin: <system.identitymdel> <identitycnfiguratin> <claimsauthenticatinmanager type="evault.web.ui.httpmdules.claimstransfrmerwrapper, EVault.Web.UI"/> <audienceuris> <add value="yuraudienceuri" /> </audienceuris> <certificatevalidatin certificatevalidatinmde="chaintrust" /> <issuernameregistry type="system.identitymdel.tkens.validatingissuernameregistry, System.IdentityMdel.Tkens.ValidatingIssuerNameRegistry"> <authrity name="yurissuersiteid"> <keys> <add thumbprint="yurissuersigningcertificatethumbprint" /> </keys> 47

48 <validissuers> <add name="yurissuersiteid" /> </validissuers> </authrity> </issuernameregistry> </identitycnfiguratin> </system.identitymdel> <system.identitymdel.services> <federatincnfiguratin> <ckiehandler requiressl="true" /> <wsfederatin passiveredirectenabled="true" issuer="yurissuerurlpassiveredirectinuri" realm="yuraudienceuri" requirehttps="true" /> </federatincnfiguratin> </system.identitymdel.services> c. Replace the highlighted variables with the apprpriate values fr yur envirnment: yuraudienceuri is the Prtal installatin URI. yurissuerurlpassiveredirectinuri is the passive requestr URL f yur identity prvider. This value can be fund in the federatin metadata in the fllwing element: PassiveRequestrEndpint/Address yurissuersiteid is the cnfigured URI f the issuer sent within SAML tken (smetimes referred t as Site ID ). This value can be fund in the federatin metadata in the entityid attribute f the EntityDescriptr element. yurissuersigningcertificatethumbprint is the IdP signing certificate thumbprint. It must be entered in uppercase with n dashes (e.g., 886B8DC3498FF93A8D0B844DC2F E7EE51 ). The IdP signing certificate must be installed n any machine where the Hst Prtect Service is installed. See Install IdP Signing Certificate n the machine where Prtal is installed. 6. If yu are using a self-signed certificate fr testing, disable certificate revcatin checking by ding the fllwing: a. Lcate the <certificatevalidatin line added in Step 5: <certificatevalidatin certificatevalidatinmde="chaintrust" /> b. Replace the line shwn abve with the fllwing line: <certificatevalidatin certificatevalidatinmde="chaintrust" revcatinmde="ncheck" /> 7. Save the Prtal Web.cnfig file. 48

49 6.5.2 Install IdP Signing Certificate n the machine where Prtal is installed Fr Prtal single sign-n, the Identity Prvider signing certificate must be installed n the machine where Prtal is installed. If Prtal is installed as a distributed system, the certificate must be installed n each machine where the Hst Prtect Service is installed Username in the SAML tken The username will be retrieved frm the fllwing attribute in the SAML tken: AttributeName="username" AttributeNamespace=" The suggested frmats fr username are: User Principal Name (UPN) - e.g., user@dmain.cm User Lgn Name - e.g., user Windws Accunt Name - e.g., dmain\user Due t Agent limitatins, it is best t keep t avid spaces and apstrphes in user names. Fr this reasn, the UPN frmat is recmmended. T ensure cmpatibility with the single sign-n implementatin in Prtal versins 7.70 and 7.62, if the username attribute is nt present, the username shuld be retrieved frm the fllwing attribute: EVaultPrtalUserName This attribute can be present in any namespace. If this attribute is nt present, use the default name attribute: AttributeName="name" AttributeNamespace=" laims" User rle in the SAML tken A user s rle in Prtal can be determined based n grup membership r anther Active Directry schema attribute. A custmer can use their existing grup structure, and map their existing (r new) rles t a specific prtal claim, using ADFS claim transfrmatin. The benefit f this apprach is that when using prper federatin with many external issuers (cmpnents that actually authenticate users), and a single federatin prvider (cmpnent that generates final SAML tken fr Prtal), the transfrmatin can be dne in ne place (federatin prvider) rather than requiring the same schema fr every issuer. Here is a wrking example f a claim as passed in the SAML tken t Prtal: <saml:attribute AttributeName="Rle" AttributeNamespace=" <saml:attributevalue>superuser</saml:attributevalue> 49

50 <saml:attributevalue>supprt</saml:attributevalue> </saml:attribute> In this case, tw rles are passed t Prtal. If multiple rles are passed, Prtal will pick the mstprivileged rle User site in the SAML tken The current single sign-n implementatin is nt intended fr Prtal instances with many sites. Hwever, because there culd be mre than ne site in a Prtal instance, the SAML tken fr a user must include a site identifier. When a user signs in t Prtal, the identifier will be matched with the existing site name in Prtal t retrieve its ID. Nte: Site names must be pre-ppulated in Prtal. <saml:attribute AttributeName="SiteName" AttributeNamespace=" <saml:attributevalue>data Factry Cmpany</saml:AttributeValue> </saml:attribute> The alternate way t prvide this infrmatin wuld be t prvide the SiteId attribute: <saml:attribute AttributeName="SiteId" AttributeNamespace=" <saml:attributevalue>22efa16b-32d c70- EFCDAAF38F02</saml:AttributeValue></saml:Attribute> If present, this attribute will take precedence and verride any value passed in a SiteName claim. It safer t use the SiteId attribute than the SiteName attribute, as thse IDs are unique and less likely t change SAML tken/expected claims This sectin lists the claims that Prtal will expect in the SAML tken. Username This is the user name. It culd be in address frmat (UPN), but it can als be lgn name (username) r windws accunt name (dmain\username) AttributeName="username" AttributeNamespace=" Here is sample claim transfrmatin rule fr UPN name: c:[type == " untname", Issuer == "AD AUTHORITY"] => issue(stre = "Active Directry", types = (" query = ";userprincipalname;{0}", param = c.value); 50

51 User Id This is the unique, nn-changing identifier f the user. AttributeName="userid" AttributeNamespace=" If the same value is passed in as username, it will be impssible t change the user name withut lsing the user identity. (Anew user wuld be created in Prtal). It is suggested t use LDAP bjectguid prperty fr this claim. Here is the example f that rule: c:[type == " untname", Issuer == "AD AUTHORITY"] => issue(stre = "Active Directry", types = (" query = ";bjectguid;{0}", param = c.value); First name This is the user first name: AttributeName="firstname" AttributeNamespace=" Last name This is the user last name: AttributeName="lastname" AttributeNamespace=" Name This is the username. This is standard claim, and is smetimes passed by the federatin prvider withut the ability t be verwritten by the username in frmat. Fr this reasn, this claim will be used nly if the username claim abve is nt prvided. This claim is ptinal and is prcessed fr backwards cmpatibility nly. If prvided, this shuld crrespnd t the AD UPN name ( frmat). AttributeName="name" AttributeNamespace=" laims" Rle This claim can cntain multiple values frm the fllwing list: SuperUser SupprtUser Admin, User ExecuteOnly ReadOnly 51

52 AttributeName="rle" AttributeNamespace=" This claim can be ppulated by list f claim transfrmatin rules that will set up given rles based n AD grup membership, fr example: c:[type == " Value == "S ", Issuer == "AD AUTHORITY"] => issue(type = " Value = "SuperUser", Issuer = c.issuer, OriginalIssuer = c.originalissuer, ValueType = c.valuetype); Site name This claim cntains the user s site name: AttributeName="sitename" AttributeNamespace=" When there is nly ne site, this value can be hardcded in the claim transfrmatin rule t the active site. Fr example: => issue(type = " Value = "Big Data Cmpany"); Site Id This ptinal claim cntains the site GUID fr the user site. If present, this will take precedence ver site name, allwing mre secure user t site assciatin. AttributeName="siteid" AttributeNamespace=" Here is example f usage: => issue(type = " Value = "B0ADAD3F-D66A A0-2C0BB14A4942"); User aut-prvisining This claim specifies whether the user is external t Prtal and therefre if aut-prvisining shuld happen r nt. The pssible values wuld be true and false. If the claim is nt present, autprvisining will be disabled. This is prvided fr backwards-functinality. Fr new custmers, this claim shuld always be passed as True: AttributeName="isuserexternal" AttributeNamespace=" 52

53 Here is a sample claim transfrmatin rule: => issue(type = " Value = "true"); Trubleshting single sign-n Issue 1: After lgging ff Prtal, the ADFS sign-ut page appears. Hwever, if the Prtal URL is entered again withut restarting the brwser, the user is autmatically lgged in again. Why des this happen? Answer: Even thugh all authenticatin ckies are cleared prperly, this happens because the brwser caches authenticatin credentials t ADFS until the brwser is restarted. This can be verified by investigating sent headers with Firebug - ntice the Authrizatin NTLM header being sent. Yu can als manually clear authenticatin credentials in Firefx by pressing Ctrl+Shift+Del and chsing Active Lgins. This will frce ADFS t reauthenticate. In nrmal perating scenaris, we recmmend that users shuld clse the brwser after lgging ff ADFS t ensure that credentials are nt cached. Issue 2: When trying t sign in t Prtal, an errr page appears. The lgs state that the prblem ccurs because f a username that already exists. Answer: This culd ccur if a user with the same name was already created fr use with frms authenticatin (Prtal web frm authenticatin), r if a user with the same name was set up fr federated authenticatin (external user) but with a different external user id. If the riginal user is n lnger needed, it can be deleted by the super user. The new user will then be able t lgin successfully. Alternatively, the new user s username can be changed t avid duplicatin. 53

54 7 Mdify Prtal Yu can change which Prtal cmpnents are installed n a server by running the Prtal installatin kit. This can be useful if Prtal was installed n a single system, and yu want t change it t a distributed system. See Cnvert Prtal frm a single system t a distributed system. Yu can als change the languages that are installed and specify whether the installatin shuld be integrated with EVault Reprts. The installers autmatically shut dwn services n the machine where yu are mdifying cmpnents. Hwever, if Prtal is installed n a distributed system, shut dwn services n ther machines befre mdifying yur installatin. T mdify Prtal: 1. On the machine where yu want t mdify cmpnents, run the Prtal installatin kit. 2. On the Welcme page, click Mdify, and then click Next. 3. On the SQL Server Setup page, chse the SQL Server instance where the databases will be installed. Specify the authenticatin methd, and then click Next. Yu can ptinally click Test t validate yur cnnectin with the database server. The Select Features page appears. Cmpnents that are currently installed n the server are selected n this page. 4. Select the check bx fr each cmpnent that yu want t add r keep. Clear the check bx fr each cmpnent that yu want t uninstall. 5. Click Next. 6. On the remaining installatin wizard pages, prvide the required infrmatin. Wizard pages that appear depend n the cmpnents selected n the Select Features page. Fr infrmatin abut specific pages, see Install Prtal n a single system. 7. In the cnfirmatin dialg bx, click OK. After the cmpnents are installed, a Cmpnent Status page appears. This page indicates which cmpnents have been installed and which cmpnents need t be installed befre the system will be peratinal. The page als indicates if ne f the cmpnents is nt at the same versins as the ther cmpnents and will still need t be upgraded. Cmpnents which are currently installed, but are nt up t the current versin, may shw as missing. 8. Click Next. 9. Click Finish. 7.1 Cnvert Prtal frm a single system t a tw-server distributed system T cnvert Prtal frm a single system t a distributed system, yu can mve frnt-end cmpnents t a new server. Mving back-end Prtal cmpnents t a new server is nt recmmended, as this prcess wuld require database migratin and is mre cmplex than mving frnt-end cmpnents. 54

55 In the tw-server distributed system created using this prcedure, the Prtal UI is installed n the same system as the Redirectr and Prxy. Althugh this cnfiguratin differs frm the large-scale distributed system shwn in Prtal Distributed System (recmmended), it can supprt mre Agents than when all Prtal cmpnents are installed n a single system (recmmended fr fewer than 500 Agents). A tw-server distributed system can als serve as an interim step in mving t the recmmended distributed system. Yu can later add a lad balancer and multiple Prtal UI machines, r multiple prxies. See Cnfigure a web farm. T cnvert Prtal frm a single system t a tw-server distributed system: 1. Prepare a new server fr installing Prtal frnt-end cmpnents. Fr system requirements, see Prerequisites and the Prtal release ntes. 2. On the riginal server where Prtal cmpnents are currently installed, run the Prtal installatin kit t uninstall the fllwing frnt-end cmpnents: AMP Redirectr Service AMP Prxy Prtal UI Fr mre infrmatin, see Mdify Prtal. 3. After the uninstallatin is cmplete, pen the Internet Infrmatin Services (IIS) Manager n the server where yu uninstalled Prtal frnt-end cmpnents. 4. Right-click Prtal Services Website, and chse Edit Bindings. 5. In the Site Bindings dialg bx, click , and then click the Edit buttn. 6. In the Edit Site Binding dialg bx, delete frm the Hst name bx, and d ne f the fllwing: In the IP address list, select an IP address that the new frnt-end server (prepared in Step 1) can access. In the Hst name bx, enter either the system s name r its fully qualified dmain name (FQDN). Nte: The Prt value in the Edit Site Binding dialg bx remains as Click OK t clse the Edit Site Binding dialg bx. 8. Click Clse t clse the Site Bindings dialg bx. 9. Restart the Prtal Services Website. 10. On the new server fr frnt-end cmpnents (prepared in Step 1), run the Prtal installatin kit t install the fllwing frnt-end cmpnents: AMP Redirectr Service AMP Prxy Prtal UI During the installatin, n the SQL Server Setup page, specify the SQL Server instance where the Prtal databases are installed n the riginal server. On the AMP Service Cnfiguratin page, enter the IP address r hstname specified in Step 6 as the Ntificatin service web address. 55

56 On the AMP Redirectr Service Cnfiguratin page, enter the IP address r hstname specified in Step 6 as the Registratin service web address. Fr mre infrmatin, see Install frnt-end system cmpnents and Install the Prxy and Redirectr. 56

57 8 Upgrade Prtal Yu can upgrade existing Prtal cmpnents. Upgrade back-end system cmpnents and databases befre upgrading frnt-end system cmpnents. Befre yu start the upgrade prcess, make sure that Each system has the crrect.net and ASP.NET versins installed. Fr required versins, see the Prtal release ntes. There is enugh free space fr backing up the Prtal databases. Prtal databases are backed up autmatically during an upgrade. 8.1 Prepare fr a Prtal upgrade Befre upgrading Prtal, make sure that users cannt access the system, shut dwn services, and back up yur databases. T prepare fr a Prtal upgrade: 1. Redirect the Lgin page t a Site under maintenance page t ensure that n users lg in during the upgrade. 2. Restart the IIS server n the frnt-end system (i.e., the system with the UI cmpnent installed) t make sure that any already lgged in users will be lgged ut. 3. Shut dwn the AMP Prxy and Registratin Service. 4. Back up the EVaultWeb, WebCC, UserManagement, and SiteManagement databases. 5. Check that the Prtal UI is unavailable t the general public. 8.2 Upgrade Prtal cmpnents On each system where Prtal cmpnents versin 7.50 r later are installed, yu can upgrade the installed cmpnents. Nte: T upgrade t Prtal frm a Web CentralCntrl versin earlier than 7.50, yu must first upgrade t Web CentralCntrl 7.50 and then upgrade t Prtal 8.5. When yu upgrade Prtal, WebCC UI and Prpagatin Service cmpnents are remved. If the Prtal UI is nt installed, the upgrade prcess will install it. T upgrade Prtal cmpnents: 1. On the machine where Prtal cmpnents are installed, lg in as an administratr and run the Prtal installatin kit. The Windws user must have full access t the Prtal databases, r the upgrade might fail. 2. On the Welcme page, click Next. A Prtal Upgrade message appears. Read the message, and then click OK. 57

58 3. On the SQL Server Setup page, chse the SQL Server instance where the databases are installed. Specify the authenticatin methd, and then click Next. Yu can ptinally click Test t validate yur cnnectin with the database server. 4. If a cnfirmatin dialg bx shws cmpnents n the system that were installed using a Web CentralCntrl installatin kit, click Yes. 5. On the remaining installatin wizard pages, prvide the required infrmatin. Wizard pages that appear depend n the cmpnents that are being upgraded n the system. Fr infrmatin abut specific pages, see Install Prtal n a single system. 6. In the cnfirmatin dialg bx, click Yes. After Prtal cmpnents are upgraded, a Cmpnent Status page appears. This page indicates which cmpnents have been installed and which cmpnents need t be installed befre the system will be peratinal. 7. Click Next. 8. On the Upgrade Cmplete page, click Finish. 8.3 (Optinal) Upgrade the perating system t Windws Server 2016 Beginning with Prtal versin 8.50, Prtal is supprted n Windws Server Since previus Prtal versins are nt supprted n Windws Server 2016, we recmmend upgrading t Prtal 8.5 and then upgrading the perating system t Windws Server Make the upgraded Prtal available t users T make the upgraded Prtal available t users: 1. After upgrading Prtal back-end and frnt-end cmpnents, verify that the Prtal installatin is functinal. See System validatin. 2. Remve the redirectin cmpleted in Prepare fr the Prtal upgrade, and pint t the lgin lcatin previusly used fr Prtal. 58

59 8.5 Rll back databases after a failed upgrade During an upgrade, dump files are created. These can be used t manually rll back the databases in case the upgrade fails. The databases are backed up t the fllwing files: EVaultWeb.bak WebCC_database.bak UserManagement_database.bak SiteManagement_database.bak Each dump file name als includes the date and time when the file was created. Dump files are typically saved in the fllwing lcatin: C:\WebCCDBBackup\ Dump files remain after an upgrade. Yu shuld peridically clean up the files. The database files are nt remved whether the upgrade succeeds r fails. They are nt remved during uninstallatin. They are nt created r updated when a fresh Install, Repair, r Mdify is run. 59

60 9 Validate the Prtal installatin After installing Prtal, check that the system is wrking by perfrming the fllwing tasks: Lg in t Prtal fr the first time Create a site Create an Admin user Add a cmputer Add a backup jb View the Reprts tab 9.1 Lg in t Prtal fr the first time A default super user is added when yu install Prtal. Yu can lg in as this super user t start validating the installatin. T lg in t Prtal fr the first time: 1. In a supprted Web brwser, g t the Prtal URL. 2. Lg in using the default super user credentials: User Name = super Passwrd = 3Vlt1nc 3. In the Change Passwrd dialg bx, enter the super user s current passwrd and new passwrd, and then click Change Passwrd. Nte: The passwrd is case-sensitive. 9.2 Create a site T create a site: 1. When lgged in as the super user, click Sites n the navigatin bar. 2. Click Create New Site. The Site Details tab pens. 3. In the Parent list, click This site has n parent. 4. In the Site Name bx, enter a name fr the new site. The site name must be unique. 5. (Optinal) Enter ther site infrmatin. 6. Click Save Site. The Site Details tab clses, and the new site appears in the grid. 9.3 Create an Admin user Super users cannt add cmputers r manage backups in Prtal. Yu must create an Admin user t ensure that yu can perfrm these tasks in the new Prtal installatin. T create an Admin user: 60

61 1. When lgged in as the super user, click User Manager n the navigatin bar. 2. Click Create New User. 3. On the User Inf tab, in the Address (Username) bx, type the user s address. The user will lg in t Prtal using this address. 4. In the First Name bx, type the user s given name. 5. In the Last Name bx, type the user s surname. 6. In the Rle list, click Admin. 7. In the Site list, click the site that yu created. See Create a site. 8. In the Passwrd and Cnfirm Passwrd fields, type the user s passwrd fr lgging in t Prtal. 9. Click Create. 9.4 Add a cmputer T add a Windws, Linux r UNIX cmputer in Prtal yu must install r update Agent sftware n the cmputer. When asked t register the Agent with Prtal, enter the hst name that was entered when installing the externally accessible AMP Redirectr Service. See Install prxy systems fr distributed systems, and Install Prtal n a single system. Fr mre infrmatin abut registering an Agent with Prtal, see the specific Agent guide. T add a VMware vsphere 6.5 envirnment in Prtal, install the vsphere Recvery Agent and register the Agent t Prtal. T add anther supprted vsphere envirnment, deply a vsphere Agent and use the webcc register cmmand t enter the Prtal hst name r IP address and prt fr cmmunicating with Prtal. Fr mre infrmatin, see the vsphere Agent User Guide. T add a Hyper-V envirnment in Prtal, install a Hyper-V Agent and prvide credentials fr the agent t authenticate with a Hyper-V envirnment. See Add a Hyper-V envirnment and the Hyper- V Agent User Guide. When adding a cmputer fr Prtal, yu must enter the name f the Admin user yu created. See Create an Admin user. The added cmputer appears n the Cmputers page when this user, r anther Admin user fr the site, lgs in t Prtal. 9.5 Add a backup jb T add a backup jb: 1. In a supprted Web brwser, g t the Prtal URL. 2. Lg in as the Admin user yu created. See Create an Admin user. 3. On the navigatin bar, click Cmputers. 4. Find the cmputer that yu added (see Add a cmputer), and expand its view by clicking the cmputer rw. 5. If yu are adding the first backup jb fr a Windws cmputer, click Cnfigure Manually. 61

62 6. On the Vault Settings tab, click Add Vault. In the Vault Settings dialg bx, enter vault infrmatin and credentials fr cnnecting t the vault. Click Save. 7. Click the Jbs tab. 8. In the Select Jb Task list, click Create New Lcal System Jb. 9. In the Create New Jb dialg bx, specify the fllwing infrmatin: In the Name bx, type a name fr the backup jb. In the Descriptin bx, type a descriptin fr the backup jb. In the Destinatin list, select the vault where yu want t save the backup data. In the Lg File Optins list, select the level f detail fr jb lgging. If the Encryptin Settings list appears, select an encryptin methd fr string the backup data. If the backup data will be encrypted, enter an encryptin passwrd in the Passwrd and Cnfirm Passwrd bxes. Yu can als enter a passwrd hint in the Passwrd Hint bx. 10. In the Select Files and Flders fr Backup bx, select drives, flders, and files t include in the backup jb. 11. Click Create Jb. The jb is created, and the View/Add Schedule dialg bx appears. Click Cancel if yu d nt want t create a schedule. 9.6 View the Reprts tab T determine whether Carbnite Server Backup Reprts is integrated with Prtal, lg in as an Admin user, and click the Reprts tab. Reprts nly appear n the tab if Reprts is integrated with Prtal. See Integrate Prtal with Carbnite Server Backup Reprts. 62

63 10 Trubleshting and Maintenance This sectin describes issues that yu might encunter when installing and managing Prtal, and prvides suggestins fr reslving issues and maintaining Prtal Redirecting Prts Issue: Prtal was previusly re-cnfigured t use nn-default prts, and users have bkmarks which use thse nn-default prts. After an upgrade t versin 7.61 r later, the Prtal website uses the default prts. Slutin: Create a website which listens n the riginal (nn-default) prt and redirects the user t the default prt Open IIS Manager Under Sites right click and Add Web Site Cnfigure the website as belw: The Physical Path shuld pint t a directry which has n ther websites in it. It is recmmended t create a new directry fr this site. The Hst Name shuld be the name that was previusly cnfigured fr the Prtal website. The Prt shuld be the prt that the website was previusly cnfigured under. Mst likely, this wuld be prt 81 r prt 444 (if using https). 63