Table of Contents. Section 1: DocSTAR NetConnect v1.0 Requirements & Installation CD. DocSTAR NetConnect v1.0 Installation Guide

Transcription

1 NetConnect v1.0 Installation Guide Revision 7 8/7/2002

2

3 NetConnect v1.0 Installation GuG ide Revision 7 8/7/2002 u

4

5 Introduction Table of Contents Section 1: DocSTAR NetConnect v1.0 Requirements & Installation CD... 1 Section 2: DocSTAR NetConnect v1.0 Installation... 3 Step 1: Install DocSTAR NetConnect License on DocSTAR Host... 4 Step 2: Verify that Internet Information Server (IIS) is enabled with proper settings... 4 Step 3: Install Microsoft IIS Security Lockdown Tool... 6 Step 4: Install DocSTAR NetConnect v1.0 Software Step 5: Install DocSTAR Digital Certificate (for SSL Communications) Step 6: Final NetConnect Setup Step 7: Test DocSTAR NetConnect Installation on Host Step 8: Configure Router Connections for DocSTAR NetConnect Step 9: Configure and Test DocSTAR NetConnect remote clients Appendix A: NetConnect Installation Files Appendix B: NetConnect Additions to DSHOST Service/Desktop DocSTAR NetConnect v1.0 Installation Guide

6

7 Introduction DocSTAR NetConnect v1.0 is an optional software module that allows a DocSTAR v3.x Departmental or Enterprise System to become a Secure Internet accessible Document Imaging System. Through the use of today s widely available Secure High-Speed WAN/Internet Connections, DocSTAR can now become The Electronic Filing System People want to use remotely. DocSTAR NetConnect allows a client computer to access the DocSTAR Host over the Internet in the same fashion that they access the DocSTAR Host from their LAN. From a DocSTAR User perspective, the operation of DocSTAR is exactly the same. If the DocSTAR user is using a Laptop that is attached to the LAN when they are in the office and connects via a High-Speed WAN/Internet connection when they are at home, they can easily switch from LAN to Internet Mode and back as necessary. Conceptual Overview DocSTAR NetConnect v1.0 Installation Guide

8

9 Section 1: DocSTAR NetConnect v1.0 Requirements & Installation CD This section will familiarize you with the minimum requirements to install DocSTAR NetConnect v1.0 Software and the contents of the DocSTAR NetConnect v1.0 Installation CD. The following listed DocSTAR Host System minimum requirements must be satisfied before DocSTAR NetConnect v1.0 Software can be installed on the DocSTAR Host System. Please keep in mind, although the minimum requirements may be satisfied, performance may not be adequate. For this reason, there is a recommended specification (for better performance) next to the minimum requirement for hardware. Note: The installation of DocSTAR NetConnect v1.0 should only be performed by DocSTAR v3.x Enterprise DocSTAR Service Engineers (EDSE). Important Note: When selecting a high-speed Internet connection (for the DocSTAR NetConnect Host) and Internet Service Provider, be sure that hosting a Web Server is allowed and the required port (port 80 for http and/or port 443 for SSL) is open for Internet requests. DocSTAR Host System Requirements Hardware Minimum Requirement Recommended Processor Pentium III based DocSTAR Host Pentium 4 based DocSTAR Host RAM 256 MB 512 MB (or higher) SVGA Monitor 32-bit Color 32-bit Color Hard Drive Space (for DocSTAR NetConnect v1.0 software) WAN/Internet Connection Bandwidth requirement may increase as the # of concurrent client connections increases 1024 x 768 Resolution 1024 x 768 Resolution 2 MB 2 MB Business Cable, Business DSL, Dedicated Frame Relay, or T1 with a Static IP Address Dedicated Frame Relay, T1 or higher with a Static IP address Software Minimum Requirement Recommended Operating System MS Windows 2000 Server MS Windows 2000 Server Existing DocSTAR Software Version (Host) DocSTAR Version 3.x Departmental or Enterprise DocSTAR Version 3.x Departmental or Enterprise DocSTAR Client Requirements (to use DocSTAR v3.x in Internet Mode ) Hardware Minimum Requirement Recommended Processor Pentium II Pentium III (or higher) RAM 64 MB 256 MB (or higher) SVGA Monitor 256 Color 800 x 600 Resolution 32-bit Color 1024 x 768 Resolution Hard Drive Space 100 MB 100 MB (or higher) (for DocSTAR v3.x software) CD-ROM Drive For Installing Software For Installing Software WAN/Internet Connection High-Speed Connection (Cable/DSL/Frame Relay/T1) High-Speed Connection (Cable/DSL/Frame Relay/T1) Software Minimum Requirement Recommended Operating System Windows 98 Windows 2000 Professional or Server Microsoft Internet Explorer MS IE 4.0 SP2 or higher MS IE 5.0 DocSTAR NetConnect v1.0 Installation Guide Page1

10 The DocSTAR NetConnect v1.0 Installation CD The DocSTAR NetConnect v1.0 Installation CD contains the following: iislockd.exe - SETUP.EXE - Contains the Microsoft Internet Information Services (IIS) Security Lockdown Tool installation program. This program is not used by the DocSTAR NetConnect v1.0 setup program. This program should be run before installing NetConnect v1.0 software. The DocSTAR NetConnect v1.0 setup program. Page 2 DocSTAR NetConnect v1.0 Installation Guide - v3.x

11 Section 2: DocSTAR NetConnect v1.0 Installation This section will guide you through the installation of DocSTAR NetConnect v1.0 Software. DocSTAR NetConnect Architecture The diagram below provides a simplified graphical representation of the architecture of DocSTAR NetConnect v1.0. Installation Steps Below is a list of the installation steps to be performed: 1. Install DocSTAR NetConnect License on DocSTAR Host 2. Verify that Internet Information Server (IIS) is enabled with proper settings 3. Install Microsoft IIS Security Lockdown Tool 4. Install DocSTAR NetConnect v1.0 Software 5. Install DocSTAR Digital Certificate (for SSL Communications) 6. Create Local User Account for remote access (if necessary) 7. Test DocSTAR NetConnect Installation on Host 8. Configure Router Connections for DocSTAR NetConnect 9. Configure and Test DocSTAR NetConnect remote clients Note: Appendices A & B provide detailed information about installation files and modifications made to the DSHost Service/Desktop. *Important Note: In all of the following steps, you must be logged into the Windows 2000 Server DocSTAR Host as Administrator. This assures that you will have the necessary rights to perform the installation properly. DocSTAR NetConnect v1.0 Installation Guide Page3

12 Step 1: Install DocSTAR NetConnect License on DocSTAR Host Purpose: This step enables the DocSTAR Host to communicate with DSProxy.DLL and the presence of the license also provides an indication to the DSHost Service/Desktop that virtual web shares must be established every time it starts, see Appendices A & B. DSProxy.DLL provides an intermediate communication step between DSServer.DLL (processes all client requests) and Listen.ASP (Active Server Page that actually listens for internet client requests). With the DocSTAR NetConnect Certificate in hand, call DocSTAR Technical Support and add the DocSTAR NetConnect License (as well as any additional licenses necessary) to the Hardware Key on the DocSTAR Host System using the DocSTAR Administration Program. Step 2: Verify that Internet Information Server (IIS) is enabled with proper settings Purpose: This step verifies that Internet Information Services are enabled and set properly in order to provide the Web Services necessary for Listen.ASP (Active Server Page) to function properly, see Appendix A. On Microsoft Windows 2000 Server, Internet Information Services (IIS) is enabled by default. If IIS has been disabled, it must be enabled again. Using the Control Panel\Add/Remove Programs select Add/Remove Windows Components and verify that Internet Information Services are enabled and verify that the options are set as shown in the following screens: Page 4 DocSTAR NetConnect v1.0 Installation Guide - v3.x

13 The details should be set as follows: Scroll down to verify the rest of the settings, as shown below. DocSTAR NetConnect v1.0 Installation Guide Page5

14 Step 3: Install Microsoft IIS Security Lockdown Tool Purpose: This step installs the Microsoft IIS Security Lockdown Tool. This tool modifies the way IIS is configured and installs URLScan (a special Internet request filter) to provide better security for Web Servers. This helps prevent hackers, viruses, worms and other unwanted Internet traffic from attacking the Web Server. Important Note: Installation of the IIS Security Lockdown Tool is considered the minimum security measure required to provide a reasonably safe and secure DocSTAR Web Server Solution. Insert the DocSTAR NetConnect v1.0 CD into the CD-ROM drive and run iislockd.exe. You will see the Welcome screen. Click Next. Page 6 DocSTAR NetConnect v1.0 Installation Guide - v3.x

15 If you instead see the This Server Was Already Configured screen, the Internet Lockdown tool has already been installed. Click Cancel to exit the lockdown tool and continue with Step 4. You will see the License Agreement screen. Select I agree and click Next. DocSTAR NetConnect v1.0 Installation Guide Page7

16 You will see the Select Server Template screen. Select Dynamic Web Server (ASP enabled) and click Next. This Web Server Template will configure IIS with the optimum security options for a Dynamic Web Server that uses Active Server Pages (such as DocSTAR w/netconnect). You will see the URLScan screen. Make sure the checkbox is checked and click Next. Page 8 DocSTAR NetConnect v1.0 Installation Guide - v3.x

17 You will see the Ready to Apply Settings screen. Click Next. You will see the Applying Security Settings screen. Click Next. DocSTAR NetConnect v1.0 Installation Guide Page9

18 You will see the Completing the Internet Information Services Lockdown Wizard screen. Click Finish. Step 4: Install DocSTAR NetConnect v1.0 Software Purpose: This step installs the DocSTAR NetConnect v1.0 Software. The files installed and changes made to the DSHost Service/Desktop are outlined in Appendices A & B. Insert the DocSTAR NetConnect v1.0 CD into the CD-ROM drive and run SETUP.EXE. Page 10 DocSTAR NetConnect v1.0 Installation Guide - v3.x

19 You will see the Select DocSTAR Host screen. Enter the computer name of the DocSTAR Host and click Next. You will see the Start Installation screen. Click Next. DocSTAR NetConnect v1.0 Installation Guide Page11

20 You will see the Installation Complete screen. Click Finish. Page 12 DocSTAR NetConnect v1.0 Installation Guide - v3.x

21 Step 5: Install DocSTAR Digital Certificate (for SSL Communications) Purpose: This step installs the DocSTAR Digital Certificate for SSL communications. SSL (Secure Sockets Layer) provides an added level of security when accessing information over the Internet. Most Internet online banking and shopping transactions use SSL. SSL allows a web client and web server to set up encrypted communications between them, thereby making the communications much more secure. A Digital Certificate is necessary and used by IIS to identify itself to a web client and set up the SSL encryption scheme between them. DocSTAR NetConnect installs a DocSTAR generic, unsigned, and untrusted Digital Certificate for DocSTAR clients and the DocSTAR NetConnect Host to be able to communicate over the Internet using SSL (if desired and setup appropriately as will be shown later). Unsigned and untrusted Digital Certificates function just as signed and trusted certificates. The only difference between them is that signed and trusted Digital Certificates are generated by a Trusted Certificate Authority (such as VeriSign). Signed and trusted Digital Certificates can be obtained (for a fee) from a Trusted Certificate Authority and used in place of the generic Digital Certificate supplied by DocSTAR (if desired). Right-click on My Computer and select Manage. You will see the Computer Management screen. Right-click on Default Web Site and select Properties. DocSTAR NetConnect v1.0 Installation Guide Page13

22 You will see the Default Web Site Properties screen. Select the Directory Security tab. You will see the Directory Security tab. Select the Server Certificate button from the Secure communications area. Page 14 DocSTAR NetConnect v1.0 Installation Guide - v3.x

23 You will see the Welcome to the Web Server Certificate Wizard screen. Click Next. You will see the Server Certificate screen. Select Import a certificate from a Key Manager backup file and click Next. DocSTAR NetConnect v1.0 Installation Guide Page15

24 You will see the Import screen. Type C:\DOCSTAR\docstar.key and click Next. You will see the Key Manager Certificate Password screen. Type docstar and click Next. Page 16 DocSTAR NetConnect v1.0 Installation Guide - v3.x

25 You will see the Imported Certificate Summary screen. Click Next. You will see the Completing the Web Server Certificate Wizard screen. Click Finish. DocSTAR NetConnect v1.0 Installation Guide Page17

26 Step 6: Final NetConnect Setup Purpose: In this step, the final NetConnect Setup is completed. A user account may be created for the remote client to use to login. This is only necessary if a user account(s) doesn t already exist for this purpose. There can either be one user account used for all remote client logins or each remote client login can use it s own login. Note: If the DocSTAR Host System is logging into a Domain, accounts that exist in the Domain can be used to login to the DocSTAR Host System. Launch the DocSTAR Administration program. You will see the Administration Screen. Click on the NetConnect button. You will see the NetConnect Setup screen. Set Authentication and IIS Log File parameters desired. Enter the name of the Windows NT/2000 Domain that will be the Default Logon Domain (if using Domain accounts to logon). Page 18 DocSTAR NetConnect v1.0 Installation Guide - v3.x

27 Click OK to accept the changes and exit the Administration program. To create a Local account to logon to DocSTAR through NetConnect: Right-click on My Computer and select Manage. You will see the Computer Management screen. Right-click on Local Users and Groups\Users and select New User. DocSTAR NetConnect v1.0 Installation Guide Page19

28 You will see the New User screen. You can choose to create one generic DocSTAR account (for all remote users) or create an individual account for each user that will be accessing remotely. Note: This step is not necessary if the DocSTAR host is logging into a Domain and each user, that will be accessing remotely through NetConnect, already has an account in the Domain that will be used to validate their remote access. Be careful when setting the user name and password, since they are case sensitive. Page 20 DocSTAR NetConnect v1.0 Installation Guide - v3.x

29 Step 7: Test DocSTAR NetConnect Installation on Host Purpose: In this step, the DocSTAR NetConnect installation will be tested locally using a web browser. The DocSTAR NetConnect software setup installs a default.htm test page to test the proper operation of DocSTAR NetConnect over http and/or SSL connections from a web browser. To test standard http communications: Launch a web browser (such as Internet Explorer) and type in the following address (if the computer name of the DocSTAR Host is DocSTAR, if it is not then substitute the DocSTAR Host computer name). Press Enter. If IIS and DocSTAR NetConnect are installed properly and running, you should see the Enter Network Password screen. Enter the user account information that was setup in Step 6. Click Next. If IIS and DocSTAR NetConnect are installed properly, you should now see the test page displayed successfully as shown below. DocSTAR NetConnect v1.0 Installation Guide Page21

30 To test SSL communications: Launch a web browser (such as Internet Explorer) and type in the following address (if the computer name of the DocSTAR Host is DocSTAR, if it is not then substitute the DocSTAR Host computer name). Press Enter. Note: When communicating over SSL notice that https is used in the address instead of http. If IIS and DocSTAR NetConnect are installed properly and running, you should see the Security Alert screen. This is a standard warning that the Server Digital Certificate is an unsigned and untrusted certificate. Click Yes. Page 22 DocSTAR NetConnect v1.0 Installation Guide - v3.x

31 If IIS and DocSTAR NetConnect are installed properly and running, you should see the Enter Network Password screen. Enter the user account information that was setup in Step 6. Click Next. DocSTAR NetConnect v1.0 Installation Guide Page23

32 If IIS and DocSTAR NetConnect are installed properly for SSL communications, you should now see the test page displayed successfully as shown below. Note: When a successful SSL connection has been established there will be a picture of a lock in the bottom status bar. Step 8: Configure Router Connections for DocSTAR NetConnect Purpose: In this step, information is presented to facilitate the proper setup of a router used to connect the DocSTAR NetConnect Host to the Internet. Due to the wide variety of routers and high-speed connections available, it is not possible to offer detailed instructions for configuring every make and model of router or type of connection and Internet Service Provider. It is highly recommended that these configuration settings be discussed with and setup by the customer s Network Administrator. Important Note: Depending on the type of connection (at the DocSTAR NetConnect Host location) and the Service Agreement between the Internet Service Provider and the Customer, hosting a Web Server may be restricted or prohibited. In addition, the Internet Service Provider may elect to block port 80 for incoming requests (this will prevent Internet users from connecting to the DocSTAR NetConnect Host through standard http communication, however SSL (https) communications may still be functional). When selecting a high-speed Internet connection (for the DocSTAR NetConnect Host) and Internet Service Provider, be sure that hosting a Web Server is allowed and the required port (port 80 for http and/or port 443 for SSL) is open for Internet requests. Page 24 DocSTAR NetConnect v1.0 Installation Guide - v3.x

33 First, obtain the Static IP Address of the Router on the WAN/Internet side (this is the IP Address that the Internet sees when communicating with the router). In some cases, there may be multiple Static IP Addresses assigned to one router. If so, one must be selected for use with DocSTAR NetConnect. Record it below. Static IP Address of Router (WAN/Internet side):... Second, obtain the Static IP Address of the DocSTAR NetConnect Host on the LAN. Record it below. Static IP Address of DocSTAR NetConnect Host:... In order for the DocSTAR NetConnect Host to receive and respond to Internet requests the following ports need to be open for inbound and outbound communication. Note: You may choose to have the DocSTAR NetConnect Host receive and respond to standard http requests only, SSL https requests only, or both. For standard http communication: For SSL https communication: Port 80 must be open Port 443 must be open In addition, since the DocSTAR NetConnect Host cannot be addressed directly from the Internet, the following ports need to be forwarded to the DocSTAR NetConnect Host by the router. Note: This will configure the router to send all Internet Requests addressed to the Static IP Address of the router (WAN/Internet side) on these ports to the DocSTAR NetConnect Host. This is necessary for DocSTAR NetConnect to function properly. For standard http communication: For SSL https communication: Port 80 must be forwarded to the Static IP Address of the DocSTAR NetConnect Host Port 443 must be forwarded to the Static IP Address of the DocSTAR NetConnect Host As an example, the forwarding configuration of a sample LinkSys Router is shown below (the Static IP Address of the DocSTAR NetConnect Host in this example is ): DocSTAR NetConnect v1.0 Installation Guide Page25

34 Step 9: Configure and Test DocSTAR NetConnect remote clients Purpose: This is the final step in which remote clients will be setup and tested. To setup remote clients you will need to have the Static IP Address of the Router used with the DocSTAR NetConnect Host (or the Static IP Address selected for use with DocSTAR NetConnect). This was recorded in Step 8. Install DocSTAR v3.x Software on the remote client station. When you see the Select DocSTAR Host Settings screen set the Internet Settings as follows: Default Connection Type: DocSTAR Host Name: Use SSL (Encryption): Host Domain Name: Host Domain Address Internet DOCSTAR (in this example) Selected (in this example) (in this example) (this is the Static IP Address of the Router) /dsnc/ Note: You will have to enter Internet User Name and Password settings from the DocSTAR Setup screen. Page 26 DocSTAR NetConnect v1.0 Installation Guide - v3.x

35 From the DocSTAR Setup screen verify the settings are correct and enter the Internet User Name and Password information from Step 6. DocSTAR NetConnect v1.0 Installation Guide Page27

36 It is also recommended that you select the Station Settings tab and check the Show Progress Dialog Box on Long Operations checkbox. (This will allow remote clients to monitor the progress of long operations). You should now be able to access DocSTAR remotely. If DocSTAR is not able to run properly, you may use the Internet Explorer test procedure outlined in Step 7 to verify that it has been set up properly. Note: If using test procedure from Step 7, substitute the DocSTAR Host Name DOCSTAR with the Static IP Address of the router in the address bar. or Page 28 DocSTAR NetConnect v1.0 Installation Guide - v3.x

37 Appendix A A: NetConnect Installation Files The following files are installed, to the directory locations listed, during the NetConnect installation process: DSProxy.DLL C:\DocSTAR DocSTAR.key C:\DocSTAR TLBINF32.DLL C:\winnt\system32 Hisecweb.inf C:\winnt\security\templates Listen.ASP C:\inetpub\wwwroot\dsnc Upload.ASP C:\inetpub\wwwroot\dsnc Default.htm C:\inetpub\wwwroot\dsnc DocSTAR_01.gif C:\inetpub\wwwroot\dsnc DocSTAR_14.jpg C:\inetpub\wwwroot\dsnc DocSTAR_nav_home.gif C:\inetpub\wwwroot\dsnc Handinmonitor.gif C:\inetpub\wwwroot\dsnc File Definitions: DSProxy.DLL o Called by Listen.ASP o Translates XML Requests o Calls DSServer.DLL o Returns the response in XML DocSTAR.key o Generic, unsigned and untrusted digital certificate used for SSL communications TLBINF32.DLL o Used by DSProxy.DLL. Listen.ASP o Receives request from Client o Creates the connection to DSProxy.DLL o Passes the request to DSProxy.DLL o Returns the result of the call to the client Upload.ASP o Uploads files to the specified location Default.htm o Default/test html page displayed when directly connecting to the Server from a web browser DocSTAR_01.gif o Graphic used by Default.htm DocSTAR_14.gif o Graphic used by Default.htm DocSTAR_nav_home.gif o Graphic used by Default.htm Handinmonitor.gif o Graphic used by Default.htm DocSTAR NetConnect v1.0 Installation Guide Page29

38 Appendix B B: NetConnect Additions to DSHOST Service/Desktop The following actions are added to the DSHOST Service/Desktop and are executed each time the DSHost Service/Desktop is started: Creates a virtual web share for the DocSTAR directory (usually C:\DOCSTAR) Creates a virtual web share for the Archive directory (usually E:\ARCHIVE) Creates a virtual web share for the Two-Tier Storage directory (usually D:\DOCS) Note: The above virtual web shares are created using the same naming convention as their hidden LAN network shares. The properties for the above shares are set as follows, each time the DSHOST Service/Desktop is started: Read Access: Yes (Allows reading of a file) Write Access: No (Does not allow writing of a file) Directory Browsing: No (Does not allow directory browsing) Client Logging: No (Does not write client requests to a log file) Anonymous Access: No (Does not allow anonymous access) NTLM Authentication: No (Does not use NTLM Authentication scheme) Basic Authentication: Yes (Uses Basic Authentication scheme) Enable Default Doc: No (Does not allow a default.htm/asp file) Access Script: No (Does not allow.asp file execution) The directory C:\inetpub\wwwroot\dsnc is assigned the following properties: Read Access: Yes (Allows reading of a file) Write Access: No (Does not allow writing of a file) Directory Browsing: No (Does not allow directory browsing) Client Logging: No (Does not write client requests to a log file) Anonymous Access: No (Does not allow anonymous access) NTLM Authentication: No (Does not use NTLM Authentication scheme) Basic Authentication: Yes (Uses Basic Authentication scheme) Enable Default Doc: Yes (Allows a default.htm/asp file) Access Script: Yes (Allows.asp file execution) Important Note: If any of the above IIS settings are manually reconfigured, the DSHOST Service/Desktop will reset them back to the settings shown above, the next time it is started. Page 30 DocSTAR NetConnect v1.0 Installation Guide - v3.x