Using ifix EGD I/O Driver and OPC Server v7.20 with Microsoft Windows XP Service Pack 2 WHITE PAPER

Transcription

1 Using ifix EGD I/O Driver and OPC Server v7.20 with Microsoft Windows XP Service Pack 2 WHITE PAPER Last Modified: September 16, 2004

2 Table of Contents Introduction... 1 Network Protection... 1 Windows Firewall... 1 Windows Firewall settings... 2 Allowing Exceptions... 4 DCOM Enhancements... 9 DCOM Settings System-wide COM/DCOM Settings Driver-specific DCOM Settings References: White Paper: Windows XP Service Pack 2 Overview Windows XP Service Pack 2 Security Information for Developers Windows XP Security Guide White Paper: Using OPC over DCOM with Windows XP Service Pack Disclaimer: i

3 Introduction Microsoft Windows XP Service Pack 2 (SP2) includes many changes and security enhancements that will directly affect all ifix drivers that use DCOM for remote connectivity. In addition, any ifix Ethernet driver that supports receiving unsolicited messages (UDP or TCP) from the hardware (PLC, controller, or some other remote machine) may also be affected. This document is written specifically for the ifix EGD I/O Driver v7.20 with Microsoft Windows XP Service Pack 2 operating system and may not be applicable to other versions of the Operating system or to other ifix drivers. Network Protection The three major areas of improved network protection in Windows XP Service Pack 2 are the Windows Firewall, Distributed COM, and Remote Procedure Calls. In addition, some unnecessary services have been disabled, by default. Windows Firewall The major enhancement in SP2 is the Windows Firewall, which is turned ON by default. This helps to protect your computer against security threats. When turned ON, Windows Firewall blocks all unsolicited requests to connect to your computer, except for requests to programs or services selected on the Exceptions tab. 1

4 Windows Firewall settings To modify Windows firewall settings: 1. Click Start and then click Control Panel. 2. In control panel, click Windows Security Center. The Windows Security Center dialog box appears. 3. Click Firewall. The Windows Firewall dialog box appears. 2

5 4. On the General Tab make your selection. By default, the Windows Firewall is set to ON. It is recommended by Microsoft that you keep it at this setting (ON) to give your machine the highest possible protection. 5. Click OK to save your changes. 3

6 Allowing Exceptions Because the firewall restricts communication between your computer and any other computer on the network, you will need to adjust the setting for programs that need an open connection. You can make an exception for these programs, so that they can communicate through the firewall. The Windows Firewall Exception can be specified at two main levels: the Program level and the Port level At the Program level, you can specify the Programs (Applications or Services) that are able to respond to unsolicited communications from other computers/devices on the network. At the Port level, you can specify whether or not the firewall allow traffic on a specific port for either TCP or UDP communications. In this case, all applications that use the specified port for communications will be allowed (or not allowed) communications on that port. For proper communications of the EGD driver, you must open the firewall for the EGD driver and EGD Services. If you are using the EGD Management Tool (EMT) on this computer, then you must add EMT.exe, which is located in the C:\Program Files\GE Industrial Systems \EGD Management Tool\ sub-directory (or wherever your EMT program is installed). If you are using the EGD driver as an OPC Server and want to connect to it remotely using DCOM, then you will also have to add Dllhost.exe, located in the C:\Windows\System32 sub-directory (or wherever your Windows program is installed). This is necessary because the EGD OPC Data Access Server and EGD OPC Alarms & Events Server are implemented as InProc (dll) Servers. 4

7 To add a program to the Exceptions list: 1. Click Start and then click Control Panel. The Control Panel dialog box appears. 2. In control panel, click Windows Security Center. The Windows Security Center dialog box appears. 3. Click Firewall. The Windows Firewall dialog box appears. 4. Select the Exceptions tab, 5

8 5. Click Add Program. The Add Program dialog box appears. ` 6. Click Browse and navigate to the directory where your EGD driver is installed. 7. Select EGDDRV.exe program, and then click OK. The EGDDrv program appears in the Programs list on the Add a Program dialog box. 8. Repeat Steps 6 and 7 to add EGDDataService.exe to the Program list. 9. If you are using the EGD Management Tool, Repeat Steps 6 and 7 to add EMT.exe to the Program list. 10. If you are using the EGD driver as an OPC Server and want to connect to it remotely using DCOM, then you must also add Dllhost.exe, which is located in the C:\Windows\System32 sub-directory (or wherever your Windows program is installed). 11. Click OK to save your changes. 6

9 To add a port to the Exceptions list: If you are using DCOM to remotely connect to the EGD driver, either through a remote OPC Client or remote PowerTool, you must open DCOM listen TCP Port Click Start and then click Control Panel. The Control Panel dialog box appears. 2. In control panel, click Windows Security Center. The Windows Security Center dialog box appears. 3. Click Firewall. The Windows Firewall dialog box appears. 4. Select the Exceptions tab. 5. Click Add Port. The Add a Port dialog box appears. 6. In the Name field, enter DCOM Listen. 7. In the Port number field, enter Select the TCP option. 9. Click OK to save your changes and return to the Windows Firewall dialog box. 7

10 The Programs and Services list displays the following: Note: This screen may have other entries in it, based on the Programs and Services installed on your machine. 8

11 DCOM Enhancements The Microsoft Component Object Model (COM) is a platform-independent, distributed, object-oriented system for creating binary software components that can interact with each other. The Distributed Component Object Model (DCOM) allows applications to be distributed across locations on the network. The DCOM wire protocol provides transparent support for reliable and efficient communication between COM components. In Windows XP Service Pack 2, the security of DCOM has been enhanced. A systemwide setting restricts DCOM activation, launch, and call privileges, and differentiates between local and remote clients. By default, everyone is granted local launch, local activation, and local call permissions, which should enable all local scenarios to continue to work without change. Also, all authenticated users are granted remote call permissions, which enables most common server applications, as long as the client is not anonymous. By default, only administrators are granted remote activation and launch permissions. In addition to the system-wide DCOM security settings, individual COM servers can be set to restrict the rights available to users. There are four new launch permission levels for COM servers: local launch, remote launch, local activate, and remote activate. There are two new access permission levels for COM servers: local calls and remote calls. The default permission levels work properly for almost all cases. An application can set its own permissions programmatically, which may override the default settings; therefore, the user may not have explicit control these settings. To overcome this security flaw, Microsoft has added system-wide setting limits to the DCOM Security Settings from Launch and Access to limit permissions that an application can use. This limit prevents applications from using permissions beyond what is specified in the DCOM configuration system-wide setting. By default, the limits set by Windows XP Service Pack 2 will not allow for OPC communications over the network. IMPORTANT NOTES: 1. If the OPC communications is confined to a single machine (i.e. using COM, but not DCOM) it continues to work properly without making changes to DCOM settings. 2. If you do not plan to use the EGD PowerTool to connect remotely to the EGD driver, then you may not need to change your DCOM settings. 3. To make any OPC Client / OPC Server application work via DCOM, changes need to be made on both sides especially if you intend to use OPC Asynchronous I/O communications. 9

12 4. If this is the first time you are connecting to (or allowing connections from) other machines on the network, you must run the Windows Network Wizard (from Start ->Control Panel) to setup your computer to run on your network. This allows you to share resources on your computer with other computers on your network. It is recommended that you run the Network Setup Wizard before modifying the DCOM settings. DCOM Settings The following procedures provide general guidelines on configuring DCOM settings on Windows XP SP2 for the EGD driver. DCOMcnfg.exe is a Microsoft program that allows you to view and/or modify DCOM settings. There are some settings that can be modified for the entire system (for example, you can change the defaults settings that will affect all programs running on you computer), and there are settings that can be modified for a particular program or application. 1. From the Start menu, select Run. The Run dialog box appears. 2. Type dcomcnfg and click OK. 3. Under Console Root, click Component Services to expand it. 4. Under Component Services, click Computers to expand it. 5. Select My Computer. 10

13 Now you will modify both system-wide DCOM settings and EGD driver-specific DCOM settings. 11

14 System-wide COM/DCOM Settings This procedure modifies the system-wide DCOM settings for the computer. When these steps are implemented, they are applicable to all programs that use COM/DCOM communications on the computer. To modify system-wide COM/DCOM settings: This procedure is applicable to all programs that use COM / DCOM communications on the computer. Important Note: Be careful when making any system wide security changes. Any inadvertent changes may affect the entire system and may cause some or all programs to stop working. 1. On the Component Services dialog box, right-click My Computer and select Properties. 12

15 2. Select the COM Security tab. There are four permissions on this dialog box. You may need to make changes to the Edit Limits for Access Permissions and Launch and Activation Permissions. We recommend that you do not change the Edit Default settings, since this will change the default settings for all programs and applications running on the computer. 13

16 3. Click Access Permissions > Edit Limits i. For user Labeled ANONYMOUS LOGON - you need to check Allow box for Remote Access Note: This setting is necessary for applications that use OPCenum.exe to function and also for some OPC Servers and OPC Clients that set their DCOM Authentication Level to None to allow anonymous connections. If you do not use such applications, you may not need to enable remote access for anonymous logon users. ii. Select Everyone and then select the Allow check box for Remote Access. IMPORTANT NOTE: Since Everyone includes all authenticated users, it is recommended to add these permissions to a smaller subset of users. One way of doing this is to create a Group named MyDriverUsers and add all user accounts to this Group that will execute any OPC driver or client. Then substitute MyDriverUsers everywhere that Everyone appears in the entire DCOM configuration dialogs. 14

17 iii. Click OK to close the Access Permissions dialog box and return to the My Computer Properties dialog box. 4. Click Launch and Activation Permissions > Edit Limits The Launch Permission dialog box appears. For each user (or group) that needs to launch or activate the driver, or participates in OPC / DCOM communications (e.g., MyDriverUsers ), make sure that Local Launch, Remote Launch, Local Activation, and Remote Activation are enabled. 5. Click OK to save your changes. 15

18 Driver-specific DCOM Settings The following procedure details the EGD driver-specific COM/DCOM settings. You must change the EGD Driver settings for remote users to be able to access the driver either through OPC (as an OPC Data Access Server or OPC Alarms and Events Server) or if using the PowerTool remotely to connect to the EGD driver. To modify driver-specific DCOM settings: 1. Access the Component Services dialog box and expand My Computer. 16

19 2. Select (or expand) DCOM Config 17

20 3. Right-click EGDDRV I/O Server 7.2 (EGDDRV.EXE) and select Properties. 18

21 4. The EGDDrv I/O Server 7.2 Properties dialog box appears with the General tab selected. Normally, the Authentication Level should be left as Default. This uses the default authentication rules that are set in the system-wide DCOM settings. 19

22 5. Click the Location tab and ensure that the Run Application on this computer check box is selected. 20

23 6. Click the Security tab and select the Customize option for each of the permissions on this screen. 7. Click Edit... in the Launch and Activation Permissions area. 8. Add INTERACTIVE, NETWORK, SYSTEM, and EVERYONE to the Group or user names list. 21

24 9. Select the Allow check box for Local Launch, Remote Launch, Local Activation, and Remote Activation for all the users (or groups). 10. Click OK to save your changes and return to the EGDDrv I/O Server 7.2 Properties dialog box. IMPORTANT NOTE: Because Everyone includes all authenticated users, it is recommended that you add these permissions to a smaller subset of users. One way of doing this is to create a Group named MyDriverUsers and add all user accounts to this Group that will execute any OPC driver or client. Then substitute MyDriverUsers everywhere that Everyone appears in the entire DCOM configuration dialogs. 11. Click Edit... button for Access Permissions area. 22

25 12. Add INTERACTIVE, NETWORK, SYSTEM, and EVERYONE and select the Allow check box for Local Access and Remote Access for all the users (or groups). 13. Click OK to save your changes and return to the EGDDrv I/O Server 7.2 Properties dialog box. 23

26 14. Click Edit... button for Configuration Permissions. Typically you do not have to modify any settings in this dialog. 15. Click OK to save your changes and return to the EGDDrv I/O Server 7.2 Properties dialog box. 16. Click OK to save all your changes. Repeat Steps 3 to 15 for each program (application) that needs to have DCOM access from a remote computer. For OPC access this includes: EGD OPC Data Access Server EGD OPC Alarms & Events Server 24

27 References: White Paper: Windows XP Service Pack 2 Overview Published: February 2004 By Microsoft Windows XP Service Pack 2 Security Information for Developers Windows XP Security Guide Published: May 22, 2003 By Microsoft White Paper: Using OPC over DCOM with Windows XP Service Pack 2 Published: August 9, 2004; USA By OPC Foundation Disclaimer: This is a preliminary document and may be changed substantially prior to final commercial release of the software described herein. This white paper is for informational purposes only. GE Fanuc Automation Americas, Inc. cannot guarantee the accuracy of any information and assumes no responsibility for accuracy or suitability for application by its readers. GE Fanuc Automation Americas, Inc. MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS DOCUMENT. Microsoft, Windows, and the Windows logo are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. 25