MARS Installation Guide Version 2.40

Transcription

1 MARS Installation Guide Version 2.40

2 MARS Installation Guide Document Version Edition Software Version Published First 2.40 August 2017

3 MARS Installation Guide All rights reserved. No parts of this work may be reproduced in any form or by any means - graphic, electronic, or mechanical, including photocopying, recording, taping, or information storage and retrieval systems - without the express written permission of Merlon Software Corporation. Products that are referred to in this document may be either trademarks and/or registered trademarks of the respective owners. Merlon Software Corporation makes no claim to these trademarks. While every precaution has been taken in the preparation of this document, Merlon Software Corporation assumes no responsibility for errors or omissions, or for damages resulting from the use of information contained in this document or from the use of programs and source code that may accompany it. In no event shall Merlon Software Corporation be liable for any loss of profit or any other commercial damage caused or alleged to have been caused directly or indirectly by this document.

4 I MARS Installation Guide Table of Contents Part 1 Introduction 2 Part 2 System Requirements 4 Part 3 Downloads 6 Part 4 Upgrade Considerations 8 Part 5 Installation 10 Part 6 Configuration Information 13 Part 7 Performing a Client-Only Install 15 Part 8 Performing a Silent Install 18 Part 9 Manually Install Server Components 21 1 Installing the... MARS Server 21 2 Installing the... MARS Reload Analyzer 22 3 Installing the... MARS EMS Template 22 Part 10 Uninstall 25 Part 11 How to Shut Down The MARS Service 27 Part 12 Securing MARS Sessions With SSL/TLS 30 1 Server configuration... with XYPRO XEL 30 2 Server Configuration... with XYPRO Host Encryption (XHE) 31 3 Server Configuration... With The HPE Nonstop SSL Proxy 34 4 Client Configuration... With Open SSL 35 5 Client Configuration... With The HPE Nonstop SSL remote proxy 36 Index 37

5 Part 1 Introduction

6 2 1 MARS Installation Guide Introduction This guide describes how to install and configure MARS. MARS has client and server components. The server components must be installed on each NonStop server. The client programs must be installed on each user's Windows PC.

7 Part 2 System Requirements

8 4 2 MARS Installation Guide System Requirements Before you install MARS, check that your PC and the HPE NonStop server meet the following requirements. PC Windows 7, Windows 8, Windows 8.1, or Windows 10. Microsoft Internet Explorer version 7 or later. A TCP/IP connection to an HPE NonStop system. A monitor that supports a resolution of 1024 x 768 or higher is recommended. HPE NonStop Server H06.05 or later, J06.04 or later, or L15.02 or later. SQL/MX version 3.00 or later (Required for SQL/MX table support). SQL/MP version 350 or later (Required for MP tables support). TCP/IP.

9 Part 3 Downloads

10 6 3 MARS Installation Guide Downloads There are several MARS setup files that you can download from the Merlon web site. MARS. This is the full setup program. It includes all of the client and server components. The MARS Administrator should use this setup program to install the client programs on his or her PC, and to install the server components on each NonStop server. MARS Client. This setup installs the MARS and Server Tools client. It does not include the server components. Most users, other than the MARS Administrator should use this setup program. MARS Server. This compressed file contains the server components and documentation only. Only the MARS Administrator should download this file. Merlon Reload Analyzer (MRA). This compressed file contains the server-only MRA tool, used for detailed reload analysis. The MRA is included in the full MARS installation. Only the MARS Administrator should download this file.

11 Part 4 Upgrade Considerations

12 8 4 MARS Installation Guide Upgrade Considerations Before you upgrade to a newer version you must first shut down the MARS service on the NonStop server. There are some special considerations when you plan to install a newer version of MARS into the same subvolume as a previous version. This is considered as an upgrade from the older version to the newer version. What happens when you install MARS over an older version? When you install the MARS server components, you can choose to install over an existing installation (an upgrade), or into a fresh subvolume (a new install). If you install over an existing installation, the MARS components will be replaced by the newer version. However, the existing configuration information and the MARS database will be retained. If you install into a fresh subvolume, existing configuration information will not be used, and a new MARS database will be created. The new installation will not have access to data from the existing MARS database, such as filesets or schedules. Who should run the upgrade install? The user who installed the existing version must install the upgrade. What are The Security Considerations For an Upgrade? The installer will need to replace existing files with newer versions, so the user running the upgrade will need purge access to the existing files. This is why we recommend that the same user perform the upgrade. Upgrade Procedure 1. Shut down the MARS service. (Use the Quick Procedure). 2. Run the MARS setup program on your PC. For version 2.40 this is called mars240.exe. 3. Follow the prompts. When finished, Setup will launch the MARS client which will display the Configuration And Installation wizard. 4. In the Installation step, select the Full option, and follow the prompts. 5. In the NonStop Server File Locations step, select the install subvolume name to be upgraded. 6. Continue following the prompts until installation has been completed. The server components will be upgraded and the MARS service will be started.

13 Part 5 Installation

14 10 5 MARS Installation Guide Installation The user who is the MARS Administrator should perform these steps Download MARS From The Merlon Web Site 1. Go to the Merlon web page at: 2. On the right hand side of the page, click on the link to Downloads Click the MARS link near the top of the page. This is the full setup program. Your browser will ask if you wish to run the program, or save it to disk. You want to save the program to disk. 3. The Save As dialog box will appear. Select a directory on your PC's hard drive in which to save the file. You can use any directory. Click Save to save the file. The program will be saved with the name MARSxxx.EXE. (Note: xxx is the MARS version number, for example, for version 2.40, the file is called MARS240.EXE.) Install MARS To Install MARS you will need a LICENSE file. Contact us at sales@merlon.com to request a license. If MARS is already installed on your PC, you have two choices: Either Keep the previous version, and install this version. Or Replace the previous version with this version. If you wish to keep the previous version, install this version in a different directory, and use a different Start Menu folder. To replace the previous version, install this version in the same directory as the existing version. The previous version will be uninstalled automatically. You can also uninstall MARS manually. Once the installation program has been downloaded, run it as follows: 1. Select Run from the Start Menu 2. Enter the program name, including the path of the directory, for example: C:\TEMP\MARS240.EXE 3. The program will ask for a setup password, enter the password supplied to you by Merlon. If you don t have the password, contact us at sales@merlon.com. The setup program installs the MARS client, follow the instructions on the screen. By default, the MARS client is installed here: On 32 Bit versions of Windows: C:\Program Files\Merlon\MARS

15 Installation 11 On 64 Bit versions of Windows C:\Program Files (x86)\merlon\mars You can choose another directory, but we recommend you use the default. The MARS setup program adds a shortcut in the Windows Start menu. When the setup program has finished installing the client components, it gives you the option to launch the client. You should check this option. When the client program is started for the first time, it will prompt you for configuration information, and will optionally install the NonStop server components of MARS. Once you have installed the server components on the first NonStop server, you can install them on other NonStop servers using the Server Tools client. (See the MARS Manual for details.) You can also perform a silent install.

16 Part 6 Configuration Information

17 Configuration Information 6 13 Configuration Information In order to configure MARS, you will need to know the following: A Guardian user name and password. This will be used when installing the NonStop server components. This user will become the MARS Administrator. The name of a TCP/IP process running on the NonStop system that can be used to connect from your PC. The default is $ZB01C, you may use a different value on your system. Check with your system administrator. The TCP/IP address used by this TCP/IP process, for example (Use the SCF command INFO SUBNET $<tcpip>.* to display the IP address of the TCP/IP process.) A TCP/IP port number which is available for use by MARS. A port number is used to make a connection between a PC client and an MARS server. Note that the port number you choose must not be used by any other applications that share the same TCP/IP process with MARS. Port numbers that are less than 1024 are reserved for special services like FTP and TELNET. Therefore, you must use a port number greater than (To find out which port numbers are in use, use the SCF STATUS PROCESS command for the TCP/IP process you plan to use.) If you are unsure about the TCP/IP configuration, contact your system administrator. A home term name. This should be a permanent device or process name (like $ZHOME, or $VHS). Do not use a dynamic terminal name, for example a dynamic Telnet terminal name. The name of an SQL/MP catalog in which to register the SQL/MP components of MARS.

18 Part 7 Performing a Client-Only Install

19 Performing a Client-Only Install 7 15 Performing a Client-Only Install Users, other than the MARS Administrator should perform these steps. Note: The MARS server components must be installed on the NonStop server before you can use the MARS client. Download The MARS Client Setup Program From The Merlon Web Site 1. Go to the Merlon web page at: 2. On the right hand side of the page, click on the link to Downloads Click the link for the client setup program you wish to download. Most users should use the MARS Client setup program. Your browser will ask if you wish to run the program, or save it to disk. You want to save the program to disk. 3. The Save As dialog box will appear. Select a directory on your PC's hard drive in which to save the file. You can use any directory. Click Save to save the file. The program will be saved with a name like MARSCxxx.EXE. (Note: xxx is the MARS version number, for example, for version 2.40, the full client setup program file is called MARSC240.EXE.) Install The MARS Client If the MARS client is already installed on your PC, you have two choices: Either Keep the previous version, and install this version. Or Replace the previous version with this version. If you wish to keep the previous version, install this version in a different directory, and use a different Start Menu folder. To replace the previous version, install this version in the same directory as the existing version. The previous version will be uninstalled automatically. You can also uninstall MARS manually. Once the installation program has been downloaded, run it as follows: 1. Select Run from the Start Menu 2. Enter the program name, including the path of the directory, for example: C:\TEMP\MARSC240.EXE 3. The program will ask for a setup password, enter the password supplied to you by Merlon. If you don t have the password, contact us at sales@merlon.com. The setup program installs the MARS client, follow the instructions on the screen. By default, the MARS client is installed here: On 32 Bit versions of Windows:

20 16 MARS Installation Guide C:\Program Files\Merlon\MARS On 64 Bit versions of Windows C:\Program Files (x86)\merlon\mars You can choose another directory, but we recommend you use the default. The MARS setup program adds a shortcut in the Windows Start menu. When the setup program has finished installing the client components, it gives you the option to launch the client. You should check this option. When the client program is started for the first time, it will prompt you for the IP address and port number used to connect to the NonStop server. Contact the MARS Administrator for the correct values. You can also perform a silent install.

21 Part 8 Performing a Silent Install

22 18 8 MARS Installation Guide Performing a Silent Install The Setup program accepts optional command line parameters. These can be useful to system administrators, and to other programs calling the Setup program. In particular, you can perform an install that does not require any input from the user. A so-called "silent" install. The following command line parameters relate to silent installs /SPDisables the This will install MARS... Do you wish to continue? prompt at the beginning of Setup. /SILENT, /VERYSILENT Instructs Setup to be silent or very silent. When Setup is silent the wizard and the background window are not displayed but the installation progress window is. When a setup is very silent the installation progress window is not displayed. Everything else is normal so for example error messages during installation are displayed and so is the startup prompt (if you haven't disabled it with '/SP-' command line option explained above). /SUPPRESSMSGBOXES Instructs Setup to suppress message boxes. Only has an effect when combined with '/SILENT' or '/VERYSILENT'. /DIR="x:\dirname" Overrides the default directory name displayed on the Select Destination Location wizard page. A fully qualified pathname must be specified. /GROUP="folder name" Overrides the default folder name displayed on the Select Start Menu Folder wizard page. /NOICONS Instructs Setup to initially check the Don't create a Start Menu folder check box on the Select Start Menu Folder wizard page. /PASSWORD=password Specifies the password to use. Here is an example that performs a silent install to the default directory and Start Menu Folder: MARSC240.EXE /SP- /VERYSILENT /SUPPRESSMSGBOXES /PASSWORD=installpassword Note that installpassword is not the real install password. Contact Merlon to get the real password.

23 Performing a Silent Install Here is an example that performs a silent install to a custom directory and Start Menu Folder: MARSC240.EXE /SP- /VERYSILENT /SUPPRESSMSGBOXES /DIR="C:\MARS240" /GROUP="MARS 2.40"/PASSWORD=installpassword 19

24 Part 9 Manually Install Server Components

25 Manually Install Server Components 9 Manually Install Server Components 9.1 Installing the MARS Server 21 About Manual Installation Most users should use the configuration wizard to install the server components. Manual installation should only be necessary if the configuration wizard fails, for example due to a network security issue. The configuration wizard uses standard Telnet and FTP services to connect to the NonStop server. If these services are not available on your system, you will need to do a manual installation of the server components. For assistance contact us at support@merlon.com or call us toll free at 888 4MERLON ( ) or The server components should be installed when logged on as the user that is the MARS Administrator. How to Perform a Manual Installation 1. Transfer the file MARSPAKX.100 from the PC folder where you installed the client to a subvolume on the NonStop server. Note: This is a binary file, make sure that you use a binary file transfer method. 2. Transfer the license file you received from Merlon to the same subvolume as in step 1. Note: This is an ASCII file, make sure it is not transferred as a binary file. It must be named LICENSE, and should be an edit (code 101) file. 3. Change the file code of the MARSPAKX file to 100, like this: FUP ALTER MARSPAKX, CODE Run the MARSPAKX program. This is a self-extracting archive. It will unpack the files needed to perform the install. When it has finished it will start the SETUP program. 5. The SETUP program will prompt you for the configuration information needed to complete the installation. Each prompt has a default response, shown in (). Press Enter to accept the default. You will be asked to provide the following information: The process name for the MARS monitor. LISTEN process name. Enter a process name to be used by the LISTEN process. This name must not be used by another program. Use the PPD command to list the process names currently being used. TCPIP process name. Enter the name of the TCPIP process to use for client connections. TCPIP port number. This must be a number between 1024 and This port number must not be used by any other application using the same TCPIP process as MARS. Use the SCF STATUS PROCESS command to list the in-use port numbers. LISTEN IP address. This is the TCP/IP address which will accept connection requests from MARS clients. To accept connections on any IP address press Enter. Use MARS with SQL/MX. Enter Y if you have SQ:L/MX installed on your system.

26 22 MARS Installation Guide Use MARS with SQL/MP. Enter Y if you have SQL/MP installed on your system. Server Programs catalog name. If SQL/MP was selected, enter the name of an existing SQL/MP catalog. Server programs will be registered here. You must have read and write access to this catalog. SETUP will then terminate. Run the RM macro to start the MARS monitor and LISTEN process. You should then be able to logon to the client program, which will connect to the server. 9.2 Installing the MARS Reload Analyzer About Installation The MARS Reload Analyzer (MRA) is included in the MARS installation, so this step is required only when the MARS server is not installed. For assistance contact us at support@merlon.com or call us toll free at 888 4MERLON ( ) or The server components should be installed when logged on as the user that is the MARS Administrator. How to Perform a Manual Installation 1. Transfer the file MRAPAKX.100 from the PC folder where you installed the client to a subvolume on the NonStop server. Note: This is a binary file, make sure that you use a binary file transfer method. 2. Transfer the license file you received from Merlon to the same subvolume as in step 1. Note: This is an ASCII file, make sure it is not transferred as a binary file. It must be named LICENSE, and should be an edit (code 101) file. 3. Change the file code of the MRAPAKX file to 100, like this: FUP ALTER MRAPAKX, CODE Run the MRAPAKX program. This is a self-extracting archive. It will unpack the files needed to perform the install. When it has finished it will start the SETUP program. 5. The SETUP program will complete the installation 9.3 Installing the MARS EMS Template This procedure is unnecessary unless you wish to use native EMS filters to distribute or print MARS events. If you do chose to do this, you must first build a DDL dictionary from TACL as follows: ddl /in $system.zspidef.zspiddl/ dict marsdict! ddl /in $system.zspidef.zemsddl/ dict marsdict ddl /in marsddl/ dict marsdict You can then create the template file as follows: templ /in marstmpl/ marstobj

27 Manually Install Server Components 23 To install the template file, the SUPER id is required. Follow the instructions in Chapter 6 of the DSM Template services manual.

28 Part 10 Uninstall

29 Uninstall 10 Uninstall To uninstall the MARS client: In Windows 7: Select the Uninstall option from the Start Menu MARS folder. In Windows 8 and later: Right click on the MARS program in the Start Menu and select uninstall. Alternatively, you can use the Windows Control panel. Note however, that the control panel can only uninstall the most recently installed version. To use the Windows Control panel: On Windows 7: 1. From the Windows Start menu, select Settings, Control Panel. 2. Double click on the Add/Remove Programs icon. 3. Select MARS from the list of applications. 4. Click Add / Remove. On Windows 8 and later: 1. From the Windows Start menu, select Windows System, Control Panel. 2. Double click on the Programs and Features icon. 3. Select MARS from the list of applications. 4. Click Uninstall. 25

30 Part 11 How to Shut Down The MARS Service

31 How to Shut Down The MARS Service How to Shut Down The MARS Service If you need to shut down the MARS service in order to install a newer version you should first read Upgrade Considerations. About The MARS Server Components There are a number of MARS processes that run on the NonStop server. Some of them run continuously, while others only run when a user session is active. To shut down MARS you must stop all of these processes. The LISTEN Process This is a persistent process pair. It accepts connection requests from MARS clients, and starts an MRA process to support each client session. Typically there is only one of these process pairs, although there may be more, depending on your network configuration. The MARS Process This is a persistent process pair, responsible for reviewing files and tables to trigger reloads and update statistics tasks, as well as managing those tasks. There is one of these. The MSC Process This process supports a client session. There are two of these per active client sessions. DXMX and DXMP Processes These processes are started as required by the MARS process, they provide SQL/MX and SQL/MP database services. They stop automatically when their parent process stops. How to Shut Down MARS The Essentials: The general procedure is as follows: Disconnect all user sessions. Stop the LISTEN process, this prevents new client connections. Shut down the MARS process., MARS will wait until all other MARS processes have stopped before it terminates. The Details: The Quick Shut Down Procedure While logged on as the MARS Administrator (the user who installed MARS), you can use this procedure: 1. Request that all users terminate their MARS client programs. 2. Logon to TACL as the MARS administrator. 3. Set VOLUME to the MARS installation subvolume. 4. Enter SHUTDOWN

32 28 MARS Installation Guide This is a TACL macro that stops in progress reload and update statistics processes, the LISTEN process, and the MARS process. Otherwise, use the manual shut down procedure. The Manual Shut Down Procedure Halt all Reload and Update Statistics Servers Logon to the MARS client as the MARS Administrator, press the Suspend button to suspend MARS processing. This will suspend any running reloads and stop update statistics servers. Disconnect all user sessions. All user who are currently connected using an MARS client program must exit the program. Stop The MARS process. The MARS process must be stopped by the MARS administrator. To stop the MARS process: 1. Logon to TACL as the MARS administrator. 2. Set VOLUME to the MARS installation subvolume. 3. Use the STATUS *, PROG MARS command to display the MARS process name. 4. Use the STOP $mars command on the MARS process (where $mars is the process name). Stop The LISTEN process. The LISTEN process must be stopped by the MARS administrator. To stop the LISTEN process: 1. Logon to TACL as the MARS administrator. 2. Set VOLUME to the MARS installation subvolume. 3. Use the STATUS *, PROG LISTEN command to display a list of the LISTEN process names. 4. Use the STOP $proc command on each LISTEN process (where $proc is the process name).

33 Part 12 Securing MARS Sessions With SSL/TLS

34 30 12 MARS Installation Guide Securing MARS Sessions With SSL/TLS MARS sessions can be configured to use SSL/TLS for session security. SSL/TLS support can be accomplished in two ways: In-process. The MARS client and server can be configured to support SSL/TLS directly, via calls to dynamic link libraries (DLLs). Data is encrypted in the MARS component before being transferred across the network. This is the preferred approach. Using a proxy. A proxy program is installed in the PC and / or NonStop server. The MARS component uses a local loopback TCPIP connection to communicate with the proxy. The proxy implements SSL/TLS support. Data is transferred in the clear between the MARS process and the local proxy. Data is encrypted by the proxy before being transferred across the network. Note that MARS does not implement SSL/TLS directly, it depends on third party code, either in the form of DLLs, or proxy proams. The method you choose depends on the SSL/TLS support software that is available to you. Some options require third-party software licenses. Both the client and the server need to be configured properly to use SSL/TLS successfully. You do not have to use the same method on the server as on the client. For example, you could use in-process support on the client, and proxy support on the server. Server Options Merlon has tested the MARS server with: The XYPRO Encryption Library (XEL). The XYPRO Host Encryption proxy (XHE). The HPE Nonstop SSL host proxy. Client Options Merlon has tested the MARS client with: OpenSSL. The HPE Nonstop SSL remote proxy Server configuration with XYPRO XEL This method supports SSL/TLS directly in the MARS server process. It relies on the use of DLLs which are included in the XYPRO XEL product. Tips: This is the preferred method for SSL/TLS support. It provides the best performance, and least system resource consumption You will need to license and install the XEL product from XYPRO.

35 Securing MARS Sessions With SSL/TLS 31 Merlon recommends that you use the MARS LISTEN program to manage connections to the MARS server on the host. A LISTEN process is configured using a file in the MARS subvolume called LSNINI. Here is a typical example [TCPIP] Process=$ZB1AC Port=18200 ListenIPAddr= [LISTEN] Program=MSC AppPrefix=MAR CPUs=0,1,2,3 MaxServers=10 To enable the use of XEL, you must edit the LSNINI file as follows: 1. First, stop the MARS LISTEN process if it is running. 2. Edit the LSNINI file and modify the Program setting like this: Program=MSC - SSL ssloptions Where ssloptions are: --CAFILE filename: specifies the file containing the optional Certificate Authority data. --CERTFILE filename: specifies the host certificate file. If this is not specified, MARS searches for a file called MARCERT in the installation subvolume. --CRLFILE filename: specifies the certificate revocation list file. --CIPHERS ciphers: ciphers is a comma separated list of cipher numbers to enable. Ciphers may be expressed as a decimal number or in hexadecimal using a 0x prefix. --KEYFILE filename: specifies the file containing the server private key. --PASSWORD pwd: specifies the password for the server public key file. Because the password is sensitive information, you should secure the LSNINI file so that only the userid under which LISTEN runs can read it. See the XYPRO XEL documentation for more information. 3. Restart the LISTEN process Server Configuration with XYPRO Host Encryption (XHE) This method, uses the XYGATEHE program that runs as a proxy on the NonStop server to secure the client session using SSL/TLS. Tip: If you have not already done so, install and configure the XHE product in accordance with

36 32 MARS Installation Guide the XYPRO Host Encryption Manual. The XYGATEHE program is started by a system LISTNER process or an MARS LISTEN process and establishes an SSL/TLS session with the client. When the XYGATEHE process receives a connection request from a client, it establishes a local unencrypted session with an MARS server process. The local session is contained within the NonStop server, so no data is transmitted in the clear over the network. This session uses the local loopback IP address ( ). To use this option you must: Configure the XYGATEHE proxy. Configure a local TCPIP Process Configure the MARS server. Configuring The XYGATEHE Proxy A XYGATEHE proxy process is started when a client connection request is received. There are two ways to do this: Using the system LISTNER program. Using the MARS LISTEN program. Using The System LISTNER Program To use the system LISTENER, you must update the system PORTCONF file. The PORTCONF entry should look something like this: nnnnn $SYSTEM.XYGATEHE.XYGATEHE -a:rsc -T:$ZLOOP -P: SSL_NEG:SSLSRV Where nnnnn is the port number that the client will use to connect to the server. (The IP address the client uses must match the IP address of the TCPIP process used by the LISTNER). -T specifies the name of the local loopback TCPIP process (used to connect to the MARS server process). -P specifies the port number to use on the local loopback TCPIP process. Using The MARS LISTEN Program If you elect to use the MARS LISTEN program to start XYGATEHE, you will need to run one LISTEN process for XYGATEHE, and a second LISTEN process for the MARS server. You must edit the LSNINI file in the MARS subvolume. The LSNINI file will contain configuration settings for both XYGATEHE and the MARS server. Here is an example of the LSNINI settings for XYGATEHE and the MARS server: [TCPIPXYGATEHE] Process=$ZB1AC Port=8000 ListenIPAddr= [LISTENXYGATEHE] Program=$SYSTEM.XYGATEHE.XYGATEHE -a:rsc -T:$ZLOOP -P: SSL_NEG:SSLSRV AppPrefix=MAR CPUS=2,3

37 Securing MARS Sessions With SSL/TLS 33 [TCPIPMARS] Process=$ZLOOP Port=18200 ListenIPAddr= [LISTENMARS] Program=MSC AppPrefix=MAR CPUs=0,1,2,3 MaxServers=10 Next, you need to edit the RM macro to start the two instances of the LISTEN process. Here is an example:?tacl MACRO [#IF [#EMPTY [#PROCESSINFO/PIN/$LSHE]] THEN DELETE DEFINE =TCPIP^PROCESS^NAME ADD DEFINE =TCPIP^PROCESS^NAME,CLASS MAP,FILE $ZB1AC PARAM TCPIP^PROCESS^NAME $ZB1AC RUN $D1.MARS.LISTEN/NAME $LSHE, IN $ZHOME, OUT $ZHOME, TERM $ZHOME, NOWAIT/& --tcpsection TCPIPXYGATEHE --listensection LISTENXYGATEHE ] [#IF [#EMPTY [#PROCESSINFO/PIN/$LSSX]] THEN DELETE DEFINE =TCPIP^PROCESS^NAME ADD DEFINE =TCPIP^PROCESS^NAME,CLASS MAP,FILE $ZLOOP PARAM TCPIP^PROCESS^NAME $ZLOOP RUN $D1.MARS.LISTEN/NAME $$LSSX, IN $ZHOME, OUT $ZHOME, TERM $ZHOME, NOWAIT/& --tcpsection TCPIPMARS --listensection LISTENMARS ] Note the use of the --tcpsection and --listensection command line options to specify the sections of the LSNNI file that apply to each LISTEN process. Configuring a Local Loopback TCPIP Process Merlon recommends you use a local TCPIP process for the session between XYGATEHE and the MARS server. This prevents inadvertent sending of session data in the clear over the network. The local TCPIP process needs to be configured for loopback, for example: TCPIP /NAME $ZLOOP, NOWAIT,CPU 0,PRI 160, TERM $ZHOME /1 SCF ALTER SUBNET $ZLOOP.#LOOP0, IPADDRESS SCF START SUBNET $ZLOOP.* Configuring The MARS Server You must configure the LISTEN process used to start the MARS server process. If you elected to use LISTEN to start the XYGATEHE proxy, you will need to configure both the XYGATEHE proxy and the MARS server in the same LSNINI file. There is an example above. If you elected to start the XYGATEHE proxy using the system LISTNER, then the LSNINI file only contains the MARS server configuration settings. Here is an example: [TCPIP] Process=$ZLOOP Port=18200 ListenIPAddr= [LISTEN] Program=MARS AppPrefix=MAR CPUs=0,1,2,3

38 34 MARS Installation Guide MaxServers=10 These settings use the local loopback TCPIP process. The port number must match the -P command line parameter used to start the XYGATEHE proxy process Server Configuration With The HPE Nonstop SSL Proxy This method, uses the $SYSTEM.ZNSSSL.SSLOBJ program that runs as a proxy on the NonStop server to secure the client session using SSL/TLS. Tip: If you have not already done so, install and configure the HPE Nonstop SSL product in accordance with the HPE Nonstop SSL Reference Manual. Merlon recommends that you run the SSLOBJ program as a persistent process. This removes the need to configure it in the LISTNER or MARS LISTEN program. As a persistent process, the Nonstop SSL proxy server performs the listening function itself. Furthermore, because the proxy runs as super, it is easier to secure the server private key password. When the SSLOBJ process receives a connection request from a client it establishes a local unencrypted session with an MARS server process. The local session is contained within the NonStop server, so no data is transmitted in the clear over the network. This session uses the local loopback IP address ( ). To use this option you must: Configure the SSLOBJ proxy. Configure a local TCPIP Process Configure the MARS server. Configuring The SSLOBJ Proxy Use the Nonstop SSL SETUP macro to configure a persistent proxy server. Set the run mode to 6 (Generic Server). Make sure that the TARGETSUBNET and TARGETPORT parameters match the values in the LSNINI file ($ZLOOP and in the example below). Configuring a Local Loopback TCPIP Process Merlon recommends you use a local TCPIP process for the session between SSLOBJ and the MARS server. This prevents inadvertent sending of session data in the clear over the network. The local TCPIP process needs to be configured for loopback, for example: TCPIP /NAME $ZLOOP, NOWAIT,CPU 0,PRI 160, TERM $ZHOME /1 SCF ALTER SUBNET $ZLOOP.#LOOP0, IPADDRESS SCF START SUBNET $ZLOOP.* Configuring The MARS Server

39 Securing MARS Sessions With SSL/TLS 35 You must configure the LISTEN process used to start the MARS server process. In the MARS subvolume, change the LSNINI so that the LISTEN program uses the local TCPIP process, for example: [TCPIP] Process=$ZLOOP Port=18200 ListenIPAddr= [LISTEN] Program=MARS AppPrefix=MAR CPUs=0,1,2,3 MaxServers=10 The Process and Port settings must match the SSLOBJ TARGETSUBNET and TARGETPORT settings Client Configuration With Open SSL This method supports SSL/TLS directly in the MARS client program. Tips: This is the preferred method for client SSL/TLS support. The OpenSSL Windows 32-bit libraries libeay32.dll and ssleay.dll are required. These are not shipped as part of MARS. If you do not already have them on your PC, you can obtain them from various Internet web sites. MARS is compatible with Open SSL versions 1.0.x, it is not compatible with versions 1.1.x. The source code is available from the OpenSSL web site. Pre-compiled 32 bit binaries for Windows are available from a number of web sites. You may find this link useful. Important Note: Merlon does not endorse or recommend any specific version of the OpenSSL libraries, use at your own risk. These DLLs need to be installed in your environment PATH or in the MARS installation directory. After installing the DLLs, start MARS and click Profiles to navigate to the Manage Session Profiles window. Set the Encryption Level setting for the session profile to Open SSL.

40 MARS Installation Guide Client Configuration With The HPE Nonstop SSL remote proxy Install the client software as is described in the HPE Nonstop SSL Reference Manual under Remote Proxy Configuration. Proceed as follows: Configure the HPE Proxy client: Create a user session and select an unused local port on the client. Set the session protocol to Generic TCP Client. Set the target IP address and port for the NonStop server. Configure an MARS session profile: Start MARS and click Profiles to navigate to the Manage Session Profiles Window. Create or modify a session. Set the Host Name or IP Address field to Set the port to the value chosen as the local port in the Remote Proxy Session. Set the Encryption Level field to Proxy. Click OK to return to the Logon dialog. Click OK to connect to the NonStop server.

41 Index Session Security 30 Setup 6 Shutdown 27 SQLXPress Administrator SSL/TLS 30 Stop SQLXPress 27 System Requirements 4 Index -CClient SSL/TLS 35, 36 Configuration 13 Connection Information 13 -TTCP/IP 13 TLS/SSL 30 -DDownload 6 -U- -EEncryption Uninstall Upgrade 30 -W- -IInstallation Client Only 15 Full client and server Manual server install Silent 18 Uninstall 25 Windows Version 10 21, 22 NonStop OS Version 4 NonStop Server Configuration NonStop SSL 34, 36 -O35 -PPort Number 13 -SSecurity Administrator 8 Server SSL/TLS 30, 31, 34 -XXEL XHE -N- Open SSL 25 8,

42