Common Document. Configuration Notes for Microsoft Windows Server 2008 R2 and Microsoft Windows 7

Transcription

1 Common Document Configuration Notes for Microsoft Windows Server 2008 R2 and

2 Page 2 Table of Contents 1 General 4 2 Supported Windows 2008 / Windows 7 Software Versions and Configurations Supported OS Software Versions Supported Windows 2008 / Windows 7 MISS and Workstation Configurations 5 3 Exchange Software compatible with the Windows 2008 / Windows 7 Software Operating Systems GATE 3.5 Kits Eurex 13.0 Kits Xetra 11.0 Kits CCP 6.0 Kits 7 4 Windows 2008 / Windows 7 Installation Procedure Simulation - Installation under Windows 2008 or Windows Production - Installation under Windows 2008 or Windows Advanced Simulation - Installation under Windows 2008 or Windows Windows 2008 Server Configuration Installing the Internet Information Services (IIS) Configuring the Internet Information Services (IIS) 13 6 Creating user groups and users (Windows 2008 MISS Only) Creating the file transfer group Set rights for ftp groups Assigning the ftp group to the FTP site User Rights Assignments 23 7 Windows 2008 Configuration Issues Password policies Definition of Static Routes Network interface binding order A host with single network interface A host with multiple network interfaces Firewall Settings Disabling the Windows 2008 Firewall Changing User Account Control (UAC) Settings 28

3 Page 3 8 Windows 7 Configuration Issues Disabling the Windows 7 Firewall Changing User Account Control (UAC) Settings 30

4 Page 4 1 General The purpose of this document is to provide the relevant information necessary for the installation of the GATE 3.5, Eurex 13.0, Xetra 11.0 and CCP 6.0 software on the Windows 2008 Server and Windows 7 Operating Systems. In general this includes: 1. The supported Windows 2008 and Windows 7 software versions and configurations (Chapter 2) 2. The Eurex 13.0, Xetra 11.0, CCP 6.0 and GATE software which is Windows 2008 / Windows 7 compatible and the software distribution process (Chapter 3) 3. The Windows 2008 / Windows 7 migration paths, (i.e.) the steps which have to be taken to perform a new installation from Windows 2008 / Windows 7 and subsequently install the GATE 3.5, Eurex 13.0, Xetra 11.0 and CCP 6.0 Software (Chapter 4). 4. Configuration of the Windows 2008 Server (Chapter 5) 5. Standard setup of user groups and user accounts in Windows 2008 (Chapter 6). 6. Known Windows 2008 / Windows 7 installation and configuration issues which may occur (Chapter 7 / 8).

5 Page 5 2 Supported Windows 2008 / Windows 7 Software Versions and Configurations 2.1 Supported OS Software Versions The following Operating System Versions of Windows 2008 (64bit) and Windows 7 (64bit) will be supported: MISS Operating System Windows 2008 Server R2 (64bit) Workstation (Windows 2008 R2) Windows 2008 Server R2 (64bit) Workstation (Windows 7) Windows 7 Prof. (64bit) Service Pack N/A N/A N/A Language English English English 2.2 Supported Windows 2008 / Windows 7 MISS and Workstation Configurations The following MISS/Workstation Combinations will be supported: Workstation Miss Server Oracle Solaris (sparc) Oracle Solaris (x86) Windows 2003 Server + R2 1) Windows 2008 Server + R2 1) Windows XP 2 ) Windows 7 1) Oracle Solaris (sparc) Oracle Solaris (x86) supported possible supported possible supported supported possible supported supported possible supported supported Windows 2003 Server R2 1) possible possible supported possible supported possible Windows 2008 Server R2 1) possible possible possible possible possible supported 1) only 64 bit version 2) only 32 bit version

6 Page 6 3 Exchange Software compatible with the Windows 2008 / Windows 7 Software Operating Systems For the migration to Windows 2008 an update to the existing GATE 3.5 software is required. The Eurex 13.0, Xetra 11.0 and CCP 6.0 kits are already compatible with the new operating systems. The GATE 3.5 Update Kits are available for download from the Eurex, Xetra or CCP website. The following software kits are therefore required for the installation under Windows 2008 or Windows GATE 3.5 Kits GATE 3.5 Simulation environment: GATE 3.5 Simulation Full Kit: GateR35S.msi GATE 3.5 Simulation Update Kit: gater35s_upd3.pl GATE 3.5 Production environment: GATE 3.5 Production Full Kit: GateR35.msi GATE 3.5 Production Update Kit: gater35_upd3.pl GATE 3.5 Advanced Simulation environment: GATE 3.5 Advanced Simulation Full Kit: GateR35A.msi GATE 3.5 Advanced Simulation Update Kit: gater35a_upd3.pl 3.2 Eurex 13.0 Kits Eurex 13.0 Simulation environment: Eurex 13.0 Simulation Full Kit: EurexR130S.msi Eurex 13.0 Production environment: Eurex 13.0 Production Full Kit: EurexR130.msi Eurex 13.0 Advanced Simulation environment: Eurex 13.0 Advanced Simulation Full Kit: EurexR130A.msi

7 Page Xetra 11.0 Kits Xetra 11.0 Simulation environment: Xetra 11.0 Simulation Full Kit: XetraR110S.msi Xetra 11.0 Production environment: Xetra 11.0 Production Full Kit: XetraR110.msi Xetra 11.0 Advanced Simulation environment: Xetra 11.0 Advanced Simulation Full Kit: XetraR110A.msi 3.4 CCP 6.0 Kits CCP 6.0 Simulation environment: CCP 6.0 Simulation Full Kit: CCPR60S.msi CCP 6.0 Production environment: CCP 6.0 Production Full Kit: CCPR60.msi

8 Page 8 4 Windows 2008 / Windows 7 Installation Procedure Although an upgrade of the Windows 2003 Server to Windows 2008 Server R2 and Windows XP to Windows 7 are supported by Microsoft, Eurex, Xetra and CCP strongly recommends the a new installation of the Operating Systems prior to the installation of the GATE 3.5 and Eurex 13.0, Xetra 11.0 or CCP 6.0 software. The information contained within this document refers to a new installation only and assumes that a network connection between the MISS servers and its respective workstations has been established. Important: The Administrator account automatically created by the Windows 7 installation is disabled by default. Prior to installing the GATE 3.5, Eurex 13.0, Xetra 11.0 and CCP 6.0 software the Administrator account must be enabled and provided with a password. The Administrator account must be used for the installation of the Exchange software on both the Windows 2008 MISS server and the workstation. The Administrator account in Windows 7 can be enabled by removing the check mark in the following window: Click Start > Computer (right click) > Manage Select Local Groups and Users > Users > Administrator (right click) > Properties

9 Page 9 When performing the installation of the exchange software from network drivers the following warning may possibly be displayed but can safely be ignored by clicking Run. For detailed information relating to the installation of the GATE 3.5, Eurex 13.0, Xetra 11.0 and CCP 6.0 software please refer to the respective Installation Guides which are available for download from the respective website. 4.1 Simulation - Installation under Windows 2008 or Windows 7 The following section details the steps to be performed for the new installation of the Eurex 13.0 Simulation software (same as for Xetra 11.0 and CCP 6.0). 1. Install Windows 2008 R2 on the MISS or Workstation and/or Windows 7 on the workstation. 2. Install the GATE 3.5 Simulation Kit for Windows: Gater35S.msi 3. Install the GATE 3.5 Simulation Update Kit 3 for Windows: gater35s_upd3.pl 4. In the case of a MISS installation, ensure the Internet Information Services (IIS) are installed (See Chapter 5) 5. Install the Eurex 13.0 Simulation Kit for Windows: EurexR130S.msi or Install the Xetra 11.0 Simulation Kit for Windows: XetraR110S.msi or Install the CCP 6.0 Simulation Kit for Windows: CCPR60S.msi

10 Page Production - Installation under Windows 2008 or Windows 7 The following section details the steps to be performed for the new installation of the Eurex 13.0 Production software (same as for Xetra 11.0 and CCP 6.0). 1. Install Windows 2008 R2 on the MISS or Workstation and/or Windows 7 on the workstation. 2. Install the GATE 3.5 Production Kit for Windows: Gater35.msi 3. Install the GATE 3.5 Production Update Kit 3 for Windows: gater35_upd3.pl 4. In the case of a MISS installation, ensure the Internet Information Services (IIS) are installed (See Chapter 5) 5. Install the Eurex 13.0 Production Kits for Windows: EurexR130.msi or Install the Xetra 11.0 Production Kits for Windows: XetraR110.msi or Install the CCP 6.0 Production Kits for Windows: CCPR60.msi 4.3 Advanced Simulation - Installation under Windows 2008 or Windows 7 The following section details the steps to be performed for the new installation of the Eurex 13.0 Advanced Simulation software (same as for Xetra 11.0). 1. Install Windows 2008 R2 on the MISS or Workstation and/or Windows 7 on the workstation. 2. Install the GATE 3.5 Advanced Simulation Kit for Windows: Gater35a.msi 3. Install the GATE 3.5 Advanced Simulation Update Kit 3 for Windows: gater35a_upd3.pl 4. In the case of a MISS installation, ensure the Internet Information Services (IIS) are installed (See Chapter 5) 5. Install the Eurex 13.0 Advanced Simulation Kit for Windows: EurexR130A.msi or Install the Xetra 11.0 Advanced Simulation Kit for Windows: XetraR110A.msi

11 Page 11 5 Windows 2008 Server Configuration 5.1 Installing the Internet Information Services (IIS) Internet Information Services (IIS) is the web server software included with Windows IIS isn t added by default when Windows 2008 is installed. The IIS software must be activated so that the MISS Server can receive reference data files, reports and software files from Eurex, Xetra and CCP. In order to install the IIS, select the Turn Windows features on or off option which can be found by clicking Control Panel > Programs > Program and Features Under the Server Manager select the option Roles and then Add Roles

12 Page 12 Select the Web Services (IIS) role Select the FTP Server from Select Role Services to install for Web Server (IIS). All other Web Server settings (default settings) can be removed.

13 Page Configuring the Internet Information Services (IIS) Start the Internet Information Services (IIS) Manager which can be found by clicking Start > Administrative Tools and expand the tree to reveal the Sites branch.

14 Page 14 Select the FTP Authentication option in the main window and enable the Basic Authentication option. Under the Sites option of the Connections window select the Add FTP Site option.

15 Page 15 Define the FTP site as follows Modify the Binding and SSL settings to add the IP address of the WAN interface and Allow SSL connections.

16 Page 16 Now define the users who have access to the FTP server and their appropriate permissions as required. Please Note that the user accounts (described in section 6) require at least WRITE access. During the installation of the Eurex 13.0 or Xetra 11.0 or CCP 6.0 Kits make sure to change the FTP root directory to match the Physical path entered during the definition of the FTP site in the earlier step by clicking the Change button. Based on the example above the following FTP root directory entry should be made.

17 Page 17

18 Page 18 6 Creating user groups and users (Windows 2008 MISS Only) The GATE, Eurex, Xetra and CCP software requires that users and groups are created for administrators, file transfer accounts and traders. Administrative users must also belong to the respective ftp group. Before starting to use or verify the GATE / Eurex / Xetra or CCP Front End installation, the following users and groups should be created. For each environment create the appropriate ftp groups: Eurex Xetra Xetra Xetra Xetra Xetra CCP FFM FF2 ISE XIM Vienna FTP group eurexft xetraft xetra2ft xiseft xximft xwbagft Ccpft For each environment create the appropriate user account: Eurex Xetra Xetra Xetra Xetra Xetra CCP FFM FF2 ISE XIM Vienna Production eurnet xnet51 xnet61 xnet55 xnet57 xnet68 cnet20 Simulation eurnet01 xnet52 xnet62 n/a n/a xnet69 cnet21 Advanced Simulation eurnet03 xnet53 n/a n/a n/a n/a n/a GATE requires a group for administration (default: gategrp ) and for traders (default: gatetrd ). Administrator users (default: gateadm ) must belong to the gategrp and gatetrd groups. The trader users must belong to the gatetrd group. If a trader user is also required to be able to trade on the MISS, this user must be also part of the gategrp group. Other users, as required, must be members of group "gatetrd". Note: Every user within the gategrp group can start or stop the GATE architecture and all exchange Xervices! User names and passwords must be a minimum of 5 characters in length otherwise the login to GATE is not possible. For a detailed description of the operation and technical features, see the Eurex Front End Installation Guide 13.0 Xetra Front End Installation Guide 11.0 CCP Front End Installation Guide 6.0

19 Page Creating the file transfer group The following section shows how to create the file transfer groups, user accounts and assign the users to the appropriate group. Please note that the following screenshots may differ according to the installation configuration, which you have chosen. The following section explains the creation of users and groups using Eurex and the Server Manager. Click Start > Administrative Tools > Server Manager Expand the Configuration branch to display the Local Users and Groups section Click with the right mouse key on the Users entry and select New User The password for each of the accounts will have been provided to you by the exchange. Please make sure that the options User cannot change password and Password never expires are selected and the option User must change password at next logon is deselected

20 Page 20 Click with the right mouse key on the Groups entry and select New Group Click the Add button to add the newly created users to the eurexft group (Note: multiple users may be entered separated by a ; )

21 Page Set rights for ftp groups Click Start > Administrative Tools > Local Security Policy and select Local Policies followed by User Rights Assignment. Double-click the Allow log on locally option and then click the Add User or Group option. Please Note: In order to be able to select the eurexft group the Object Types button needs to be clicked and the Groups box checked. Enter the eurexft in the dialogue box.

22 Page Assigning the ftp group to the FTP site Once the ftp group has been created and has the appropriate user accounts assigned, the group has to be given the appropriate rights to access the FTP site created above. Start the Internet Information Services (IIS) Manager which can be found by clicking Start > Administrative Tools and expand the tree to reveal the Sites branch and select the FTP site created in the earlier step (e.g.) Transfer and select the Edit Permissions options. Click the Security tab followed by Edit button followed then by the Add button. Enter eurexft into the dialogue box and click the OK button.

23 Page 23 The following dialogue will now be displayed. Ensure the Read and Write options are checked and press OK User Rights Assignments In addition to the Allow log on locally for the ftp group the following user group assignments are required. User / Group gategrp gatetrd gateadm Rights assignment Allow log on locally Allow log on locally Act as part of the operating system The Act as part of the operating system assignment for the gateadm user is assigned in the same was as the Allow log on locally described in section 6. Important! The gateadm user must also be a member of the ftp group e.g. eurexft and Administrators group.

24 Page 24 7 Windows 2008 Configuration Issues 7.1 Password policies In order to ensure that the FTP passwords provided by the exchange are accepted by the Windows 2008 operating system and do not expire the following steps must be performed. Click Start > Administrative Tools > Local Security Policy and expand the Account Policies / Password Policies branch. The password complexity options and password aging functionality need to be disabled as shown below. 7.2 Definition of Static Routes The IP address of the MISS interface (WAN) is defined by the exchange and needs to be configured on the respective network interface. In addition, static routes need to be defined. At the command prompt, a command with the following syntax needs to be entered. route p add network-destination mask gateway address metric 1 Example addresses for Eurex: route p add mask metric 1 route p add mask metric 1 The routes defined in this way will be set up permanently and are available after a reboot of the system.

25 Page Network interface binding order A name resolution for all MISSes and Workstations, on which the GATE front end software is installed, must be configured. For performance and availability reasons Deutsche Börse recommends that static name resolution through the hosts file. Furthermore, with regard to the name resolution on a single MISS or WS the following cases have to be distinguished: A host with single network interface - If the computer name is set to match the GATE LAN hostname of the machine (i.e. the hostname assigned to the interface connected to the members LAN), then no further steps are necessary. - If the computer name is NOT set to match the GATE LAN hostname of the machine, then the optional qualifier <computername> in the [MISS]/[WS] sections within the configmbr.ini has to be set to the computer name of the machine manually, to avoid problems with the GATE name resolution (for configuration details: see Operations Guide GATE 3.5) A host with multiple network interfaces - If the computer name is set to match the GATE LAN hostname of the machine, then the network interface whose IP address is assigned to this GATE LAN hostname must be on the first position of the Windows network service binding order. To verify the binding order: Click Start > Control Panel > Network and Internet > Network and Sharing Center and select the option Change Adapter Settings If the following window appears without the addition menu bar

26 Page 26 Press the ALT key to reveal the hidden options and select the Advanced / Advanced Settings Option The current binding will be displayed and the connection order can be changed accordingly by using the arrow buttons next to the Connections: window.

27 Page 27 - If the computer name is NOT set to match the GATE LAN hostname of the machine, then the optional qualifier <computername> in the [MISS]/[WS] sections within the configmbr.ini has to be set to the computer name of the machine manually. Furthermore, if - the computer name does also NOT match a Xervice WAN hostname (i.e. a hostname assigned to an interface connected to an exchange WAN), then no further steps are necessary. - the computer name does match a Xervice WAN hostname, then the network interface whose IP address is assigned to this Xervice WAN hostname must be on the first position of the Windows network service binding order (see above). 7.4 Firewall Settings In order to ensure that the transfer of USIM libraries, reference data files and reports can be transferred to the MISS and to guarantee the correct communication between the MISS and Workstation, the use of the Windows 2008 firewall should be disabled on both the WAN and LAN interfaces Disabling the Windows 2008 Firewall To disable the Windows 2008 firewall: Click Start > Control > Panel > System and Security > Windows Firewall and select the option Turn Windows Firewall on or off

28 Page 28 Disable the Firewall be clicking the appropriate radio buttons Changing User Account Control (UAC) Settings The gateadm account used for the administration of the Exchange software must be a member of the Administrators group in order to be able to access system resources (e.g.) Task scheduler. When the gateadm account is assigned to the Administrators group it is entitled to have the same privileges as the Administrator account itself. However in the default setting the Operating System will request confirmation before performing any tasks requiring system privileges. gateadm does not receive Administrator privileges by default, only on request. As there is no interaction during the start of the MISS, the use of the scheduler functionality which automatically attempts to start the MISS multiple times, for example, will fail. In order to disable the so called User Account Control. Click Start > Control > Panel > System and Security and select the option Change User Account Control settings

29 Page 29 Move the sliding bar to the option Never notify

30 Page 30 8 Windows 7 Configuration Issues Disabling the Windows 7 Firewall To disable the Windows 7 firewall: Click Start > Control > Panel > System and Security > Windows Firewall and select the option Turn Windows Firewall on or off Changing User Account Control (UAC) Settings Click Start > Control > Panel > System and Security and select the option Change User Account Control settings Move the sliding bar to the option Never notify