Teradata ServiceConnect Enhanced Policy Server Installation and Configuration Guide. Powered by Axeda

Transcription

1 Teradata ServiceConnect Enhanced Policy Server Installation and Configuration Guide Powered by Axeda B K October 2012

2 The product or products described in this book are licensed products of Teradata Corporation or its affiliates. Teradata, Active Enterprise Intelligence, Applications-Within, Aprimo, Aprimo Marketing Studio, Aster, BYNET, Claraview, DecisionCast, Gridscale, MyCommerce, Raising Intelligence, Smarter. Faster. Wins., SQL-MapReduce, Teradata Decision Experts, "Teradata Labs" logo, "Teradata Raising Intelligence" logo, Teradata ServiceConnect, Teradata Source Experts, "Teradata The Best Decision Possible" logo, The Best Decision Possible, WebAnalyst, and Xkoto are trademarks or registered trademarks of Teradata Corporation or its affiliates in the United States and other countries. Adaptec and SCSISelect are trademarks or registered trademarks of Adaptec, Inc. AMD Opteron and Opteron are trademarks of Advanced Micro Devices, Inc. Apache, Apache Hadoop, Hadoop, and the yellow elephant logo are either registered trademarks or trademarks of the Apache Software Foundation in the United States and/or other countries. Axeda is a registered trademark of Axeda Corporation. Axeda Agents, Axeda Applications, Axeda Policy Manager, Axeda Enterprise, Axeda Access, Axeda Software Management, Axeda Service, Axeda ServiceLink, and Firewall-Friendly are trademarks and Maximum Results and Maximum Support are servicemarks of Axeda Corporation. Data Domain, EMC, PowerPath, SRDF, and Symmetrix are registered trademarks of EMC Corporation. GoldenGate is a trademark of Oracle. Hewlett-Packard and HP are registered trademarks of Hewlett-Packard Company. Hortonworks, the Hortonworks logo and other Hortonworks trademarks are trademarks of Hortonworks Inc. in the United States and other countries. Intel, Pentium, and XEON are registered trademarks of Intel Corporation. IBM, CICS, RACF, Tivoli, and z/os are registered trademarks of International Business Machines Corporation. Linux is a registered trademark of Linus Torvalds. LSI is a registered trademark of LSI Corporation. Microsoft, Active Directory, Windows, Windows NT, and Windows Server are registered trademarks of Microsoft Corporation in the United States and other countries. NetVault is a trademark or registered trademark of Quest Software, Inc. in the United States and/or other countries. Novell and SUSE are registered trademarks of Novell, Inc., in the United States and other countries. Oracle, Java, and Solaris are registered trademarks of Oracle and/or its affiliates. QLogic and SANbox are trademarks or registered trademarks of QLogic Corporation. Red Hat is a trademark of Red Hat, Inc., registered in the U.S. and other countries. Used under license. SAS and SAS/C are trademarks or registered trademarks of SAS Institute Inc. SPARC is a registered trademark of SPARC International, Inc. Symantec, NetBackup, and VERITAS are trademarks or registered trademarks of Symantec Corporation or its affiliates in the United States and other countries. Unicode is a registered trademark of Unicode, Inc. in the United States and other countries. UNIX is a registered trademark of The Open Group in the United States and other countries. Other product and company names mentioned herein may be the trademarks of their respective owners. The information contained in this document is provided on an "as-is" basis, without warranty of any kind, either express or implied, including the implied warranties of merchantability, fitness for a particular purpose, or non-infringement. Some jurisdictions do not allow the exclusion of implied warranties, so the above exclusion may not apply to you. In no event will Teradata Corporation be liable for any indirect, direct, special, incidental, or consequential damages, including lost profits or lost savings, even if expressly advised of the possibility of such damages. The information contained in this document may contain references or cross-references to features, functions, products, or services that are not announced or available in your country. Such references do not imply that Teradata Corporation intends to announce such features, functions, products, or services in your country. Please consult your local Teradata Corporation representative for those features, functions, products, or services available in your country. Information contained in this document may contain technical inaccuracies or typographical errors. Information may be changed or updated without notice. Teradata Corporation may also make improvements or changes in the products or services described in this information at any time without notice. To maintain the quality of our products and services, we would like your comments on the accuracy, clarity, organization, and value of this document. Please teradata-books@lists.teradata.com Any comments or materials (collectively referred to as "Feedback") sent to Teradata Corporation will be deemed non-confidential. Teradata Corporation will have no obligation of any kind with respect to Feedback and will be free to use, reproduce, disclose, exhibit, display, transform, create derivative works of, and distribute the Feedback and derivative works thereof without limitation on a royalty-free basis. Further, Teradata Corporation will be free to use any ideas, concepts, know-how, or techniques contained in such Feedback for any purpose whatsoever, including developing, manufacturing, or marketing products or services incorporating Feedback. Copyright 2012 by Teradata Corporation. All Rights Reserved.

3 Table of Contents Preface...5 Purpose...5 Audience...5 Prerequisites...5 Revision History...5 Additional Information...5 Chapter 1: Teradata ServiceConnect Enhanced Policy Server...7 About Teradata ServiceConnect Enhanced Policy Server...7 Help System...8 Recommended Platform Requirements...8 Chapter 2: Policy Server Installation...11 Before Installation...11 Pre-Installation Decisions...11 Installing the Policy Server on Windows...12 Installing the Policy Server on Linux...14 Reinstallation Considerations...15 Installed Files List...15 Chapter 3: Policy Server Configuration File...17 The PolicyManager.properties File...17 Stopping the Policy Server...17 Editing the PolicyManager.properties File...18 Properties in PolicyManager.properties...18 Teradata ServiceConnect Enhanced Policy Server Installation and Configuration Guide 3

4 Table of Contents Chapter 4: Policy Server Operations...25 Starting the Policy Server...25 Accessing the Policy Server...25 Setting User Preferences...26 Setting Up Security...26 User Authentication...26 Creating Profiles...27 Creating Roles...28 Setting Up Users...28 What Is a Policy?...30 Policy Inheritance...30 About Permissions...30 Base Installation Options...34 Shutting Down the Policy Server...36 Approving Remote Sessions...36 Chapter 5: System Maintenance and Troubleshooting...39 Unexpected Actions from Packages...39 Device Group Deletion...39 Missing Devices...40 Pending Requests Monitoring...40 Remote Session Monitoring...40 Audited Operations...41 Backup and Restore...42 Version Information...42 Tomcat Troubleshooting Teradata ServiceConnect Enhanced Policy Server Installation and Configuration Guide

5 Preface Purpose This guide provides installation and configuration information for users of the Teradata ServiceConnect Enhanced Policy Server (referred to as the Policy Server throughout this manual). Audience The audience includes, but is not limited to, customers who have decided to implement the Policy Server application. Prerequisites You should have access to, or be familiar with, the following: Standard industry terminology Server Management Web Services (SMWeb) Revision History Date October 2012 February 2012 Description Added trademark changes and procedure for accepting remote sections. Initial release Additional Information Updates and supplementary information are available online. Internet site for product, service, resource, support, and other customer information Internet site for published Teradata customer documentation Teradata ServiceConnect Enhanced Policy Server Installation and Configuration Guide 5

6 Preface Additional Information index.cfm isupr.cfm Intranet site for published Teradata service documentation Section of the intranet site for Teradata service documentation specific to software installation and upgrade information Intranet site linking to Teradata software server 6 Teradata ServiceConnect Enhanced Policy Server Installation and Configuration Guide

7 CHAPTER 1 Teradata ServiceConnect Enhanced Policy Server About Teradata ServiceConnect Enhanced Policy Server The Teradata ServiceConnect Enhance Policy Server (Policy Server) is a server-based software application that resides on your network, allowing you to control and monitor access to your individual devices by the Teradata ServiceConnect Enhanced Gateway Agent. The Policy Server sets and controls all permissions, ensuring only authorized access to, and use of, the managed devices. Through the pages of the application, authenticated users can set up and manage device-specific permissions as well as audit Policy Server operations. Administrators of the Policy Server can also set up profiles, roles, and user accounts to control access to the components of the Policy Server application. Hypersonic SQL provides a standalone, open source, Java-based database to store and manage the Policy Server configurations. Apache Tomcat provides the Web application and file realm component for Policy Server. OpenDS directory server (an open source directory server from Sun Microsystems, Inc.) provides an internal directory server for managing access to the Policy Server application. Alternatively, you can configure an external OpenDS LDAP directory server to manage access to the Policy Server application. A single Policy Server can be configured to manage some or all agent devices. Large or widespread organizations can configure multiple Policy Servers to handle multiple devices uniquely. The platform communicates with devices by sending commands to the Agents running on the devices and by receiving their responses. The commands are typically requests to perform actions, such as upload files, run applications, restart, execute packages, set data values, and so on. If a device is not managed by the Policy Server, the Agent performs the Platform s action automatically and provides any requested data. If a device is managed by a Policy Server, the Agent first references its policy to determine whether it can perform the action. In addition to platform-initiated actions, each Agent can also be configured with its own actions, which are associated with triggering events. These associations are called logic schemas. The Agents execute the actions configured in a logic schema when the associated trigger fires. For example, if a data item reaches a specified value, the Agent performs a predefined action, such as sending an alarm to the Platform, or setting a value to another data item. Agents can also be configured to upload data and alarms to the platform. These configurations are called data loggers and alarm loggers. Teradata ServiceConnect Enhanced Policy Server Installation and Configuration Guide 7

8 Chapter 1 Teradata ServiceConnect Enhanced Policy Server Help System When devices managed by a Policy Server are asked to perform an action from the platform, their Agents first refer to their policy, as defined by the Axeda Policy Server. A policy is a list of actions that the Agent is capable of performing and the permissions to perform each action. The permissions have at least an access right and can also have time windows and expressions that define who can request the action and from which Platform. The policy determines how the Agent handles a request: accept and perform the action, deny the action, or ask Policy Server to approve the action. The Agent enforces the policy as set in Policy Server and reports its policy-related activities to the Policy Server and the platform. When an Agent requests permission to perform an action, the Policy Server sends an notification to the specified users. The recipients must accept or deny the action within a defined time period. The Policy Server sends that action back to the Agent. The Agent notifies the platform that the action was approved or denied, and, if approved, performs the action. The Agents initiate all communication between Policy Server and its managed devices. When an Agent contacts the Policy Server, it receives any current or updated policy settings or accepted or denied requests. At the same time, the Agent sends the Policy Server its action requests and list of supported actions. Help System Detailed online help is available within the Policy Server application. Recommended Platform Requirements Platform Feature Hardware Operating System Web Browser Recommended Requirements Both Virtual and Physical hardware are supported. 1 CPU; 1 GHz minimum 1GB RAM minimum 100Mb NIC or faster 40GB drive minimum As audit log files are created, your disk space requirements will grow. You may choose to set up an automated log archival process or monitor disk space usage and archive log files as required. 32/64 Bit Microsoft Windows 7 Ultimate and Professional 32/64 Bit Microsoft Windows Server 2008 Enterprise SP 2 32 Bit Microsoft Windows 2003 SP2 32 Bit Microsoft Windows XP SP 3 32/64 Bit Red Hat Enterprise Linux 5.x 32/64 Bit SUSE Linux Enterprise Desktop 10 Policy Administrators' workstations access the Policy Server via a web browser. Microsoft Internet Explorer 5.5 or later 8 Teradata ServiceConnect Enhanced Policy Server Installation and Configuration Guide

9 Chapter 1 Teradata ServiceConnect Enhanced Policy Server Recommended Platform Requirements Platform Feature LDAP Directory Server Integration Listener Ports Recommended Requirements Sun One (iplanet) 5 Open DS 1.0 Microsoft Active Directory integration is currently not available The Policy Administrators and the Agent (SWS) connect to the Policy Server on any tcp port you configure. Teradata recommends tcp 8009, which does not conflict with currently well-known ports. Teradata ServiceConnect Enhanced Policy Server Installation and Configuration Guide 9

10 Chapter 1 Teradata ServiceConnect Enhanced Policy Server Recommended Platform Requirements 10 Teradata ServiceConnect Enhanced Policy Server Installation and Configuration Guide

11 CHAPTER 2 Policy Server Installation Before Installation Note: Always install and validate the Gateway Agent before installing the Policy Server. The installation media contains the installation program for the Policy Server and its components. The program installs: The Policy Server Apache Tomcat Hypersonic SQL Java Runtime Environment OpenDS directory server The program allows you to configure an OpenDS LDAP external directory server for user authentication. You can configure the Policy Server to communicate with the directory server from the installation program. However, you need to configure the groups required for Policy Server from the administration program of your external directory server. It is recommended, but not required, that you configure these groups before you run the Policy Server installation program, especially if you want to install and run Policy Server as a service. If you do not have a directory server and you select No when prompted to use an external directory server, the program installs the OpenDS directory server. The program also configures Open DS and sets it up to run as a service. When you configure users in the Policy Server application, you are configuring users for Open DS. Pre-Installation Decisions Prior to installing the Policy Server, address the following issues: Do you have a plan and resources in place for 24-hour access to the Policy Server? If you decide to restrict access with the Policy Server, Teradata's response time is limited by the time it takes you to log in and grant access. The Gateway Agent should be installed and configured for your site prior to installing the Policy Server. For more information, see the Teradata ServiceConnect Enhanced Gateway Agent Installation and Configuration Guide. Determine where you want to install the Policy Server and its components. Verify enough disk space is available. Make sure ports 8009 and 389 are available on the server. Port 8009 is where the Policy Server listens for incoming requests. Port 389 is used by the OpenDS directory server. Teradata ServiceConnect Enhanced Policy Server Installation and Configuration Guide 11

12 Chapter 2 Policy Server Installation Installing the Policy Server on Windows Obtain the URL for your server and the addresses of the users to be notified when a system problem is detected. By default, the Policy Server sends messages once an hour until a problem is resolved. Determine if you need messages more or less frequently. Decide how long to keep audit log files. The default is five days. One file is created for each day of entries. Decide whether SSL encryption is required for communications between the Policy Server and the rest of your platform. Teradata does not supply a SSL certificate for the Policy Server. If you want to use SSL, you must install it at a later time. Decide if you want Policy Server to start each time the machine starts, or if you want to start it manually. If you need to configure your external directory server groups for Policy Server after installation, do not start the service after installation. Since the installation program starts OpenDS as a service after installing it, you may want to start the Policy Server service as well. Choose if you want to use an external directory server. If you do not have an existing directory server, you can use the OpenDS directory server included in the Policy Server installation. If you want to use an existing external OpenDS directory server, you need the configuration information when installing. If you choose not to use an external directory server, the installation program installs and configures OpenDS for use with Policy Server. It adds the groups you need as well as the administrator user (the installer also adds this user to the groups required for Policy Server). You do not have any additional configuration steps for OpenDS. You can add, edit, and remove the users for this internal directory server directly from the Policy Server application (Administration component). Installing the Policy Server on Windows 1 Locate and run AxedaPolicyServer.exe. The Policy Server installation program starts, showing the information you need during installation. 2 Click Next. 3 Read the License Agreement, then click I accept the terms of the License Agreement. 4 Click Next to display the Choose Install Folder screen. 5 Either accept the default folder, or browse to the installation folder you want to use. 6 Click Next to display the Listening Port screen 7 At Port, enter Click Next to display the Server screen. 9 At Hostname, type the URL for your outgoing server. 10 Click Next to display the System Error Notification Settings screen. 11 Complete the following fields: 12 Teradata ServiceConnect Enhanced Policy Server Installation and Configuration Guide

13 Chapter 2 Policy Server Installation Installing the Policy Server on Windows Field Name Content address to send to The address of the Tomcat/Policy Server system administrator. If the system has problems, Tomcat sends a notification message to this address. from address Frequency (in minutes) of s Subject for System Error s The address for the Policy Server, which appears in the From line of the message. Change the default to the address of the person or group who will monitor this server. This can be changed later if needed. The number of minutes you want Tomcat to wait between transmissions of the message, until the problem is resolved. Default is once per hour. The string to use in the Subject line of messages from the system. The default is APS System Error. 12 Click Next to display the Audit Log screen. 13 At Days, type the number of days to keep audit log information, or accept the default of five days. The audit log messages are available through the View Audit Log Entries page in the Audit Log component of the Policy Server. You can change this setting through the Configuration tab. This setting does not affect the number of audit log files (also containing a single day s audit messages per file) saved to disk; that setting is managed in the PolicyManager.properties file. 14 Click Next to display the Use SSL screen. 15 Select No to indicate you are not using SSL. 16 Click Next to display the Axeda Policy Server Service screen. 17 Select Install as a service if you want the Policy Server to start when you start or reboot the machine. Otherwise, leave it cleared. 18 To start the service immediately after installation, select Start service. If you need to configure Policy Server users in your external directory server, leave this check box cleared. 19 Click Next to display the first Directory Server Configuration screen. 20 Select No if you do not want to configure an external LDAP directory server. 21 Click Next to display the Pre-Installation Summary screen. 22 Review your installation selections. If necessary, click Previous to return to a previous screen and change the selections. 23 Click Install. If the Install Complete screen reports that warnings occurred, check the log file created by the installer, called AxedaPolicyServer_Install.log. This file is stored in the installation folder. Open this file in a text editor to look for the warnings. 24 Click Done to exit. Teradata ServiceConnect Enhanced Policy Server Installation and Configuration Guide 13

14 Chapter 2 Policy Server Installation Installing the Policy Server on Linux 25 Access the Policy Server at 26 Verify that you can sign in. The ID and Password are both admin. If you cannot sign in, repeat the procedure, making sure you complete each step. If you still cannot sign in, contact Teradata Services. 27 If you can sign in successfully, and see the policies, click Log Out. 28 Follow the Import and Configuration Guide that was downloaded with the Policy Server Application Software to configure the policy server for use. Installing the Policy Server on Linux The installation program for Linux runs in a console window. Press Enter, and follow the on-screen prompts. 1 Locate and run AxedaPolicyServer.bin. The Policy Server installation program starts. 2 Read the information required to perform this installation. 3 Read and accept the License Agreement. 4 Select the folder in which to install Policy Server. Press Enter to use the default folder. 5 When prompted for the Listening Port, enter Enter the URL for your outgoing server. 7 Type the address of the Policy Server system administrator (for the To field). If the system has problems, Tomcat sends a notification message to this address. 8 The address the Policy Server, which appears in the From line of the message. Change the default to the address of the person or group who will monitor this server. This can be changed later if needed. 9 Enter the number of minutes you want Tomcat to wait between transmissions of the message, until the problem is resolved. Default is once per hour. 10 Enter the string to use in the Subject line of messages from the system. The default is APS System Error. 11 Type the number of days to keep audit log information, or accept the default of five days. The audit log messages are available through the View Audit Log Entries page in the Audit Log component of the Policy Server. You can change this setting through the Configuration tab. This setting does not affect the number of audit log files (also containing a single day s audit messages per file) saved to disk; that setting is managed in the PolicyManager.properties file. 12 When prompted, enter N to indicate you are not using SSL. 14 Teradata ServiceConnect Enhanced Policy Server Installation and Configuration Guide

15 Chapter 2 Policy Server Installation Reinstallation Considerations 13 Enter Y if you want the Policy Server to start when you start or reboot the machine. Otherwise, press Enter. 14 If you chose an external directory server, type 2 and press Enter to select OpenDS LDAP. 15 When prompted, review your installation selections. 16 Type Y to continue with the installation. If the installer reports that warnings occurred, check the log file created by the installer, called Axeda_Policy_Server_InstallLog.log. This file is stored in the installation folder. Open this file in a text editor to look for the warnings. 17 Access the Policy Server at 18 Verify that you can sign in. The ID and Password are both admin. If you cannot sign in, repeat the procedure, making sure you complete each step. If you still cannot sign in, contact Teradata Services. 19 If you can sign in successfully, and see the policies, click Log Out. 20 Follow the Import and Configuration Guide that was downloaded with the Policy Server Application Software to configure the policy server for use. Reinstallation Considerations If you need to reinstall the Policy Server, contact Teradata for assistance. Depending on your configuration, you must recover or save certain files, so you do not have to re-configure the Policy Server. Installed Files List When the installation is complete, the following directory and files are available in the installation directory. Directory audit bin Contents All audit log files are saved to this directory by default. serverversion.cmd server-version.jar For obtaining the release number and build number of your Policy Server hsqldb Hypersonic SQL application files /apm - Hypersonic SQL files for the Policy Server /bin - runutil.bat / runutil.sh /lib - hsqldb.jar and servlet.jar Teradata ServiceConnect Enhanced Policy Server Installation and Configuration Guide 15

16 Chapter 2 Policy Server Installation Installed Files List Directory jre OpenDS Contents Supported version of the JRE (Java Runtime Environment). The installation program updated your system class path to point to this directory. If you did not configure an external directory server, the installation program automatically installs, configures, and starts this open source directory server as a service. This is installed as an automatic service, so that whenever you stop and start the machine where it is running, OpenDS stops and starts automatically. You can add users through the Policy Server Administration component. If you chose to configure an external directory server during installation, this directory is absent. Tomcat5 Apache Tomcat application files. /bin - Tomcat startup files, which have all been modified by the installation program to point to the installed location /common/classes - PolicyManager.properties and log4j.properties common/endorsed - xml-apis.jar and xercesimpl.jar, XML parser and XML apis for Tomcat common/i18n - Tomcat jar files for different languages common/lib - Tomcat jar files /conf - Tomcat configuration files (server.xml is the only one you may need to edit) /server - Tomcat subdirectories and files for the server. The webapps directory contains subdirectories and files for its manager application, including the manager-how-to.html file that explains how to use the Tomcat manager Web application. /webapps/ applications/apm - Policy Server web application files Uninstall All the files needed to uninstall Policy Server, the database, and Tomcat5 16 Teradata ServiceConnect Enhanced Policy Server Installation and Configuration Guide

17 CHAPTER 3 Policy Server Configuration File The PolicyManager.properties File The Policy Server configuration file is PolicyManager.properties. This file contains all Policy Server-specific settings initially configured based on your entries during installation. This file is in the Tomcat5\common\classes directory of the Policy Server installation directory. If you used the default installation directory for Windows, the complete path for this file is c:\axeda\policyserver\tomcat5\common\classes \PolicyManager.properties. You may decide to edit the Policy Server configuration file for a number of reasons, such as changing the default values for the refresh rate in the Pending Requests pages and changing your external directory server information. If you move your directory server, for example, you need to reconfigure it to communicate with Policy Server and with Tomcat. If you move the Policy Server machine, you need to edit the Policy Server configuration file, and possibly reconfigure the Policy Server IP address and port for the Agents running on devices managed by the Policy Server. You can perform this task using the Deployment Utility. In general, the configuration files are comprised of name-value pairs (for example server.database=aps, where server.database is the name and APS is the value). Do not change the name settings. If you do want to change the value settings, make sure the values you apply are supported and use the same case, as the files are case-sensitive. To change the configuration of the Policy Server, edit the PolicyManager.properties file in a text editor. Make sure the Policy Server is not running while you make the changes. If you installed Policy Server as a service on Windows and chose to start it after installation, stop the service before editing this file. Stopping the Policy Server Take the steps below to stop the Policy Server service on Windows. 1 From the Start menu, select Control Panel. 2 Select Administrative Tools. 3 In the Administrative Tools window, select Services. 4 In the Services window, select the Axeda Policy Server service. 5 Click Stop for the service. 6 Leave the Services window open while you edit the configuration file. Teradata ServiceConnect Enhanced Policy Server Installation and Configuration Guide 17

18 Chapter 3 Policy Server Configuration File The PolicyManager.properties File Editing the PolicyManager.properties File 1 Navigate to your installation directory. By default it is c:\axeda\policyserver. 2 Navigate to the subdirectory: Tomcat5\common\classes. 3 Using a text editor, open the PolicyManager.properties file 4 Edit the properties as needed. 5 Save and close the file. 6 If you changed the directory server configuration, you must also edit the Tomcat server.xml file. 7 Restart the Policy Server. Properties in PolicyManager.properties Name (com.axeda.apm.) Description Supported Values Server Information startup.name Name of your Policy Server. This appears in the server console window only. Any valid text string, up to 250 characters. startup.version Build number for this Policy Server. Do not change. Services uses this number for reference. JDBC Settings jdbc.hosturl Address the Policy Server uses for the Hypersonic SQL database. The installation program sets this path based on where you install the Policy Server. For example, the default installation path on Windows is C:\Axeda\PolicyServer. The value here always uses the forward slashes, as in the following example for a Windows installation: jdbc:hsqldb:c:/axeda/ PolicyServer/hsqldb/apm/apm. jdbc.user Administrator for the server. Defaults to admin. Supports any valid user defined in the directory server, whether internal (OpenDS) or external (your existing OpenDS LDAP directory server). jdbc.password Administrator's password for the server. Defaults to admin. Supports any valid user password defined for the user in the associated directory server. jdbc.initial_pool_size jdbc.max_pool_ size The initial number of database connections to maintain in memory. The maximum number of database connections to maintain in memory. Default is 5 connections. Supports up to the maximum (max_pool_size). Default is 150 connections. 18 Teradata ServiceConnect Enhanced Policy Server Installation and Configuration Guide

19 Chapter 3 Policy Server Configuration File The PolicyManager.properties File Name (com.axeda.apm.) Description Supported Values jdbc.implementation_ class Connection manager implementation class. Do not change the default: com.axeda.common.jdbc.hsql. HSQLConnectionManager. jdbc.checkpoint_frequency Settings notification. .encoding notification. . mail_server System Error Notification Settings logger.notification. _to logger.notification. _ from logger.notification. _ frequency logger.notification. _ subject Audit Archive Settings audit.archive.file.enable_ logging_to_file audit.archive.file.prefix The number of hours between backups of the Policy Server database Character set used for encoding messages. Name of server to use for sending messages, typically set during installation. address of the user to which serverbased notification are sent. address used to identify the Policy Server when it sends notifications. How often (in minutes) the server sends messages about pending requests. Text shown in the Subject line of the pending request notification message. Specifies whether daily audit log entries are saved. Name (prefix) of the file to which audit log information is saved. Each day the server creates a new file of this name and appends that name with a timestamp. The default is 3 hours. The default value is UTF-8 (non-ascii). Supports any valid character set, including ASCII, UTF-16, and ISO8859. The encoding you select must be supported by your server and client applications. Specify the complete server path for your server. Any valid address. Any valid address. The default is 60 minutes. Any whole number is supported Supports any text string, up to 250 characters. The default is APS System Error. True: the server saves audit log information to a file (default). False: audit log information is not saved to a file. Any valid text string is supported. The default value is APM_Audit. audit.archive.file.suffix Filename extension for the audit log file. The default value is.txt. Policy Server also supports the.csv. audit.archive.file.path audit.archive.days_available _for_ui Directory where the audit log files for the Policy Server are archived. Number of days of audit log information to show in the Audit log page of the Policy Server and to save in the database. When the The installation program creates a directory, /audit, under the main installation directory. Policy Server supports any valid directory location on the local computer. This value is set in the installation program. Any whole number is supported. The default value is 5 days. Teradata ServiceConnect Enhanced Policy Server Installation and Configuration Guide 19

20 Chapter 3 Policy Server Configuration File The PolicyManager.properties File Name (com.axeda.apm.) Description Supported Values Audit Log Paging: Number of Entries on Each Page number of days is reached, the audit log records defined by that number of days are removed from the audit database. audit.max-entries-per-page Web Services Settings Maximum number of entries shown in a single page of the Audit Log. Maximum number of category entries shown in a single page of the Audit Log. The default is 100 entries per page. Supports whole numbers from 1 to 999. The default is 100 entries per page. Supports whole numbers from 1 to 999. webservices.enable Enables support for Web services operations. The default is false (disabled). Change to true to enable the Policy Server to accept and perform web services operations. webservices.authentication. required webservices.session.timeout Enables user authentication requirements for web services operations. The maximum number of records returned for a web services query. How long Policy Server waits before ending an unattended web services session. The default is true (enabled). Change to false if the Policy Server can accept web services operations without requiring user authentication. The default is 1000 records. Any whole number is supported. The default is 60 minutes. Any whole number is supported. Backup/Restore Settings (Teradata recommends that you never change these settings) The data directory that is backed up using a web services backuprestoreservice operation. The installation program creates the directory, /hsqldb/apm/, under the main installation directory. By default, this directory is identified as the data directory to backup. Supports any valid directory location on the local computer. audit.max-category-entriesper-page webservices.max-recordsreturned backup-restore.datadirectory backup-restore.backupdirectory backup-restore.backupfileset Pool for XML Parser The destination directory that contains the data that was backed up using a web services backuprestoreservice operation. The files to include in a backup using a Web services backuprestoreservice operation. The installation program creates a directory, /hsqldb/apm/backup/, under the main installation directory. By default, this directory is identified as the destination directory to contain the backed up data. Supports any valid directory on the local computer. By default, the following database files (located in the /hsqldb/ directory) are defined for backup: apm.backup apm.data apm.script apm.properties 20 Teradata ServiceConnect Enhanced Policy Server Installation and Configuration Guide

21 Chapter 3 Policy Server Configuration File The PolicyManager.properties File Name (com.axeda.apm.) Description Supported Values parser.max-pool-size=5000 Contact Thread Queue Size and Max Delay Settings db.maxcontact ThreadUpdate QueueSize db.maxcontact ThreadUpdate Delay db.max_rows Message Settings message.timeout Directory Server The maximum number of connections in the connection pool. Increase this value based on the number of agents. The greater the pool size, the more memory is used. The maximum size of the update contact thread queue (the number of device items). The maximum delay between contact thread updates, in seconds. The maximum number of rows to fetch from the database. The number of milliseconds the Policy Server waits for a message to be sent to it. Messages that take longer than this time period are discarded and a warning is issued. The default is This value cannot be less than 10. The default is The default is 10 seconds. The default is 1000 rows. The default is milliseconds. The values shown here are for the internal OpenDS directory server (the default). If you are using an external LDAP server, the values you provided during installation appear in this section of PolicyManager.properties. directory-server.port directory-server.name directoryserver.peoplesearch directoryserver.groupsearch directory-server. adminsearch The port on the directory server to use for authentication. The host name or IP address of the machine where the directory server is running. Search information for locating users in the database of the directory server. Search information for locating groups in the database of the directory server. Search information for locating administrators in the database of the directory server. Specify the port number for the Policy Server to use for communication with the directory server. The standard port for LDAP directory servers is 389, which is used by the internal OpenDS. Specify the IP address or host name of the machine where the directory server is running. For the internal OpenDS, the value is localhost. Specify the appropriate peoplesearch entry for your directory server. For an internal OpenDS, the value is: ou=people,dc=axeda,dc=com Specify the appropriate groupsearch entry for your directory server. For an internal OpenDS, the value is: ou=groups,dc=axeda,dc=com Specify the appropriate entry for your directory server. For an internal OpenDS, the value is ou=admin. userstore.factory The User Store factory. Do not change the default: com.axeda.apm.user.ldapuserstorefactory. Teradata ServiceConnect Enhanced Policy Server Installation and Configuration Guide 21

22 Chapter 3 Policy Server Configuration File The PolicyManager.properties File Name (com.axeda.apm.) Description Supported Values userstore.name userstore.group.users userstore.group. administrators userstore.group.ldap. administrators The name of the user store associated with Tomcat. The users group required in the directory server for Policy Server. The administrators group required in the directory server for Policy Server. The LDAP administrators group required in the directory server for Policy Server. For Open LDAP (including an internal or external OpenDS), the value is OPEN_LDAP. Do not change the default: APSUsers. Do not change the default: APSAdmins. Do not change the default: APSLdapAdmins. directory-server.on Enables the directory server. Do not change the default: true. administrator. support. user.password.expired user.password.expiration_ warning Instantiator instantiator.startupfile.name scheduler.retry-frequency scheduler.max-threads Enhanced Select Lists The address of the administrator of the directory server The address for the support organization. The period of time when user passwords are valid. Identifies how soon before a password will expire the directory server sends a message to warn the user that the password will expire. The name of the XML configuration file for the scheduler. The Instantiator reads this file for the scheduler. The number of milliseconds the scheduler waits between attempts to connect to the database. The maximum number of threads for the scheduler to use. By default, this property has no value. If you provide an address in this file, use proper format. The address for the support organization. Should be an internal address for the person or organization responsible for the health of the policy server. By default, the value is -1, which means no expiration period. You can change this value to a number of days. By default, the value is -1, which means that no messages are sent. This value corresponds to the expired property value of -1 (no expiration period). If you set a value such as 60 or 90 days for the expiration, you should also set a value for this property. For example, you may want to warn users 10 or 14 days in advance of the expiration. Do not change the default: startup.xml. Do not change the default: 100 milliseconds. Do not change the default: 5 threads. Enhanced select lists provide a way to select items in the Policy Server application from very large datasets. These lists also maintain a most-recently-used list, which makes each select list more efficient. When an enhanced select list is in enhanced mode, any items not displayed in the first max-lines-displayed items are available to select in a popup window. 22 Teradata ServiceConnect Enhanced Policy Server Installation and Configuration Guide

23 Chapter 3 Policy Server Configuration File The PolicyManager.properties File Name (com.axeda.apm.) Description Supported Values enhanced-select-list.mrusize enhanced-select-list.maxlines-displayed enhanced-select-list.popupthreshold Password Length The number of items to store in the most recently used list. The maximum number of lines displayed when a select list is in enhanced mode. When the number of items in a select list is greater than or equal to this value, the list is shortened by the number of max-linesdisplayed and the list uses enhanced mode. The default is 9 items. This value is appropriate for the way pop-up windows work on Windows platforms. The default is 11 lines. The default is 35 items. user.password.length The minimum length for user passwords. The default is 6 characters. Depending on security needs, many installations increase this value to 8 characters. Pending Requests, Automatic Refresh Interval pendingrequests.refresh.interval Remote Sessions remote.started.before Sets the number of seconds between automatic refreshing of the information on the pending requests page. Sets a time period for displaying remote sessions. For example, the default value is 5 hours. The View and End remote sessions page displays remote sessions that have started between now and 5 hours ago. The default is 60 seconds. The default is 5 hours. If you want to see the remote sessions for the previous two days, set this value to 48 hours. Teradata ServiceConnect Enhanced Policy Server Installation and Configuration Guide 23

24 Chapter 3 Policy Server Configuration File The PolicyManager.properties File 24 Teradata ServiceConnect Enhanced Policy Server Installation and Configuration Guide

25 CHAPTER 4 Policy Server Operations Starting the Policy Server If you chose to install the Policy Server as a service on Windows and then made changes to the configuration files, you must restart Policy Server. To restart the Policy Server service, open the Services window. For example, on Windows XP, select Control Panel on the Start menu. From the Control Panel window, open Administrative Tools, then Services. Select the Policy Server service, and click Restart to restart the service. If you did not install Policy Server as a service, start the Axeda Policy Server manually after making configuration changes. As a default, the Policy Server runs the HSQL database in in-process (standalone) mode. When you start the Policy Server, the database starts as well. Only the Policy Server can access the database. When you stop the server, the database stops as well. To start Axeda Policy Server, you run the startaps script for the operating system. This script starts the Tomcat Web server, the Policy Server, and the HSQL database. You do not need to start Tomcat and the database separately. If you are using the OpenDS directory server, it is already running as a service; it stops and starts when the machine is stopped and started. If you are using an external directory server, make sure it is running before you start Policy Server. 1 To start the Policy Server on Windows: a Run startaps.bat by double-clicking on the file in an Explorer window. 2 To start the Policy Server on Linux: a b At a command prompt, change to the directory containing the server installation. This directory contains the shell script, startaps.sh, used to start the server. Type startaps.sh (case-sensitive) and press Enter. Accessing the Policy Server 1 Run our browser. 2 In the address bar, type the IP address and port number 8009 for the Policy Server, for example: The Login fields display. 3 Enter the user name and password for the administrator. Teradata ServiceConnect Enhanced Policy Server Installation and Configuration Guide 25

26 Chapter 4 Policy Server Operations Setting User Preferences The default administrator login credentials are admin / admin. The Policy tab displays. Setting User Preferences 1 Log into the Policy Server. 2 In the upper right corner of the window, click Preferences. The User Preferences page appears. 3 At Default Application, select the tab that you want to display on login: Policy, Pending Requests, Remote, or Administration. The default page is the Home page. 4 To update your password and address, click Edit User Attributes. The Update your Address and Password page appears. 5 Change your address or password, and click Submit. 6 On the User Preferences page, click Submit to save your changes. The system returns to your selected default page. Setting Up Security After installing the Policy Server, you need to set up security, by assigning privileges to the components of the application by configuring profiles, roles, and users. You must be an administrator of the directory server associated with Policy Server to add users because adding them in the Policy Server application adds them to your directory server. Be sure you know the administrator login and password for the directory server. Create profiles first, then roles, and finally users. You can always return to the created profiles, roles, and users and edit their definitions. Note that you cannot rename these elements; you must delete them and create new ones. User Authentication To access the Policy Server, you must submit a valid user name and password to Policy Server for approval. The server matches the user name and password against the information in the directory server database. For approved users, the server determines the Policy Server groups in which the users are defined. Based on the group membership and the privileges assigned (through the roles assigned to the user), the Policy Server displays or hides components of the application. You set up security in the administration component of the Policy Server application. You can control access to each main component (Policy, Pending Requests, Audit Log, Configuration, Remote (Sessions), and Administration) but not to the individual pages or features within a component. 26 Teradata ServiceConnect Enhanced Policy Server Installation and Configuration Guide

27 Chapter 4 Policy Server Operations Setting Up Security Privileges Profiles Roles Users Privileges are the base units for the system's security architecture. Privileges are defined in the system and cannot be changed. Most of the Policy Server application offers two privileges: View and Add/Edit. View provides read-only access to the pages of a component. Add/Edit provides read, write, and delete access to the pages of the component. For example, Add/Edit for the Pending Requests component allows users to approve or deny pending requests, while, for the Administration component, it allows users to create, edit, and delete profiles, roles, and users. For the Audit Log component, only the View privilege is available. For the Remote (Sessions) component, the two privileges are View and End. End allows a user to end a remote session. The Administration component allows you to define a set of privileges to one or more components. This set of privileges is called a profile. You may choose to create a profile for each main component (Policy, Pending Requests, Audit Log, Configuration, Administration, and Remote (Sessions)). Alternatively, you may choose to create profiles that apply to the jobs that certain users perform. For example, you want to create profiles for users who manage Pending Requests and users who need to monitor the Audit Log. In a profile called PendingRequests, you select View and Add/Edit for the Pending Requests component. In another profile called AuditLog, you provide View access to the Audit Log component. In a third profile called PolicyView, you provide View access only to the Policy component. Once you have defined profiles, you combine them into sets, called roles. You then assign roles to each user or assign users to each role. To continue the example from Profiles, you might create a role called RequestManager and assign it the PendingRequests and PolicyView profiles. You then assign the user whose job it is to handle incoming requests to the role. That user can then approve and deny pending requests, and as needed, view the policies for the devices. Created either in the Administration component of the Policy Server application or in your LDAP directory server, Users are the accounts you create for people to access the Policy Server. Once you have defined roles and assigned profiles to them, you assign users to the roles. Similarly, when creating or editing users, you can assign one or more roles to them. When the user logs in, the Policy Server authenticates the user name and password and then makes available the features defined by the roles assigned to the user. If a user has no roles assigned, only the home page of the Policy Server application is available. If a user has multiple roles assigned and a profile for one role is deleted, that role becomes inactive. The next time the user logs in, only the features defined by the role that has not changed are available. For example, a user has one role that provides View and Add/Edit to the configuration component (through one profile) and a second role that provides the same access to the Policy and Pending Requests components through two separate profiles. If you remove the profile for the Policy component, the second role becomes inactive. The next time the user logs in, only the Home page of the entire application and the configuration component are available. The removal of the Policy profile makes both the Policy and Pending Requests components unavailable because both profiles (Policy and Pending Request) are assigned to the same role. Creating Profiles To create a profile, you need to have View and Add/Edit privileges to the Administration component. If you are logged in as the administrator of your directory server, you have these privileges. 1 In the Policy Server, select the Administration tab. Teradata ServiceConnect Enhanced Policy Server Installation and Configuration Guide 27

28 Chapter 4 Policy Server Operations Setting Up Security 2 Select New > Profile. The Create profile page appears. 3 At Name, type a unique identifier for the profile, up to 50 characters. Use the names of the components, such as Audit Log, Policy, Policy View, or Pending Requests. 4 At Description, type a brief description of the profile. 5 Under Component / Privilege, select the check box to assign privileges for the profile. Access can either be View or Add/Edit. 6 Click Submit to save the new profile. The View and remove profiles page appears when you exit, with the new profile's name and description listed. Notice the Delete link in the Actions column. Click this link to remove the related profile. Creating Roles To create a role, you need to have View and Add/Edit privileges to the Administration component. If you are logged in as the administrator of your directory server, you have these privileges. 1 In the Policy Server, select the Administration tab. 2 Select New > Role. The Create role wizard starts. 3 At Role Name, type a unique identifier for the role, up to 50 characters. 4 At Description, type an explanation of the role, using up to 200 characters. 5 Click Next. The wizard advances to the Assign profiles to role page. 6 In Available Profiles, select the profiles for this role and click the right arrow to move them to Selected Profiles. Use CTRL or SHIFT to select more than one profile at a time. 7 Click Next. The wizard advances to the Assign users to role page. 8 If you have not yet created users, click Next. If you have created users, assign them to the role you are creating, then click Next. 9 Review the information, and click Finish to create the role. Setting Up Users Once you create profiles and roles, you can create users and assign them roles that give them the privileges they need. To create users, you need View and Add/Edit privileges to the 28 Teradata ServiceConnect Enhanced Policy Server Installation and Configuration Guide

29 Chapter 4 Policy Server Operations Setting Up Security Administration tab, as well as the administrator login name and password for the directory server that you are using with the Policy Server. 1 In the Policy Server, select the Administration tab. 2 Select New > User. The Create User wizard starts. 3 If this is the first time you accessed the wizard during this session, sign in: a b c At User Name, type the user name of the directory server administrator. For the OpenDS server installed with Policy Server, type admin. At Password, type the password of the directory server administrator. For the OpenDS server installed with Policy Server, type admin. Click Submit to display the Create User page. 4 At User Name, type a unique identifier for the user, using up to 50 alphanumeric characters. You cannot change this name once the user has been created. You cannot use spaces, punctuation, or any special characters. 5 At Full Name, type the first and last names of the user, up to 50 characters. You can use alphanumeric characters, periods, and spaces. 6 At Password and Confirm Password, type the initial password for the user. Passwords can be between six and 50 characters long, including alphanumeric characters, spaces, and punctuation. Passwords are case-sensitive. 7 For this user to receive notifications regarding device groups assigned the user, type the address for the user. If more than one address is needed, separate the addresses with a comma. 8 Optionally, type the phone number and fax number for the user. These fields accept numbers and hyphens. 9 If the user is an administrator of the Policy Server and the directory server, select the Administrator check box. When you select this option, the user has all privileges to all components of the Policy Server application. 10 Click Next. 11 If the user is an administrator, skip this step. If the user is not an administrator: a b Assign roles to the user by selecting them, and clicking the right arrow to move them to Selected Roles. Use CTRL or SHIFT to select more than one profile at a time. Click Next. 12 Review the information. 13 Click Finish to create the role. Teradata ServiceConnect Enhanced Policy Server Installation and Configuration Guide 29

30 Chapter 4 Policy Server Operations What Is a Policy? What Is a Policy? A policy is a set of permissions for performing actions. When it first registers with the Policy Server, an Agent sends a complete list of its supported actions. Policy Server is installed with support for all known actions contained in the released version. These actions are referred to as Base actions. By default, all base actions are defined with a default permission and the access right Ask for Approval. Until you change the permission and access right in the Policy Server, each device asks the Axeda Policy Server for approval to perform any action defined in the policy. Policy Server supports new actions by automatically applying a permission of Ask for Approval. Policy Inheritance The hierarchy of device groups exists to support the inheritance of policies. By default all automatically created device groups inherit the policy of the Global device group. You can change this inheritance by creating your own device groups and by changing the Parent device group for each automatically created device group. About Permissions A permission defines how an action is managed through a combination of values for the parameters of the action, filters, and inheritance. Each action defined in a policy has at least one permission and may have multiple, related permissions. If you require different policies for device groups, you can edit the default permission and create additional permissions for each action. Not all actions take parameters. For example, the Restart Agent action, which controls whether the device performs a requested hard restart, has no specific parameters. However, the Package action, which controls whether a device can accept a Software Management package from the Platform, supports two parameters: the name of the package and the version of the package. The Global device group and its policy define the default permissions for all new device groups. If you modify the permissions of the Global policy, any device groups that currently inherit the Global policy inherit those changes. All new device groups have the Global policy until you change either the parent device group or the policy for the new device group. When adding a permission or action that contains a file name, always use full paths. Access Rights An access right specifies how you want the individual devices to handle the related action. New permissions have a default access right (Ask for Approval), however you can assign it a different access right and create filters for the permission. Filters are optional but all permissions have at least the default filter, which consists of a single access right. Three access rights are available: 30 Teradata ServiceConnect Enhanced Policy Server Installation and Configuration Guide

31 Chapter 4 Policy Server Operations What Is a Policy? Always Allow Ask for Approval The agent can execute the action without asking for approval or sending the action information to the Policy Server. To see which actions of this right were performed on a device, refer to the log file of the agent running on the device The default access right for any new permission and for all permissions in the Global device group when you first start the Policy Server. With this right, the agent forwards the action and its parameters to the Policy Server for approval, and sends a status message to the Platform. When it receives the request for approval, the Policy Server sends an to the address specified for the device group and stores the action request in the Pending Requests queue. The action request remains in the Pending Request page until it is approved or denied, or until it times out. If it times out, the action is denied and must be requested again; a message is written to the audit log of the Policy Server. When approved or denied, the action request is removed from the Pending Requests page and a message is written to the audit log of the Policy Server. Policy Server sends its response to the Agent running on the device. The Agent sends another status message to the Platform to identify whether the action request was approved or denied. If the action request was approved, the Agent then processes the action. Never Allow The Agent does not execute the action. It sends information about requests for an action with this access right to the Policy Server only when Never Allow actions are requested from the Platform. To see which device-initiated actions of Never Allow rights were denied on a device, refer to the log file of the Agent running on the device. Due to the frequency of requests, the following actions do not support the Ask for Approval access right nor do they support filters: Set Time, Data Item Values, Alarms, Event, and . If you apply a filter to one of these actions, it has no effect. About Filters A filter is a set of restrictions for a permission. You can create a filter and assign it to one or more permissions in the same policy or in different policies. You must have Add/Edit permission to the Policy component of the application to create, edit, delete, or assign filters to permissions. Every permission has a default filter that cannot be removed. This default filter is an access right that can be set to Always Allow, Ask for Permission, or Never Allow. A default filter has no name, expression, or time window. If the permission has multiple filters, the default filter is always the last one in the list. When the Agent evaluates the filters for a permission, if no user-defined filter in the list is a match, the Agent evaluates the default filter, which always matches. Adding filters to permissions allows you to: Maintain a static list of permissions, each with a default access right Allow or deny access to an action for a specific user Create a time window during which a user can access or request access Assign multiple filters to a permission to set up a complex set of allow, ask, and deny rules You must assign new filters a name that is unique in the Policy Server database and an access right. In addition, if you want to restrict a permission to certain users at certain times, you can add expressions, which can consist of variables, values, and operators. Teradata ServiceConnect Enhanced Policy Server Installation and Configuration Guide 31

32 Chapter 4 Policy Server Operations What Is a Policy? Valid operators are the equal sign (=) and AND. For variables, you can specify the userid and the domain name of the Platform from which the Agent received the action request. Variables can contain the asterisk (*) wildcard character to represent any number of characters. Grouping and other Boolean operators, such as OR and NOT are not supported. Expressions are case insensitive. However, variable names must be entered as follows: userid and enterpriseid (i.e., capital I, lowercase all other letters). When evaluating expressions, the Agents parse and check the syntax. The Policy Server does NOT check expression syntax. To restrict access to a period of time, define a Time Window for the filter. You can choose a fixed time period or one of two recurring time periods. <blank> One Time Weekly Recurrence Weekly Range No time period. If you previously added a Time Window and need to remove it, select this option. Allows the action for a single time period, which can span days, weeks, or months. This option requires a Start Date and Time as well as an End Date and Time. For the date fields, click the calendar icon and select the date. Type times in the format HH:MM AM or PM. Allows the action to repeat on specified days of the week, during specified hours. Allows the action during a specified range of days of the week. The period begins at the Start Time on the Start Day of the week. The time period ends at the End Time on the End Day of the week. After you have defined filters and assigned them to one or more permissions, the Access Right column for those permissions shows the default filter but also contains the details for the assigned filters. The column to the left of the default filter shows an Expand icon. Click the icon to display the details of all filters assigned to a permission. The filters appear in the order in which the Agent will evaluate them, with the default filter shown last. Filter Evaluation Filters are always evaluated in the order they appear or were entered, from first to last. There is an implicit OR operator between filters. Evaluation stops when a filter in the list is matched. A filter match means that the Agent was able to match both the expression and the time attribute of the filter to an incoming user request. You can view and change the filter order from the Policy page for a device group. A time window is not associated with any particular time zone. When evaluating the filter, the Agent uses its system clock. An implicit AND operator exists between the filter s expression and time window. When an Agent evaluates a filter, both the associated expression AND the time window must match before the filter is considered a match and the requested action is allowed. That is, a filter is a match only if the attributes of the incoming user (userid and enterpriseid) match the filter s expression AND the user is requesting the action within the time window associated with the filter. 32 Teradata ServiceConnect Enhanced Policy Server Installation and Configuration Guide

33 Chapter 4 Policy Server Operations What Is a Policy? When a filter has no explicit expression or time window, the filter has no restrictions with regard to the user making the request or the time of the request. A filter with an empty expression matches all users and a filter with an empty time window matches at all times. Setting Permissions You can change the access right for all displayed permissions to a specific access right. For example, suppose you temporarily want to prevent all actions for a device. To do so, you display the Policy page for the device group and set all permissions to Never Allow. When you want to restore the policy settings to their original settings, clear Set All Permissions. In addition, the Set All Permissions feature allows you to reset all permissions to those of the parent device group. Follow the steps below to set all permissions to the same access right. 1 Select the Policy tab, and click Explore Device Groups. 2 Click the name of the device group whose policy you want to edit. The View or change the policy settings for <your selected device group> page appears. 3 Scroll to the end of the page. Below the Policy table, select Set All Permissions. 4 From the list, select the access right to set for all policy permissions: Always Allow, Ask for Approval, or Never Allow. If this is not the Global policy, you can also select Reset to Parent to set all access rights to those defined in the parent policy (either Global or a model). 5 If you want to assign filters: a b c Click Assign Filter. In the Available Filters table, select each filter you want to assign. Click Add Checked to move the filters to the Selected Filters table. d Click Save Changes to return to the policy page for the device group. 6 Click Done. 7 At the Update policy confirmation message, click OK. If you selected an access right, it appears in the Access Right column and cannot be changed. The Inheritance column displays the name of this device group. If you selected Reset to Parent instead of an access right, the name of the parent device group appears in the Inheritance column and the Access Right column displays Reset to Parent. You cannot change this access right. You must first restore the original policy settings. 8 If you need to restore all permission to the original settings for the device group: a b Below the Policy table, clear the check box next to Set All Permissions. Click Done and then OK. The table is updated to show the original settings (before you set all permissions to have the same access right or to reset to the permissions of the parent group). Teradata ServiceConnect Enhanced Policy Server Installation and Configuration Guide 33

34 Chapter 4 Policy Server Operations Base Installation Options Permission Inheritance Any permission set in the Global group is inherited by its child device groups. Within a child group's policy, you can override a permission set in the parent group as long as that permission is not locked in the parent group's policy. For example, assume an Execute action permission defined in the Global policy specifies that a device can execute any application without asking for approval. If the child group contains sensitive devices, you can override this permission within the child group s policy to specify that a device needs to ask for approval before running any application. This overridden permission is then inherited by that group s child groups. Notification settings for device groups can also be set for each device group, or, if not set for a child group, inherited from the parent device group. For example, you configure notification settings for the Global group. Any child groups of that Global group will use the same notification settings. As with permissions, you can override notification settings for a child device group; you can even configure unique notification settings for each device group managed by the Policy Server. Unlike permissions, notification settings cannot be locked. Permission Locks You can lock permissions to prevent them from being overwritten in the policy of a child device group. To change a permission for a child group that is locked in its parent policy, you must display the policy of the parent group where that permission is locked. For example, if a permission is locked in the Global policy, you need to open the Global policy to change the permission. All child device groups inherit that change. You lock permissions from the View or change the policy settings page for a selected device group. For each permission you want to lock, select the Lock checkbox for the related permissions. The Access Right settings for permissions that are locked in a parent s policy are not selectable in the page. In addition, no check boxes are available. Base Installation Options For This Action: Alarms This table describes all actions managed in a base installation. Any custom actions supported by your devices are not included. "Always Allow" permits the Agent, without asking, to do this: Send alarms to the platform. Custom alarms started as the result of a Start Custom Alarm action, configured in a logic schema, are not affected. All alarms are included in the action. You can select only Always Allow or Never Allow for this action. In addition, filters do not work for this action. Parameters: Alarm Name is set to * by default. You cannot change this value. Create a Timer Allow the Platform to create a dynamic timer. Name of the timer to create. 34 Teradata ServiceConnect Enhanced Policy Server Installation and Configuration Guide

35 Chapter 4 Policy Server Operations Base Installation Options For This Action: Data Item Values "Always Allow" permits the Agent, without asking, to do this: Send data item values to the platform. Data item values sent as the result of a Write Data Item action, configured in a logic schema, are not affected. All data items are included in the action. You can select only Always Allow or Never Allow for this action. In addition, filters do not work for this action. Parameters: Data Item Name is set to * by default. You cannot change this value. Disable a Script Disable a script from running when requested. Name of the script to disable. Disable a Timer Disable a timer when requested. Name of the timer to disable. s Send notifications to the platform. s sent as the result of a Send action, configured in a logic schema, are not affected. All notifications are included in the action. You can select only Always Allow or Never Allow for this action. In addition, filters do not work for this action. to is set to * by default. You cannot change this value. Enable a Script Enable a script for operation when requested. Name of script to enable. Enable a Timer Enable a timer when requested. Name of timer to enable. Events Execute Send events to the platform. All events are included in the action. You can select only Always Allow or Never Allow for this action. In addition, filters do not work for this action. Start an application on the device when requested, whether an platform-based request or Agent-initiated process. Event Name is set to * by default. You cannot change this value. Name of the applications to run. File Download Accept files downloaded from the platform. Full path of the file to download to the device. The name of the file and path may be explicit or use wildcards (for example, c:\error.log or c:\*.log. File Upload Gateway Provisioning Modify Ping Update Rate Package Upload files to the platform when requested, whether a platform-based request or Agent-initiated process. Add devices to be managed by a Gateway. Modify or delete devices that are already managed by a Gateway. Accept a new ping rate from the platform. The ping rate is the frequency, in seconds, that the Agent contacts the platform. Accept a package deployed from the platform. All contents of a package are included in the permission. Full path of the file to upload to the platform device. The path name on the device can be absolute or relative (which the Agent interprets to be the root of the Agent installation). The filename may be explicit or use wildcards (for example, c:\error.log or c:\*.log. The default action is *, meaning all three actions--add, Modify, and Delete--are permitted. If creating a new permission for this action, type the name of the action (Add, Modify, or Delete) New update ping rate. Name and version number of the package to execute on the device. Register Script Register a script when requested. Name of the script to register. Remote Application Start a remote application session when requested. Name of the remote application. Teradata ServiceConnect Enhanced Policy Server Installation and Configuration Guide 35

36 Chapter 4 Policy Server Operations Shutting Down the Policy Server For This Action: "Always Allow" permits the Agent, without asking, to do this: Parameters: Remote Terminal Start remote terminal sessions when requested. Name of the remote terminal interface. Remove a Timer Remove a timer when requested. Name of the timer to remove. Restart Agent Restart when requested. None. Run Script Run a script when requested, whether a Platform-based request or Agent-initiated process. Name of the script to run. Schedule a Script Schedule a script to run on the device when requested. Script name is set to * by default. Applies to all scripts. Set Data Item Vales Write values to its data items when requested. You can select only Always Allow or Never Allow for this action. In addition, filters do not work for this action. Set Time Allow the platform to set the time on the Agent. Time. Stop Remote Application Stop a remote application. Name of the data item to which you want to write a value. sessionid is the number of the session assigned when it was established through the platform. Stop Script Stop a script when requested. Name of the script to stop. Unregister Script Un-register a script when requested. Name of the script to unregister. Unschedule a Script Un-schedule a script on the device. None. Shutting Down the Policy Server 1 To shut down the Policy Server: a Run the shutdownaps script or press CTRL-C in the console window. b When prompted for confirmation, answer Y. Approving Remote Sessions This process provides an overview of how to approve or deny a remote session. Use this as a template for your own business process. In addition to these steps, consider including: How approvers will receive requests, such as or pager. Any steps approvers need to perform before logging into Teradata ServiceConnect to approve a request Samples of the custom s sent 1 Start the Policy Server. 2 When prompted, log in. The Policy Server window displays. 36 Teradata ServiceConnect Enhanced Policy Server Installation and Configuration Guide

37 Chapter 4 Policy Server Operations Approving Remote Sessions You may not see all of the menu options shown in the examples below. The options you see depend on the permissions that have been assigned to your account. 3 Click Pending Requests. 4 At Accept/Deny Request, select Accept or Deny to control access to the system. 5 Click Refresh to refresh the display. The request is no longer listed. 6 If your account has access to the Remote menu, confirm that the approved session has become active, or the denied session has ended. Teradata ServiceConnect Enhanced Policy Server Installation and Configuration Guide 37