TOP Server Version 6 Security Settings

Transcription

1 TOP Server 1 (10) TOP Server Version 6

2 TOP Server 2 (10) Contents Security Built In... 3 User Manager Configuration... 3 New User Accounts... 5 New User Group and Properties... 5 Configuration Security... 6 Administrative Settings Security... 7 Event Log Tracing... 8 Security Policies... 8

3 TOP Server 3 (10) Security Built In The TOP Server security features are accessed through the TOP Server Administration Interface. The User Manager options were added as part of Version 5 and the Security Policies are now included as well as part of Version 6. The Administrator account is used to add multiple users, each with their own set of rights for server access. Any user action that can influence or disrupt server operation is logged to the server's event logging system. The Security Policies tab expands the value of using the User Manager Options by providing increased control over security. The Security Policies allow administrators to assign security access permissions on individual objects (such as channels, devices, and tags) based on the role of a user interacting with the runtime project. It is used in conjunction with the server s User Manager, which allows you to manage user groups, users, and default security settings. Projects using OPC UA in particular can gain significate security control. User Manager Configuration The TOP Server User Manager settings have been enhanced to provide greater control over access to specific runtime and configuration tasks for users. To access the User Manager, follow the steps below. Start by Right Clicking on the Administration icon in the system tray. Choose Settings from the pop up menu and then the User Manager tab.

4 TOP Server 4 (10) There are three default groups available and each one contains an individual account. Other user groups and accounts can be created based off these three. Administrators o Administrator Server Users o Default User Anonymous Clients o Data Client Only the Administrator account can add additional users to the system or to change the settings of existing accounts. By default, the password for the Administrator account is blank, as this disables the security settings for connecting the Configuration. Although the Administrator account cannot be deleted, its password can be changed. The Default User account is used when no other account is active. This is the normal condition of the server. Like the Administrator account, the Default User account cannot be deleted but its password can be changed. The account can only be disabled when the Administrator denies the Server Users group all privileges. Setting the Privileges in the Group Properties can be used to control Configuration Security. The Data Client account governs the client application access and is used in conjunction with the Security Policies features.

5 TOP Server 5 (10) New User Accounts To add a new User account to a group, right click on the Group you wish to add the user to and select Add User. The following properties will be available for you to configure. Name: This parameter is used to specify a name for the user. The name can be up to 31 characters in length. Description (Optional): This parameter is used to briefly describe each user account. This can be particularly helpful for ensuring that operators log in to the proper account. Password (Optional): This parameter is used to specify the password that the user must enter in order to log in to the system. The password can be up to 127 characters in length. Users must enter it correctly in both the Password and Confirm fields for the change to be accepted. Each time a user account is edited, the password must be re-entered. New User Group and Properties Privileges are assigned at the group level. All user accounts listed under that specific group will have the same rights. To add a new Group to the User Manager, right click under the groups you already have configured and select Add User Group. The following properties will be available to fill in. Name: This parameter is used to specify a name for the user. The name can be up to 31 characters in length. Description (Optional): This parameter is used to briefly describe each user account. This can be particularly helpful for ensuring that operators log in to the proper account.

6 TOP Server 6 (10) The Properties window will list the same permissions when you add a group or if you go into the group properties to edit. The Properties are broken up into 6 main topics. Under these topics you will find specific permissions that you can select Allow or Deny. If you aren t sure what each permission mean, select the permission and down at the bottom you will see an explanation of what that means. Configuration Security In the TOP Server configuration window you can click Tools Options and select the Runtime Connection tab.

7 TOP Server 7 (10) When you click the Show user login dialog checkbox the Runtime Connection User and Password request below will be required. The User and Password used are configured in the User Manager as explained above. If you do not have a password configured in the User Manager, you can leave that box blank. If you do have a password configured this must match what is saved in the User Manager in the User Properties. If the Show user login dialog checkbox is not selected, no user authentication will be required upon connection to the Runtime. Administrative Settings Security If you set the Administrative account password in the User Manager, the Authentication Required dialog will open, requiring a password before you can open the TOP Server Administrative Settings or User Manager. Only the TOP Server Administrator Account will be able to log in to the Administrative Settings. To remove this password, go into the User Manager and select the Administrator properties. When prompted for a New Password, leave this blank and select OK.

8 TOP Server 8 (10) Event Log Tracing The Event Log Tracing shown below is very effective for change management and Security. The image below shows how all the actions between the log in and log out our part of a single users actions. Security Policies The Securities Policies tab provides the option to set access rights on 5 different access categories. In conjunction with the Data Client User account these give Administrators the ability to control what clients have access to specific object information or the ability to add dynamic tags or not. TOP Server allows you to give each group custom permissions for each of these access categories. To modify the settings, right click on each category and select Custom permissions.

9 TOP Server 9 (10) These custom permissions allow you to modify the permissions down to the tag level for each group.

10 TOP Server 10 (10) TOP Server also allows you to copy these permissions to other groups. To do this, select the More options arrow at the bottom of the Custom permissions window. If you have further questions or need assistance our experienced staff is more than happy to help. Contact us: Online Support Support Phone Support +1 (704) Fax +1 (704)