EDITRAN/PX. Windows/Unix. Installation and user manual

Transcription

1 EDITRAN/PX Windows/Unix Installation and user manual INDRA 17/03/2017

2 EDITRAN/PX Windows/Unix Installation and user manual INDEX 1. INTRODUCTION Main features Architecture and requirements INSTALLATION UNIX WINDOWS Installation guide BOOT AND SHUTDOWN UNIX Syslog notifications WINDOWS Syslog notifications EDITRAN/PX SETTINGS Confproxy command Graphic interface to set EDITRAN/PX IP addresses without a log EDITRAN/PX MONITORING Queries from EDITRAN Web monitoring edihttplog.cfg Home page Requests to the gateway EDITRAN requests Web server requests Log file ANNEX Release diagnostics Launching script in Linux INDRA. All rights reserved. EDITRAN/PX

3 EDITRAN/PX Windows/Unix Installation and user manual 1.INTRODUCTION 1. INTRODUCTION Given the sensitivity to connect internet public networks from machines hosting corporate applications, a new EDITRAN/PX module has been developed, in order to add more security to EDITRAN in TCP/IP connections. This new software module, usually installed in the DMZ network, gives us the possibility of not having to expose the application files in a publish network, and it also simplifies the firewall rules management, as they don t need to be modified every time a new node wants to connect to our EDITRAN using TCP/IP Main features The widening implantation of TCP/IP protocol in EDITRAN is associated to the new needs that arise from the use of Internet. Internet gives a great number of advantages to the communication among nodes, but it also adds a number of uncertainties, for example regarding communication security. Here arises the need to use products such as firewalls, to allow us to control, if possible, the security uncertainties, as well as uncertainties in other products such as EDITRAN/PX, specifically developed for EDITRAN, which will avoid most of the DoS (Denial of Service) attacks, bombing, etc. This way, it will protect EDITRAN HOST from the dangers in case it is located in a demilitarized area. Now we will detail some of the features which make EDITRAN an essential element in a TCP/IP public network. MultiPlatform EDITRAN/PX is available for Microsoft Windows operating systems, as well as for UNIX operating systems, such as Solaris, Linux... This way, it allows choosing the best platform for every need. Optimization (MultiThreading) One of the main concerns when designing EDITRAN/PX is the search for greatest efficiency. Then, EDITRAN/PX is implemented in such a way that it creates a thread for every connected client. So, it allows that every connection doesn t affect the other ones, as well as it achieves the greatest efficiency in multiprocessor systems. TimeOut Before connecting with EDITRAN, there is an independent TimeOut which will close the connection, even if a client connects without sending any data. This way, we can avoid EDITRAN HOST being attacked by a DoS because of the lack of free connections. Bombing In addition to a TimeOut, EDITRAN/PX also counts with a system that avoids multiple connections from a same client, with the intention of trying a Dos. These connections will never reach the internal EDITRAN HOST, will avoid loading it, and will switch off the connection with the responsible, if an attempt of bombing is detected. INDRA. All rights reserved. EDITRAN/PX Pág. 1-1

4 EDITRAN/PX Windows/Unix Installation and user manual 1.INTRODUCTION Security As we already mentioned, EDITRAN/PX avoids EDITRAN to be located in the demilitarized zone, since that is the area in which EDITRAN/PX will be; this way, security is increased, because EDITRAN remains in the internal network, outside the DMZ. EDITRAN protocol validation One of the main features of EDITRAN/PX is that it recognizes the EDITRAN protocol. In this way, it will be possible to avoid non-compliant communications arriving at the internal EDITRAN, thus performing works beforehand and freeing EDITRAN from performing them. Syslog generation EDITRAN/PX has its own log generation system, and it also uses the system syslog, which allows to store it or to send the same log to another machine. For further details, see 2.5 Syslog notifications Architecture and requirements The following picture shows a typical EDITRAN system installation scenario with the module EDITRAN/PX. Internet DMZ Internal network EDITRAN/PX EDITRAN EDITRAN BACKUP EDITRAN/PX gateway: it is installed in UNIX or Windows platforms, connected to an Internet public network, and with TCP/IP connectivity to the corporate network EDITRAN devices. This manual focuses on installing and using this module. EDITRAN devices: it can be installed in any of the approved platforms: z/os, iseries, Windows or UNIX. The minimum compatible EDITRAN version with the EDITRAN/PX module is 4.1. EDITRAN must have the EDITRAN/TCP component licensed to be used with EDITRAN/TX. INDRA. All rights reserved. EDITRAN/PX Pág. 1-2

5 EDITRAN/PX Windows/Unix Installation and user manual 2.Installation 2. Installation The needed elements for the proper working of EDITRAN/PX system in UNIX-WINDOWS environments are: Installed TCP/IP protocol. Installed and licensed EDITRAN/PX software UNIX In UNIX environments, EDITRAN/PX software is distributed as a.tar file, zipped using GNU Zip. For example, if we receive the file EDItranPX.tar.gz, to unzip it we will need to execute the following: gunzip EDItranPX.tar.gz tar xvf EDItranPX.tar 2.2. WINDOWS In Windows, an installation program is provided. To carry out the installation, we have to execute the.exe file with an administrator user role. Follow the instructions in 2.2.1Installation guide. If you decide to create a Windows Service to control EDITRAN/PX, it will have the following name and features: Installation guide In this section, we will see the necessary steps to install EDITRAN/PX in Windows. First of all, we must decide where we will install EDITRAN/PX. In the following steps, we will learn how to set it: In the first picture, we are asked to fill three values, related to the EDITRAN/PX local connection. We have to fill the IP, the EDITRAN/PX listening port and the log query port. In case we want to add a backup host or more than one listening port, we will need to follow the steps in 4 EDITRAN/PX settings. INDRA. All rights reserved. EDITRAN/PX Pág. 2-1

6 EDITRAN/PX Windows/Unix Installation and user manual 2.Installation In the second screen, we will set the connection for the local EDITRAN associated to EDITRAN/PX. We will be asked for the local EDITRAN IP and for its TCP connection port. In the last screen, we will set the local IP which can connect EDITRAN/PX to use its EDITRAN service. The default settings will allow the connection only for the local EDITRAN mentioned in the previous screen. As we have already seen, during the installation process we can set the product. If afterwards we want to consult or modify the original specification, we can do it using commands (see section 4) or using the graphic interface described in section 4.2. INDRA. All rights reserved. EDITRAN/PX Pág. 2-2

7 EDITRAN/PX Windows/Unix Installation and user manual 3.Boot and shutdown 3. Boot and shutdown 3.1. UNIX To boot and shutdown EDITRAN/PX we must execute the following: To boot EDITRAN/PX: EDItranPX start To shutdown EDITRAN/PX: EDItranPX stop To check EDITRAN/PX status: EDItranPX status We can choose which processes will boot and will shutdown in the EDItranPX starting script, for the PROC_STAR y PROC_STOP variables Syslog notifications In UNIX systems there is a standard and widespread way to send and store log messages: syslog. There is a daemon that receives UDP requests in the 514 log port, and it transfers or stores them, depending on the settings. To allow syslog control, EDItranPX redirects to system log or to syslog information about every connection and disconnection made through it. The messages are sent with an error level LOG_NOTICE WINDOWS If we chose to create a service during the installation process, we will need to boot from the same EDITRAN/PX service, and we must have the needed permissions. If we didn t choose to install or to create the service, we could boot from the command prompt (cmd) executing the file ediproxyth.exe Syslog notifications Windows operating systems doesn t have the syslog functionality; however, there is a software created to collect and to store outputs to the syslog (for example the company Kiwi Enterprises has the product Kiwi Syslog Daemon in From a Windows system, we can choose to send the syslog to a UNIX system or to a Windows syslog server. This requires to edit or to create a syslog.cfg file in the same directory where EDItranPX is installed, and afterwards to write the IP address of the syslog destination device. If we want to download this information to a file, we will need to boot EDITRAN/PX as a process, and then to execute the command ediproxyth 2> [path and name of the file] INDRA. All rights reserved. EDITRAN/PX Pág. 3-3

8 EDITRAN/PX Windows/Unix Installation and user manual 4.EDITRAN/PX settings 4. EDITRAN/PX settings 4.1. Confproxy command Once it is installed, we must set EDITRAN/PX for it to work properly. For this, we will need the following command. In UNIX, is mandatory to execute before starting the system for the first time. We have several different ways to set EDITRAN/PX. If the command is executed without any parameters, help will be displayed. confproxy V5.1 R0 - Apr Copyright (C) INDRA confproxy -c : It shows settings 1st way of use: New HOST, deleting the previous settings confproxy <ip host> <host port> <local ip> <local port> [1st allowed ip] [2 nd allowed ip]... [n allowed ip] where: <ip host>: (Mandatory) Host IP address. <host port>: (Mandatory) Host port. <local ip>: (Mandatory) Listening local IP address. <local port>: (Mandatory) Local listening port. [n allowed ip]: (Optional) Allowed Ips. 2nd way of use: Adding new proxy listening port confproxy -a <ip host> <host port> <local ip> <local port> [1st Allowed ip] [2nd allowed ip]... [n allowed ip] donde: <ip host>: (Mandatory) Host IP address. <host port>: (Mandatory) Host port. <local ip>: (Mandatory) Listening local IP address. <local port>: (Mandatory) Local listening port. [n allowed ip]: (Optional) Allowed Ips. 3rd way of use: Adding new backup host (it shares proxy listening port) confproxy -b <ip host> <host port> <local port> donde: <ip host>: (Mandatory) Host IP address. <host port>: (Mandatory) Host port. <local port>: (Mandatory) Local listening port. 4th way of use: Removing local IP confproxy -d <local ip> [<local port>] where: <local ip>: (Mandatory) IP address to remove. <local port>: (Optional) Listening port to remove. The first way of use helps to set a host, if we remove the previous settings in the first place. This command has an optional parameter, allowed IPs, to increase the number of addresses from which we can use EDITRAN/PX in our network. By default, only the ones corresponding to all settings hosts will be allowed. INDRA. All rights reserved. EDITRAN/PX Pág. 4-4

9 EDITRAN/PX Windows/Unix Installation and user manual 4.EDITRAN/PX settings Example: In a network with the addresses showed in the next picture, we have to enter the command the following parameters: confproxy Internet EDITRAN/PX IP= Port=7775 Port=7776 EDITRAN IP= Port=7777 EDITRAN BACKUP IP= Port=7777 To see EDITRAN/PX current settings, we need to execute the following command: confproxy -c The second way of use (-a parameter -a) allows to add a new host while respecting the previous settings. This new host will have a different EDITRAN/PX listening port, which will redirect between the different hosts. Ii is possible to set a maximum of 10 different listening ports. The command gives also the possibility of adding allowed IPs. confproxy a The third way of use (-b parameter) helps to add a backup host, i.e., it uses the same EDITRAN/PX listening port than the previous host. In case there is a connection, EDITRAN/PX will try to contact the first host in the list, and if the connection is not possible, it will try it with the backup host. We can have up to 9 backup hosts per host. confproxy b The fourth way of use (-d parameter) allows to remove a local port, if several of them have been defined. If there are several ports related to the same local IP, is necessary to specify both parameters. confproxy d INDRA. All rights reserved. EDITRAN/PX Pág. 4-5

10 EDITRAN/PX Windows/Unix Installation and user manual 4.EDITRAN/PX settings 4.2. Graphic interface to set EDITRAN/PX To execute the program, it is necessary to have a Java 6 or higher. To open the graphic interface, we must execute ConfigurarProxy.jar, which is in the installation folder of EDITRAN/PX. The displayed menu is the following: In the left column are displayed EDITRAN/PX listening ports. If we select any of them, in the right column there will be displayed the different hosts assigned to that port. EDITRAN/PX tries in the first place to send the query to the first port in the column, which is the main port. The following ones are the backup ports. In the lower right corner there is a combo box in which are displayed the allowed IPs. In the case this combo is empty (this is the default option), the system will admit only the IPs from our network which are set as hosts. External IPs are not filtered. Adding listening port To add a new listening port, we have to click on the button Add listening port. Then it will appear an emerging menu with the fields IP and Host port to which EDITRAN/PX redirects, and EDITRAN/PX IP and Listening Port. Editting listening port To edit a listening port, we must double click on the table, on the listening port we want to edit. We can modify the fields IP and EDTRAN/PX listening port for the selected port. INDRA. All rights reserved. EDITRAN/PX Pág. 4-6

11 EDITRAN/PX Windows/Unix Installation and user manual 4.EDITRAN/PX settings Removing listening port To remove a listening port we must select one and click on the button Remove listening port. Notice that this will also remove the information of the hosts related to the one we are going to remove. Adding Host To add a new host we must click on the button Add backup host. It will appear an emerging window in which we can fill information about IP and Host port. We have to remember that a host is assigned to a specific listening port. This new host will be added, initially, as a host back up, following the previous ones. If we want to arrange them in a different way, we will need to remove them and put them again in the desired order. Modifying Host To modify a host we have to double click on the table, on the host we want to edit. In the emerging window, we can edit its fields. Removing Host To remove a host, we will select it and will click the button Remove host. Notice that every listening port must have, at least, a related host. Adding allowed IP To add an IP we must fill the enabled field IP to add and click on the button +. This IP will appear in the combo box, where all the allowed IPs are. Removing allowed IP To remove an IP, we will select it from the combo box and we will click on the button -. The selected IP will disappear from the allowed IPs list of the combo box IP addresses without a log Within an organization there can be network monitoring tools (such as HP Openview, Service Monitoring Daemon, LANsurveyor, ipmonitor...). These systems try, periodically, to connect the service in a network node to check whether it is still active and accepting connections. To avoid the ediproxyth.ou to become full of not wanted information about the systems, there is the possibility of creating a file with several TCP/IP addresses, whose activity information will not appear in the EDITRANPX log. In this way, we can include in a file all the TCP/IP addresses in which we have monitoring systems, and we will avoid the file ediproxyth.out to be filled with lines of useless information. If there are TCP/If addresses from which we don t want to get a log, we will need to fill each address in a line of the file ipnotraza.cfg, in the directory where EDITRANPX is installed. Maybe there is no ipnotraza.cfg file. In this case, the file ediproxyth.out will have all the information. Now we will show the information of an ipnotraza.cfg file which contains 2 IPs ( y ) from which we don t wish to have a log in the ediproxyth.out file: INDRA. All rights reserved. EDITRAN/PX Pág. 4-7

12 EDITRAN/PX Windows/Unix Installation and user manual 5.EDITRAN/PX monitoring 5. EDITRAN/PX monitoring 5.1. Queries from EDITRAN In EDITRAN z/os and iseries we can make queries from the menu to consult EDITRAN/PX status, log or settings. Then it is necessary the process logsrv (which listens by default from the port 8120) to be running. This value can be modified during the installation process (in Windows) or any other time, creating or modifying, if it exists, the file logsrv.cfg. It is a text file, with a line of the following type: PORT= Web monitoring It is possible to web monitor EDITRAN/PX running from any node having access to the gateway using a web client. The application has been checked and it works with Internet Explorer 8 and Google Chrome. If we want to web monitor EDITRAN/PX using a web browser, we need to connect the address being the default port This data can be set, as we will see later. When we connect the web page, the web server will ask us for the user and password. The default user is: User: editran Password: editran edihttplog.cfg This default file is installed together with the typical EDITRANPX installation, and is located in the installation root. It keeps the parameters which will be used by the web client. They are the following: PATHHOME: this is the path from which is located the EDITRANPX installation folder, where are contained the web server resources. By default it is weblog. IPESCUCHA: web server listening IP. By default it is PUERTO: web server listening port. By default it is IPDENEGADAS: IPs which cannot connect the web server. By default it is blank. USUARIOS: users who have permission to connect the server for web monitoring. IPPERMITIDAS: allowed IPs for web connection. If it s blank, every IP is allowed. By default it is blank. TIMEOUT: timer for every query s disconnection. CABECERA y PIE: files we need to include. They are necessary for the server, and they are included in the installation Home page The web application home page is displayed in the following picture. There are three different sections: Requests to the gateway: EDITRAN/PX web monitoring. EDITRAN requests: EDITRAN program web monitoring. INDRA. All rights reserved. EDITRAN/PX Pág. 5-1

13 EDITRAN/PX Windows/Unix Installation and user manual 5.EDITRAN/PX monitoring Web server requests: Web application management and monitoring Requests to the gateway It has three sections: Log monitoring: it allows checking the EDITRAN/PX log. Here is a picture: Settings monitoring: EDITRAN/PX settings. It includes information about the remote host IP, the EDITRAN/PX listening IP and the connection ports. Status monitoring: it indicates whether EDITRAN/PX gateway is active or inactive. INDRA. All rights reserved. EDITRAN/PX Pág. 5-2

14 EDITRAN/PX Windows/Unix Installation and user manual 5.EDITRAN/PX monitoring EDITRAN requests Two sections: License monitoring: it allows checking EDITRAN/PX license and its status. HostID monitoring: it monitors the computer identifier where EDITRAN/PX is installed Web server requests Two sections: Web server. Settings: it allows monitoring and managing users which can access the web server, and also allows changing listening IP and port, denied and allowed IPs, and server header and footer files. This web application is the one which modifies edihttplog.cfg. Here is a picture: It is recommended to remove the editran default user and to create a new one, with a different password, to avoid non desired connections. Web server: reboot server: it reboots the web server Log file You can see the plan text file log.txt, which contains the information showed in the consultation methods listed above. INDRA. All rights reserved. EDITRAN/PX Pág. 5-3

15 EDITRAN/PX Windows/Unix Installation and user manual 6.Annex 6. Annex 6.1. Release diagnostics In the following table, EDITRANPX release diagnostics are displayed. Release code Description 1 A Time Out has occurred. 2 It has not been possible to connect the remote EDITRAN. 3 It was not possible to send to user data to the remote node. 4 An error has occurred while sending data to the remote node. 5 A Close from the remote node has been received. 6 An error from the remote node has been received. 7 Source IP not allowed. 8 Wrapped user s data are not correct. 9 User s data are not correct. 11 The limit of concurrent connections has been reached. 12 User s data length is incorrect. 13 The DNS of the remote node couldn t be resolved Launching script in Linux. We need to perform the following steps to install EDITRAN/PX as a launching script in Linux: Copy, in the system /etc/init.d folder, the script editranpx. Execute as a root the command chkconfig --add editranpx. Reboot the system to check whether it runs properly. Before copying the file, we will need to modify a few values, marked in red: #!/bin/bash # # editranpx This starts and stops ediproxyth. # # chkconfig: # description: editranpx es el proxy de EDItran. # processname: /home/editran/px.502/ediproxyth # pidfile: /var/run/ediproxyth.pid # Path donde se ha instalado EDItranPX PX_INSTALL_PATH=/opt/EDItranPX # Usuario que ejecutará el servicio USREDI=editran In the first section in bold (PX_INSTALL_PATH), we need to define the installation path for EDITRANPX. In the second section, in bold, we will have to define which one will be the boot user for EDITRAN/PX service. INDRA. All rights reserved. EDITRAN/PX Pág. 6-1

16 Centros de Competencia ecommerce Avda. de Bruselas Alcobendas. Madrid, España T T INDRA. All rights reserved. EDITRAN/PX Pág. 6-1