C CURE 9000 Version 1.93 SSLF and EC Secure Configurations on Windows XP and Windows Vista with C CURE 9000 REVISION F0 6 Technology Park Drive Westford, MA 01886-3140 http://www.swhouse.com Fax: 978-577-4392 Phone: 978-577-4000
C CURE and Software House are registered trademarks of Tyco International Ltd. and its respective companies. The trademarks, logos, and service marks displayed on this document are registered in the United States [or other countries]. Any misuse of the trademarks is strictly prohibited and Tyco International Ltd. will aggressively enforce its intellectual property rights to the fullest extent of the law, including pursuit of criminal prosecution wherever necessary. All trademarks not owned by Tyco International Ltd. are the property of their respective owners, and are used with permission or allowed under applicable laws. Product offerings and specifications are subject to change without notice. Actual products may vary from photos. Not all products include all features. Availability varies by region; contact your sales representative. Software version: C CURE 9000 v1.93 Document Number: UM-076 Revision Number: F0 Release Date: June 2010 This manual is proprietary information of Software House. Unauthorized reproduction of any portion of this manual is prohibited. The material in this manual is for information purposes only. It is subject to change without notice. Software House assumes no responsibility for incorrect information this manual may contain. 2010 Tyco International Ltd. and its respective companies. All rights reserved.
Table of Contents Overview............................................................ 1-1 Windows XP Professional System Requirements.......................... 1-2 Microsoft Windows XP Professional Secure Configuration..................... 1-2 Microsoft Windows XP SSLF and EC........................................ 1-2 Windows Vista System Requirements................................... 1-3 Microsoft Windows Vista Secure Configuration.............................. 1-3 Microsoft Windows Vista SSLF and EC...................................... 1-3 Microsoft Windows Vista Limitations....................................... 1-3 Administration Station Configuration Not Saved on Remote Vista Client in an SSLF Environment.............................................. 1-3 Report Preview Can Fail on a Vista Client in an SSLF Domain.............. 1-4 C CURE 9000 Database Privileges...................................... 1-5 Firewall Exceptions....................................................... 1-6 C CURE 9000 SSLF and EC Secure Configurations iii
Table of Contents iv C CURE 9000 SSLF and EC Secure Configurations
Overview This document contains information on any special requirements for the Specialized Security--Limited Functionality (SSLF) or the less restrictive Enterprise Client (EC) environments on the Windows XP Professional operating system (with SP3) and on the Windows Vista operating system (with SP1) with the C CURE 9000 System. NOTE Windows 7 has not been evaluated by NIST. Therefore C CURE 9000 has not been qualified for SSLF and EC on Windows 7. Windows XP Professional users should first refer to and read the Windows XP Security Guide, available online at: http://technet.microsoft.com/en-us/ library/cc163061.aspx. The document provides an overview of secure environments on XP and links to detailed configuration information for both SSLF and EC on Windows XP Professional, SP3. Windows Vista users should first refer to and read the Windows Vista Security Guide, available online at: http://technet.microsoft.com/en-us/library/ bb629420.aspx. The document provides an overview of secure environments on Vista and links to detailed configuration information for both SSLF and EC on Windows Vista, SP1. SSLF and EC environments do not require any changes to the C CURE 9000. Certain TCP/UDP firewall ports are required to be open for communication, which is allowed by the SSLF and EC specification since they are needed for hardware to function. Several programs, most notably ICU and _mprosrv.exe need to be added to the Windows firewalls exceptions. SSLF is supported under Windows XP Professional for both client and server, and on Vista for client only. Not supported with SSLF or EC is istar dialup because remote access service (RAS) is required for istar dialup, and RAS is specifically disabled by SSLF. C CURE 9000 SSLF and EC Secure Configurations 1 1
Windows XP Professional System Requirements Windows XP Professional System Requirements Microsoft Windows XP Professional Secure Configuration Details on the configuration and links to Microsoft implementation guidelines are available on the NIST site at http://csrc.nist.gov/itsec/ download_winxp.html. Microsoft Windows XP SSLF and EC There are two preset secure configurations of Microsoft Windows XP Professional: Specialized Security -- Limited Functionality (SSLF) and the less restrictive Enterprise Client (EC). Details on these configurations and links to Microsoft implementation guidelines are available at the following Microsoft and NIST sites: http://technet.microsoft.com/en-us/library/cc163061.aspx http://csrc.nist.gov/itsec/download_winxp.html. The SSLF and EC environments with the C CURE 9000 system are currently supported on Windows XP Professional only, and are supported for both client and server. The C CURE 9000 system may be installed before or after configuring XP. 1 2 C CURE 9000 SSLF and EC Secure Configurations
Windows Vista System Requirements Windows Vista System Requirements Microsoft Windows Vista Secure Configuration Details on the configuration and links to Microsoft implementation guidelines are available on the NIST site at http://csrc.nist.gov/itsec/ guidance_vista.html. Microsoft Windows Vista SSLF and EC There are two preset secure configurations of Microsoft Windows Vista: Specialized Security -- Limited Functionality (SSLF) and the less restrictive Enterprise Client (EC). Details on these configurations and links to Microsoft implementation guidelines are available at the following Microsoft and NIST sites: http://technet.microsoft.com/en-us/library/bb629420.aspx http://csrc.nist.gov/itsec/guidance_vista.html. The SSLF and EC environments with the C CURE 9000 system are currently supported on Windows Vista for client only. The C CURE 9000 system may be installed before or after configuring Vista. Microsoft Windows Vista Limitations Testing has found the following two limitations to the use of Windows Vista with C CURE 9000. Administration Station Configuration Not Saved on Remote Vista Client in an SSLF Environment If you try to use Client Configuration (right-click Admin Client tray icon and select Configure) to change the server that a remote client connects to, then click Save and Close, your change is not saved in an SSLF environment. C CURE 9000 SSLF and EC Secure Configurations 1 3
Windows Vista System Requirements Workaround: An administrator with proper security permissions should open the Admin Workstation Config File (SWHSystem\Client\SoftwareHouse.NExtGen.Client.AdminWorkstation.ex e.config) in Notepad and change the server IP or name manually. The text to change is indicated in bold below: <client> <endpoint name="clientsession" address="net.tcp://servername:8999/ CrossFire/IClientSession" binding="nettcpbinding" bindingconfiguration="servicebinding" contract="softwarehouse.crossfire.common.clientinterfacelayer.iclie ntsession"></endpoint> <endpoint name="clientstream" address="net.tcp://severname:8997/ CrossFire/IClientStream" binding="nettcpbinding" bindingconfiguration="streambinding" contract="softwarehouse.crossfire.common.clientinterfacelayer.iclie ntstream"></endpoint> </client> Report Preview Can Fail on a Vista Client in an SSLF Domain If you try to preview a Report or Report Form on a Vista Client in an SSLF Domain, you may experience the following error: "Object Reference not set error". This error occurs because C CURE 9000 Reporting utilizes Isolated Storage, which does not support the FIPSAlgorithmPolicy. Workaround: You can use either an XP client or a non-sslf Vista client to preview the report. Alternatively, you can change the registry setting for fipsalgorithmpolicy to 0, as follows: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa ] "fipsalgorithmpolicy"=dword:00000000 1 4 C CURE 9000 SSLF and EC Secure Configurations
C CURE 9000 Database Privileges C CURE 9000 Database Privileges In order to create the C CURE 9000 database, the user performing the installation must have local admin rights on the SQL Server machine. Having local admin rights gives the user full access to the SQL Server database. The default operation of the application is that the Windows domain user who runs the C CURE 9000 service is the owner of all three C CURE 9000 databases (SWHSystem, SWHSystemAudit, and SWHSystemJournal). In this default situation, the user/owner has full privileges on the databases. However, it is possible to restrict access to the minimally-permissible. At a minimum, the user needs the following roles in order to execute the related tasks: Table 1-1: Admin Roles Needed Task Required Role(s) Target Databases General Editing and Viewing db_datareader db_datawriter SWHSystem SWHSystemAudit SWHSystemJournal Database backup db_backupoperator SWHSystem SWHSystemAudit SWHSystemJournal Log Message Management db_datareader db_datawriter SWHSystem db_owner SWHSystemAudit SWHSystemJournal For log message management, the db_owner role can be secured by denying all permissions on the audit and journal databases except for the following: Alter Alter Schema Connect Backup log C CURE 9000 SSLF and EC Secure Configurations 1 5
C CURE 9000 Database Privileges Checkpoint Create default Create function Create table Select Delete Insert Update Execute Firewall Exceptions The following exceptions may need to be added to the Windows Firewall. Exceptions can be made for particular ports and for executables which use dynamically-assigned ports. To add an exception: 1. Start > Settings > Control Panel > Windows Firewall. 2. Set the firewall On. On the Exceptions tab, select either Add Port or Add program. The opening in the network can be limited to particular machines on the network by selecting Change scope. Port Description Exception Type Location 8999 Base Address of the CrossFire Service TCP Server 8989 Base Address of the Client TCP Server 8998 Base Address of HTTP TCP Server 8997 Base Address of Client Stream Port TCP Server 8995 Trace Viewer URI TCP Server 8985 Base Address of Driver Service TCP Server 8005 System Trace URI TCP Server 1 6 C CURE 9000 SSLF and EC Secure Configurations
C CURE 9000 Database Privileges Port Description Exception Type Location 8006 Remote Hardware Interface List URI TCP Server 5000 a Base TCP Port for ISC TCP Server 5001->5003 ISC Ports TCP Server 5000 a IntellexAPI Base Address TCP Server 5001 IntellexAPI Live Port TCP Server 5003 IntellexAPI Alarm Port TCP Server 2600 ApC Driver TCP Server 2800 istar Driver TCP Server 2801 istar Fast Download Port TCP Server 2803 istar Encryption Port TCP Server 5025 ISC Point Change Port UDP Server 5026 ISC Version Attendance Port UDP Server 28010 istarex Communications TCP Server 28001 istarex Fast Download Connection TCP Server 28002 istarex Fast Image Download TCP Server SoftwareHouse.Crossfire.Server.exe Program Server ICU.exe Program Server 80 IIS TCP Server 1433 Sql Server TCP DB server 1433 Sql Server UDP DB server 1434 Sql Server UDP DB server 1521 Oracle listener TCP DB server SoftwareHouse.NextGen.Client.AdminWorkstation.exe Program Client SoftwareHouse.NextGen.Client.MonitoringStation.exe Program Client a. These work fine, using the same port address. C CURE 9000 SSLF and EC Secure Configurations 1 7
C CURE 9000 Database Privileges 1 8 C CURE 9000 SSLF and EC Secure Configurations