Installing and configuring Janus Network Security - Revision history

JAL: mention RKWeb

2017-06-07T20:58:51Z

mention RKWeb

← Older revision		Revision as of 20:58, 7 June 2017
Line 42:		Line 42:
	A few components of <var class="product">RKTools</var> are required for <var class="product">Janus Network Security</var>, so <var class="product">RKTools</var> must be installed prior to proceeding.		A few components of <var class="product">RKTools</var> are required for <var class="product">Janus Network Security</var>, so <var class="product">RKTools</var> must be installed prior to proceeding.
	More information is available in [[RKTools installation]].		More information is available in [[RKTools installation]].
	<p class="note"><b>Note:</b> As part of <var class="product">RKTools</var> installation, the <code>JANSSL</code> file should be allocated and initialized. <code>JANSSL</code> is used to store SSL certificates, certificate requests and private keys.

			<blockquote class="note">
			<p><b>Note:</b> As part of <var class="product">RKTools</var> installation, the <code>JANSSL</code> file should be allocated and initialized. <code>JANSSL</code> is used to store SSL certificates, certificate requests and private keys. </p>
			<p>
	The <code>JANSSL</code> file should have a minimum of 1050 pages;		The <code>JANSSL</code> file should have a minimum of 1050 pages;
	the <var class="product">[[RKTools]]</var> <code>SIRIUS</code> file contains a sample <code>CREATE.JANSSL</code> deck.		the <var class="product">RKTools</var> <code>SIRIUS</code> file (prior to version 7.7) or the <code>M204PROC</code> file (as of RKTools 7.7) contains a sample <code>CREATE.JANSSL</code> deck. </p>
			<p>
	<var class="product">RKTools</var> installation also creates the <code>JANSSL</code> subsystem, which is the certificate management application.		<var class="product">RKTools</var> installation also creates the <code>JANSSL</code> subsystem, which is the SSL certificate management application.
	The procedure containing the <code>JANSSL</code> subsystem definition is <code>SUBSYS.DEF.JANSSL</code> — it is in file <code>SIRIUS</code> ~~for releases~~ prior to RKTools 7.7, and in <code>M204PROC</code> for 7.7 and ~~later~~.		The procedure containing the <code>JANSSL</code> subsystem definition is <code>SUBSYS.DEF.JANSSL</code> — it is also in file <code>SIRIUS</code> prior to RKTools 7.7, and in <code>M204PROC</code> for V7.7 and higher.
	As described later ([[#givpriv\|Add appropriate users to the JANSSL subsystem]]), you may need to update the subsystem.		As described later ([[#givpriv\|Add appropriate users to the JANSSL subsystem]]), you may need to update the subsystem. </p>
	</p>		</blockquote>
			<p>
			If you have RKTools version 7.7 or higher, you probably want to [[RKTools installation#RKWeb (Model 204 Tools on the Web)\|follow the directions]] to install RKWeb, the web interface that includes access to the <code>JANSSL</code> certificate management application. </p>

	==<b id="usecert"></b>Make an initial SSL connection==		==<b id="usecert"></b>Make an initial SSL connection==
Line 62:		Line 66:

	The following subsections describe how to set up and connect to a <var class="product">Janus Web Server</var> port.		The following subsections describe how to set up and connect to a <var class="product">Janus Web Server</var> port.
	If you are configuring a different type of Janus port, like an SSL-protected client socket port, for example,		<ul>
			<li>If you are configuring a different type of Janus port, like an SSL-protected client socket port, for example,
	the same sequence of steps applies except for these:		the same sequence of steps applies except for these:
	<ul>		<ul>
Line 68:		Line 73:

	<li>The keywords denoting the port type (<code>WEB</code> and <code>WEBSERV</code>) in the <var>JANUS</var> command examples would be replaced by <code>CLSOCK</code>. </li>		<li>The keywords denoting the port type (<code>WEB</code> and <code>WEBSERV</code>) in the <var>JANUS</var> command examples would be replaced by <code>CLSOCK</code>. </li>
			</ul></li>

			<li>If you have RKTools version 7.7 or higher, and you installed and will use the RKWeb interface to access the <code>JANSSL</code> certificate management application, your SSL port is already defined. You can skip the port-definition specific instructions in the following subsection, but you still may need to start your SSL port and adjust the <code>JANSSL</code> subsystem information as described below. You can ignore the subsection describing how to connect to the SSL port from a browser; RKWeb makes this connection.</li>
	</ul>		</ul>

JAL: minor formatting

2017-04-17T21:09:08Z

minor formatting

← Older revision		Revision as of 21:09, 17 April 2017
Line 14:		Line 14:

	<li>Make an initial connection to a port that uses the Rocket-provided internal certificate.		<li>Make an initial connection to a port that uses the Rocket-provided internal certificate.
	<ol>		<ol type="a">
	<li>Define and start the SSL port. </li>		<li>Define and start the SSL port. </li>
	<li>Give appropriate user(s) access privileges. </li>		<li>Give appropriate user(s) access privileges. </li>
Line 20:		Line 20:
	</ol>		</ol>
	<p>		<p>
	Your initial connection ~~will be a test of the~~ setup ~~to this point~~, using the		Your initial connection tests your port, user, and web rule setup, using the
	Rocket-provided internal certificate (discussed in [[Janus Network Security#selfca\|Self-signed certificates]]).		Rocket-provided internal certificate (discussed in [[Janus Network Security#selfca\|Self-signed certificates]]).
	</p> </li>		</p> </li>
Line 31:		Line 31:
	</p>		</p>

	The <var class="product">[[Sirius Mods]]</var> are a set of features providing a base of support for most the products formerly owned by Sirius - they must be installed before proceeding.		The <var class="product">[[Sirius Mods]]</var> are a set of features providing a base of support for most the products formerly owned by Sirius — they must be installed before proceeding.

	You can confirm whether the <var class="product">Sirius Mods</var> are installed and at the current release level		You can confirm whether the <var class="product">Sirius Mods</var> are installed and at the current release level
	by entering the following at the <var class="product">Model 204</var> command line:		by entering the following at the <var class="product">Model 204</var> command line:
	<p class="code"~~><nowiki~~>SIRIUS~~</nowiki>~~</p>		<p class="code">SIRIUS</p>
	The resulting display will include the current release of the		The resulting display will include the current release of the
	<var class="product">Sirius Mods</var>.		<var class="product">Sirius Mods</var>.
Line 48:		Line 48:

	<var class="product">RKTools</var> installation also creates the <code>JANSSL</code> subsystem, which is the certificate management application.		<var class="product">RKTools</var> installation also creates the <code>JANSSL</code> subsystem, which is the certificate management application.
	The procedure containing the <code>JANSSL</code> ~~apsy~~ definition is <code>SUBSYS.DEF.JANSSL</code> - it is in file <code>SIRIUS</code> for releases prior to RKTools 7.7, and in <code>M204PROC</code> for 7.7 and later.		The procedure containing the <code>JANSSL</code> subsystem definition is <code>SUBSYS.DEF.JANSSL</code> — it is in file <code>SIRIUS</code> for releases prior to RKTools 7.7, and in <code>M204PROC</code> for 7.7 and later.
	As described later - ([[#givpriv\|Add appropriate users to the JANSSL subsystem]]) - you may need to update the subsystem.		As described later ([[#givpriv\|Add appropriate users to the JANSSL subsystem]]), you may need to update the subsystem.
	</p>		</p>

Line 63:		Line 63:
	The following subsections describe how to set up and connect to a <var class="product">Janus Web Server</var> port.		The following subsections describe how to set up and connect to a <var class="product">Janus Web Server</var> port.
	If you are configuring a different type of Janus port, like an SSL-protected client socket port, for example,		If you are configuring a different type of Janus port, like an SSL-protected client socket port, for example,
	the same sequence of steps ~~would apply~~ except for the ~~last~~ subsection,		the same sequence of steps applies except for these:
	~~and the~~ keywords denoting the port type - <code>WEB</code> and <code>WEBSERV</code> - in the <var>JANUS</var>		<ul>
	command examples would be replaced by <code>CLSOCK</code>.		<li>The "Connect to the SSL port from a browser" subsection does not apply. </li>

			<li>The keywords denoting the port type (<code>WEB</code> and <code>WEBSERV</code>) in the <var>JANUS</var> command examples would be replaced by <code>CLSOCK</code>. </li>
			</ul>

	===<b id="sslport"></b>Define and start an SSL port===		===<b id="sslport"></b>Define and start an SSL port===
	To define an initial SSL web port using the Rocket-provided internal certificate. a user with system manager or system administrator		To define an initial SSL web port using the Rocket-provided internal certificate. a user with system manager or system administrator
	privileges must issue a command like:		privileges must issue a command like:
	<p class="code">JANUS DEFINE [portName] 443 WEBSERV 5 SSL [sslInfo]		<p class="code">JANUS DEFINE <i>portName</i> 443 WEBSERV 5 SSL <i>sslInfo</i>
	</p>		</p>
	~~where~~:		Where:
	<ul>		<ul>
	<li><~~code~~>[portName]</~~code~~> ~~can be replaced by~~ an arbitrary port name ~~up to~~ 30 characters in length. </li>		<li><var class="term">portName</var> is an arbitrary port name as many as 30 characters in length. </li>

	<li><~~code~~>443</~~code~~> ~~can be replaced by~~ an arbitrary port number (although 443 is the default for HTTPS). </li>		<li><var class="term">443</var> is an arbitrary port number (although 443 is the default for HTTPS). </li>

	<li><code>5</code> can be replaced by a different maximum thread value. </li>		<li><code>5</code> can be replaced by a different maximum thread value. </li>

	<li><~~code~~>[sslInfo]</~~code~~> ~~Using a '~~*~~' indicates~~ that the internal, Rocket-generated, certificate and		<li><var class="term">sslInfo</var> may be an asterisk (<tt>*</tt>) to indicate that the internal, Rocket-generated, certificate and private key is to be used.
	private key is to be used. ~~When~~ a certificate from a certifying authority is being used,		If a certificate from a certifying authority is being used,
	~~you~~ replace ~~the~~ <~~code~~>[sslInfo]</~~code~~> with the file name and procedure name		replace <var class="term">sslInfo</var> with the file name and procedure name
	that ~~contains~~ the certificate ~~- so~~, ~~something like, "~~SSL MYFILE MYCERTIFICATE.CERT~~" -~~ as shown in [[Implementing a server certificate#portnew\|Defining and starting a port]]. </li>		that contain the certificate (for example, <code>SSL MYFILE MYCERTIFICATE.CERT</code>), as shown in [[Implementing a server certificate#portnew\|Defining and starting a port]]. </li>
	</ul>		</ul>

Line 91:		Line 94:
	<p class="code">JANUS START SSLWEB		<p class="code">JANUS START SSLWEB
	</p>		</p>
	where <code>SSLWEB</code> is the port name specified on the <~~code~~>JANUS DEFINE</~~code~~> command.		where <code>SSLWEB</code> is the port name specified on the <var>JANUS DEFINE</var> command.
	The port is started and SSL is enabled.		The port is started and SSL is enabled.

Line 153:		Line 156:
	While possible, this is <b><i>strongly discouraged</i></b>,		While possible, this is <b><i>strongly discouraged</i></b>,
	because the above web rule will result in unencrypted		because the above web rule will result in unencrypted
	<var class="product">Model  204</var> passwords being sent over the network as JANSSL verifies access privileges.		<var class="product">Model 204</var> passwords being sent over the network as JANSSL verifies access privileges.

	The only reason to allow access to JANSSL like this might be that there is local network security that ~~allows~~ you ~~to feel confident~~ that this is not a problem, and for some reason, it is not possible for your browser to		The only reason to allow access to JANSSL like this might be that there is local network security that gives you confidence that this is not a problem, and for some reason, it is not possible for your browser to
	work with the internal Janus certificate.		work with the internal Janus certificate.

Alan at 15:04, 17 April 2017

2017-04-17T15:04:55Z

← Older revision		Revision as of 15:04, 17 April 2017
Line 6:		Line 6:
	<p class="note"><b>Note:</b> This requirement does not apply if your version of <var class="product">Model 204</var> is 7.5 or higher.		<p class="note"><b>Note:</b> This requirement does not apply if your version of <var class="product">Model 204</var> is 7.5 or higher.

	~~<p>~~
	This step would probably be done by the person responsible		This step would probably be done by the person responsible
	for installing and supporting <var class="product">Model 204</var> at your site.		for installing and supporting <var class="product">Model 204</var> at your site.

Alan at 15:03, 17 April 2017

2017-04-17T15:03:28Z

← Older revision		Revision as of 15:03, 17 April 2017
Line 6:		Line 6:
	<p class="note"><b>Note:</b> This requirement does not apply if your version of <var class="product">Model 204</var> is 7.5 or higher.		<p class="note"><b>Note:</b> This requirement does not apply if your version of <var class="product">Model 204</var> is 7.5 or higher.

	<p>This step would probably be done by the person responsible		<p>
			This step would probably be done by the person responsible
	for installing and supporting <var class="product">Model 204</var> at your site.		for installing and supporting <var class="product">Model 204</var> at your site.
	If you are already running <var class="product">[[Janus Web Server]]</var>, this step involves		If you are already running <var class="product">[[Janus Web Server]]</var>, this step involves

Alan at 14:59, 17 April 2017

2017-04-17T14:59:45Z

Show changes

Alan at 21:08, 14 April 2017

2017-04-14T21:08:48Z

Dme at 16:38, 14 April 2017

2017-04-14T16:38:05Z

← Older revision		Revision as of 16:38, 14 April 2017
Line 22:		Line 22:
	</ol>		</ol>
	<p>		<p>
	~~In step 2 you~~ test the ~~success of your first connection~~, using the		Your initial connection will be a test of the setup to this point, using the
	Rocket-provided internal certificate (discussed in [[Janus Network Security#selfca\|Self-signed certificates]]).		Rocket-provided internal certificate (discussed in [[Janus Network Security#selfca\|Self-signed certificates]]).
	</p> </li>		</p> </li>

Dme: /* Install Janus TCP/IP Base */

2017-04-14T16:23:54Z

Install Janus TCP/IP Base

← Older revision		Revision as of 16:23, 14 April 2017
Line 29:		Line 29:
	Each of these steps is further described below. </p>		Each of these steps is further described below. </p>

	==<b id="insbase"></b>~~Install Janus TCP/IP Base==~~		==<b id="insbase"></b><b id="insmods"></b>Install Sirius Mods==
	~~As mentioned earlier, <var class="product">Janus Network Security</var> is generally installed as~~
	~~an addition to <var class="product">Janus Web Server</var>.~~
	~~It can also be installed without it, for use by other non-web Janus products.~~
	~~In either case, some of the steps in the following subsections may have already been completed.~~
	~~You should confirm each one before proceeding to the next step.~~

	~~===~~<b id="insmods"></b>Install Sirius Mods===
	<p class="note"><b>Note:</b> This requirement does not apply to versions of <var class="product">Model 204</var> after 7.4.		<p class="note"><b>Note:</b> This requirement does not apply to versions of <var class="product">Model 204</var> after 7.4.
	</p>		</p>

Dme at 16:21, 14 April 2017

2017-04-14T16:21:59Z

← Older revision		Revision as of 16:21, 14 April 2017
Line 2:		Line 2:
	preliminary tasks must be completed.		preliminary tasks must be completed.
	Some of these tasks may be performed by different people, but they should occur in the following sequence:		Some of these tasks may be performed by different people, but they should occur in the following sequence:
	~~<ol>~~
	~~<li>Install <var class="product">Janus TCP/IP Base</var>~~
	<ol>		<ol>
	<li>Install the <var class="product">Sirius Mods</var>, which contains <var class="product">Janus Network Security</var> support.		<li>Install the <var class="product">Sirius Mods</var>, which contains <var class="product">Janus Network Security</var> support.
	<p class="note"><b>Note:</b> This requirement does not apply if your version of <var class="product">Model 204</var> is 7.5 or higher.		<p class="note"><b>Note:</b> This requirement does not apply if your version of <var class="product">Model 204</var> is 7.5 or higher.
	~~</p> </li>~~

	~~<li>Install or update <var class="product">[[RKTools]]</var>. </li>~~
	~~</ol>~~
	<p>		<p>
	~~Step 1~~ would probably be done by the person responsible		This step would probably be done by the person responsible
	for installing and supporting <var class="product">Model 204</var> at your site.		for installing and supporting <var class="product">Model 204</var> at your site.
	If you are already running <var class="product">[[Janus Web Server]]</var>, this step involves		If you are already running <var class="product">[[Janus Web Server]]</var>, this step involves
	some minor updates for support of <var class="product">Janus Network Security</var>. </p></li>		some minor updates for support of <var class="product">Janus Network Security</var>. </p></li>

			<li>Install or update <var class="product">[[RKTools]]</var>. </li>

	<li>Make an initial connection to a port that uses the		<li>Make an initial connection to a port that uses the

Dme: /* Install or update RKTools */

2017-04-14T16:15:34Z

Install or update RKTools

← Older revision		Revision as of 16:15, 14 April 2017
Line 53:		Line 53:
	<var class="product">Sirius Mods</var>.		<var class="product">Sirius Mods</var>.

	===<b id="insulsp"></b>Install or update RKTools===		==<b id="insulsp"></b>Install or update RKTools==
	A base portion of <var class="product">RKTools</var> is required for <var class="product">Janus Network Security</var>, so <var class="product">RKTools</var>		A base portion of <var class="product">RKTools</var> is required for <var class="product">Janus Network Security</var>, so <var class="product">RKTools</var>
	must be installed prior to proceeding.		must be installed prior to proceeding.

← Older revision		Revision as of 21:08, 14 April 2017
Line 10:		Line 10:
	for installing and supporting <var class="product">Model 204</var> at your site.		for installing and supporting <var class="product">Model 204</var> at your site.
	If you are already running <var class="product">[[Janus Web Server]]</var>, this step involves		If you are already running <var class="product">[[Janus Web Server]]</var>, this step involves
	some minor updates ~~for~~ support of <var class="product">Janus Network Security</var>. </p></li>		some minor updates in support of <var class="product">Janus Network Security</var>. </p></li>

	<li>Install or update <var class="product">[[RKTools]]</var>. </li>		<li>Install or update <var class="product">[[RKTools]]</var>. </li>

	<li>Make an initial connection to a port that uses the		<li>Make an initial connection to a port that uses the Rocket-provided internal certificate.
	Rocket-provided internal certificate.
	<ol>		<ol>
	<li>Define and start the SSL port. </li>		<li>Define and start the SSL port. </li>
	<li>Give appropriate user(s) ~~correct~~ privileges. </li>		<li>Give appropriate user(s) access privileges. </li>
	<li>Download internal certificate as CA to browser. </li>		<li>Download internal certificate as CA to browser. </li>
	</ol>		</ol>
Line 33:		Line 32:
	</p>		</p>

	The <var class="product">[[Sirius Mods]]</var> are a ~~combination~~ of features ~~which provide~~ a base of support for most Sirius ~~products, and~~ they must be installed ~~prior to~~ proceeding.		The <var class="product">[[Sirius Mods]]</var> are a set of features providing a base of support for most the products formerly owned by Sirius - they must be installed before proceeding.

	You can confirm whether the <var class="product">Sirius Mods</var> are installed and at the current release		You can confirm whether the <var class="product">Sirius Mods</var> are installed and at the current release level
	by entering the following ~~command~~ at the <var class="product">Model 204</var> command line:		by entering the following at the <var class="product">Model 204</var> command line:
	<p class="code"><nowiki>SIRIUS		<p class="code"><nowiki>SIRIUS
	</nowiki></p>		</nowiki></p>
	~~This~~ will ~~display various information regarding the configuration of~~		The resulting display will include the current release of the
	~~Sirius products in this online, including~~ the current release of the
	<var class="product">Sirius Mods</var>.		<var class="product">Sirius Mods</var>.

	==<b id="insulsp"></b>Install or update RKTools==		==<b id="insulsp"></b>Install or update RKTools==
	A ~~base portion~~ of <var class="product">RKTools</var> is required for <var class="product">Janus Network Security</var>, so <var class="product">RKTools</var>		A few components of <var class="product">RKTools</var> are required for <var class="product">Janus Network Security</var>, so <var class="product">RKTools</var>
	must be installed prior to proceeding.		must be installed prior to proceeding.
	More information is available in [[RKTools installation]].		More information is available in [[RKTools installation]].
	<p class="note"><b>Note:</b> As part of <var class="product">RKTools</var> installation, ~~you~~ should ~~allocate~~ and ~~initialize a file called~~ <code>JANSSL</code>, ~~which~~		<p class="note"><b>Note:</b> As part of <var class="product">RKTools</var> installation, that <code>JANSSL</code> file should be allocated and initialized. <code>JANSSL</code> is used to store SSL certificates, certificate requests and private keys.
	~~has the correct characteristics for storing an SSL~~ private ~~key~~.
	The <code>JANSSL</code> file should be a minimum of 1050 pages;		The <code>JANSSL</code> file should be a minimum of 1050 pages;
	the <var class="product">[[RKTools]]</var> <code>SIRIUS</code> file contains a sample <code>CREATE.JANSSL</code> deck.		the <var class="product">[[RKTools]]</var> <code>SIRIUS</code> file contains a sample <code>CREATE.JANSSL</code> deck.

	<var class="product">RKTools</var> installation also creates ~~a subsystem called~~ <code>JANSSL</code>, which ~~provides~~		<var class="product">RKTools</var> installation also creates the <code>JANSSL</code> subsystem, which is the certificate management application.
	~~components for~~ the certificate management application.		The procedure containing the <code>JANSSL</code> apsy definition is <code>SUBSYS.DEF.JANSSL</code> - it is in file <code>SIRIUS</code> for releases prior to RKTools 7.7, and in <code>M204PROC</code> for 7.7 and later.
	The <code>~~SIRIUS~~</code> ~~file that contains the~~ definition is <code>SUBSYS.DEF.JANSSL</code>.
	As described later ([[#givpriv\|Add appropriate users to the JANSSL subsystem]]), you may need to update the subsystem.		As described later ([[#givpriv\|Add appropriate users to the JANSSL subsystem]]), you may need to update the subsystem.
	</p>		</p>

	==<b id="usecert"></b>Make an initial SSL connection==		==<b id="usecert"></b>Make an initial SSL connection==
	In order to implement and test ~~the success of~~ your first SSL		In order to implement and test your first SSL
	connection, you can use the Rocket-provided internal certificate, which		connection, you can use the Rocket-provided internal certificate, which
	was distributed with ~~the~~ <var class="product">Janus Network Security</var> ~~tape~~ (and discussed further		was distributed with <var class="product">Janus Network Security</var> (and discussed further
	in [[Janus Network Security#Self-signed certificates\|Self-signed certificates]]		in [[Janus Network Security#Self-signed certificates\|Self-signed certificates]]
	Ultimately, you will probably want to arrange to receive a certificate		Ultimately, you will probably want to arrange to receive a certificate
Line 68:		Line 65:

	The steps in the subsections that follow describe how to set up		The steps in the subsections that follow describe how to set up
	and connect to a <var class="product">Janus Web Server</var> ~~server~~ port.		and connect to a <var class="product">Janus Web Server</var> port.
	If you are configuring a Janus <var>CLSOCK</var> SSL port, for example,		If you are configuring a Janus <var>CLSOCK</var> SSL port, for example,
	the same sequence of steps apply (except for the last subsection),		the same sequence of steps apply except for the last subsection,
	but the keywords <code>WEB</code> and <code>WEBSERV</code> in the <var>JANUS</var>		but the keywords denoting the port type - <code>WEB</code> and <code>WEBSERV</code> - in the <var>JANUS</var>
	command examples ~~must~~ be replaced ~~as necessary~~ by <code>CLSOCK</code>.		command examples would be replaced by <code>CLSOCK</code>.

	===<b id="sslport"></b>Define and start an SSL port===		===<b id="sslport"></b>Define and start an SSL port===