VASCO Linux Identikey Server Installation Guide

PDF

Документ

Identikey Server

Installation Guide For Linux

3.1

3.1

Disclaimer of Warranties and Limitations of Liabilities

Disclaimer of Warranties and Limitations of Liabilities

The Product is provided on an 'as is' basis, without any other warranties, or conditions, express or implied, including but not limited to warranties of merchantable quality, merchantability of fitness for a particular purpose, or those arising by law, statute, usage of trade or course of dealing. The entire risk as to the results and performance of the product is assumed by you. Neither we nor our dealers or suppliers shall have any liability to you or any other person or entity for any indirect, incidental, special or consequential damages whatsoever, including but not limited to loss of revenue or profit, lost or damaged data of other commercial or economic loss, even if we have been advised of the possibility of such damages or they are foreseeable; or for claims by a third party. Our maximum aggregate liability to you, and that of our dealers and suppliers shall not exceed the amount paid by you for the Product. The limitations in this section shall apply whether or not the alleged breach or default is a breach of a fundamental condition or term, or a fundamental breach. Some states/countries do not allow the exclusion or limitation or liability for consequential or incidental damages so the above limitation may not apply to you.

Copyright

No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording, or otherwise, without the prior written permission of

VASCO Data Security Inc.

RADIUS Documentation Disclaimer

The RADIUS documentation featured in this manual is focused on supplying required information pertaining to the

RADIUS server and its operation in the Identikey Server environment. It is recommended that further information be gathered from your NAS/RAS vendor for information on the use of RADIUS.

Trademarks

VASCO®, Vacman®, IDENTIKEY®, aXs GUARD™, DIGIPASS®, and ® are registered or unregistered trademarks of VASCO Data Security, Inc. and/or VASCO Data Security International GmbH in the U.S. and other countries.

Document Version: 1.3

Table of Contents

1 Introduction.................................................................................................................................................... 5

1.1

Chroot Environment............................................................................................................................................. 5

1.2

Software Components......................................................................................................................................... 5

1.3

System Requirements.......................................................................................................................................... 6

1.4

Available Guides.................................................................................................................................................. 8

2 Pre-installation Tasks................................................................................................................................... 10

2.1

Database Type................................................................................................................................................... 10

2.2

Master Domain.................................................................................................................................................. 10

2.3

User ID and Domain Name Conversion............................................................................................................... 11

2.4

System Clock..................................................................................................................................................... 11

2.5

Java Web Server................................................................................................................................................ 12

2.6

Serial Number and Maintenance ID.................................................................................................................... 12

2.7

License File....................................................................................................................................................... 12

3 Installation Packages Overview..................................................................................................................... 13

3.1

Install Packages................................................................................................................................................. 13

4 Basic Installation.......................................................................................................................................... 15

4.1

Installation Checklist.......................................................................................................................................... 16

4.2

Install Identikey Server....................................................................................................................................... 16

5 Advanced Installation.................................................................................................................................... 18

5.1

Database Decisions........................................................................................................................................... 18

5.2

Installation Checklist.......................................................................................................................................... 19

5.3

Start Identikey Server Installation....................................................................................................................... 19

5.4

Set Up Database................................................................................................................................................ 20

5.5

Continue Identikey Server Installation.................................................................................................................31

5.6

Identikey Server Configuration File..................................................................................................................... 34

6 Configuration................................................................................................................................................ 41

6.1

Run an Identikey Server Configuration Tool........................................................................................................ 41

6.2

Web Administration Setup Tool.......................................................................................................................... 41

6.3

Deploy Web Administration Interface ................................................................................................................. 44

7 Post-Installation Tasks.................................................................................................................................. 47

7.1

Licensing........................................................................................................................................................... 47

Identikey Server Linux Installation Guide

Table of Contents

7.2

Backup Strategy................................................................................................................................................ 47

7.3

Audit Settings.................................................................................................................................................... 47

7.4

Database Tasks................................................................................................................................................. 48

7.5

Replication........................................................................................................................................................ 48

7.6

Daemon Setup................................................................................................................................................... 49

7.7

Configure Additional Identikey Servers............................................................................................................... 49

7.8

Set Up User Self Management and OTP Request Websites................................................................................. 49

8 Uninstall Identikey Server............................................................................................................................. 51

8.1

Backing Up Data................................................................................................................................................ 51

8.2

Run Uninstall Script........................................................................................................................................... 51

8.3

Data Removal.................................................................................................................................................... 51

9 Extend Data Store Schema........................................................................................................................... 52

10 File/Directory Placement............................................................................................................................... 55

10.1 Permissions....................................................................................................................................................... 56

11 Technical Support......................................................................................................................................... 58

11.1 Support Contact Information.............................................................................................................................. 58

Identikey Server Linux Installation Guide

Introduction

1 Introduction

This Installation Guide is designed to provide you with the information you will need in order to install Identikey

Server. It will guide you through preparation, installation and post-installation tasks which may be required for your system.

1.1

1.2 Chroot Environment

Identikey Server is installed and runs in a chroot environment based on a Debian distribution with selinux enabled.

This allows it to be run on almost any Linux distribution.

When interacting with Identikey Server and its components (such as configuration tools) you will need to enter this environment by using this command: vds_chroot <installation directory> /bin/bash where <installation directory> will be /opt/vasco/identikey if installed in the default installation location.

Software Components

Identikey Server consists of various components, some necessary and some optional.

1.2.1

Required Components

Identikey Server

The Identikey Server is a server component that performs authentication, signature validation, administration and provisioning tasks. It runs as a daemon.

Data Store

All information required by Identikey Server is stored in an ODBC-compliant database.

Web Administration Interface

Allows all Identikey Server data store administration tasks to be carried out over a web interface.

Identikey Server Linux Installation Guide

Introduction

1.2.2

Optional Components

Virtual Digipass Message Delivery Component

This is a daemon that is responsible for delivering One Time Passwords through a text message HTTP gateway to a

User’s mobile phone.

Digipass TCL Command-Line Administration

Administration may be carried out using Digipass TCL Command-Line Administration Utility, which allows interactive command-line and scripted administration of Identikey Server data.

Audit Viewer

The Audit Viewer is a GUI application that can display and filter audit messages from the Identikey Server. It can read the data from text files and ODBC databases or receive a live feed from the Identikey Server.

OTP Request Site

This is a miniature web site that allows a User to request a Virtual Digipass OTP to be sent to their mobile phone.

User Self Management Web Site

This is a miniature web site that allows Users to make appropriate changes to their own Digipass settings, such as

PIN changes. This is used in a RADIUS environment, when the normal authentication requests are made using a

CHAP-based protocol and therefore PIN changes and other 'self-management' features are not possible.

1.2.3

Identikey Server SDK

The Software Development Kit allows creation of custom SOAP clients and authentication engines, using the SOAP interface. This is an upgrade add-on to Identikey Server and will only be available for installation if it has been purchased. It requires a separate installation program.

1.3 System Requirements

1.3.1

Server Components

Identikey Server and the Virtual Digipass Message Delivery Component require:

Linux on x86 or amd64 architecture

Kernel 2.6

Identikey Server has been tested on:

Ubuntu 8.04

Identikey Server Linux Installation Guide

Introduction

SuSE 10.0

Red Hat 5.0

Please note that a server without X-Windows will not be able to run the Configuration GUI, the GUI Configuration

Wizard or the Audit Viewer.

1.3.2

Web Administration Interface

The Web Administration Interface can be run on any Java web application server running:

Java Runtime Environment version 5.0 or above

Java Server Pages version 2.0 or above

Java Servlets version 2.4 or above

It has been tested primarily on Apache Tomcat 5.5.

It is compatible with most common browsers, including:

Internet Explorer 6.0

Internet Explorer 7.0

Mozilla Firefox 2.0

Opera 9.0

Netscape 8.1 (a few cosmetic issues appear with this browser)

1.3.3

Other Components

The Audit Viewer and Digipass TCL Command-Line Administration require the same as the Server Components.

The Request OTP and User Self Management Websites require any web server capable of running CGI.

1.3.4

Database

Identikey Server will support most modern ODBC-compliant relational, transactional databases. It has been tested on the following databases:

PostgreSQL 8.2.5

Oracle 10g (32-bit), 11g (64-bit)

IBM DB2 9.1

Sybase Adaptive Server Anywhere 11.0

Identikey Server Linux Installation Guide

Introduction

ODBC Driver

Any ODBC driver used must be Unicode compliant and use 2-byte SQLWCHAR and 8-byte SQLLEN for 64-bit systems. Identikey Server has been tested with the ODBC drivers provided by Oracle, IBM and Sybase in their database systems.

1.3.5

Language

Identikey Server is designed to function on any language version of Linux however, the product has only been comprehensively tested on English language versions.

1.4 Available Guides

The following Identikey Server guides are available:

Product Guide

The Product Guide will introduce you to the features and concepts of Identikey Server and the various options you have for using it.

Getting Started Guide

The Getting Started Guide will lead you through a standard setup and testing of key Identikey Server features.

Windows Installation Guide

Use this guide when planning and working through an installation of Identikey Server in a Windows environment.

Linux Installation Guide

Use this guide when planning and working through an installation of Identikey Server in a Linux environment.

Administrator Reference

In-depth information required for administration of Identikey Server. This includes references such as data attribute lists, backup and recovery and utility commands.

Performance and Deployment Guide

Contains information on common deployment models and performance statistics.

Help Files

Context-sensitive help accompanies the Administration Web Interface and Digipass Extension for Active Directory

Users and Computers.

Identikey Server Linux Installation Guide

Identikey Server SDK Programmers Guide

In-depth information required to develop using the SDK.

Introduction

Identikey Server Linux Installation Guide

Pre-installation Tasks

2 Pre-installation Tasks

This section outlines the preparation that you need to do before installing Identikey Server.

Please note that to perform pre-installation and installation tasks you must be logged in as Administrator on the system where Identikey Server is to be installed.

2.1 Database Type

When installed on a Linux operating system, Identikey Server requires an ODBC-compliant database as its data store. See the ODBC Database topic in the Administrator Reference for more information.

The database may be located on any machine to which the Identikey Server can connect.

Note

An embedded PostgreSQL database is available with the Identikey Server. If you choose the basic installation, this will be installed and configured by default.

2.2 Master Domain

Identikey Server has the concept of a Master Domain. This domain has special significance in two ways:

It is used as the default domain, when no domain is specified.

Only administrators in the Master Domain may be assigned the privilege to view data from all domains.

Administrators in other domains will only ever be able to view data in their own domain.

The default name for the Master Domain is master . If you prefer to use another name, you can specify your preferred name when you add the database schema. If the schema has already been added, you can change the

Master Domain name during an advanced installation.

Note

In the basic installation, the default Master Domain name is used. To modify this, use the

Administration Web Interface.

Identikey Server Linux Installation Guide

2.3

Pre-installation Tasks

User ID and Domain Name Conversion

The Identikey Server has options to configure how User IDs and domain names are handled. It is important that these are set up before data is added to the database. Therefore before installing, decide which of these options to use.

Note

In the basic installation, User ID and Domain name conversion is automatically set to Convert to

Lower case . To modify this, use the Administration Web Interface.

Case-sensitivity

The Identikey Server may be configured to save and retrieve User IDs and domain names in lower case, upper case or with no conversion (data is saved or searched on exactly as entered). The configuration required will depend on your company's requirements and the capabilities of the database used as the data store. See the Encoding and

Case-Sensitivity topic in the Administrator Reference for more information.

The case conversion of User IDs and domain names can be set when you add the database schema. If the schema has already been added, you can set the case conversion option using the Identikey Server Configuration Wizard, or by running the Identikey Server Configuration utility at any time afterwards.

Caution

Changing case conversion after the initial configuration may require modification of all User IDs and domain names in the data store.

2.4 System Clock

The Identikey Server requires that:

Your server’s time is set correctly in relation to GMT, and

The time zone and daylight savings indicators are set correctly.

All machines hosting the Identikey Server component must be very closely clock-synchronized.

Identikey Server Linux Installation Guide

Pre-installation Tasks

2.5 Java Web Server

2.6

2.7

Note

This is required for an advanced installation of Identikey Server only. A basic installation will install and set up a Tomcat web server automatically.

To run the Web Administration package you will need a Java Web Server. If you do not have one, it will need to be set up now.

Identikey Server has been tested primarily on Apache Tomcat 5.5.

Serial Number and Maintenance ID

You must have a product Serial Number and a company Maintenance ID unless you are installing an evaluation version of Identikey Server. If these have not been issued to you, contact your VASCO supplier.

License File

Licensing of Identikey Server may be performed before or after installation. If performed before installation of the product, the License file may be uploaded to the data store during the initial configuration. Once a license file is received, copy it to the Identikey Server installation directory – by default /opt/vasco/identikey – to allow the configuration wizard to find it within the chroot environment.

Identikey Server Linux Installation Guide

Installation Packages Overview

3 Installation Packages Overview

Manual installation of packages is not required, as installation and configuration are run within a chroot jail. See 4

Basic Installation

or 5 for installation instructions.

3.1 Install Packages

The packages included in the distribution are included below, with their dependencies. All packages are optional, but all packages with dependencies must be installed with their dependencies.

Table 1: Packages included in Identikey Server distribution

Package Description

vasco-3rdparty vasco-aal3seal vasco-audit-core vasco-audit-viewer

Provides base C runtime libraries to the

Identikey Server

Provides SEAL library support

Libraries to access Identikey Server auditing data

Allows an auditor to view the auditing data generated by the Identikey Server.

libc6 libc6

Dependencies

vasco-cgi vasco-cgi-config

User management website.

vasco-audit-core vasco-3rdparty libstlport5.1

unixodbc2.2.12

libsqlite3-0 libstlport5.1

libxml2

Vasco-cgi vasco-3rdparty vasco-controller vasco-identikey-admin-cmdline vasco-identikey-admin-web

Provides the base AAL2 libraries for the

Identikey Server.

Simple SEAL protocol client for the

Identikey Server vasco-aal3seal tcl8.4

vasco-audit-core libstlport5.1

vasco-controller

Recommends: tomcat5.5

Vasco-identikey-dbutils vasco-identikey-doc

Web based administration for the

Identikey server suite

Provides the database setup tool for the

Identikey server suite.

Provides the documentation for the

Identikey server suite.

unixodbc2.2.12

libstlport5.1

Identikey Server Linux Installation Guide

Installation Packages Overview

Package Description Dependencies

vasco-identikey-samples Provides sample digipasses and users for the Identikey server suite.

vasco-identikey-scenario-administration Provides the administration scenario for the Identikey suite.

vasco-identikey-scenario-auditing Provides the auditing scenario for the

Identikey suite.

vasco-identikey-subsystem-storage vasco-identikey-subsystem-storage vasco-identikey-scenario-authentication Provides the authentication scenario for the Identikey suite.

vasco-identikey-scenario-provisioning Provides the provisioning scenario for the

Identikey suite.

vasco-identikey-subsystem-storage vasco-identikey-subsystem-storage vasco-identikey-scenario-replication vasco-identikey-scenario-reporting vasco-identikey-scenario-signature vasco-identikey-server vasco-identikey-server-config-gui

Provides the replication scenario for the

Identikey suite.

Provides the reporting scenario for the

Identikey suite.

vasco-identikey-subsystem-storage vasco-identikey-subsystem-storage

Provides the signature scenario for the

Identikey suite.

The core Identikey server package vasco-identikey-subsystem-storage vasco-audit-core libstlport5.1

openssl, libxml2 unixodbc2.2.12

The gui config tools for Identikey Server vasco-3rdparty vasco-identikey-server vasco-identikey-subsystem-replication Provides the replication subsystem for the

Identikey suite.

vasco-identikey-server vasco-identikey-subsystem-storage vasco-identikey-server vasco-mdc-server vasco-mdc-server-config-gui

Provides the storage subsystem for the

Identikey suite.

This is the server used to by the Identikey

Server to send text messages for Virtual

Digipass. An SMS gateway is required.

GUI configuration tools for the MDC server ibstlport5.1

openssl libxml2 libcurl3 vasco-mdc-server vasco-3rdparty vasco-req-otp-website vasco-self-management-website

User management website.

vasco-cgi vasco-cgi

Identikey Server Linux Installation Guide

Basic Installation

4 Basic Installation

A basic installation of Identikey Server involves a quick, simple installation and configuration of the package, using standard components and default settings where possible. This installation option is best suited to evaluation, test and low-demand settings. The installation runs in a chroot environment, with selinux enabled.

Note

If you want non-default options and/or components (for example data encryption settings), use the advanced installation. See

for instructions.

Default Components and Configuration

Data store: Embedded PostgreSQL database The default DSN set up is:

DSN: Identikey

User ID: (blank)

Password: (blank)

Identikey Server:

Installation path: /opt/vasco/Identikey/

Licensed scenarios enabled

Master domain: master

User ID & Domain name conversion: Mixed

Data encryption: Standard

Administration Web Interface

Apache web server

Public certificate file: <Identikey Server install dir>/etc/vasco/ikeycerts.pem

Private certificate file: <Identikey Server install dir>/etc/vasco/ikeypvk.pem

Certificate keystore: <Identikey Server install dir>/etc/vasco/keystore.jks

Certificate keystore password: ikwebpassword

Message Delivery Component (Virtual Digipass)

Identikey Server Linux Installation Guide

4.1

4.2

Basic Installation

Installation Checklist

Before installing, check that you have:

License file available (alternatively, complete installation and then load a license file via the Administration Web

Interface)

Install Identikey Server

Note

Ensure that you are logged in as a User with sufficient administration privileges on the machine to run the installation and configuration commands required.

Open a command line prompt.

Run install.sh.

Enter basic.

Press Space to scroll through the IK EULA.

Enter yes to agree to the License conditions.

Press Space to scroll through the Java Virtual Machine EULA.

Enter yes to agree to the License conditions.

If required, select an IP address to use for Identikey Server.

Identikey Server will be installed.

Some configuration will be required:

Enter a User ID and password for the first Identikey Server administrator.

10.

In a separate command window, copy the license file to /opt/vasco/identikey .

11.

In the original command window, enter the location – relative to the installation directory – and filename of the license file.

12.

Select the scenarios to be enabled by entering yes when queried on each. Entering no will disable that specific scenario for that IK.

13.

Enter a private key password to be used for the server SSL certificate.

14.

Select a RADIUS topology option.

You will be prompted to enter connection details for the RADIUS Server and/or Client, so that Back-End

Server and/or Client records may be created for them.

15.

Enter RADIUS connection details as required.

A summary of the configuration will be displayed.

Identikey Server Linux Installation Guide

Basic Installation

16.

Enter y to accept the configuration options shown.

17.

Enter y to import Digipass records from a file, or n to skip this step.

If you entered y, enter this information:

administrator user name

Domain to import to

iii

the location and file name of the Digipass import file

Transport key (for demo Digipass, this will be 11111111111111111111111111111111 – 32 ones)

Enter y to import Digipass records from another import file, or n to finish import.

Identikey Server will be auto-configured and the service started.

Identikey Server Linux Installation Guide

Advanced Installation

5 Advanced Installation

An advanced installation of Identikey Server allows complete control over software components to be installed, and the configuration to be completed.

Note

If you wish to have a quick, default install and configuration, run the installation in basic mode.

See

for instructions.

The installation – and the resultant Identikey Server daemon - runs in a chroot environment, with selinux enabled.

Note

The security settings in the chroot environment may impact on the driver for the ODBC database to be used. Check your database documentation for details on using it with selinux.

5.1 Database Decisions

The following checklist contains the key decisions to make before you start.

Database Location and Setup

A number of decisions may be required for the ODBC database to be used:

The server on which the database will be located.

Will the data for the Identikey Server be stored in a new database, or added to an existing database?

Type of database to be used

Will a new schema be used?

New Database

Decide the collation sequence to be used – for example, case-sensitivity and data encryption options.

Database User Accounts

Create or select database user accounts for:

Modifying the database schema (database administrator account required).

Identikey Server (see the Administrator Reference for details on the permissions required).

Identikey Server Linux Installation Guide

5.2

5.3

Advanced Installation

Installation Checklist

Before installing, check that you have:

License file available

Java web server available, if you will not be installing the Apache Tomcat server available with the Identikey

Server installation

ODBC-Compliant database (see 5.1

and 1.3.4

Database

for more information) installed

Start Identikey Server Installation

Open a command line prompt.

Run install.sh

Enter advanced

Press Space to scroll through the Identikey Server EULA

Enter yes to agree to the License conditions

Enter an installation path (default: /opt/vasco/Identikey)

If you wish to use the embedded PostgreSQL database as Identikey Server's data store, enter yes.

If you wish to use another database, enter no.

To install the Identikey Server component on this machine, enter yes.

To install the Administration Web Interface on this machine, enter yes.

10.

To install the OTP Request web site on this machine, enter yes.

11.

To install the User Self Management web site on this machine, enter yes.

12.

To install the Message Delivery Component (used with Virtual Digipass) on this machine, enter yes.

13.

To install the Audit Viewer on this machine, enter yes.

14.

Press Space to scroll through the Java Virtual Machine EULA

15.

Enter yes to agree to the License conditions.

Some initial pre-installation tasks will be performed, then the installation process will pause.

16.

Open a new command prompt to complete the database installation and setup.

Identikey Server Linux Installation Guide

5.4 Set Up Database

Advanced Installation

Note

If using the embedded PostgreSQL database, installation and configuration are handled by the installation script. No manual setup is required.

5.4.1

UnixODBC

Note

Note that iODBC is not supported, only unixODBC.

UnixODBC will be installed with Identikey Server. Additional steps must be followed to fully set up your database to work with Identikey Server. More specific instructions are included for PostgreSQL 8.2, Oracle 10g, IBM DB2 9.1 and Sybase Adaptive Server Anywhere 11.0. For other products, follow the generic instructions below:

5.4.2

Acquire and install ODBC driver for the Database

Install the ODBC driver to the Identikey Server chroot environment.

5.4.3

Create an ODBC Data Source

Create the Data Source as required for your database. Follow the instructions provided by the database vendor.

Guidelines are given below for the databases that have been specifically tested.

5.4.4

License File

Copy the Identikey Server license file to the Identikey Server installation directory.

Identikey Server Linux Installation Guide

Advanced Installation

5.4.5

SSL Certificate

If you have a commercial SSL certificate that you wish to use with Identikey Server, copy the certificate and the trusted certificate file to the Identikey Server installation directory.

5.4.6

Digipass Record Import File

If you wish to import Digipass records during the initial configuration, copy the .dpx file to the Identikey Server installation directory.

Identikey Server Linux Installation Guide

Advanced Installation

5.4.7

ODBC Setup for PostgreSQL

When manually setting up a PostgreSQL database for Identikey Server, use the following information as a guide.

No environment variables are required.

ODBC Driver

Most PostgreSQL ODBC drivers provided by Linux distributions and on www.postgresql.org

use 4-byte

SQLWCHAR. However, the one in the Identikey Server CD has been re-built using 2-byte SQLWCHAR. If you are not using the PostgreSQL database provided with Identikey Server, extract the Identikey Server version of the

ODBC driver psqlodbcw.so

from vasco-postgresql-8.2-i386.tgz for 32-bit systems, and vasco-postgresql-8.2amd64.tgz for 64-bit systems, and replace the version of this file found in /usr/lib or /usr/lib64 with the one extracted.

To build both the 32-bit and 64-bit version of PSQLODBC, remove the following line from config.h:

#define SQL_WCHART_CONVERT

For 64 bit UNIXODBC, add the following two lines to sqltypes.h :

#define HAVE_LONG_LONG

#define BUILD_REAL_64_BIT_MODE

Note

The PostgreSQL ODBC driver uses the OpenSSL library to encrypt or hash credentials used to connect to the database. A compatibility issue may occur if your system has a version of

OpenSSL prior to 0.9.8b when connecting to a PostgreSQL database that requires MD5 or other non-plaintext password authentication.

To register the driver and setup libraries, add the following lines to /etc/odbcinst.ini

[PostgreSQL Unicode]

Description = PostgreSQL Unicode

Driver = /usr/lib/psqlodbcw.so

Setup = /usr/lib/psqlodbcw.la

Threading = 0

To configure the database as a data source using the PostgreSQL Unicode driver registered above, add the following lines to /etc/odbc.ini:

[ODBC Data Sources]

Identikey-DataSrc = Identikey Server database

[Identikey-DataSrc]

Identikey Server Linux Installation Guide

Advanced Installation

Driver = PostgreSQL Unicode

Description = Identikey Server database

Servername = <IP address>

Port = <port>

Protocol = 6.4

UserName =

Password =

Database = <database name>

ReadOnly = No

RowVersioning = No

ShowSystemTables = No

FakeOidColumn = No

FakeOidIndex = No

ConnSettings =

Trace = No where

<IP address> is the address of the machine on which the database is installed, <port> is the port number on which the database listens for connection requests, and <database name> is the name configured for the database.

Identikey Server Linux Installation Guide

Advanced Installation

5.4.8

ODBC Setup for Sybase Adaptive Server Anywhere 11.0

To set up Sybase for use with Identikey Server, base your setup on the following example. This applies to Sybase

Adaptive Server Anywhere 11.0 on 32-bit Linux.

Set the following environment variables:

Environment

Variable

Description Possible Contents

ODBCINI

ODBCINST

A number of environment variables are set by the sa_config.sh script that is created during installation and setup of Sybase. That script should be run to set the necessary variables. It is located in the Sybase bin directory, eg.

/opt/sqlanywhere11/bin32/sa_config.sh

Add the line

/opt/sqlanywhere11/bin32/sa_config.sh

/etc/profile

ODBC.INI file path/name.

ODBCINST.INI file path/name.

/etc/odbc.ini

/etc/odbcinst.ini

To register the driver and setup libraries, add the following lines to /etc/odbcinst.ini

[ODBC Drivers]

Sybase=Installed

[ODBC]

Trace=No

TraceFile=/var/log.log

[Sybase]

Driver=/opt/sqlanywhere11/lib32/libdbodbc11.so

Threading = 0

To configure the database as a data source using the Sybase driver registered above, add the following lines to

/etc/odbc.ini:

[ODBC Data Sources]

Identikey-DataSrc=Sybase

[Identikey-DataSrc]

Driver=Sybase

ServerName=<server name>

Identikey Server Linux Installation Guide

Advanced Installation

DatabaseFile=<database file>

StartLine=

AutoStart=No

AutoStop=No

Description=SQL Anywhere 11.0

CommLinks=tcpip(IP=<IP address>;PORT=<port>)

LogFile=/var/anywhere.log

where <server name> is the Server Name configured in Sybase, <database file> is the location of the Sybase database file,

<IP address> is the IP address of the database server, and <port> is the port on which the database server listens for connection requests (default: 2638). See your Sybase documentation for further information on these variables.

Identikey Server Linux Installation Guide

Advanced Installation

5.4.9

ODBC Setup for Oracle 10g

To set up Oracle for Identikey Server, use the following as a guide.

Create a file /etc/tnsnames.ora

which contains:

ORAC =

(DESCRIPTION =

(ADDRESS_LIST =

(ADDRESS = (PROTOCOL = TCP)(HOST = <IP address>)(PORT =

<Port>))

)

(CONNECT_DATA =

(SERVICE_NAME = IDENTIKEY)

)

) where <IP address> is the address of the database server, and <Port> is the port on which database connections should be made (default 1521).

Add the following line to /etc/ld.so.conf

/usr/lib/oracle/xe/app/oracle/product/10.2.0/client/lib

Add the following environment variables:

Environment

Variable

Description Possible Contents

TNS_ADMIN

LD_LIBRARY_PATH

ORACLE_SID

ORACLE_BASE

ODBC

ODBCINST

Shared library load path.

/etc

<Oracle installation path>/product/<version>/client_1/lib

<Oracle database SID> (specified during installation of database)

ODBC.INI file path/name.

<Oracle installation path> (typically /u01/app/oracle)

/etc/odbc.ini

ODBCINST.INI file path/name. /etc/odbcinst.ini

To register the driver and setup libraries, add the following lines to /etc/odbcinst.ini

[ODBC Drivers]

Oracle 10g ODBC driver = Installed

[ODBC]

Trace=No

Identikey Server Linux Installation Guide

Advanced Installation

TraceFile=/var/anywhere.log

[Oracle 10g ODBC driver]

Description = Oracle ODBC driver for Oracle 10g

Driver = <driver location>

Setup =

FileUsage =

CPTimeout =

CPReuse =

Threading = 0 where

<driver location> is the path to the ODBC driver for the database. For Oracle 10g, this will be typically be /usr/lib/oracle/xe/app/oracle/product/10.2.0/client/lib/libsqora.so.10.1

To configure the database as a data source using the Oracle driver registered above, add the following lines to /etc/odbc.ini:

[ODBC Data Sources]

Identikey-DataSrc=DataDirect 5.3 Oracle Wire Protocol

[Identikey-DataSrc]

Driver=<driver location>

Description=DataDirect 5.3 Oracle Wire Protocol

AlternateServers=

ApplicationUsingThreads=1

ArraySize=60000

AuthenticationMethod=1

CachedCursorLimit=32

CachedDescLimit=0

CatalogIncludesSynonyms=1

CatalogOptions=0

ConnectionRetryCount=0

ConnectionRetryDelay=3

DefaultLongDataBuffLen=1024

DescribeAtPrepare=0

EnableDescribeParam=0

EnableNcharSupport=0

Identikey Server Linux Installation Guide

Advanced Installation

EnableScrollableCursors=1

EnableStaticCursorsForLongData=0

EnableTimestampWithTimeZone=0

EncryptionMethod=0

GSSClient=native

HostName=<IP address>

HostNameInCertificate=

KeyPassword=

KeyStore=

LoadBalancing=0

LocalTimeZoneOffset=

LockTimeOut=-1

LogonID=

Password=

PortNumber=<Port>

ProcedureRetResults=0

ReportCodePageConversionErrors=0

ReportRecycleBin=0

ServerName=<Oracle Server Name>

ServerType=0

ServiceName=<Identikey Service Name>

SID=<Oracle Database SID>

TimestampeEscapeMapping=0

TNSNamesFile=/etc/tnsnames.ora

TrustStore=

TrustStorePassword=

UseCurrentSchema=1

ValidateServerCertificate=1

WireProtocolMode=1 where <IP address> is the address of the database server, <Port> is the port on which the database listens for connection requests, <driver location> is the path to the ODBC driver for the database, <Oracle Server

Name> is the configured name for the Oracle server, <Oracle Database SID> is the configured SID for the

Oracle database and <Identikey Service Name> is the name of the Identikey service. For Oracle 10g, this will be typically be /usr/lib/oracle/xe/app/oracle/product/10.2.0/client/lib/libsqora.so.10.1

Identikey Server Linux Installation Guide

Advanced Installation

5.4.10 ODBC Setup for IBM DB2 9.1

To set up DB2 for Identikey Server, use the instructions below as a guide.

Extract/install DB2 client libraries.

As root, enter the following commands: groupadd db2das groupadd db2admin groupadd db2fence useradd db2das -m -d /home/db2das db2das useradd db2admin -m -d /home/db2admin db2admin useradd db2fence -m -d /home/db2fence db2fence passwd db2admin cd /opt/ibm/db2/V9.1/instance

./db2icrt -a server -u db2fence db2admin

Enter the following commands to source the db2admin profile: cd /home/db2admin/sqllib

../db2profile

As user db2admin, enter the following commands: db2 catalog tcpip node dbnode remote <IP address> server 50000 catalog database <database name> at node <database node> connect <database name> user <User ID>

To register the driver and setup libraries, add the following lines to /etc/odbcinst.ini

[ODBC]

Trace=No

TraceFile=/var/db2.log

[DB2]

Driver=/opt/ibm/db2/....../libdb2.so

Description=DB2 ODBC Driver

Fileusage=1

Dontdlclose=1

Threading=0

Identikey Server Linux Installation Guide

Advanced Installation

To configure the database as a data source using the DB2 driver registered above, add the following lines to

/etc/odbc.ini:

[ODBC Data Sources]

Identikey-DataSrc=IBM DB2 ODBC DRIVER

[Identikey-DataSrc]

Driver=DB2

Description=DBNAME DB2 ODBC DRIVER

Set the following environment variables:

Possible Contents Environment

Variable

ODBC

ODBCINST

DB2INSTANCE

Description

ODBC.INI file path/name.

ODBCINST.INI file path/name.

DB2 instance name.

/etc/odbc.ini

/etc/odbcinst.ini

db2admin

Note

Please note that when setting up a DB2 database the page size should be set to at least 8192k.

A smaller page size will create an error when Identikey Server attempts to connect to the database.

Identikey Server Linux Installation Guide

5.5

Advanced Installation

Continue Identikey Server Installation

Return to the original Identikey Server installation command prompt.

Enter yes .

This will enter the Identikey Server chroot environment.

Finish Database Setup

Add any environmental variables required for the database connection in the /etc/profile file.

Copy /opt/vasco/Identikey/etc/odbc.ini

to <IK installation directory>/root/.odbc.ini

Test Database

Enter the following command to test the database connection: isql <DSN> <username> <password> where <DSN> is the Data Source Name set up earlier in the Database Setup stage – our instructions used a

DSN of Identikey-Data – and <username> and <password> are the User ID and password for a database administrator account.

If the database connection attempt is not successful, an error message will be displayed – check the setup instructions above to ensure all necessary steps have been followed.

Modify Database Schema

To set up the required schema in the database to be used for Identikey Server, enter the following command:

/usr/sbin/dpdbadmin addschema –u <username> –p <password> -d <DSN> where <DSN> is the Data Source Name set up earlier in the Database Setup stage (our instructions used a

DSN of Identikey-Data ), < username> is the User Name for a database administrator with schema modification privileges, and <password> is the password for that administrator account.

If you want to specify your own Master Domain name and/or lower or upper case conversion for User IDs and

Domain names, specify the -domain and/or -case options.

For further details on DPDBADMIN, see 9

Permissions

If the database user account used by the Identikey Server is not the owner of the tables and is not a database administrator account, it must be granted permissions for the tables, or ownership of the tables transferred.

See your database documentation for information on how to do this. The modifications to the database permissions should be made using a separate command prompt.

Identikey Server Linux Installation Guide

Advanced Installation

Note

Ensure that it is possible for the account(s) mentioned to reference the tables by name without a schema prefix. If this cannot be done, see the Administrator Reference for advanced setup instructions.

Enter the following command in the original Identikey Server installation command prompt: exit

The installation program will ask if you wish to proceed with the Identikey Server installation.

Enter yes .

Identikey Server and other selected components will be installed.

10.

Enter DSN, database administrator User ID and password for the database that Identikey Server will use as its data store.

11.

If required, select an IP address to use for Identikey Server.

12.

Enter a name for the Master Domain, or hit enter to use the default name of master .

13.

Select a User ID and Domain name conversion option

14.

Enter a User ID and password for the first Identikey Server administrator. This gives you an initial login, to allow User import and creation.

15.

Select data encryption option(s)

16.

Enter the location and filename of the Identikey Server license file – this must be relative to

/opt/vasco/identikey .

17.

Select the scenarios to be enabled by entering yes when queried on each. Entering no will disable that specific scenario for that Identikey Server.

18.

Enter 1 to generate and install a new test SSL certificate, or 2 to install your own commercial SSL certificate.

If you enter 1 :

Enter a private key password to be used for the new SSL certificate.

If you enter 2 :

Enter the path and filename for the SSL certificate.

Enter a private key password to be used for the SSL certificate.

Enter the path and filename for the trusted certificate file.

Enter the password for the trusted certificate file.

Enter y to proceed.

19.

Enter the IP address for an Administration Web Interface, if available. If you are installing the Administration

Web Interface on the current machine, enter the IP address of the current machine. This will create a client

Component record with the type Administration Client in the data store.

Identikey Server Linux Installation Guide

Advanced Installation

20.

If the Identikey Server SDK Sample Web Client has been installed, enter the IP address of that machine. A client Component record will be created for the machine.

A summary of the configuration will be displayed.

21.

Enter y to accept the configuration options shown.

Identikey Server will be configured and the daemon started.

Identikey Server Linux Installation Guide

Advanced Installation

5.6 Identikey Server Configuration File

When Identikey Server has been configured the settings are stored in the configuration file.

<?xml version="1.0" ?>

<VASCO>

<Server-Config>

<Server-Location type=" string" data="10.2.10.100" />

</Server-Config>

<Trace-Header type="

unsigned" data="47" />

<Trace-Mask type=" unsigned" data="0x3FFFFFFF" />

<Trace-File type="

string" data="/var/vasco/identikey/ikeyserver.trace" />

</Tracing>

<Storage-Key type="

string" data="" />

<Cipher-Name type=" string" data="des_ede" />

<Cipher-Module type=" string" data="" />

<Enable-Engine type="

bool" data="false" />

<Engine-Module type=" string" data="" />

<Engine-Parameters />

</Encryption>

<Storage-Engine type="

string" data="ODBC" />

<ODBC>

<Library-Path type=" string" data="/usr/lib/libikstorageodbc.so" />

<Load-Balancing type="

bool" data="false" />

<Connection-Timeout type=" unsigned" data="5000" />

<Domain-Cache>

<Max-Age type="

unsigned" data="900" />

<Max-Size type="

unsigned" data="200" />

<Clean-Threshold type="

unsigned" data="100" />

<Min-Clean-Interval type=" unsigned" data="60" />

</Domain-Cache>

<Data-Sources>

<Data-Source00>

<Display-Name type="

string" data="Identikey Server" />

<Username type="

string" data="digipass" />

<Password type="

string" data="hXRzkAU8HIsQpKpelZwAT4k=" />

<Control-Table type="

string" data="vdsControl" />

<Min-Reconnect-Interval type="

unsigned" data="0" />

<Max-Reconnect-Interval type=" unsigned" data="10" />

</Data-Source00>

</Data-Sources>

</ODBC>

Identikey Server Linux Installation Guide

Advanced Installation

</Storage>

<MDC-IP type=" string" data="127.0.0.1" />

<MDC-Port type="

unsigned" data="20007" />

</VDPClient>

<Library-Path type="

string" data="/usr/lib/libikreplication.so" />

<Repl-Server type=" string" data="10.2.10.100" />

<Allow-Loopback type="

bool" data="true" />

<Connection-Timeout type=" unsigned" data="60" />

<Min-Reconnect-Interval type="

unsigned" data="1" />

<Max-Reconnect-Interval type=" unsigned" data="60" />

<Dead-Item-Cleanup-Threshold type="

unsigned" data="60" />

<Queue>

<File-Path type=" string" data="/var/vasco/repldata/" />

<Max-Retry-Count type="

unsigned" data="3" />

<Retry-Interval type=" unsigned" data="60" />

<Max-File-Size type="

unsigned" data="100" />

</Queue>

<Server-List />

</Replication>

<Audit>

<ODBC type="

string" data="/usr/lib/libdpauditodbc.so" />

</Libraries>

<Enabled type="

bool" data="true" />

<Type type="

string" data="utf8file" />

<Display-Name type=" string" data="Text File" />

<Fail-On-Error type="

bool" data="false" />

<Unhandled-Only type=" bool" data="false" />

<Error type="

bool" data="true" />

<Success type="

bool" data="true" />

<Log-File type="

string" data="/var/vasco/identikey/ikeyserver{year}{month}.audit" />

<Keep-Open type="

bool" data="true" />

<Use-GMT type="

bool" data="false" />

<Allow-Newlines type=" bool" data="false" />

</Plugincfg>

</Profile00>

Identikey Server Linux Installation Guide

<Type type="

string" data="syslog" />

<Display-Name type=" string" data="Linux Syslog (errors only)" />

<Fail-On-Error type="

bool" data="false" />

<Unhandled-Only type=" bool" data="false" />

<Error type="

bool" data="true" />

<Warning type="

bool" data="false" />

<Info type="

bool" data="false" />

<Success type="

bool" data="false" />

<Syslog-Facility type=" string" data="local0" />

</Plugincfg>

</Profile01>

<Enabled type="

bool" data="true" />

<Type type="

string" data="syslog" />

<Display-Name type=" string" data="Linux Syslog (fall-back)" />

<Fail-On-Error type="

bool" data="true" />

<Unhandled-Only type=" bool" data="true" />

<Error type="

bool" data="true" />

<Warning type="

bool" data="true" />

<Success type="

bool" data="true" />

<Syslog-Facility type="

string" data="local0" />

</Plugincfg>

</Profile02>

<Type type="

string" data="live" />

<Display-Name type=" string" data="Live Audit Viewer" />

<Fail-On-Error type="

bool" data="false" />

<Unhandled-Only type=" bool" data="false" />

<Error type="

bool" data="true" />

<Warning type="

bool" data="true" />

<Success type="

bool" data="true" />

<IP-Address type="

string" data="10.2.10.100" />

<Server-Port type=" unsigned" data="20006" />

<Auth-Timeout type="

unsigned" data="60" />

<Max-Connections type=" unsigned" data="3" />

</Plugincfg>

</Profile03>

Identikey Server Linux Installation Guide

Advanced Installation

<Display-Name type="

string" data="odbc" />

<Fail-On-Error type="

bool" data="false" />

<Unhandled-Only type="

bool" data="false" />

<Error type="

bool" data="true" />

<Warning type="

bool" data="true" />

<Success type="

bool" data="true" />

<DSN type="

string" data="identikey server" />

<Password type="

string" data="vSMkx1JrS9xHUfpvDctsd_Y=" />

</Plugincfg>

<Enabled type="

bool" data="true" />

</Profile04>

</Plugins>

</Audit>

<Component-Cache>

<Max-Age type=" unsigned" data="900" />

<Max-Size type="

unsigned" data="1000" />

<Clean-Threshold type=" unsigned" data="800" />

<Min-Clean-Interval type="

unsigned" data="60" />

</Component-Cache>

<Policy-Cache>

<Max-Age type="

unsigned" data="900" />

<Max-Size type=" unsigned" data="200" />

<Clean-Threshold type=" unsigned" data="100" />

<Min-Clean-Interval type="

unsigned" data="60" />

</Policy-Cache>

<Challenge-Cache>

<Max-Age type="

unsigned" data="60" />

<Max-Size type=" unsigned" data="1200" />

<Clean-Threshold type="

unsigned" data="1000" />

<Min-Clean-Interval type=" unsigned" data="5" />

</Challenge-Cache>

<BackEnd-Cache>

<Max-Age type=" unsigned" data="900" />

<Max-Size type="

unsigned" data="200" />

<Clean-Threshold type=" unsigned" data="100" />

<Min-Clean-Interval type="

unsigned" data="60" />

</BackEnd-Cache>

<DPX-Cache>

<Max-Age type="

unsigned" data="86400" />

<Max-Size type=" unsigned" data="200" />

<Clean-Threshold type="

unsigned" data="100" />

Identikey Server Linux Installation Guide

Advanced Installation

<Min-Clean-Interval type=" unsigned" data="60" />

</DPX-Cache>

<Admin-Session-Cache>

<Max-Concurrent-Sessions type="

unsigned" data="10" />

<Max-Session-Time type="

unsigned" data="86400" />

<Session-Timeout type=" unsigned" data="3600" />

</Admin-Session-Cache>

<Report-Cache>

<Max-Age type=" unsigned" data="86400" />

<Max-Size type="

unsigned" data="400" />

<Clean-Threshold type=" unsigned" data="100" />

<Min-Clean-Interval type="

unsigned" data="60" />

</Report-Cache>

<Task-Manager>

<Max-Workers type="

unsigned" data="30" />

</Task-Manager>

<Library-Path type="

string" data="/usr/lib/libikcommradius.so" />

</RADIUS>

</BackEndAuthenticators>

<Enabled type="

bool" data="false" />

<Library-Path type=" string" data="/usr/lib/libikcommseal.so" />

<IP-Address type="

string" data="10.2.10.100" />

<IP-Port type="

unsigned" data="20003" />

<Require-Client-Component type=" bool" data="false" />

</SealCommunicator>

<Library-Path type="

string" data="/usr/lib/libikcommsoap.so" />

<DPX-Upload-Location type=" string" data="/usr/share/vasco/identikey/dpx/" />

<IP-Port type="

unsigned" data="8888" />

<SSL>

<Enabled type="

bool" data="false" />

<Server-Certificate type="

string" data="/etc/vasco/ikeypvk.pem" />

<Private-Key-Password type=" string" data="LOeH9$Q5YOa0" />

<CA-Certificate-Store type="

string" data="/etc/vasco/ikeycerts.pem" />

<Client-Authentication-Method type=" string" data="none" />

<Reverify-Client-On-Reconnect type="

bool" data="false" />

</SSL>

</SoapCommunicator>

<Enabled type="

bool" data="true" />

Identikey Server Linux Installation Guide

<Library-Path type=" string" data="/usr/lib/libikcommradius.so" />

<Authentication-Port type="

string" data="1812" />

<Accounting-Port type=" string" data="1813" />

<Request-Cache>

<Max-Age type="

unsigned" data="5" />

<Max-Size type="

unsigned" data="0" />

<Clean-Threshold type="

unsigned" data="200" />

<Min-Clean-Interval type=" unsigned" data="30" />

</Request-Cache>

<Proxy-Cache>

<Max-Age type=" unsigned" data="99999999" />

<Max-Size type="

unsigned" data="0" />

<Clean-Threshold type=" unsigned" data="200" />

<Min-Clean-Interval type="

unsigned" data="30" />

</Proxy-Cache>

</RadiusCommunicator>

</Communicators>

<Enabled type="

bool" data="true" />

<Display-Name type=" string" data="Authentication Scenario" />

<Library-Path type="

string" data="/usr/lib/libikscenauth.so" />

</ScenarioModule00>

<Enabled type="

bool" data="true" />

<Display-Name type=" string" data="Signature Validation Scenario" />

<Library-Path type="

string" data="/usr/lib/libikscensign.so" />

</ScenarioModule01>

<Enabled type="

bool" data="true" />

<Display-Name type="

string" data="Provisioning Scenario" />

<Library-Path type="

string" data="/usr/lib/libikscenprovision.so" />

<Min-Time-Before-Reactivation type=" unsigned" data="1440" />

<Max-Nbr-Attempts type="

unsigned" data="3" />

<Max-Nbr-Locations type=" unsigned" data="5" />

</Reactivation>

</ScenarioModule02>

<Enabled type="

bool" data="true" />

<Display-Name type="

string" data="Administration Scenario" />

<Library-Path type=" string" data="/usr/lib/libikscenadmin.so" />

</ScenarioModule03>

<Display-Name type="

string" data="Reporting Scenario" />

<Library-Path type=" string" data="/usr/lib/libikscenreport.so" />

Identikey Server Linux Installation Guide

Advanced Installation

<Report-Location type=" string" data="/usr/share/vasco/identikey/reports/" />

<Audit>

<Plug-ins>

<Plugin01 type="

string" data="/usr/lib/libdpauditodbc.so" />

</Plug-ins>

<ODBC>

<DSN type="

string" data="postgres" />

</ODBC>

<UTF8>

<Path type="

string" data="/var/vasco/identikey/" />

</UTF8>

</Audit>

</ScenarioModule04>

<Display-Name type="

string" data="Audit Scenario" />

<Library-Path type="

string" data="/usr/lib/libikscenaudit.so" />

</ScenarioModule05>

<Display-Name type=" string" data="Replication Scenario" />

<Library-Path type="

string" data="/usr/lib/libikscenrepl.so" />

</ScenarioModule06>

</Scenarios>

</VASCO>

Identikey Server Linux Installation Guide

6 Configuration

Configuration

6.1 Run an Identikey Server Configuration Tool

To configure the Identikey Server once the initial installation and configuration has been completed, enter the chroot environment by entering the following command: vds_chroot <IK install directory> /bin/bash

Then enter one of the following commands:

Configuration Wizard, command-line version

ikconfigwizardconsole

Configuration Wizard, GUI version

ikconfigwizardgui

Configuration GUI

ikconfigutilgui

Web Administration Setup Tool 6.2

6.2.1

Overview

The Web Administration Setup Tool is a Java application that allows the set up and configuration of the

Administration Web Interface. The Web Administration Setup Tool is used for managing SSL certificates as well as

Identikey Servers to which the Web Administration application can connect. The Web Administration Setup Tool requires a Java Runtime Environment.

The information created using the Web Administration Setup Tool can be viewed via the Web Administration application. Any changes made using the Web Administration Setup Tool will not be reflected in the Web

Administration application until the Web Administration application is restarted.

The Web Administration Setup Tool stores its information using the Java preferences API. Under Windows it uses the Windows registry.

Identikey Server Linux Installation Guide

6.2.2

Running the Application

Configuration

Note

The vds_chroot command will enter you into the chroot environment. This is necessary for all

Setup Tool commands.

To exit the chroot environment, enter: exit

6.2.3

Available Commands

The commands should be in the following format: java -jar admintool.jar <command> [options]

The following commands are available:

Setup Tool Command

autoadd <name> <url> <certificate archive> <password> <connection limit>

<connection timeout> server list server add <name> <url>

<connection_timeout> <connection limit> server delete <name> server default <name> server localaddress <name> <local address> certificate list certificate list <certificate archive>

<passphrase> certificate add <certificate archive>

<passphrase> <certificate file> <name> certificate delete <certificate archive>

Explanation

Creates a new Identikey Server connection for the Administration Web

Interface.

If a certificate archive and password is specified, the Identikey Server's SSL certificate will be added to it. If no certificate archive is specified, it will be added to the existing keystore.

A connection limit (number of concurrent connections to allow) and connection timeout may also be specified.

List the available Identikey SOAP servers

Add a new Identikey Server connection.

A connection limit (number of concurrent connections to allow) and connection timeout may also be specified.

Remove an existing Identikey Server

Set the specified Identikey SOAP server as the default

Specify a local IP address to specify when connecting to the provided server name.

Displays the list of certificate alias which are in the used certificate archive

Displays the list of certificate alias which are in the specifiedcertificate archive (opened using the specified passphrase)

Installs the certificate into an existing or new certificate archive using the provided passphrase and alias the certificate using the provided name.

Removes the certificate with the specified alias from the provided

Identikey Server Linux Installation Guide

Setup Tool Command

certificate delete <certificate archive>

<passphrase> autoadd <name> <url> <certificate archive> <passphrase>

6.2.4

Command Usage Examples

Configuration

Explanation

Removes the certificate with the default alias "IdentikeyServer" certificate archive using the provided password.

Combines the functionality of the server add and certificate add commands and automates the retrieval of the certificate from the Identikey Server.

6.2.4.1 Adding an Identikey Server

To add an Identikey Server, navigate to the i<install dir>\webadmin directory and then run the command java -jar admintool.jar autoadd new_server https://10.2.1.1:8888

This command will create a new Identikey Server record which will be displayed in the Web Administration application using the name “new_server” and will connect to the Identikey SOAP communicator using http

(inherent to SOAP) at address 10.2.1.1 using port 8888 (as configured for the identikey server).

NOTE

Protocol strings must be provided (http or https for SSL connections).

You can verify that this server has been created by running the following command: java -jar admintool.jar server list which will display the current list of servers.

NOTE

The server name and url are considered to be unique. Attempting to add another server with a different name and the same url will fail (adding a server with the same name and different url will overwrite the existing server's entry)

6.2.4.2 Adding a certificate

To connect to an Identikey Server which is using an SSL connection we must add the server's certificate to the

Web Administration application's certificate archive. The certificate used by the Identikey Server is usually created with the filename “ikeycerts.pem” and located in :

<install dir>\bin

Identikey Server Linux Installation Guide

Configuration

6.3

To add this certificate to the Web Administration application's certificate archive, run the following command: java -jar admintool.jar autoadd new_server webadmin.jks ourPassword \etc\vasco\ikeycerts.pem

where the webadmin.jks is the Web Administration application's keystore filename and ourPassword is the password we use to make sure that no-one can simply add another certificate to our Web Administration application's certificate archive.

Once this certificate has been added we can connect to the Identikey Server.

NOTE

Make sure that the connection url to the server is updated (https is used as opposed to http).

All other commands provided are extensions of these two basic commands.

Deploy Web Administration Interface

The Web Administration Interface is provided as a .war (web archive) file, webadmin.war. This web application must be deployed in a Java web application server before it can be used.

To deploy the Web Administration interface you must:

Have a Java Web Application Server. Identikey Server has primarily been tested with Apache Tomcat.

Make sure the Java Web Application Server is running successfully.

Enter the chroot environment: vds_chroot <install dir> /bin/bash

Configure the application with the location of the Identikey Server. This is done using the admintool.jar program.

java -jar admintool.jar server add my_server https://127.0.0.1:8888

If the machine on which the Web Administration Interface has been installed has more than one IP address, you must ensure that the same source IP address is used each time a connection to the server is made. The command to enforce this is server localaddress <name> <local address>

Set up SSL for the SOAP connection to the Identikey Server.

If the Web Administration is not on the same machine as the Identikey Server, copy the ikeycerts.pem file from the Identikey Server machine (located in /etc/vasco ) to a directory accessible to the Web

Administration Interface.

Run the following command: java -jar admintool.jar certificate add <certificate archive> <password>

Where <password> should be replaced with a password of your choice. This command will create an

SSL certificate key store for the Web Administration Interface.

Identikey Server Linux Installation Guide

Configuration

Deploy the Web Administration Interface application.

The instructions below are for deploying the Web Administration Interface with Apache Tomcat.

6.3.1

Deploy Web Administration Interface Using Apache Tomcat Server

If your Tomcat installation does not have an administrator account set up yet, create one:

Open the file tomcat-users.xml

in the Tomcat conf directory.

Add the following lines into this file and save the changes:

<role rolename="manager"/>

<role rolename="admin"/>

<user username="admin" password="" roles="admin,manager"/>

If the JAVA_HOME environment variable is not set for the user starting Tomcat, set it to the Java home directory in that user's profile or in the Tomcat startup script. Ensure that the JAVA_HOME, PATH and

CLASSPATH environment variables are set so that they refer to the correct JRE version, if more than one JRE version exists on the machine.

If you have not restarted the machine since installing, the Tomcat service may need to be started manually:

Go to the Apache Tomcat directory and enter

./bin/catalina.sh start

Open a browser at http://localhost:<port on which the web application server is listening> . Typically the port number will be 8080 .

The Tomcat introduction page should be displayed.

Click on Tomcat Manager.

The Tomcat Manager login window will be displayed.

Log in using admin as your username and a blank password (unless you have changed the default administration credentials).

The Tomcat Web Application Manager will be opened.

Scroll down to the WAR file to deploy section.

Click on the Browse button.

Find and select the webadmin.war file – typically in /usr/share/vasco

10.

Click on Open.

11.

Click on Deploy.

12.

An entry titled /webadmin should appear in the Applications list.

13.

Restart the Apache Tomcat service:

Go to the Apache Tomcat directory and enter

./bin/catalina.sh start

Identikey Server Linux Installation Guide

Configuration

14.

Go back to the browser window.

15.

Click on the new /webadmin entry.

The Web Administration Interface login screen should be displayed.

16.

6.3.2

Upload Limit

An upload limit of 5 megabytes has been set in the Web Administration Interface for user or DPX import files.

To change this value:

Navigate to the Tomcat installation directory.

Navigate to the Tomcat/webapps/webadmin/WEB-INF/classes directory

Double-click the struts.properties file and edit the struts.multipart.maxSize value:

#set max upload size to 5 meg struts. multipart.maxSize=52428800

Identikey Server Linux Installation Guide

7 Post-Installation Tasks

Post-Installation Tasks

7.1 Licensing

Each Identikey Server will require a license key to be loaded into its Server record – even if you are using an evaluation license. If this is not completed during the install process, it will need to be done before the Identikey

Server can be used for authentication, signature validation or provisioning. Refer to the Licensing section of the

Administration Reference for instructions.

7.1.1

Evaluation Serial Number

If you do not obtain a license key file during installation of the Identikey Server, but wish to use an evaluation license, you will need to use this serial number on the VASCO licensing site: 2FC4FF0E1E .

7.2

7.3 Backup Strategy

Consider a backup strategy to be put in place for files which will require backing up. For more information, see the

Backup and Recovery section of the Administrator Reference.

Audit Settings

Configure how and when the Identikey Server will record audit messages.

7.3.1

Text File

If auditing to a text file, you will need to decide how often a new text file should be created. By default, a new text file is created monthly. To change this frequency, modify the variables used in the file name. For example, if the

Identikey Server is configured to write to a text file set to IdentikeyServer-{year}-{month}.audit

, a new text file will be created monthly. If the text file name is set to IdentikeyServer-{year}-{month}-{mday}.audit

, a new text file will be created daily.

For more information, see the Auditing section of the Administrator Reference.

Identikey Server Linux Installation Guide

Post-Installation Tasks

7.3.2

Syslog

Auditing can be set up to write to the Syslog. Correctly configuring the facility will enable separation of events from different sources. Valid values are User (default), daemon, auth, authpriv, syslog, localn (where n = is a number from 0 to 7 inclusive). By default, the local0 facility is configured.

Note

Due to the Identikey Server daemon running in the chroot environment, some extra setup must be completed before auditing to Syslog. See the Auditing section of the Administrator Reference for instructions.

7.4 Database Tasks

7.4.1

Configure Connection Parameters

You may wish to increase the number of connections attempted to the database if:

The load on the database will be high, and

Changes to the connection settings will be efficient with the database and database driver in question.

Setting an idle timeout will allow connections which are no longer required to be closed as soon as possible, which may lower the load on the database server. See the Administrator Reference for more information.

7.4.2

Additional Databases

If additional databases are required for backup, failover or load-balancing purposes, configure the Identikey Server to use them now.

See the Additional ODBC Databases topic in the Product Guide and the Database Connection Handling topic in the

Administrator Reference for more information.

7.5 Replication

Replication may be required between Identikey Servers. See the Replication section of the Administration

Reference for instructions on setting up replication.

Identikey Server Linux Installation Guide

Post-Installation Tasks

7.6 Daemon Setup

Daemons are installed during initial installation of the product they are part of. No direct set up is required as any settings they need are retrieved from the configuration file created using the Configuration Wizard.

For Ubuntu and SuSE the Daemons are stored in /etc/init.d.

For Red Hat the daemons are stored in /etc/rc.d/init.d

To start a daemon go to the directory the daemon is stored in and enter ./daemon-name start

To stop a daemon go to the directory the daemon is stored in and enter ./daemon-name stop

You can also restart a daemon by going to the directory in which the daemon is stored and entering

./daemon-name restart

The term daemon-name in the above examples refers to the daemon service name.

7.6.1

Identikey Server

The daemon service name for the Identikey Server daemon is Identikey.

7.6.2

Message Delivery Component

The daemon service name for the Message Delivery Component is MDC .

7.7 Configure Additional Identikey Servers

Follow the same process as in the Configure Identikey Server section in this manual. However, these settings will be overwritten when replication is set up:

Master Domain

User ID/Domain name conversion

You will need to request a License Key for each additional Identikey Server.

7.8 Set Up User Self Management and OTP Request Websites

To set up the User Self Management and OTP Request Websites you need to deploy the web pages to a web server such as Apache and configure the CGI used by the web site with the location of the Identikey Server.

The web sites consist of HTML pages with JavaScript, CSS and image files and the CGI. Therefore it can be deployed in a wide variety of web servers. The CGI needs to be located in a directory where it can be executed.

Identikey Server Linux Installation Guide

Post-Installation Tasks

The following instructions are for setting up the user websites from a chroot environment while the host environment runs the Apache2 webserver. Adjust these configuration steps where necessary:

Create a new sites file named vasco in /etc/apache2/sites-available with the following contents:

ScriptAlias /dpselfservice/cgi-bin /opt/vasco/identikey/usr/share/vascocgi/cgi-bin Alias /dpselfservice /opt/vasco/identikey/usr/share/selfmgmt

AllowOverride None

Order Allow, Deny

Allow From All

</Directory>

ScriptAlias /reqotp/cgi-bin /opt/vasco/identikey/usr/share/vasco-cgi/cgibin Alias /reqotp /opt/vasco/identikey/usr/share/reqotp

AllowOverride None

Order Allow,Deny

Allow From All

</Directory>

This configuration assigns the aliases /dpselfservice and /reqotp to the web-sites located in the chroot environment at /opt/vasco/identikey .

Create a symbolic link in /etc/apache2/sites-enabled to /etc/apache2/sites-available/vasco so Apache2 will load the configuration file: cd /etc/apache2/sites-enabled ln -s ../sites-available/vasco

Ensure the 'www-data' user and group exist in the host and in the chroot environment with the same user- and group IDs.

Restart the Apache2 webserver.

Open a browser and browse to http://localhost/dpselfservice or http://localhost/reqotp

Identikey Server Linux Installation Guide

8 Uninstall Identikey Server

8.1

8.2

8.3

Uninstall Identikey Server

Backing Up Data

This step will be required if you are using the embedded PostgreSQL database supplied with Identikey Server.

Copy all database files from the chroot directory to a safe location.

Run Uninstall Script

Exit the chroot environment, if within it.

Navigate to the installation CD.

Run the uninstall script:

./uninstall.sh

Enter y.

Identikey Server will be uninstalled.

Data Removal

When you uninstall Identikey Server, the database and the data inside it will not be removed. If you wish to delete it, you need to do this manually.

The simplest way to remove all data is to remove the schema modifications. This will drop all the tables used by

Identikey Server.

If you do not wish to delete the data, it is possible to re-install Identikey Server without losing this data.

Remove Schema Modifications

The dropschema command in the DPDBADMIN command line utility can be used to remove all schema modifications from the database, deleting all data relating to Identikey Server. Refer to the DPDBADMIN section of the Administration Reference for instructions.

Identikey Server Linux Installation Guide

Extend Data Store Schema

9 Extend Data Store Schema

The dpdbadmin addschema command is used to create all required tables in an existing database, if they are not already there. Each table will be checked individually to see if it is already there and if not, will be added.

This command is intended to be run manually by an administrator before Identikey Server is configured.

It may be necessary to go through an approval process in your company before running this command. You may also need to have a database administrator run the command for you. This depends on your company’s structure and rules for control of the database.

This command may also be used to create the tables required for auditing to an ODBC database.

Prerequisite Information

Database Administrator Account

In order to successfully modify the database structure, you will need the username and password of a database administrator account that is able to make changes to the database schema – for example, creating tables. You must pass these credentials to the command in the parameters.

Database Name

You will need the ODBC Data Source Name (DSN) of the database.

Master Domain Name

You can specify the name of the Master Domain (see 2.2

Master Domain) when you add the database schema.

However if you do not do it at that time, the Configuration Wizard can change it.

UserID/Domain Name Conversion

You can specify the Case Conversion option for UserIDs and Domain names (see 2.3

User ID and Domain Name

Conversion) when you add the database schema. However if you do not do it at that time, the Configuration Wizard

can change it.

Modify the Database Structure

Open a command prompt.

Enter the chroot environment: vds_chroot <install dir> /bin/bash

Navigate to the installation’s bin directory by typing: cd /usr/sbin

Type: dpdbadmin addschema –u user_name –p password -d dsn

See below for more details regarding the required parameters.

Identikey Server Linux Installation Guide

Extend Data Store Schema

The progress and success/failure of the command will be displayed in the command prompt window. If there was a failure, it can be run again after the problem has been rectified.

Command Line Syntax

dpdbadmin addschema -d dsn [–u user_name] [–p password] [-domain domain_name] [-case case_conversion] [-vdsuser alternatename] [-vdsuserattr alternatename] [-vdsdomain alternatename] [-vdscontrol alternatename]

[-vdsdigipass alternatename] [-vdsdpapplication alternatename] [-vdspolicy alternatename] [vdsbackend alternatename] [-vdscomponent alternatename]

[-vdsorgunit alternatename] [-vdsdpsoftparams alternatename] [-vdsreport alternatename] [-vdsreportformat alternatename] [-audit] [-noserver]

[-nouser] [-utf8factor factor] [-q] [-v] [-l file_name] vdsuser vdsuserattr vdsdomain vdscontrol vdsdigipass vdsdpapplication vdspolicy vdsbackend vdscomponent vdsorgunit vdsdpsoftparams vdsreport vdsreportformat

-audit

-noserver

Table 2: DPDBADMIN addschema Command Line Options

-d

-u

-p

-domain

-case

Option

-nouser

-utf8factor

Description

ODBC Data Source Name (DSN)

User name of a database administrator (if required).

Password of the database administrator. This option may be omitted if they have a blank password.

Specify the Master Domain to be used. If not specified, it will be “master”. The Domain will be created if it does not already exist.

Specify to convert User IDs and domain names to either upper or lower case. The value must be either “upper” or “lower”.

Alternative name for the Digipass User table to be created.

Alternative name for the Digipass User Attribute table to be created.

Alternative name for the Domain table to be created.

Alternative name for the Control table to be created.

Alternative name for the Digipass table to be created.

Alternative name for the Digipass Application table to be created.

Alternative name for the Policy table to be created.

Alternative name for the Back-end Server table to be created.

Alternative name for the Component table to be created.

Alternative name for the Organizational Unit table to be created.

Alternative name for the DPSoft Parameters table to be created.

Alternative name for the Report Definition table to be created.

Alternative name for the Report Format table to be created.

Create the Audit tables.

Do not create the main tables used by the Identikey Server. This should only be used with the -audit option, when you only want to create the auditing tables.

Do not create Digipass User table. This option is not currently supported.

On certain databases (such as Oracle and DB2), column sizes are specified in bytes, not characters, by default. When UTF-8 encoding is used to store data, for full Unicode support, one character may

Identikey Server Linux Installation Guide

Extend Data Store Schema

Option Description

-q

-v

-l be represented as more than one byte. Normally 2 or 3 characters are used, depending on the language, but some characters require 4. If your data will include a lot of non-English characters, you can increase the size of certain columns by a factor to allow for the extra bytes. The value of the parameter should be 2, 3 or 4. Typically, 3 is sufficient. The columns affected by this are the User

Name (not User ID) and various Description fields.

On other databases, column sizes are specified in characters, and this parameter is not needed.

Quiet mode, will not output commentary text.

Verbose mode.

Log output to file file_name.

DPDBADMIN addschema Command Sample

dpdbadmin addschema –u DBAdmin –p pwd3498 -d UserDb -domain mydomain -case lower

This command will modify the database structure of the ODBC database with the data source name of UserDb. It uses a database administrator account with the User ID of DBAdmin and password pwd3498. A non-default

Master Domain will be used, called “mydomain”. It specifies to convert domain names and User IDs to lower case.

dpdbadmin addschema –u DBAdmin –p pwd3498 -d AuditDb -audit -noserver

This command will create only the auditing tables in the ODBC database with the data source name of AuditDb. It uses a database administrator account with the User ID of DBAdmin and password pwd3498.

Identikey Server Linux Installation Guide

File/Directory Placement

10 File/Directory Placement

Listed below are the files supplied with the Identikey Server and the location – relative to the chroot jail – in which the files are installed.

Table 3: List of files and file locations for Identikey Server

Package Location File Name

vasco-aal3seal vasco-identikey-scenarioprovisioning

/etc/vasco

/usr/lib

/usr/lib vasco-identikey-admin-cmdline /usr/share/vasco/admincmd vasco-identikey-admin-cmdline /usr/lib

/usr/lib vasco-identikey-scenarioadministration vasco-identikey-scenariosignature

/usr/lib identikeyconfig.xml

libikaal3seal.so

libikscenprovision.so

dpadmincmd.tmpl

libtclvasco.so

libikscenadmin.so

libikscensign.so

vasco-identikey-scenarioreporting vasco-identikey-admin-web vasco-identikey-server vasco-identikey-server vasco-req-otp-website vasco-audit-viewer vasco-audit-viewer vasco-audit-viewer vasco-audit-viewer vasco-identikey-scenarioreplication vasco-mdc-server

/usr/lib

/usr/share/vasco libikscenreport.so

webadmin.war

vasco-identikey-admin-web vasco-identikey-scenario-auditing /usr/lib vasco-identikey-server vasco-identikey-server vasco-identikey-server

/usr/share/vasco

/usr/share/vasco/identikey admintool.jar

libikscenaudit.so

identikeyconfig.tmpl, policies.xml, reports.xml, certgen.tmpl, identikey

/usr/share/vasco/identikey/reports/xslt *.xslt

/usr/bin ikeyserver

/usr/sbin

/usr/lib usr/share/reqotp/*

/usr/bin

/usr/lib

/usr/share/doc/vasco

/etc/vasco

/usr/lib

/usr/share/vasco/mdc/ ikconfigwizardconsole libikcommsoap.so, libikcommseal.so, libikcommradius.so

*.html, *.js, *.css, *.jpg, *.png, *.gif

dpauditviewer libdpadtreader.so

AuditViewerHelp.htb

dpauditviewer.xml

libikscenrepl.so

mdcconfig.tmpl

Identikey Server Linux Installation Guide

Package

vasco-mdc-server vasco-mdc-server vasco-mdc-server vasco-mdc-server vasco-identikey-subsystemstorage vasco-3rdparty vasco-audit-core

Location

/usr/bin

/usr/lib

/usr/share/vasco/init.d

/etc/vasco

/usr/lib

/usr/lib vasco-identikey-subsystemreplication

/usr/lib vasco-identikey-server-config-gui /usr/sbin vasco-identikey-server-config-gui /usr/share/doc/vasco vasco-identikey-scenarioauthentication

/usr/lib vasco-cgi vasco-cgi vasco-cgi-config vasco-identikey-doc

/etc/vasco

/usr/bin

/usr/sbin

/usr/share/doc/vasco vasco-controller /usr/lib vasco-self-management-website /usr/share/selfmgmt/* vasco-identikey-samples /usr/share/vasco/identikey/dpx vasco-identikey-samples /usr/share/vasco/identikey/user

File/Directory Placement

File Name

mdcserver libvdpclient.so

mdc curl-ca-bundle.crt

libikstorageodbc.so

ibwx_gtk2u-2.8.so

libdpauditlive.so, libdpaudit.so, libdpauditodbc.so, libikreplication.so

Ikconfigutilgui, ikconfigwizardgui

ConfigurationGUIHelp.htb

libikscenauth.so

usercgi.xml

usercgi usercgicfg

Identikey Server Product Guide.pdf, Identikey

Server Administrator Reference.pdf, Identikey

Server Linux Installation Guide.pdf

libaal2sdk.so

*.html, *.js, *.css, *.jpg, *.png, *.gif

DemoGO3.dpx, demovdp.dpx, demo.dpx, demoaes.dpx, demoDP4Web.dpx

user-import.csv

10.1 Permissions

Table 4: List of directories and permissions for Identikey Server

Created Directories Permission s

User group

/var/vasco/repldata

/var/vasco/identikey

/usr/share/vasco/identikey/dpx

775

Identikey

Identikey Server Linux Installation Guide

User/group/other

drwxrwxr-x drwxrwxr-x drwxrwxr-x

Created Directories Permission s

/usr/share/vasco/identikey/reports 775

/var/vasco/mdc 775

Identikey mdcserver

User group

File/Directory Placement

User/group/other

drwxrwxr-x drwxrwxr-x

Identikey Server Linux Installation Guide

Technical Support

11 Technical Support

If you encounter problems with a VASCO product please do the following:

Read the How to Troubleshoot topic in the Administrator Reference for help in discovering the source of your problem.

Check if your problem is resolved in the Knowledge Base located at the following URL: http://www.vasco.com/support .

If you do not find the information you need in the Knowledge Base, please contact the company that sold you the VASCO product.

Only after doing these steps, if your needs are still not completely met please contact VASCO support:

11.1 Support Contact Information

E-mail

[email protected]

Website

http://www.vasco.com/support/contacts.html

Phone

Australia

Belgium

Singapore

USA

+61 2 8061 3700 (Sydney)

+32 2 609 9770 (Brussels)

+65 6 232 2727

+1 508 366 3400 (Boston)

Identikey Server Linux Installation Guide