VASCO Linux Identikey Server Installation Guide
Reklama
Reklama
Identikey Server
Installation Guide For Linux
3.1
3.1
Disclaimer of Warranties and Limitations of Liabilities
Disclaimer of Warranties and Limitations of Liabilities
The Product is provided on an 'as is' basis, without any other warranties, or conditions, express or implied, including but not limited to warranties of merchantable quality, merchantability of fitness for a particular purpose, or those arising by law, statute, usage of trade or course of dealing. The entire risk as to the results and performance of the product is assumed by you. Neither we nor our dealers or suppliers shall have any liability to you or any other person or entity for any indirect, incidental, special or consequential damages whatsoever, including but not limited to loss of revenue or profit, lost or damaged data of other commercial or economic loss, even if we have been advised of the possibility of such damages or they are foreseeable; or for claims by a third party. Our maximum aggregate liability to you, and that of our dealers and suppliers shall not exceed the amount paid by you for the Product. The limitations in this section shall apply whether or not the alleged breach or default is a breach of a fundamental condition or term, or a fundamental breach. Some states/countries do not allow the exclusion or limitation or liability for consequential or incidental damages so the above limitation may not apply to you.
Copyright
Copyright © 2009 VASCO Data Security, Inc., VASCO Data Security International GmbH. All rights reserved.
No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording, or otherwise, without the prior written permission of
VASCO Data Security Inc.
RADIUS Documentation Disclaimer
The RADIUS documentation featured in this manual is focused on supplying required information pertaining to the
RADIUS server and its operation in the Identikey Server environment. It is recommended that further information be gathered from your NAS/RAS vendor for information on the use of RADIUS.
Trademarks
VASCO®, Vacman®, IDENTIKEY®, aXs GUARD™, DIGIPASS®, and ® are registered or unregistered trademarks of VASCO Data Security, Inc. and/or VASCO Data Security International GmbH in the U.S. and other countries.
Document Version: 1.3
Table of Contents
Table of Contents
Identikey Server Linux Installation Guide
3
Table of Contents
Identikey Server Linux Installation Guide
4
Introduction
1 Introduction
This Installation Guide is designed to provide you with the information you will need in order to install Identikey
Server. It will guide you through preparation, installation and post-installation tasks which may be required for your system.
1.1
1.2
Chroot Environment
Identikey Server is installed and runs in a chroot environment based on a Debian distribution with selinux enabled.
This allows it to be run on almost any Linux distribution.
When interacting with Identikey Server and its components (such as configuration tools) you will need to enter this environment by using this command: vds_chroot <installation directory> /bin/bash where <installation directory> will be /opt/vasco/identikey if installed in the default installation location.
Software Components
Identikey Server consists of various components, some necessary and some optional.
1.2.1
Required Components
Identikey Server
The Identikey Server is a server component that performs authentication, signature validation, administration and provisioning tasks. It runs as a daemon.
Data Store
All information required by Identikey Server is stored in an ODBC-compliant database.
Web Administration Interface
Allows all Identikey Server data store administration tasks to be carried out over a web interface.
Identikey Server Linux Installation Guide
5
Introduction
1.2.2
Optional Components
Virtual Digipass Message Delivery Component
This is a daemon that is responsible for delivering One Time Passwords through a text message HTTP gateway to a
User’s mobile phone.
Digipass TCL Command-Line Administration
Administration may be carried out using Digipass TCL Command-Line Administration Utility, which allows interactive command-line and scripted administration of Identikey Server data.
Audit Viewer
The Audit Viewer is a GUI application that can display and filter audit messages from the Identikey Server. It can read the data from text files and ODBC databases or receive a live feed from the Identikey Server.
OTP Request Site
This is a miniature web site that allows a User to request a Virtual Digipass OTP to be sent to their mobile phone.
User Self Management Web Site
This is a miniature web site that allows Users to make appropriate changes to their own Digipass settings, such as
PIN changes. This is used in a RADIUS environment, when the normal authentication requests are made using a
CHAP-based protocol and therefore PIN changes and other 'self-management' features are not possible.
1.2.3
Identikey Server SDK
The Software Development Kit allows creation of custom SOAP clients and authentication engines, using the SOAP interface. This is an upgrade add-on to Identikey Server and will only be available for installation if it has been purchased. It requires a separate installation program.
1.3
System Requirements
1.3.1
Server Components
Identikey Server and the Virtual Digipass Message Delivery Component require:
Linux on x86 or amd64 architecture
Kernel 2.6
Identikey Server has been tested on:
Ubuntu 8.04
Identikey Server Linux Installation Guide
6
Introduction
SuSE 10.0
Red Hat 5.0
Please note that a server without X-Windows will not be able to run the Configuration GUI, the GUI Configuration
Wizard or the Audit Viewer.
1.3.2
Web Administration Interface
The Web Administration Interface can be run on any Java web application server running:
Java Runtime Environment version 5.0 or above
Java Server Pages version 2.0 or above
Java Servlets version 2.4 or above
It has been tested primarily on Apache Tomcat 5.5.
It is compatible with most common browsers, including:
Internet Explorer 6.0
Internet Explorer 7.0
Mozilla Firefox 2.0
Opera 9.0
Netscape 8.1 (a few cosmetic issues appear with this browser)
1.3.3
Other Components
The Audit Viewer and Digipass TCL Command-Line Administration require the same as the Server Components.
The Request OTP and User Self Management Websites require any web server capable of running CGI.
1.3.4
Database
Identikey Server will support most modern ODBC-compliant relational, transactional databases. It has been tested on the following databases:
PostgreSQL 8.2.5
Oracle 10g (32-bit), 11g (64-bit)
IBM DB2 9.1
Sybase Adaptive Server Anywhere 11.0
Identikey Server Linux Installation Guide
7
Introduction
ODBC Driver
Any ODBC driver used must be Unicode compliant and use 2-byte SQLWCHAR and 8-byte SQLLEN for 64-bit systems. Identikey Server has been tested with the ODBC drivers provided by Oracle, IBM and Sybase in their database systems.
1.3.5
Language
Identikey Server is designed to function on any language version of Linux however, the product has only been comprehensively tested on English language versions.
1.4
Available Guides
The following Identikey Server guides are available:
Product Guide
The Product Guide will introduce you to the features and concepts of Identikey Server and the various options you have for using it.
Getting Started Guide
The Getting Started Guide will lead you through a standard setup and testing of key Identikey Server features.
Windows Installation Guide
Use this guide when planning and working through an installation of Identikey Server in a Windows environment.
Linux Installation Guide
Use this guide when planning and working through an installation of Identikey Server in a Linux environment.
Administrator Reference
In-depth information required for administration of Identikey Server. This includes references such as data attribute lists, backup and recovery and utility commands.
Performance and Deployment Guide
Contains information on common deployment models and performance statistics.
Help Files
Context-sensitive help accompanies the Administration Web Interface and Digipass Extension for Active Directory
Users and Computers.
Identikey Server Linux Installation Guide
8
Identikey Server SDK Programmers Guide
In-depth information required to develop using the SDK.
Introduction
Identikey Server Linux Installation Guide
9
Pre-installation Tasks
2 Pre-installation Tasks
This section outlines the preparation that you need to do before installing Identikey Server.
Please note that to perform pre-installation and installation tasks you must be logged in as Administrator on the system where Identikey Server is to be installed.
2.1
Database Type
When installed on a Linux operating system, Identikey Server requires an ODBC-compliant database as its data store. See the ODBC Database topic in the Administrator Reference for more information.
The database may be located on any machine to which the Identikey Server can connect.
Note
An embedded PostgreSQL database is available with the Identikey Server. If you choose the basic installation, this will be installed and configured by default.
2.2
Master Domain
Identikey Server has the concept of a Master Domain. This domain has special significance in two ways:
1.
It is used as the default domain, when no domain is specified.
2.
Only administrators in the Master Domain may be assigned the privilege to view data from all domains.
Administrators in other domains will only ever be able to view data in their own domain.
The default name for the Master Domain is master . If you prefer to use another name, you can specify your preferred name when you add the database schema. If the schema has already been added, you can change the
Master Domain name during an advanced installation.
Note
In the basic installation, the default Master Domain name is used. To modify this, use the
Administration Web Interface.
Identikey Server Linux Installation Guide
10
2.3
Pre-installation Tasks
User ID and Domain Name Conversion
The Identikey Server has options to configure how User IDs and domain names are handled. It is important that these are set up before data is added to the database. Therefore before installing, decide which of these options to use.
Note
In the basic installation, User ID and Domain name conversion is automatically set to Convert to
Lower case . To modify this, use the Administration Web Interface.
Case-sensitivity
The Identikey Server may be configured to save and retrieve User IDs and domain names in lower case, upper case or with no conversion (data is saved or searched on exactly as entered). The configuration required will depend on your company's requirements and the capabilities of the database used as the data store. See the Encoding and
Case-Sensitivity topic in the Administrator Reference for more information.
The case conversion of User IDs and domain names can be set when you add the database schema. If the schema has already been added, you can set the case conversion option using the Identikey Server Configuration Wizard, or by running the Identikey Server Configuration utility at any time afterwards.
Caution
Changing case conversion after the initial configuration may require modification of all User IDs and domain names in the data store.
2.4
System Clock
The Identikey Server requires that:
Your server’s time is set correctly in relation to GMT, and
The time zone and daylight savings indicators are set correctly.
All machines hosting the Identikey Server component must be very closely clock-synchronized.
Identikey Server Linux Installation Guide
11
Pre-installation Tasks
2.5
Java Web Server
2.6
2.7
Note
This is required for an advanced installation of Identikey Server only. A basic installation will install and set up a Tomcat web server automatically.
To run the Web Administration package you will need a Java Web Server. If you do not have one, it will need to be set up now.
Identikey Server has been tested primarily on Apache Tomcat 5.5.
Serial Number and Maintenance ID
You must have a product Serial Number and a company Maintenance ID unless you are installing an evaluation version of Identikey Server. If these have not been issued to you, contact your VASCO supplier.
License File
Licensing of Identikey Server may be performed before or after installation. If performed before installation of the product, the License file may be uploaded to the data store during the initial configuration. Once a license file is received, copy it to the Identikey Server installation directory – by default /opt/vasco/identikey – to allow the configuration wizard to find it within the chroot environment.
Identikey Server Linux Installation Guide
12
Installation Packages Overview
3 Installation Packages Overview
or 5 for installation instructions.
3.1
Install Packages
The packages included in the distribution are included below, with their dependencies. All packages are optional, but all packages with dependencies must be installed with their dependencies.
Table 1: Packages included in Identikey Server distribution
Package Description
vasco-3rdparty vasco-aal3seal vasco-audit-core vasco-audit-viewer
Provides base C runtime libraries to the
Identikey Server
Provides SEAL library support
Libraries to access Identikey Server auditing data
Allows an auditor to view the auditing data generated by the Identikey Server.
libc6 libc6
Dependencies
vasco-cgi vasco-cgi-config
User management website.
User management website.
vasco-audit-core vasco-3rdparty libstlport5.1
unixodbc2.2.12
libsqlite3-0 libstlport5.1
libxml2
Vasco-cgi vasco-3rdparty vasco-controller vasco-identikey-admin-cmdline vasco-identikey-admin-web
Provides the base AAL2 libraries for the
Identikey Server.
Simple SEAL protocol client for the
Identikey Server vasco-aal3seal tcl8.4
vasco-audit-core libstlport5.1
vasco-controller
Recommends: tomcat5.5
Vasco-identikey-dbutils vasco-identikey-doc
Web based administration for the
Identikey server suite
Provides the database setup tool for the
Identikey server suite.
Provides the documentation for the
Identikey server suite.
unixodbc2.2.12
libstlport5.1
Identikey Server Linux Installation Guide
13
Installation Packages Overview
Package Description Dependencies
vasco-identikey-samples Provides sample digipasses and users for the Identikey server suite.
vasco-identikey-scenario-administration Provides the administration scenario for the Identikey suite.
vasco-identikey-scenario-auditing Provides the auditing scenario for the
Identikey suite.
vasco-identikey-subsystem-storage vasco-identikey-subsystem-storage vasco-identikey-scenario-authentication Provides the authentication scenario for the Identikey suite.
vasco-identikey-scenario-provisioning Provides the provisioning scenario for the
Identikey suite.
vasco-identikey-subsystem-storage vasco-identikey-subsystem-storage vasco-identikey-scenario-replication vasco-identikey-scenario-reporting vasco-identikey-scenario-signature vasco-identikey-server vasco-identikey-server-config-gui
Provides the replication scenario for the
Identikey suite.
Provides the reporting scenario for the
Identikey suite.
vasco-identikey-subsystem-storage vasco-identikey-subsystem-storage
Provides the signature scenario for the
Identikey suite.
The core Identikey server package vasco-identikey-subsystem-storage vasco-audit-core libstlport5.1
openssl, libxml2 unixodbc2.2.12
The gui config tools for Identikey Server vasco-3rdparty vasco-identikey-server vasco-identikey-subsystem-replication Provides the replication subsystem for the
Identikey suite.
vasco-identikey-server vasco-identikey-subsystem-storage vasco-identikey-server vasco-mdc-server vasco-mdc-server-config-gui
Provides the storage subsystem for the
Identikey suite.
This is the server used to by the Identikey
Server to send text messages for Virtual
Digipass. An SMS gateway is required.
GUI configuration tools for the MDC server ibstlport5.1
openssl libxml2 libcurl3 vasco-mdc-server vasco-3rdparty vasco-req-otp-website vasco-self-management-website
User management website.
User management website.
vasco-cgi vasco-cgi
Identikey Server Linux Installation Guide
14
Basic Installation
4 Basic Installation
A basic installation of Identikey Server involves a quick, simple installation and configuration of the package, using standard components and default settings where possible. This installation option is best suited to evaluation, test and low-demand settings. The installation runs in a chroot environment, with selinux enabled.
Note
If you want non-default options and/or components (for example data encryption settings), use the advanced installation. See
for instructions.
Default Components and Configuration
Data store: Embedded PostgreSQL database The default DSN set up is:
DSN: Identikey
User ID: (blank)
Password: (blank)
Identikey Server:
Installation path: /opt/vasco/Identikey/
Licensed scenarios enabled
Master domain: master
User ID & Domain name conversion: Mixed
Data encryption: Standard
Administration Web Interface
Apache web server
Public certificate file: <Identikey Server install dir>/etc/vasco/ikeycerts.pem
Private certificate file: <Identikey Server install dir>/etc/vasco/ikeypvk.pem
Certificate keystore: <Identikey Server install dir>/etc/vasco/keystore.jks
Certificate keystore password: ikwebpassword
Message Delivery Component (Virtual Digipass)
Identikey Server Linux Installation Guide
15
4.1
4.2
Basic Installation
Installation Checklist
Before installing, check that you have:
License file available (alternatively, complete installation and then load a license file via the Administration Web
Interface)
Install Identikey Server
Note
Ensure that you are logged in as a User with sufficient administration privileges on the machine to run the installation and configuration commands required.
1.
Open a command line prompt.
2.
Run install.sh.
3.
Enter basic.
4.
Press Space to scroll through the IK EULA.
5.
Enter yes to agree to the License conditions.
6.
Press Space to scroll through the Java Virtual Machine EULA.
7.
Enter yes to agree to the License conditions.
8.
If required, select an IP address to use for Identikey Server.
Identikey Server will be installed.
Some configuration will be required:
9.
Enter a User ID and password for the first Identikey Server administrator.
10.
In a separate command window, copy the license file to /opt/vasco/identikey .
11.
In the original command window, enter the location – relative to the installation directory – and filename of the license file.
12.
Select the scenarios to be enabled by entering yes when queried on each. Entering no will disable that specific scenario for that IK.
13.
Enter a private key password to be used for the server SSL certificate.
14.
Select a RADIUS topology option.
You will be prompted to enter connection details for the RADIUS Server and/or Client, so that Back-End
Server and/or Client records may be created for them.
15.
Enter RADIUS connection details as required.
A summary of the configuration will be displayed.
Identikey Server Linux Installation Guide
16
Basic Installation
16.
Enter y to accept the configuration options shown.
17.
Enter y to import Digipass records from a file, or n to skip this step.
a.
If you entered y, enter this information:
i
administrator user name
ii
Domain to import to
iii
the location and file name of the Digipass import file
iv
Transport key (for demo Digipass, this will be 11111111111111111111111111111111 – 32 ones)
b.
Enter y to import Digipass records from another import file, or n to finish import.
Identikey Server will be auto-configured and the service started.
Identikey Server Linux Installation Guide
17
Advanced Installation
5 Advanced Installation
An advanced installation of Identikey Server allows complete control over software components to be installed, and the configuration to be completed.
Note
If you wish to have a quick, default install and configuration, run the installation in basic mode.
See
for instructions.
The installation – and the resultant Identikey Server daemon - runs in a chroot environment, with selinux enabled.
Note
The security settings in the chroot environment may impact on the driver for the ODBC database to be used. Check your database documentation for details on using it with selinux.
5.1
Database Decisions
The following checklist contains the key decisions to make before you start.
Database Location and Setup
A number of decisions may be required for the ODBC database to be used:
The server on which the database will be located.
Will the data for the Identikey Server be stored in a new database, or added to an existing database?
Type of database to be used
Will a new schema be used?
New Database
Decide the collation sequence to be used – for example, case-sensitivity and data encryption options.
Database User Accounts
Create or select database user accounts for:
Modifying the database schema (database administrator account required).
Identikey Server (see the Administrator Reference for details on the permissions required).
Identikey Server Linux Installation Guide
18
5.2
5.3
Advanced Installation
Installation Checklist
Before installing, check that you have:
License file available
Java web server available, if you will not be installing the Apache Tomcat server available with the Identikey
Server installation
ODBC-Compliant database (see 5.1
for more information) installed
Start Identikey Server Installation
1.
Open a command line prompt.
2.
Run install.sh
3.
Enter advanced
4.
Press Space to scroll through the Identikey Server EULA
5.
Enter yes to agree to the License conditions
6.
Enter an installation path (default: /opt/vasco/Identikey)
7.
If you wish to use the embedded PostgreSQL database as Identikey Server's data store, enter yes.
If you wish to use another database, enter no.
8.
To install the Identikey Server component on this machine, enter yes.
9.
To install the Administration Web Interface on this machine, enter yes.
10.
To install the OTP Request web site on this machine, enter yes.
11.
To install the User Self Management web site on this machine, enter yes.
12.
To install the Message Delivery Component (used with Virtual Digipass) on this machine, enter yes.
13.
To install the Audit Viewer on this machine, enter yes.
14.
Press Space to scroll through the Java Virtual Machine EULA
15.
Enter yes to agree to the License conditions.
Some initial pre-installation tasks will be performed, then the installation process will pause.
16.
Open a new command prompt to complete the database installation and setup.
Identikey Server Linux Installation Guide
19
5.4
Set Up Database
Advanced Installation
Note
If using the embedded PostgreSQL database, installation and configuration are handled by the installation script. No manual setup is required.
5.4.1
UnixODBC
Note
Note that iODBC is not supported, only unixODBC.
UnixODBC will be installed with Identikey Server. Additional steps must be followed to fully set up your database to work with Identikey Server. More specific instructions are included for PostgreSQL 8.2, Oracle 10g, IBM DB2 9.1 and Sybase Adaptive Server Anywhere 11.0. For other products, follow the generic instructions below:
5.4.2
Acquire and install ODBC driver for the Database
Any ODBC driver used must be Unicode compliant and use 2-byte SQLWCHAR and 8-byte SQLLEN for 64-bit systems. Identikey Server has been tested with the ODBC drivers provided by Oracle, IBM and Sybase in their database systems.
Install the ODBC driver to the Identikey Server chroot environment.
5.4.3
Create an ODBC Data Source
Create the Data Source as required for your database. Follow the instructions provided by the database vendor.
Guidelines are given below for the databases that have been specifically tested.
5.4.4
License File
Copy the Identikey Server license file to the Identikey Server installation directory.
Identikey Server Linux Installation Guide
20
Advanced Installation
5.4.5
SSL Certificate
If you have a commercial SSL certificate that you wish to use with Identikey Server, copy the certificate and the trusted certificate file to the Identikey Server installation directory.
5.4.6
Digipass Record Import File
If you wish to import Digipass records during the initial configuration, copy the .dpx file to the Identikey Server installation directory.
Identikey Server Linux Installation Guide
21
Advanced Installation
5.4.7
ODBC Setup for PostgreSQL
When manually setting up a PostgreSQL database for Identikey Server, use the following information as a guide.
No environment variables are required.
ODBC Driver
Most PostgreSQL ODBC drivers provided by Linux distributions and on www.postgresql.org
use 4-byte
SQLWCHAR. However, the one in the Identikey Server CD has been re-built using 2-byte SQLWCHAR. If you are not using the PostgreSQL database provided with Identikey Server, extract the Identikey Server version of the
ODBC driver psqlodbcw.so
from vasco-postgresql-8.2-i386.tgz for 32-bit systems, and vasco-postgresql-8.2amd64.tgz for 64-bit systems, and replace the version of this file found in /usr/lib or /usr/lib64 with the one extracted.
To build both the 32-bit and 64-bit version of PSQLODBC, remove the following line from config.h:
#define SQL_WCHART_CONVERT
For 64 bit UNIXODBC, add the following two lines to sqltypes.h :
#define HAVE_LONG_LONG
#define BUILD_REAL_64_BIT_MODE
Note
The PostgreSQL ODBC driver uses the OpenSSL library to encrypt or hash credentials used to connect to the database. A compatibility issue may occur if your system has a version of
OpenSSL prior to 0.9.8b when connecting to a PostgreSQL database that requires MD5 or other non-plaintext password authentication.
1.
To register the driver and setup libraries, add the following lines to /etc/odbcinst.ini
:
[PostgreSQL Unicode]
Description = PostgreSQL Unicode
Driver = /usr/lib/psqlodbcw.so
Setup = /usr/lib/psqlodbcw.la
Threading = 0
2.
To configure the database as a data source using the PostgreSQL Unicode driver registered above, add the following lines to /etc/odbc.ini:
[ODBC Data Sources]
Identikey-DataSrc = Identikey Server database
[Identikey-DataSrc]
Identikey Server Linux Installation Guide
22
Advanced Installation
Driver = PostgreSQL Unicode
Description = Identikey Server database
Servername = <IP address>
Port = <port>
Protocol = 6.4
UserName =
Password =
Database = <database name>
ReadOnly = No
RowVersioning = No
ShowSystemTables = No
FakeOidColumn = No
FakeOidIndex = No
ConnSettings =
Trace = No where
<IP address> is the address of the machine on which the database is installed, <port> is the port number on which the database listens for connection requests, and <database name> is the name configured for the database.
Identikey Server Linux Installation Guide
23
Advanced Installation
5.4.8
ODBC Setup for Sybase Adaptive Server Anywhere 11.0
To set up Sybase for use with Identikey Server, base your setup on the following example. This applies to Sybase
Adaptive Server Anywhere 11.0 on 32-bit Linux.
1.
Set the following environment variables:
Environment
Variable
Description Possible Contents
<various>
ODBCINI
ODBCINST
A number of environment variables are set by the sa_config.sh script that is created during installation and setup of Sybase. That script should be run to set the necessary variables. It is located in the Sybase bin directory, eg.
/opt/sqlanywhere11/bin32/sa_config.sh
Add the line
/opt/sqlanywhere11/bin32/sa_config.sh
to
/etc/profile
ODBC.INI file path/name.
ODBCINST.INI file path/name.
<various>
/etc/odbc.ini
/etc/odbcinst.ini
2.
To register the driver and setup libraries, add the following lines to /etc/odbcinst.ini
:
[ODBC Drivers]
Sybase=Installed
[ODBC]
Trace=No
TraceFile=/var/log.log
[Sybase]
Driver=/opt/sqlanywhere11/lib32/libdbodbc11.so
Threading = 0
3.
To configure the database as a data source using the Sybase driver registered above, add the following lines to
/etc/odbc.ini:
[ODBC Data Sources]
Identikey-DataSrc=Sybase
[Identikey-DataSrc]
Driver=Sybase
ServerName=<server name>
Identikey Server Linux Installation Guide
24
Advanced Installation
DatabaseFile=<database file>
StartLine=
AutoStart=No
AutoStop=No
Description=SQL Anywhere 11.0
CommLinks=tcpip(IP=<IP address>;PORT=<port>)
LogFile=/var/anywhere.log
where <server name> is the Server Name configured in Sybase, <database file> is the location of the Sybase database file,
<IP address> is the IP address of the database server, and <port> is the port on which the database server listens for connection requests (default: 2638). See your Sybase documentation for further information on these variables.
Identikey Server Linux Installation Guide
25
Advanced Installation
5.4.9
ODBC Setup for Oracle 10g
To set up Oracle for Identikey Server, use the following as a guide.
1.
Create a file /etc/tnsnames.ora
which contains:
ORAC =
(DESCRIPTION =
(ADDRESS_LIST =
(ADDRESS = (PROTOCOL = TCP)(HOST = <IP address>)(PORT =
<Port>))
)
(CONNECT_DATA =
(SERVICE_NAME = IDENTIKEY)
)
) where <IP address> is the address of the database server, and <Port> is the port on which database connections should be made (default 1521).
2.
Add the following line to /etc/ld.so.conf
:
/usr/lib/oracle/xe/app/oracle/product/10.2.0/client/lib
3.
Add the following environment variables:
Environment
Variable
Description Possible Contents
TNS_ADMIN
LD_LIBRARY_PATH
ORACLE_SID
ORACLE_BASE
ODBC
ODBCINST
Shared library load path.
/etc
<Oracle installation path>/product/<version>/client_1/lib
<Oracle database SID> (specified during installation of database)
ODBC.INI file path/name.
<Oracle installation path> (typically /u01/app/oracle)
/etc/odbc.ini
ODBCINST.INI file path/name. /etc/odbcinst.ini
4.
To register the driver and setup libraries, add the following lines to /etc/odbcinst.ini
:
[ODBC Drivers]
Oracle 10g ODBC driver = Installed
[ODBC]
Trace=No
Identikey Server Linux Installation Guide
26
Advanced Installation
TraceFile=/var/anywhere.log
[Oracle 10g ODBC driver]
Description = Oracle ODBC driver for Oracle 10g
Driver = <driver location>
Setup =
FileUsage =
CPTimeout =
CPReuse =
Threading = 0 where
<driver location> is the path to the ODBC driver for the database. For Oracle 10g, this will be typically be /usr/lib/oracle/xe/app/oracle/product/10.2.0/client/lib/libsqora.so.10.1
.
5.
To configure the database as a data source using the Oracle driver registered above, add the following lines to /etc/odbc.ini:
[ODBC Data Sources]
Identikey-DataSrc=DataDirect 5.3 Oracle Wire Protocol
[Identikey-DataSrc]
Driver=<driver location>
Description=DataDirect 5.3 Oracle Wire Protocol
AlternateServers=
ApplicationUsingThreads=1
ArraySize=60000
AuthenticationMethod=1
CachedCursorLimit=32
CachedDescLimit=0
CatalogIncludesSynonyms=1
CatalogOptions=0
ConnectionRetryCount=0
ConnectionRetryDelay=3
DefaultLongDataBuffLen=1024
DescribeAtPrepare=0
EnableDescribeParam=0
EnableNcharSupport=0
Identikey Server Linux Installation Guide
27
Advanced Installation
EnableScrollableCursors=1
EnableStaticCursorsForLongData=0
EnableTimestampWithTimeZone=0
EncryptionMethod=0
GSSClient=native
HostName=<IP address>
HostNameInCertificate=
KeyPassword=
KeyStore=
LoadBalancing=0
LocalTimeZoneOffset=
LockTimeOut=-1
LogonID=
Password=
PortNumber=<Port>
ProcedureRetResults=0
ReportCodePageConversionErrors=0
ReportRecycleBin=0
ServerName=<Oracle Server Name>
ServerType=0
ServiceName=<Identikey Service Name>
SID=<Oracle Database SID>
TimestampeEscapeMapping=0
TNSNamesFile=/etc/tnsnames.ora
TrustStore=
TrustStorePassword=
UseCurrentSchema=1
ValidateServerCertificate=1
WireProtocolMode=1 where <IP address> is the address of the database server, <Port> is the port on which the database listens for connection requests, <driver location> is the path to the ODBC driver for the database, <Oracle Server
Name> is the configured name for the Oracle server, <Oracle Database SID> is the configured SID for the
Oracle database and <Identikey Service Name> is the name of the Identikey service. For Oracle 10g, this will be typically be /usr/lib/oracle/xe/app/oracle/product/10.2.0/client/lib/libsqora.so.10.1
.
Identikey Server Linux Installation Guide
28
Advanced Installation
5.4.10 ODBC Setup for IBM DB2 9.1
To set up DB2 for Identikey Server, use the instructions below as a guide.
1.
Extract/install DB2 client libraries.
2.
As root, enter the following commands: groupadd db2das groupadd db2admin groupadd db2fence useradd db2das -m -d /home/db2das db2das useradd db2admin -m -d /home/db2admin db2admin useradd db2fence -m -d /home/db2fence db2fence passwd db2admin cd /opt/ibm/db2/V9.1/instance
./db2icrt -a server -u db2fence db2admin
3.
Enter the following commands to source the db2admin profile: cd /home/db2admin/sqllib
../db2profile
4.
As user db2admin, enter the following commands: db2 catalog tcpip node dbnode remote <IP address> server 50000 catalog database <database name> at node <database node> connect <database name> user <User ID>
5.
To register the driver and setup libraries, add the following lines to /etc/odbcinst.ini
:
[ODBC]
Trace=No
TraceFile=/var/db2.log
[DB2]
Driver=/opt/ibm/db2/....../libdb2.so
Description=DB2 ODBC Driver
Fileusage=1
Dontdlclose=1
Threading=0
Identikey Server Linux Installation Guide
29
Advanced Installation
6.
To configure the database as a data source using the DB2 driver registered above, add the following lines to
/etc/odbc.ini:
[ODBC Data Sources]
Identikey-DataSrc=IBM DB2 ODBC DRIVER
[Identikey-DataSrc]
Driver=DB2
Description=DBNAME DB2 ODBC DRIVER
7.
Set the following environment variables:
Possible Contents Environment
Variable
ODBC
ODBCINST
DB2INSTANCE
Description
ODBC.INI file path/name.
ODBCINST.INI file path/name.
DB2 instance name.
/etc/odbc.ini
/etc/odbcinst.ini
db2admin
Note
Please note that when setting up a DB2 database the page size should be set to at least 8192k.
A smaller page size will create an error when Identikey Server attempts to connect to the database.
Identikey Server Linux Installation Guide
30
5.5
Advanced Installation
Continue Identikey Server Installation
1.
Return to the original Identikey Server installation command prompt.
2.
Enter yes .
This will enter the Identikey Server chroot environment.
Finish Database Setup
3.
Add any environmental variables required for the database connection in the /etc/profile file.
4.
Copy /opt/vasco/Identikey/etc/odbc.ini
to <IK installation directory>/root/.odbc.ini
.
Test Database
5.
Enter the following command to test the database connection: isql <DSN> <username> <password> where <DSN> is the Data Source Name set up earlier in the Database Setup stage – our instructions used a
DSN of Identikey-Data – and <username> and <password> are the User ID and password for a database administrator account.
If the database connection attempt is not successful, an error message will be displayed – check the setup instructions above to ensure all necessary steps have been followed.
Modify Database Schema
6.
To set up the required schema in the database to be used for Identikey Server, enter the following command:
/usr/sbin/dpdbadmin addschema –u <username> –p <password> -d <DSN> where <DSN> is the Data Source Name set up earlier in the Database Setup stage (our instructions used a
DSN of Identikey-Data ), < username> is the User Name for a database administrator with schema modification privileges, and <password> is the password for that administrator account.
If you want to specify your own Master Domain name and/or lower or upper case conversion for User IDs and
Domain names, specify the -domain and/or -case options.
For further details on DPDBADMIN, see 9
.
Permissions
7.
If the database user account used by the Identikey Server is not the owner of the tables and is not a database administrator account, it must be granted permissions for the tables, or ownership of the tables transferred.
See your database documentation for information on how to do this. The modifications to the database permissions should be made using a separate command prompt.
Identikey Server Linux Installation Guide
31
Advanced Installation
Note
Ensure that it is possible for the account(s) mentioned to reference the tables by name without a schema prefix. If this cannot be done, see the Administrator Reference for advanced setup instructions.
8.
Enter the following command in the original Identikey Server installation command prompt: exit
The installation program will ask if you wish to proceed with the Identikey Server installation.
9.
Enter yes .
Identikey Server and other selected components will be installed.
10.
Enter DSN, database administrator User ID and password for the database that Identikey Server will use as its data store.
11.
If required, select an IP address to use for Identikey Server.
12.
Enter a name for the Master Domain, or hit enter to use the default name of master .
13.
Select a User ID and Domain name conversion option
14.
Enter a User ID and password for the first Identikey Server administrator. This gives you an initial login, to allow User import and creation.
15.
Select data encryption option(s)
16.
Enter the location and filename of the Identikey Server license file – this must be relative to
/opt/vasco/identikey .
17.
Select the scenarios to be enabled by entering yes when queried on each. Entering no will disable that specific scenario for that Identikey Server.
18.
Enter 1 to generate and install a new test SSL certificate, or 2 to install your own commercial SSL certificate.
If you enter 1 :
a.
Enter a private key password to be used for the new SSL certificate.
If you enter 2 :
a.
Enter the path and filename for the SSL certificate.
b.
Enter a private key password to be used for the SSL certificate.
c.
Enter the path and filename for the trusted certificate file.
d.
Enter the password for the trusted certificate file.
e.
Enter y to proceed.
19.
Enter the IP address for an Administration Web Interface, if available. If you are installing the Administration
Web Interface on the current machine, enter the IP address of the current machine. This will create a client
Component record with the type Administration Client in the data store.
Identikey Server Linux Installation Guide
32
Advanced Installation
20.
If the Identikey Server SDK Sample Web Client has been installed, enter the IP address of that machine. A client Component record will be created for the machine.
A summary of the configuration will be displayed.
21.
Enter y to accept the configuration options shown.
Identikey Server will be configured and the daemon started.
Identikey Server Linux Installation Guide
33
Advanced Installation
5.6
Identikey Server Configuration File
When Identikey Server has been configured the settings are stored in the configuration file.
<?xml version="1.0" ?>
<Server-Location type=" string" data="10.2.10.100" />
</Server-Config>
<ProductInfo />
<Trace-Header type="
unsigned" data="47" />
<Trace-Mask type=" unsigned" data="0x3FFFFFFF" />
<Trace-File type="
string" data="/var/vasco/identikey/ikeyserver.trace" />
</Tracing>
<Storage-Key type="
string" data="" />
<Cipher-Name type=" string" data="des_ede" />
<Cipher-Module type=" string" data="" />
<Enable-Engine type="
bool" data="false" />
<Engine-Module type=" string" data="" />
<Engine-Parameters />
</Encryption>
<Storage-Engine type="
string" data="ODBC" />
<Library-Path type=" string" data="/usr/lib/libikstorageodbc.so" />
<Load-Balancing type="
bool" data="false" />
<Connection-Timeout type=" unsigned" data="5000" />
<Max-Age type="
unsigned" data="900" />
<Max-Size type="
unsigned" data="200" />
<Clean-Threshold type="
unsigned" data="100" />
<Min-Clean-Interval type=" unsigned" data="60" />
</Domain-Cache>
<Display-Name type="
string" data="Identikey Server" />
<DSN type=" string" data="identikey server" />
<Username type="
string" data="digipass" />
<Password type="
string" data="hXRzkAU8HIsQpKpelZwAT4k=" />
<Control-Table type="
string" data="vdsControl" />
<Min-Reconnect-Interval type="
unsigned" data="0" />
<Max-Reconnect-Interval type=" unsigned" data="10" />
</Data-Source00>
</Data-Sources>
</ODBC>
Identikey Server Linux Installation Guide
34
Advanced Installation
</Storage>
<MDC-IP type=" string" data="127.0.0.1" />
<MDC-Port type="
unsigned" data="20007" />
</VDPClient>
<Library-Path type="
string" data="/usr/lib/libikreplication.so" />
<Enabled type=" bool" data="false" />
<Repl-Server type=" string" data="10.2.10.100" />
<Allow-Loopback type="
bool" data="true" />
<Connection-Timeout type=" unsigned" data="60" />
<Min-Reconnect-Interval type="
unsigned" data="1" />
<Max-Reconnect-Interval type=" unsigned" data="60" />
<Dead-Item-Cleanup-Threshold type="
unsigned" data="60" />
<Queue>
<File-Path type=" string" data="/var/vasco/repldata/" />
<Max-Retry-Count type="
unsigned" data="3" />
<Retry-Interval type=" unsigned" data="60" />
<Max-File-Size type="
unsigned" data="100" />
</Queue>
<Server-List />
</Replication>
<Audit>
<Libraries>
<ODBC type="
string" data="/usr/lib/libdpauditodbc.so" />
<live type=" string" data="/usr/lib/libdpauditlive.so" />
</Libraries>
<Plugins>
<Profile00>
<Enabled type="
bool" data="true" />
<Type type="
string" data="utf8file" />
<Display-Name type=" string" data="Text File" />
<Fail-On-Error type="
bool" data="false" />
<Unhandled-Only type=" bool" data="false" />
<Error type="
bool" data="true" />
<Warning type=" bool" data="true" />
<Info type=" bool" data="true" />
<Success type="
bool" data="true" />
<Failure type=" bool" data="true" />
<Plugincfg>
<Log-File type="
string" data="/var/vasco/identikey/ikeyserver{year}{month}.audit" />
<Keep-Open type="
bool" data="true" />
<Use-GMT type="
bool" data="false" />
<Allow-Newlines type=" bool" data="false" />
</Plugincfg>
</Profile00>
<Profile01>
Identikey Server Linux Installation Guide
35
<Enabled type=" bool" data="true" />
<Type type="
string" data="syslog" />
<Display-Name type=" string" data="Linux Syslog (errors only)" />
<Fail-On-Error type="
bool" data="false" />
<Unhandled-Only type=" bool" data="false" />
<Error type="
bool" data="true" />
<Warning type="
bool" data="false" />
<Info type="
bool" data="false" />
<Success type="
bool" data="false" />
<Failure type=" bool" data="false" />
<Plugincfg>
<Syslog-Facility type=" string" data="local0" />
</Plugincfg>
</Profile01>
<Profile02>
<Enabled type="
bool" data="true" />
<Type type="
string" data="syslog" />
<Display-Name type=" string" data="Linux Syslog (fall-back)" />
<Fail-On-Error type="
bool" data="true" />
<Unhandled-Only type=" bool" data="true" />
<Error type="
bool" data="true" />
<Warning type="
bool" data="true" />
<Info type=" bool" data="true" />
<Success type="
bool" data="true" />
<Failure type=" bool" data="true" />
<Plugincfg>
<Syslog-Facility type="
string" data="local0" />
</Plugincfg>
</Profile02>
<Profile03>
<Enabled type=" bool" data="true" />
<Type type="
string" data="live" />
<Display-Name type=" string" data="Live Audit Viewer" />
<Fail-On-Error type="
bool" data="false" />
<Unhandled-Only type=" bool" data="false" />
<Error type="
bool" data="true" />
<Warning type="
bool" data="true" />
<Info type=" bool" data="true" />
<Success type="
bool" data="true" />
<Failure type=" bool" data="true" />
<Plugincfg>
<IP-Address type="
string" data="10.2.10.100" />
<Server-Port type=" unsigned" data="20006" />
<Auth-Timeout type="
unsigned" data="60" />
<Max-Connections type=" unsigned" data="3" />
</Plugincfg>
</Profile03>
Identikey Server Linux Installation Guide
Advanced Installation
36
<Profile04>
<Display-Name type="
string" data="odbc" />
<Type type=" string" data="odbc" />
<Fail-On-Error type="
bool" data="false" />
<Unhandled-Only type="
bool" data="false" />
<Error type="
bool" data="true" />
<Warning type="
bool" data="true" />
<Info type=" bool" data="true" />
<Success type="
bool" data="true" />
<Failure type=" bool" data="true" />
<Plugincfg>
<DSN type="
string" data="identikey server" />
<Username type=" string" data="digipass" />
<Password type="
string" data="vSMkx1JrS9xHUfpvDctsd_Y=" />
</Plugincfg>
<Enabled type="
bool" data="true" />
</Profile04>
</Plugins>
</Audit>
<Component-Cache>
<Max-Age type=" unsigned" data="900" />
<Max-Size type="
unsigned" data="1000" />
<Clean-Threshold type=" unsigned" data="800" />
<Min-Clean-Interval type="
unsigned" data="60" />
</Component-Cache>
<Policy-Cache>
<Max-Age type="
unsigned" data="900" />
<Max-Size type=" unsigned" data="200" />
<Clean-Threshold type=" unsigned" data="100" />
<Min-Clean-Interval type="
unsigned" data="60" />
</Policy-Cache>
<Challenge-Cache>
<Max-Age type="
unsigned" data="60" />
<Max-Size type=" unsigned" data="1200" />
<Clean-Threshold type="
unsigned" data="1000" />
<Min-Clean-Interval type=" unsigned" data="5" />
</Challenge-Cache>
<BackEnd-Cache>
<Max-Age type=" unsigned" data="900" />
<Max-Size type="
unsigned" data="200" />
<Clean-Threshold type=" unsigned" data="100" />
<Min-Clean-Interval type="
unsigned" data="60" />
</BackEnd-Cache>
<DPX-Cache>
<Max-Age type="
unsigned" data="86400" />
<Max-Size type=" unsigned" data="200" />
<Clean-Threshold type="
unsigned" data="100" />
Identikey Server Linux Installation Guide
Advanced Installation
37
Advanced Installation
<Min-Clean-Interval type=" unsigned" data="60" />
</DPX-Cache>
<Admin-Session-Cache>
<Max-Concurrent-Sessions type="
unsigned" data="10" />
<Max-Session-Time type="
unsigned" data="86400" />
<Session-Timeout type=" unsigned" data="3600" />
</Admin-Session-Cache>
<Report-Cache>
<Max-Age type=" unsigned" data="86400" />
<Max-Size type="
unsigned" data="400" />
<Clean-Threshold type=" unsigned" data="100" />
<Min-Clean-Interval type="
unsigned" data="60" />
</Report-Cache>
<Task-Manager>
<Max-Workers type="
unsigned" data="30" />
</Task-Manager>
<BackEndAuthenticators>
<RADIUS>
<Enabled type=" bool" data="true" />
<Library-Path type="
string" data="/usr/lib/libikcommradius.so" />
</RADIUS>
<Engines />
</BackEndAuthenticators>
<Communicators>
<SealCommunicator>
<Enabled type="
bool" data="false" />
<Library-Path type=" string" data="/usr/lib/libikcommseal.so" />
<IP-Address type="
string" data="10.2.10.100" />
<IP-Port type="
unsigned" data="20003" />
<Require-Client-Component type=" bool" data="false" />
</SealCommunicator>
<SoapCommunicator>
<Enabled type=" bool" data="true" />
<Library-Path type="
string" data="/usr/lib/libikcommsoap.so" />
<DPX-Upload-Location type=" string" data="/usr/share/vasco/identikey/dpx/" />
<IP-Port type="
unsigned" data="8888" />
<SSL>
<Enabled type="
bool" data="false" />
<Server-Certificate type="
string" data="/etc/vasco/ikeypvk.pem" />
<Private-Key-Password type=" string" data="LOeH9$Q5YOa0" />
<CA-Certificate-Store type="
string" data="/etc/vasco/ikeycerts.pem" />
<Client-Authentication-Method type=" string" data="none" />
<Reverify-Client-On-Reconnect type="
bool" data="false" />
</SSL>
</SoapCommunicator>
<RadiusCommunicator>
<Enabled type="
bool" data="true" />
Identikey Server Linux Installation Guide
38
<Library-Path type=" string" data="/usr/lib/libikcommradius.so" />
<Authentication-Port type="
string" data="1812" />
<Accounting-Port type=" string" data="1813" />
<Request-Cache>
<Max-Age type="
unsigned" data="5" />
<Max-Size type="
unsigned" data="0" />
<Clean-Threshold type="
unsigned" data="200" />
<Min-Clean-Interval type=" unsigned" data="30" />
</Request-Cache>
<Proxy-Cache>
<Max-Age type=" unsigned" data="99999999" />
<Max-Size type="
unsigned" data="0" />
<Clean-Threshold type=" unsigned" data="200" />
<Min-Clean-Interval type="
unsigned" data="30" />
</Proxy-Cache>
</RadiusCommunicator>
</Communicators>
<Scenarios>
<ScenarioModule00>
<Enabled type="
bool" data="true" />
<Display-Name type=" string" data="Authentication Scenario" />
<Library-Path type="
string" data="/usr/lib/libikscenauth.so" />
</ScenarioModule00>
<ScenarioModule01>
<Enabled type="
bool" data="true" />
<Display-Name type=" string" data="Signature Validation Scenario" />
<Library-Path type="
string" data="/usr/lib/libikscensign.so" />
</ScenarioModule01>
<ScenarioModule02>
<Enabled type="
bool" data="true" />
<Display-Name type="
string" data="Provisioning Scenario" />
<Library-Path type="
string" data="/usr/lib/libikscenprovision.so" />
<Reactivation>
<Min-Time-Before-Reactivation type=" unsigned" data="1440" />
<Max-Nbr-Attempts type="
unsigned" data="3" />
<Max-Nbr-Locations type=" unsigned" data="5" />
</Reactivation>
</ScenarioModule02>
<ScenarioModule03>
<Enabled type="
bool" data="true" />
<Display-Name type="
string" data="Administration Scenario" />
<Library-Path type=" string" data="/usr/lib/libikscenadmin.so" />
</ScenarioModule03>
<ScenarioModule04>
<Enabled type=" bool" data="true" />
<Display-Name type="
string" data="Reporting Scenario" />
<Library-Path type=" string" data="/usr/lib/libikscenreport.so" />
Identikey Server Linux Installation Guide
Advanced Installation
39
Advanced Installation
<Report-Location type=" string" data="/usr/share/vasco/identikey/reports/" />
<Audit>
<Plug-ins>
<Plugin01 type="
string" data="/usr/lib/libdpauditodbc.so" />
</Plug-ins>
<Source type=" string" data="utf8file" />
<ODBC>
<Username type=" string" data="test" />
<Password type=" string" data="O9jfPKmQsCe8TkQkdQ1H8Zs=" />
<DSN type="
string" data="postgres" />
</ODBC>
<UTF8>
<Path type="
string" data="/var/vasco/identikey/" />
<Extension type=" string" data=".audit" />
</UTF8>
</Audit>
</ScenarioModule04>
<ScenarioModule05>
<Enabled type=" bool" data="true" />
<Display-Name type="
string" data="Audit Scenario" />
<Library-Path type="
string" data="/usr/lib/libikscenaudit.so" />
</ScenarioModule05>
<ScenarioModule06>
<Enabled type=" bool" data="true" />
<Display-Name type=" string" data="Replication Scenario" />
<Library-Path type="
string" data="/usr/lib/libikscenrepl.so" />
</ScenarioModule06>
</Scenarios>
</VASCO>
Identikey Server Linux Installation Guide
40
6 Configuration
Configuration
6.1
Run an Identikey Server Configuration Tool
To configure the Identikey Server once the initial installation and configuration has been completed, enter the chroot environment by entering the following command: vds_chroot <IK install directory> /bin/bash
Then enter one of the following commands:
Configuration Wizard, command-line version
ikconfigwizardconsole
Configuration Wizard, GUI version
ikconfigwizardgui
Configuration GUI
ikconfigutilgui
Web Administration Setup Tool 6.2
6.2.1
Overview
The Web Administration Setup Tool is a Java application that allows the set up and configuration of the
Administration Web Interface. The Web Administration Setup Tool is used for managing SSL certificates as well as
Identikey Servers to which the Web Administration application can connect. The Web Administration Setup Tool requires a Java Runtime Environment.
The information created using the Web Administration Setup Tool can be viewed via the Web Administration application. Any changes made using the Web Administration Setup Tool will not be reflected in the Web
Administration application until the Web Administration application is restarted.
The Web Administration Setup Tool stores its information using the Java preferences API. Under Windows it uses the Windows registry.
Identikey Server Linux Installation Guide
41
6.2.2
Running the Application
Configuration
Note
The vds_chroot command will enter you into the chroot environment. This is necessary for all
Setup Tool commands.
To exit the chroot environment, enter: exit
6.2.3
Available Commands
The commands should be in the following format: java -jar admintool.jar <command> [options]
The following commands are available:
Setup Tool Command
autoadd <name> <url> <certificate archive> <password> <connection limit>
<connection timeout> server list server add <name> <url>
<connection_timeout> <connection limit> server delete <name> server default <name> server localaddress <name> <local address> certificate list certificate list <certificate archive>
<passphrase> certificate add <certificate archive>
<passphrase> <certificate file> <name> certificate delete <certificate archive>
<passphrase> <name>
Explanation
Creates a new Identikey Server connection for the Administration Web
Interface.
If a certificate archive and password is specified, the Identikey Server's SSL certificate will be added to it. If no certificate archive is specified, it will be added to the existing keystore.
A connection limit (number of concurrent connections to allow) and connection timeout may also be specified.
List the available Identikey SOAP servers
Add a new Identikey Server connection.
A connection limit (number of concurrent connections to allow) and connection timeout may also be specified.
Remove an existing Identikey Server
Set the specified Identikey SOAP server as the default
Specify a local IP address to specify when connecting to the provided server name.
Displays the list of certificate alias which are in the used certificate archive
Displays the list of certificate alias which are in the specifiedcertificate archive (opened using the specified passphrase)
Installs the certificate into an existing or new certificate archive using the provided passphrase and alias the certificate using the provided name.
Removes the certificate with the specified alias from the provided
Identikey Server Linux Installation Guide
42
Setup Tool Command
certificate delete <certificate archive>
<passphrase> autoadd <name> <url> <certificate archive> <passphrase>
6.2.4
Command Usage Examples
Configuration
Explanation
Removes the certificate with the default alias "IdentikeyServer" certificate archive using the provided password.
Combines the functionality of the server add and certificate add commands and automates the retrieval of the certificate from the Identikey Server.
6.2.4.1 Adding an Identikey Server
To add an Identikey Server, navigate to the i<install dir>\webadmin directory and then run the command java -jar admintool.jar autoadd new_server https://10.2.1.1:8888
This command will create a new Identikey Server record which will be displayed in the Web Administration application using the name “new_server” and will connect to the Identikey SOAP communicator using http
(inherent to SOAP) at address 10.2.1.1 using port 8888 (as configured for the identikey server).
NOTE
Protocol strings must be provided (http or https for SSL connections).
You can verify that this server has been created by running the following command: java -jar admintool.jar server list which will display the current list of servers.
NOTE
The server name and url are considered to be unique. Attempting to add another server with a different name and the same url will fail (adding a server with the same name and different url will overwrite the existing server's entry)
6.2.4.2 Adding a certificate
To connect to an Identikey Server which is using an SSL connection we must add the server's certificate to the
Web Administration application's certificate archive. The certificate used by the Identikey Server is usually created with the filename “ikeycerts.pem” and located in :
<install dir>\bin
Identikey Server Linux Installation Guide
43
Configuration
6.3
To add this certificate to the Web Administration application's certificate archive, run the following command: java -jar admintool.jar autoadd new_server webadmin.jks ourPassword \etc\vasco\ikeycerts.pem
where the webadmin.jks is the Web Administration application's keystore filename and ourPassword is the password we use to make sure that no-one can simply add another certificate to our Web Administration application's certificate archive.
Once this certificate has been added we can connect to the Identikey Server.
NOTE
Make sure that the connection url to the server is updated (https is used as opposed to http).
All other commands provided are extensions of these two basic commands.
Deploy Web Administration Interface
The Web Administration Interface is provided as a .war (web archive) file, webadmin.war. This web application must be deployed in a Java web application server before it can be used.
To deploy the Web Administration interface you must:
1.
Have a Java Web Application Server. Identikey Server has primarily been tested with Apache Tomcat.
2.
Make sure the Java Web Application Server is running successfully.
3.
Enter the chroot environment: vds_chroot <install dir> /bin/bash
4.
Configure the application with the location of the Identikey Server. This is done using the admintool.jar program.
java -jar admintool.jar server add my_server https://127.0.0.1:8888
5.
If the machine on which the Web Administration Interface has been installed has more than one IP address, you must ensure that the same source IP address is used each time a connection to the server is made. The command to enforce this is server localaddress <name> <local address>
6.
Set up SSL for the SOAP connection to the Identikey Server.
a.
If the Web Administration is not on the same machine as the Identikey Server, copy the ikeycerts.pem file from the Identikey Server machine (located in /etc/vasco ) to a directory accessible to the Web
Administration Interface.
b.
Run the following command: java -jar admintool.jar certificate add <certificate archive> <password>
<certificate file>
c.
Where <password> should be replaced with a password of your choice. This command will create an
SSL certificate key store for the Web Administration Interface.
Identikey Server Linux Installation Guide
44
Configuration
7.
Deploy the Web Administration Interface application.
The instructions below are for deploying the Web Administration Interface with Apache Tomcat.
6.3.1
Deploy Web Administration Interface Using Apache Tomcat Server
1.
If your Tomcat installation does not have an administrator account set up yet, create one:
a.
Open the file tomcat-users.xml
in the Tomcat conf directory.
b.
Add the following lines into this file and save the changes:
<role rolename="manager"/>
<role rolename="admin"/>
<user username="admin" password="" roles="admin,manager"/>
2.
If the JAVA_HOME environment variable is not set for the user starting Tomcat, set it to the Java home directory in that user's profile or in the Tomcat startup script. Ensure that the JAVA_HOME, PATH and
CLASSPATH environment variables are set so that they refer to the correct JRE version, if more than one JRE version exists on the machine.
3.
If you have not restarted the machine since installing, the Tomcat service may need to be started manually:
a.
Go to the Apache Tomcat directory and enter
./bin/catalina.sh start
4.
Open a browser at http://localhost:<port on which the web application server is listening> . Typically the port number will be 8080 .
The Tomcat introduction page should be displayed.
5.
Click on Tomcat Manager.
The Tomcat Manager login window will be displayed.
6.
Log in using admin as your username and a blank password (unless you have changed the default administration credentials).
The Tomcat Web Application Manager will be opened.
7.
Scroll down to the WAR file to deploy section.
8.
Click on the Browse button.
9.
Find and select the webadmin.war file – typically in /usr/share/vasco
10.
Click on Open.
11.
Click on Deploy.
12.
An entry titled /webadmin should appear in the Applications list.
13.
Restart the Apache Tomcat service:
a.
Go to the Apache Tomcat directory and enter
./bin/catalina.sh start
Identikey Server Linux Installation Guide
45
Configuration
14.
Go back to the browser window.
15.
Click on the new /webadmin entry.
The Web Administration Interface login screen should be displayed.
16.
Log in using the username and password entered in the Configuration Wizard.
6.3.2
Upload Limit
An upload limit of 5 megabytes has been set in the Web Administration Interface for user or DPX import files.
To change this value:
1.
Navigate to the Tomcat installation directory.
2.
Navigate to the Tomcat/webapps/webadmin/WEB-INF/classes directory
3.
Double-click the struts.properties file and edit the struts.multipart.maxSize value:
#set max upload size to 5 meg struts. multipart.maxSize=52428800
Identikey Server Linux Installation Guide
46
7 Post-Installation Tasks
Post-Installation Tasks
7.1
Licensing
Each Identikey Server will require a license key to be loaded into its Server record – even if you are using an evaluation license. If this is not completed during the install process, it will need to be done before the Identikey
Server can be used for authentication, signature validation or provisioning. Refer to the Licensing section of the
Administration Reference for instructions.
7.1.1
Evaluation Serial Number
If you do not obtain a license key file during installation of the Identikey Server, but wish to use an evaluation license, you will need to use this serial number on the VASCO licensing site: 2FC4FF0E1E .
7.2
7.3
Backup Strategy
Consider a backup strategy to be put in place for files which will require backing up. For more information, see the
Backup and Recovery section of the Administrator Reference.
Audit Settings
Configure how and when the Identikey Server will record audit messages.
7.3.1
Text File
If auditing to a text file, you will need to decide how often a new text file should be created. By default, a new text file is created monthly. To change this frequency, modify the variables used in the file name. For example, if the
Identikey Server is configured to write to a text file set to IdentikeyServer-{year}-{month}.audit
, a new text file will be created monthly. If the text file name is set to IdentikeyServer-{year}-{month}-{mday}.audit
, a new text file will be created daily.
For more information, see the Auditing section of the Administrator Reference.
Identikey Server Linux Installation Guide
47
Post-Installation Tasks
7.3.2
Syslog
Auditing can be set up to write to the Syslog. Correctly configuring the facility will enable separation of events from different sources. Valid values are User (default), daemon, auth, authpriv, syslog, localn (where n = is a number from 0 to 7 inclusive). By default, the local0 facility is configured.
Note
Due to the Identikey Server daemon running in the chroot environment, some extra setup must be completed before auditing to Syslog. See the Auditing section of the Administrator Reference for instructions.
7.4
Database Tasks
7.4.1
Configure Connection Parameters
You may wish to increase the number of connections attempted to the database if:
The load on the database will be high, and
Changes to the connection settings will be efficient with the database and database driver in question.
Setting an idle timeout will allow connections which are no longer required to be closed as soon as possible, which may lower the load on the database server. See the Administrator Reference for more information.
7.4.2
Additional Databases
If additional databases are required for backup, failover or load-balancing purposes, configure the Identikey Server to use them now.
See the Additional ODBC Databases topic in the Product Guide and the Database Connection Handling topic in the
Administrator Reference for more information.
7.5
Replication
Replication may be required between Identikey Servers. See the Replication section of the Administration
Reference for instructions on setting up replication.
Identikey Server Linux Installation Guide
48
Post-Installation Tasks
7.6
Daemon Setup
Daemons are installed during initial installation of the product they are part of. No direct set up is required as any settings they need are retrieved from the configuration file created using the Configuration Wizard.
For Ubuntu and SuSE the Daemons are stored in /etc/init.d.
For Red Hat the daemons are stored in /etc/rc.d/init.d
To start a daemon go to the directory the daemon is stored in and enter ./daemon-name start
To stop a daemon go to the directory the daemon is stored in and enter ./daemon-name stop
You can also restart a daemon by going to the directory in which the daemon is stored and entering
./daemon-name restart
The term daemon-name in the above examples refers to the daemon service name.
7.6.1
Identikey Server
The daemon service name for the Identikey Server daemon is Identikey.
7.6.2
Message Delivery Component
The daemon service name for the Message Delivery Component is MDC .
7.7
Configure Additional Identikey Servers
Follow the same process as in the Configure Identikey Server section in this manual. However, these settings will be overwritten when replication is set up:
Master Domain
User ID/Domain name conversion
You will need to request a License Key for each additional Identikey Server.
7.8
Set Up User Self Management and OTP Request Websites
To set up the User Self Management and OTP Request Websites you need to deploy the web pages to a web server such as Apache and configure the CGI used by the web site with the location of the Identikey Server.
The web sites consist of HTML pages with JavaScript, CSS and image files and the CGI. Therefore it can be deployed in a wide variety of web servers. The CGI needs to be located in a directory where it can be executed.
Identikey Server Linux Installation Guide
49
Post-Installation Tasks
The following instructions are for setting up the user websites from a chroot environment while the host environment runs the Apache2 webserver. Adjust these configuration steps where necessary:
4.
Create a new sites file named vasco in /etc/apache2/sites-available with the following contents:
ScriptAlias /dpselfservice/cgi-bin /opt/vasco/identikey/usr/share/vascocgi/cgi-bin Alias /dpselfservice /opt/vasco/identikey/usr/share/selfmgmt
<Directory /opt/vasco/identikey/usr/share/selfmgmt>
AllowOverride None
Order Allow, Deny
Allow From All
</Directory>
ScriptAlias /reqotp/cgi-bin /opt/vasco/identikey/usr/share/vasco-cgi/cgibin Alias /reqotp /opt/vasco/identikey/usr/share/reqotp
<Directory /opt/vasco/identikey/usr/share/reqotp>
AllowOverride None
Order Allow,Deny
Allow From All
</Directory>
This configuration assigns the aliases /dpselfservice and /reqotp to the web-sites located in the chroot environment at /opt/vasco/identikey .
5.
Create a symbolic link in /etc/apache2/sites-enabled to /etc/apache2/sites-available/vasco so Apache2 will load the configuration file: cd /etc/apache2/sites-enabled ln -s ../sites-available/vasco
6.
Ensure the 'www-data' user and group exist in the host and in the chroot environment with the same user- and group IDs.
7.
Restart the Apache2 webserver.
8.
Open a browser and browse to http://localhost/dpselfservice or http://localhost/reqotp
Identikey Server Linux Installation Guide
50
8 Uninstall Identikey Server
8.1
8.2
8.3
Uninstall Identikey Server
Backing Up Data
This step will be required if you are using the embedded PostgreSQL database supplied with Identikey Server.
Copy all database files from the chroot directory to a safe location.
Run Uninstall Script
1.
Exit the chroot environment, if within it.
2.
Navigate to the installation CD.
3.
Run the uninstall script:
./uninstall.sh
4.
Enter y.
5.
Enter y.
Identikey Server will be uninstalled.
Data Removal
When you uninstall Identikey Server, the database and the data inside it will not be removed. If you wish to delete it, you need to do this manually.
The simplest way to remove all data is to remove the schema modifications. This will drop all the tables used by
Identikey Server.
If you do not wish to delete the data, it is possible to re-install Identikey Server without losing this data.
Remove Schema Modifications
The dropschema command in the DPDBADMIN command line utility can be used to remove all schema modifications from the database, deleting all data relating to Identikey Server. Refer to the DPDBADMIN section of the Administration Reference for instructions.
Identikey Server Linux Installation Guide
51
Extend Data Store Schema
9 Extend Data Store Schema
The dpdbadmin addschema command is used to create all required tables in an existing database, if they are not already there. Each table will be checked individually to see if it is already there and if not, will be added.
This command is intended to be run manually by an administrator before Identikey Server is configured.
It may be necessary to go through an approval process in your company before running this command. You may also need to have a database administrator run the command for you. This depends on your company’s structure and rules for control of the database.
This command may also be used to create the tables required for auditing to an ODBC database.
Prerequisite Information
Database Administrator Account
In order to successfully modify the database structure, you will need the username and password of a database administrator account that is able to make changes to the database schema – for example, creating tables. You must pass these credentials to the command in the parameters.
Database Name
You will need the ODBC Data Source Name (DSN) of the database.
Master Domain Name
You can specify the name of the Master Domain (see 2.2
Master Domain) when you add the database schema.
However if you do not do it at that time, the Configuration Wizard can change it.
UserID/Domain Name Conversion
You can specify the Case Conversion option for UserIDs and Domain names (see 2.3
can change it.
Modify the Database Structure
1.
Open a command prompt.
2.
Enter the chroot environment: vds_chroot <install dir> /bin/bash
3.
Navigate to the installation’s bin directory by typing: cd /usr/sbin
4.
Type: dpdbadmin addschema –u user_name –p password -d dsn
5.
See below for more details regarding the required parameters.
Identikey Server Linux Installation Guide
52
Extend Data Store Schema
The progress and success/failure of the command will be displayed in the command prompt window. If there was a failure, it can be run again after the problem has been rectified.
Command Line Syntax
dpdbadmin addschema -d dsn [–u user_name] [–p password] [-domain domain_name] [-case case_conversion] [-vdsuser alternatename] [-vdsuserattr alternatename] [-vdsdomain alternatename] [-vdscontrol alternatename]
[-vdsdigipass alternatename] [-vdsdpapplication alternatename] [-vdspolicy alternatename] [vdsbackend alternatename] [-vdscomponent alternatename]
[-vdsorgunit alternatename] [-vdsdpsoftparams alternatename] [-vdsreport alternatename] [-vdsreportformat alternatename] [-audit] [-noserver]
[-nouser] [-utf8factor factor] [-q] [-v] [-l file_name] vdsuser vdsuserattr vdsdomain vdscontrol vdsdigipass vdsdpapplication vdspolicy vdsbackend vdscomponent vdsorgunit vdsdpsoftparams vdsreport vdsreportformat
-audit
-noserver
Table 2: DPDBADMIN addschema Command Line Options
-d
-u
-p
-domain
-case
Option
-nouser
-utf8factor
Description
ODBC Data Source Name (DSN)
User name of a database administrator (if required).
Password of the database administrator. This option may be omitted if they have a blank password.
Specify the Master Domain to be used. If not specified, it will be “master”. The Domain will be created if it does not already exist.
Specify to convert User IDs and domain names to either upper or lower case. The value must be either “upper” or “lower”.
Alternative name for the Digipass User table to be created.
Alternative name for the Digipass User Attribute table to be created.
Alternative name for the Domain table to be created.
Alternative name for the Control table to be created.
Alternative name for the Digipass table to be created.
Alternative name for the Digipass Application table to be created.
Alternative name for the Policy table to be created.
Alternative name for the Back-end Server table to be created.
Alternative name for the Component table to be created.
Alternative name for the Organizational Unit table to be created.
Alternative name for the DPSoft Parameters table to be created.
Alternative name for the Report Definition table to be created.
Alternative name for the Report Format table to be created.
Create the Audit tables.
Do not create the main tables used by the Identikey Server. This should only be used with the -audit option, when you only want to create the auditing tables.
Do not create Digipass User table. This option is not currently supported.
On certain databases (such as Oracle and DB2), column sizes are specified in bytes, not characters, by default. When UTF-8 encoding is used to store data, for full Unicode support, one character may
Identikey Server Linux Installation Guide
53
Extend Data Store Schema
Option Description
-q
-v
-l be represented as more than one byte. Normally 2 or 3 characters are used, depending on the language, but some characters require 4. If your data will include a lot of non-English characters, you can increase the size of certain columns by a factor to allow for the extra bytes. The value of the parameter should be 2, 3 or 4. Typically, 3 is sufficient. The columns affected by this are the User
Name (not User ID) and various Description fields.
On other databases, column sizes are specified in characters, and this parameter is not needed.
Quiet mode, will not output commentary text.
Verbose mode.
Log output to file file_name.
DPDBADMIN addschema Command Sample
dpdbadmin addschema –u DBAdmin –p pwd3498 -d UserDb -domain mydomain -case lower
This command will modify the database structure of the ODBC database with the data source name of UserDb. It uses a database administrator account with the User ID of DBAdmin and password pwd3498. A non-default
Master Domain will be used, called “mydomain”. It specifies to convert domain names and User IDs to lower case.
dpdbadmin addschema –u DBAdmin –p pwd3498 -d AuditDb -audit -noserver
This command will create only the auditing tables in the ODBC database with the data source name of AuditDb. It uses a database administrator account with the User ID of DBAdmin and password pwd3498.
Identikey Server Linux Installation Guide
54
File/Directory Placement
10 File/Directory Placement
Listed below are the files supplied with the Identikey Server and the location – relative to the chroot jail – in which the files are installed.
Table 3: List of files and file locations for Identikey Server
Package Location File Name
vasco-aal3seal vasco-identikey-scenarioprovisioning
/etc/vasco
/usr/lib
/usr/lib vasco-identikey-admin-cmdline /usr/share/vasco/admincmd vasco-identikey-admin-cmdline /usr/lib
/usr/lib vasco-identikey-scenarioadministration vasco-identikey-scenariosignature
/usr/lib identikeyconfig.xml
libikaal3seal.so
libikscenprovision.so
dpadmincmd.tmpl
libtclvasco.so
libikscenadmin.so
libikscensign.so
vasco-identikey-scenarioreporting vasco-identikey-admin-web vasco-identikey-server vasco-identikey-server vasco-req-otp-website vasco-audit-viewer vasco-audit-viewer vasco-audit-viewer vasco-audit-viewer vasco-identikey-scenarioreplication vasco-mdc-server
/usr/lib
/usr/share/vasco libikscenreport.so
webadmin.war
vasco-identikey-admin-web vasco-identikey-scenario-auditing /usr/lib vasco-identikey-server vasco-identikey-server vasco-identikey-server
/usr/share/vasco
/usr/share/vasco/identikey admintool.jar
libikscenaudit.so
identikeyconfig.tmpl, policies.xml, reports.xml, certgen.tmpl, identikey
/usr/share/vasco/identikey/reports/xslt *.xslt
/usr/bin ikeyserver
/usr/sbin
/usr/lib usr/share/reqotp/*
/usr/bin
/usr/lib
/usr/share/doc/vasco
/etc/vasco
/usr/lib
/usr/share/vasco/mdc/ ikconfigwizardconsole libikcommsoap.so, libikcommseal.so, libikcommradius.so
*.html, *.js, *.css, *.jpg, *.png, *.gif
dpauditviewer libdpadtreader.so
AuditViewerHelp.htb
dpauditviewer.xml
libikscenrepl.so
mdcconfig.tmpl
Identikey Server Linux Installation Guide
55
Package
vasco-mdc-server vasco-mdc-server vasco-mdc-server vasco-mdc-server vasco-identikey-subsystemstorage vasco-3rdparty vasco-audit-core
Location
/usr/bin
/usr/lib
/usr/share/vasco/init.d
/etc/vasco
/usr/lib
/usr/lib
/usr/lib vasco-identikey-subsystemreplication
/usr/lib vasco-identikey-server-config-gui /usr/sbin vasco-identikey-server-config-gui /usr/share/doc/vasco vasco-identikey-scenarioauthentication
/usr/lib vasco-cgi vasco-cgi vasco-cgi-config vasco-identikey-doc
/etc/vasco
/usr/bin
/usr/sbin
/usr/share/doc/vasco vasco-controller /usr/lib vasco-self-management-website /usr/share/selfmgmt/* vasco-identikey-samples /usr/share/vasco/identikey/dpx vasco-identikey-samples /usr/share/vasco/identikey/user
File/Directory Placement
File Name
mdcserver libvdpclient.so
mdc curl-ca-bundle.crt
libikstorageodbc.so
ibwx_gtk2u-2.8.so
libdpauditlive.so, libdpaudit.so, libdpauditodbc.so, libikreplication.so
Ikconfigutilgui, ikconfigwizardgui
ConfigurationGUIHelp.htb
libikscenauth.so
usercgi.xml
usercgi usercgicfg
Identikey Server Product Guide.pdf, Identikey
Server Administrator Reference.pdf, Identikey
Server Linux Installation Guide.pdf
libaal2sdk.so
*.html, *.js, *.css, *.jpg, *.png, *.gif
DemoGO3.dpx, demovdp.dpx, demo.dpx, demoaes.dpx, demoDP4Web.dpx
user-import.csv
10.1
Permissions
Table 4: List of directories and permissions for Identikey Server
Created Directories Permission s
User group
/var/vasco/repldata
/var/vasco/identikey
/usr/share/vasco/identikey/dpx
775
775
775
Identikey
Identikey
Identikey
Identikey Server Linux Installation Guide
User/group/other
drwxrwxr-x drwxrwxr-x drwxrwxr-x
56
Created Directories Permission s
/usr/share/vasco/identikey/reports 775
/var/vasco/mdc 775
Identikey mdcserver
User group
File/Directory Placement
User/group/other
drwxrwxr-x drwxrwxr-x
Identikey Server Linux Installation Guide
57
Technical Support
11 Technical Support
If you encounter problems with a VASCO product please do the following:
1.
Read the How to Troubleshoot topic in the Administrator Reference for help in discovering the source of your problem.
2.
Check if your problem is resolved in the Knowledge Base located at the following URL: http://www.vasco.com/support .
3.
If you do not find the information you need in the Knowledge Base, please contact the company that sold you the VASCO product.
Only after doing these steps, if your needs are still not completely met please contact VASCO support:
11.1
Support Contact Information
Website
http://www.vasco.com/support/contacts.html
Phone
Australia
Belgium
Singapore
USA
+61 2 8061 3700 (Sydney)
+32 2 609 9770 (Brussels)
+65 6 232 2727
+1 508 366 3400 (Boston)
Identikey Server Linux Installation Guide
58
Stáhnout
Veřejný odkaz aktualizován
Veřejný odkaz na váš chat byl aktualizován. You may view and manage your chat links after registration here.
Veřejný odkaz na dokument
Reklama