From 5e58499fe5c81b55a131292aab135040516378c7 Mon Sep 17 00:00:00 2001 From: cliu Date: Wed, 30 Sep 2026 14:09:30 +1000 Subject: [PATCH] Add phase 2 setup and security summaries, setup check script Summarize CI Server Setup and Security Guide, add the draft installation-security skill and tools/setup_check.ps1 (read-only check practiced on the test system), and log ISS-008/009. Co-Authored-By: Claude Opus 5.5 --- .claude/skills/installation-security/SKILL.md | 32 ++++ .../tasks/setup-check.md | 46 +++++ knowledge/issues.md | 2 + knowledge/manuals/IM36K01C10-01EN.md | 159 ++++++++++++++++++ knowledge/manuals/IM36K01C30-01EN.md | 114 +++++++++++++ knowledge/progress.md | 11 +- tools/README.md | 4 + tools/setup_check.ps1 | 129 ++++++++++++++ 8 files changed, 495 insertions(+), 2 deletions(-) create mode 100644 .claude/skills/installation-security/SKILL.md create mode 100644 .claude/skills/installation-security/tasks/setup-check.md create mode 100644 knowledge/manuals/IM36K01C10-01EN.md create mode 100644 knowledge/manuals/IM36K01C30-01EN.md create mode 100644 tools/setup_check.ps1 diff --git a/.claude/skills/installation-security/SKILL.md b/.claude/skills/installation-security/SKILL.md new file mode 100644 index 0000000..cf21c96 --- /dev/null +++ b/.claude/skills/installation-security/SKILL.md @@ -0,0 +1,32 @@ +--- +name: installation-security +description: >- + CI Server R1.03 installation, upgrade and Windows/IT security. Use when the user wants to + prepare Windows for CI Server, check whether a machine meets the setup requirements, install, + reinstall, upgrade or uninstall CI Server, apply or extend a licence, install CI Server Remote + Connect, set up Vnet/IP drivers or network addresses, apply the IT Security Tool, check or + open firewall ports, manage the CIX_ groups and CIX_PROCESS account, or run CI Server on a + virtual machine. Sources IM 36K01C10-01EN and IM 36K01C30-01EN. +--- + +# Installation and security (R1.03) + +Background: `knowledge/manuals/IM36K01C10-01EN.md` (Setup) and +`knowledge/manuals/IM36K01C30-01EN.md` (Security Guide). Known issues: +`knowledge/manuals/IM36K01A50-01EN.md` (IT Security tool, install path, VMs). + +Rules: +- Run the `system-check` skill first. +- Installing, upgrading, changing Windows settings or IT security needs an elevated session, + changes the machine and often needs restarts: follow the user's chosen way of working and + confirm before each step. In *prepare only* mode, produce a checklist for the user. +- Never copy old setup files over new ones after an upgrade: compare and merge. + +| Task | Where | Status | +|---|---|---| +| Check a machine against the setup and security requirements | `tasks/setup-check.md` | draft, awaiting confirmation | +| New installation (physical, VM, dual-redundant): order of work, Windows settings, Vnet/IP, install, IT security, licence | Setup summary §2 | from docs | +| Start/stop, reinstall, upgrade (incl. HAC), extend licence, uninstall | Setup summary §3 | from docs | +| Install CI Server Remote Connect; web ports | Setup summary §2.4 | from docs | +| Firewall ports for CI Server and drivers | Security Guide summary §3 | from docs (web, DURM, SMDMON ports checked) | +| IT Security Tool, user management types, CIX_ groups/accounts, change service account | Security Guide summary §2, §5 | from docs | diff --git a/.claude/skills/installation-security/tasks/setup-check.md b/.claude/skills/installation-security/tasks/setup-check.md new file mode 100644 index 0000000..be4f14b --- /dev/null +++ b/.claude/skills/installation-security/tasks/setup-check.md @@ -0,0 +1,46 @@ +--- +task: Check a machine against the CI Server setup and security requirements +version: R1.03 +source: IM 36K01C10-01EN §1, §2.1.2, §3.2.12; IM 36K01C30-01EN §2.2, §3.2; practiced on the test system 2026-09-30 +status: draft, awaiting confirmation +--- + +# Setup check (read-only) + +``` +powershell -NoProfile -ExecutionPolicy Bypass -File tools\setup_check.ps1 +``` + +Run from the repo root, preferably elevated. Changes nothing. One line per check: +`[OK]` matches the manual, `[DIFF]` differs, `[CHECK]` needs a human decision. + +## What it checks + +| Area | Checks | +|---|---| +| CI Server | Installed version (1.03.00), CI Service state, startup type and account (`.\CIX_PROCESS`), VAGW service | +| Windows | Supported OS, visual effects, processor scheduling, virtual memory (custom, 1.5 × RAM), power plan, fast startup, Windows Defender policy, automatic updates policy, scheduled defrag and component cleanup, .NET 3.5, DCOM authentication level, display scale, 8dot3 names, regional settings | +| IT security | `CIX_OPERATOR`, `CIX_ENGINEER`, `CIX_MAINTENANCE`, `CIX_OPC` groups, `CIX_PROCESS` / `CTM_PROCESS` users, IT Security Tool installed | +| Firewall | Profiles enabled; inbound allowed for TCP 8080, 8443, UDP 17001, 17101, 18002 | + +## Reading the result + +- `[DIFF]` on a development PC is normal; for a production server, fix each item with the + Setup summary's Windows settings table (`knowledge/manuals/IM36K01C10-01EN.md` §2) or by + running the IT Security Tool. +- The script finds the firewall rules only as "some rule allows this port"; check the rule + scope separately for production. +- Also read `%TLS_LOG_PATH%\ci_start.log` after a start: every service should report + `… started` and the log ends with `CI Server started`; look for `-E-` and `failed` lines. + The first lines show the version and build (e.g. `R1.03.00 … (r10200M)`). +- The web ports actually used are `SECURE_PORT_NUMBER` / `NON_SECURE_PORT_NUMBER` in + `%TLS_ROOT_PATH%\tls\sup\jwuiisg.sup` (8443 / 8080 by default). + +## Test system result (2026-09-30) + +Windows 10 Pro 19045 development PC without the IT Security Tool: 16 OK, 5 CHECK, 15 DIFF. +Differences: firewall domain/private profiles off; no `CIX_` groups or `CTM_PROCESS` (IT +Security Tool not installed; not supported on Windows 10 Pro); fast startup on; Balanced power +plan; automatic virtual memory; Defender on; automatic updates, defrag and cleanup not +disabled. Web ports 8443/8080. `ci_start.log`: all services started, one SSL certificate error +(`knowledge/issues.md` ISS-008). diff --git a/knowledge/issues.md b/knowledge/issues.md index 0569406..aa2ecad 100644 --- a/knowledge/issues.md +++ b/knowledge/issues.md @@ -26,3 +26,5 @@ development system (see "Test system" in `progress.md`); they do not exist on ot | ISS-005 | 2026-09-30 | DATABASE (`dssqld`) | Loading `04_item_his_df.qli` straight after creating the storage group gave 2 errors once; three other runs were clean. Error text not captured. | open | Added a 5 s pause in `load.cmd`. If it happens again, capture `04_item_his_df.qlo`. | `examples/CI-Eng-Sample/load.cmd`; `.claude/skills/system-management/tasks/load-remove-records.md` | | ISS-006 | 2026-09-30 | HISTORY (`ithloahis`) | Samples dated before the start of the current storage unit were not stored (no error shown); samples after it were. Also, a new storage group stored nothing until CI Server was restarted. | open | Confirm with History Management (IM 36K10L20) in phase 9: how to load into older units, and whether a restart is really required. | `.claude/skills/system-management/tasks/load-history.md`; `examples/CI-Eng-Sample/README.md`; `knowledge/manuals/IM36K10J10-01EN.md` command-line tools | | ISS-007 | 2026-09-30 | INTEGRATION (monitoring) | `intdskmon` wrote 61.9 for a C: drive that is 61.9 % used / 38.1 % free, although the manual says it monitors the disk free space rate. `intspawn` did nothing when the command path was ~130 characters; a short path worked (limit unknown). | open | Confirm the disk value meaning and the path limit. | `.claude/skills/system-management/tasks/monitoring-processes.md`; `knowledge/manuals/IM36K10J10-01EN.md` §4.1.6; `examples/CI-Eng-Sample/monitoring/` | +| ISS-008 | 2026-09-30 | ACCESS (web/OPC UA server?) | `ci_start.log` on the test system shows `CppServerAPI::Run() failed: InitializeSslCtx(): SSL_CTX_use_certificate_chain_file() failed.` right after ACCESS Service starts. Which component and certificate is not known. | open | Identify in phase 7 (OPC Interface IM 36K10E20, Data Access IM 36K10L45). | `.claude/skills/installation-security/tasks/setup-check.md`; the phase 7 skill | +| ISS-009 | 2026-09-30 | Security Guide | DCOM port range printed as 20500–20550 in the firewall table but "2500–20550" in the OPC configuration table. Taken as a typo for 20500–20550. | open | Confirm on a system with IT security applied. | `knowledge/manuals/IM36K01C30-01EN.md` §4 | diff --git a/knowledge/manuals/IM36K01C10-01EN.md b/knowledge/manuals/IM36K01C10-01EN.md new file mode 100644 index 0000000..d5e56f2 --- /dev/null +++ b/knowledge/manuals/IM36K01C10-01EN.md @@ -0,0 +1,159 @@ +--- +manual: IM 36K01C10-01EN +title: CI Server Setup +edition: 3rd Edition, Sep. 2023 +version: R1.03 +status: from docs (Windows settings checked read-only on the test system with tools/setup_check.ps1) +--- + +# CI Server Setup (R1.03) + +New installation, maintenance (start/stop, reinstall, upgrade, licence, uninstall) and network +tools. Section numbers refer to the manual. + +## 1. Before you start + +- Needed: the CI Server software medium (or its ISO) and one **Activated License File per + server** (an upgrade needs one that includes the Upgrade License). +- Supported OS for R1.03: Windows 10 Pro / Enterprise (64-bit), Windows 10 Enterprise and IoT + Enterprise 2016 LTSB and 2019 LTSC, Windows Server 2016, Windows Server 2019, Windows Server + IoT 2019. On **Windows 10 Pro/Enterprise (non-LTSB/LTSC) the Vnet/IP drivers and the IT + Security Tool are not supported**. VMs run Windows Server 2019. +- Only listed software may coexist: Chrome / Firefox / Edge 112, Microsoft Office 2016/2019/365 + (Excel Add-in), PI AF SDK 2.10.5 + .NET 4.6.2, Adobe Acrobat (Reader) DC, Yokogawa standard + antivirus, Standard Whitelisting Software for Endpoint Security. Anything else may disturb CI Server. + +## 2. New setup + +### Order of work (§2.1, physical machine) + +1. (Vnet/IP only) Set DIP switches and fit the Vnet/IP card (VI702). +2. Configure Windows settings (below). +3. (Vnet/IP only) Install control bus driver and Vnet/IP open communication driver, then set + Windows network settings. +4. Install CI Server (with or without the IT Security Tool). +5. Apply IT security settings (IT Security Tool; Domain Link Management Tool for linked domain). +6. Apply the CI Server licence. + +On a VM (§2.2): mount the ISO, Windows settings, (Vnet/IP) **Vnet/IP Interface Package** +instead of drivers/card, VM network settings, install, IT security, licence, then VM +settings (auto start/shutdown with host, allow RDP from thin clients, disable NetBIOS over +TCP/IP, network metrics favouring the plant network). On VMs, adapters not used for Vnet/IP +must not use 192.168.0.0/16. Dual-redundant platform: see §2.3 and IM 30A05C30. + +### Windows settings (§2.1.2) + +| Setting | Required value | +|---|---| +| Security patches | Apply per company policy before going live; patch promptly later | +| Visual effects | *Let Windows choose what's best* | +| Processor scheduling | *Programs* | +| Virtual memory | Custom size, initial = maximum = 1.5 × RAM (e.g. 6 GB RAM → 9216 MB); restart | +| Power | *High performance*; disk, sleep, hibernate, display: never; hybrid sleep off; wake timers off; power button = shut down | +| Fast startup | Off: run `\Windows\Tool\HiberbootDisabled.bat` as administrator (`HiberbootEnabled` = 0); required before Vnet/IP drivers on Win10 | +| Windows Defender | Turned off by group policy (Server 2016: *Turn off Windows Defender*; 2019: *Turn off Windows Defender Antivirus*) | +| Automatic Windows updates | Disabled by group policy (*Configure Automatic Updates* = Disabled). With WSUS: install CI Server first, then disable from WSUS | +| Drive optimization | Scheduled optimization off | +| Automatic cleanup | Task Scheduler › Microsoft › Windows › Servicing › `StartComponentCleanup` disabled | +| Windows updates | KB5023702 (2023-03) on Win10 2019 LTSC / Server 2019, or folder permissions may be wrong | +| .NET Framework 3.5.1 | Installed (`dism /online /enable-feature /featurename:NetFX3 /all /Source::\sources\sxs /limitaccess`, or Server Manager feature) | +| DCOM | Default Authentication Level = *Connect*; restart | +| Display | Scale 100 % | +| 8dot3 names | `fsutil behavior set disable8dot3 2`; restart | + +### Vnet/IP (§2.1.1, §2.1.3, §2.1.4) + +- Card DIP switches: domain 1–16, station 1–64 (start from 64 downwards), each with odd + parity; action-mode switch all OFF. One card per computer; card before drivers. +- Drivers from `\Windows\VnetVirtualProduct\VirtualProduct_CIServer_package*.zip` → + `installVirtProd.cmd` (VM: `installVirtProdVPF.cmd`), as administrator, antivirus off. +- Rename connections: *Ethernet*, *Vnet*, *VnetIPOpen* (VM: *VnetIPBUS1*, *VnetIPBUS2*, + *RemoteUINetwork*). Disable IPv6; Vnet uses only *Yokogawa Vnet Protocol* + IPv4. +- Default addresses: Ethernet `172.17..`/16; control bus `172.16..`/16; + Vnet/IP open `192.168.<128+domain>.<129+station>`/24; VM remote UI `172.18..`/16. +- Computer name = station name. Check `sc query VLTDI` = RUNNING. +- Never use Internet Connection Sharing, bridge connections or Homegroup. +- Run the TCP/IP Inconsistency Detect Tool before installing CI Server (§3.8). + +### Installing CI Server (§2.1.5) + +- Run as a local administrator (domain types: domain admin or local admin + domain credentials); + join the domain first for domain/combination management. +- Close applications, disable antivirus, never run two installers, never install where CI + Server Remote Connect is installed. +- `\Windows\CIServer\ciserver-R-rM-setup.exe` = CI Server only; + `…-ITSecurity.exe` = CI Server + IT Security Tool (also installs VAGW modules; install type + *CI Server and IT Security Tool*). Choose the install folder (no spaces if non-default, + see known issues), reboot. +- **Change the initial passwords of the predefined CI Server user accounts** (Engineering + Module manual). + +### IT security (§2.1.6) and licence (§2.1.7) + +- IT Security Tool: select *Standard Model* and the user management type; keep default items; + restart. The model must be the same across the system. Save/export settings if you change + defaults. Running the tool (also during upgrade) overwrites manual security changes. +- Licence: Start menu › *License Authorization Wizard* (admin) › select the activated licence + file › Finish. + +### CI Server Remote Connect (§2.4) + +On a CI View PC (never on a Portal or Core): browse to `http(s)://:` (defaults +8080 / 8443), *Download (Windows)*, run `CI-rc-setup.exe`. Portal ports are in `jwuiisg.sup` +(Setup File Editor › *Client communication* tab); open them in the firewalls. + +### Virtualization extras (§2.5) + +RD Session Host + RD Licensing (per device) for USB redirection; limit connections to 1; +allow multiple sessions per user; enable *Windows Audio* and the *System Sound Service* task +for sound over RDP. + +## 3. Maintenance + +**Start/stop (§3.1)**: Start menu › CI Server › *Start CI Server* / *Stop CI Server*, or the +*CI Service* Windows service (set startup type *Automatic* for automatic start). An expired +licence gives an error at start. + +**Reinstall / upgrade (§3.2)**, upgrades from R1.02 or earlier (needs a Product Maintenance +Licence): +1. Database consistency: `dsschk`, `dsschk -r`, `dsschk -e`, `dsschk -e -r` (upgrade only). +2. Stop CI Server; set the CI Service startup type to *Manual*. +3. Stop the *VAGW Bossd* service, then back up `%TLS_ALLUSERS_PATH%` and `%TLS_ROOT_PATH%\tls` + (plus project files). +4. On the Core (upgrade): delete in `%TLS_SAV_PATH%` `eqp*_main.*`, `eqp*_item.*`, `opx*.*` + (`.sav/.d01/.k01`) and `*.sqlite`. +5. Note changed setup files (Setup File Editor, *Status* = Changed) and copy + `tls\com`, `sup`, `tpl`, `src` and `%TLS_ALLUSERS_PATH%\wap`. +6. (Vnet/IP) Update drivers (uninstall, reinstall, restart) and network settings. +7. Install over the top (no uninstall); if IT Security Tool was installed before, install it again. +8. IT security, licence. +9. Restore: **compare and merge** changes into the new files (never copy old files over new + ones), including `wap\cfg\operatorInterfaces\DEPLOY\layouts\`; re-apply IT security. +10. Verify: start, `dsschk -e -r` three times, restart, check `%TLS_LOG_PATH%\ci_start.log`, + restore the startup type. +- ODBC: if the Simba client version differs, remove DSNs, uninstall and reinstall the client; + on R1.02 or older with the Simba server, uninstall the server before upgrading. +- Passwords of predefined CI Server accounts are reset to the initial ones: change them again. + +**HAC upgrade (§3.3)**: stop standby, disconnect its network, upgrade and test offline, stop +standby, stop primary, reconnect standby and start it, upgrade primary, start it (sync resumes). + +**Extend licence (§3.4)**: License Authorization Wizard while running; node name/number must +match; takes effect within an hour. New features need CI Server stopped first. + +**Uninstall (§3.5, §3.6)**: back up, stop CI Server and VAGW Bossd, Programs and Features › +CI Server › Uninstall, restart. Remote Connect: uninstall it, then CI Server (IT Security +definitions), then run `\Windows\CIServer\ITSecurity\DeleteITSecurity.cmd`. + +**TCP/IP tools (§3.8)**: from the VirtualProduct package `XCM3003\Module\Tool`: +`TcpipInconsistencyDetector.cmd` (check) and `TcpipInconsistencyRepair.cmd` (resets all NIC +IPv4 settings: note them first, re-enter after restart). + +## Troubleshooting (Appendix 1) + +| Problem | Workaround | +|---|---| +| Server Manager error, Microsoft updates fail (80070543), .NET install fails | Temporarily set DCOM Default Authentication Level to *Connect* (revert to *None* afterwards where the manual says so), restart | +| Cannot manage users in Control Panel | Use Computer Management › Local Users and Groups | +| Installed updates not listed | `wmic qfe list full` | +| Cannot change time zone (Server 2019 with UAC) | Run `timedate.cpl` as administrator | diff --git a/knowledge/manuals/IM36K01C30-01EN.md b/knowledge/manuals/IM36K01C30-01EN.md new file mode 100644 index 0000000..c823aac --- /dev/null +++ b/knowledge/manuals/IM36K01C30-01EN.md @@ -0,0 +1,114 @@ +--- +manual: IM 36K01C30-01EN +title: CI Server Security Guide +edition: 3rd Edition, Sep. 2023 +version: R1.03 +status: from docs (users/groups and firewall checked read-only on the test system) +--- + +# CI Server Security Guide (R1.03) + +What the IT Security Tool changes, which Windows accounts and firewall openings CI Server +needs, and the related utilities. Section numbers refer to the manual. + +## 1. Threats and measures + +- Threats: attacks over the network, direct attacks at a terminal, theft of a computer/data. +- Measures: access control (files, folders, registry, DCOM/OPC, system commands), personal + firewall, stopping unused services, IT environment settings (NetBIOS, disk password), and + group policies (password/lockout, security options, software restriction, audit policies, + administrative templates, safe DLL search order). +- IT security settings **must** be applied at the area and process levels; business and + corporate levels follow the site's own policy. + +## 2. Security model and user management + +- CI Server supports only the **Standard model**: protects against network and terminal + attacks, **not** against theft. Password and lockout policies are *not* set by it (use + domain policy). +- User management types: + +| Type | Accounts kept on | Notes | +|---|---|---| +| Standalone | Each computer | Small systems; admin and product maintenance rights not separable | +| Domain | Domain controller | Central; rights separable | +| Combination | Domain, plus local fallback | Local `_LCL` groups for emergencies | +| Linked domain (recommended for new systems) | Domain, linked to local groups | Apply *Standalone* first, join domain, then link with Domain Link Management Tool | + +- Groups/accounts created by the IT Security Tool (standalone: local; domain types: on the + domain controller, with `_LCL` local helper groups): + +| Name | Kind | Purpose | +|---|---|---| +| `CIX_OPERATOR` | Group | Operators | +| `CIX_ENGINEER` | Group | Engineering (Engineering / Edit Module) | +| `CIX_MAINTENANCE` | Group (also Administrators) | Installation and maintenance | +| `CIX_OPC` | Group | OPC configuration and communication | +| `CIX_PROCESS` | User | Runs CI Server services and CI OPC servers | +| `CTM_PROCESS` | User | Runs VAGW services | +| `RDC_PROCESS` | User | Dual-redundant platform only | +| `VNT_*` | Groups/users | Vnet/IP Interface Package (no sign-in rights) | + +Use these accounts only for CI Server. Changing the security model may delete or rename groups. + +## 3. Firewall (§3.2) + +Windows Firewall on; block everything except what CI Server needs: + +| Use | Port | +|---|---| +| Web / secure web (CI View, CI Portal) | TCP 8080 / 80, TCP 8443 / 443 | +| DURM between nodes | UDP 17001, 17101 (one per DURM line) | +| SMDMON (system log collection) | UDP 18002 | +| Remote desktop (only if needed, restrict users) | TCP 3389 | +| HAC | UDP 16000–16006 (`hac.sup`, `jhacProperties\application.properties`); HACW_HMI UDP 16010–16041 | +| ODBC (SimbaServer, Core only) | TCP 1583 | +| Alarm e-mail | TCP 25 | +| NTP/SNTP (not needed with Vnet/IP) | 123 | +| OPC classic | TCP 135, 139, DCOM 20500–20550 (customizable); UDP 137, 138 | +| OPC UA | UDP 4840 discovery; communication port configurable | +| Vnet equipment (`odeq.exe`) | TCP 44818 | +| Equipment drivers | Rockwell CIP / PLC5 / Fisher ROC TCP 44818; DAQ TCP 34260, 34434; DNP3 TCP 20000; FA-M3 TCP 12289; IEC 60870-5-104 TCP 2404; IEC 61850 TCP 102; MeTro TCP 7075; Modbus TCP 502; STARDOM FCX TCP 1090 | +| Windows domain | DNS 53, Kerberos 88, LDAP 389, SMB 445, GC 3268/3269, DHCP 67, discovery 137/138/1900/3702/5355 + TCP 2869/5357/5358, MADCAP 2535, AD Web 9389 | +| Dual-redundant platform (PRC) | TCP 34480, 34483–34486; UDP 1311 | + +ICMP echo (ping) is allowed by the Standard model. + +## 4. Other settings (§3.3–§3.6) + +- Unused services disabled by the tool (depending on OS): Diagnostic Policy, Connected User + Experiences and Telemetry, dmwappushsvc, Downloaded Maps Manager, IP Helper, Program + Compatibility Assistant, Remote Registry, Shell Hardware Detection, Themes, Windows Push + Notifications, and others. DHCP Client must stay running. +- OPC: *Create permanent shared objects* right for `CIX_OPC`, `CIX_PROCESS`, `CTM_PROCESS`; + network access sharing model *Classic*; DCOM port range 20500–20550 (the manual's table + also prints "2500–20550", taken as a typo). +- NetBIOS over TCP/IP can be disabled (default with domain/combination management); then + configure HOSTS/DNS for name resolution. +- USB storage disabled; use the StorageDeviceCTL utility (members of `CIX_MAINTENANCE`) to + allow writing temporarily. + +## 5. Tools (§4) + +| Tool | Use | +|---|---| +| IT Security Tool (Start › YOKOGAWA Security) | *Setup* (model + management type), *Save*/*Restore* (with a default password for recreated accounts), *Change Password* of the saved file, *Import*/*Export*, *Information* (summary) | +| Domain Link Management Tool | Link/unlink the domain (linked domain management); sign in as local admin + `CIX_MAINTENANCE` | +| `PrepareReconstruction.cmd` then `ciserver-…-ITSecurity.exe` › *Apply IT Security only* | Re-apply with different target components | +| `Yokogawa.IA.iPCS.Platform.Security.CreateCIXProcess.exe [-p ]` (`\Windows\CIServer\ITSecurity`) | Create `CIX_PROCESS` or set its password; same password on all collaborating computers; restart | +| `…CreateCTMProcess.exe [-p ]` | Same for `CTM_PROCESS` | +| `ITSecuritySettingItemExport.exe` | Export applied settings | +| `YWVNETCreateVNTUser` | Change passwords of the Vnet/IP Interface Package users (VM) | + +**Changing the account that runs CI Server (§4.9)**: create the user, add it to +Administrators (and `RDC_GA_CLIENT` on a dual-redundant platform; `CIX_OPC` or +`CIX_OPC_LCL` when IT security is applied), set it on the *CI Service* Log On tab and on the +Identity tab of *CI OPC AE Server* and *CI OPC DA Server* in Component Services › DCOM Config. + +## 6. Optional hardening (§5) + +Extra settings the site may add: audit policies and event log sizes, disable recovery +console and Guest account, restrict audit log and removable media access, immediate +screen-saver password, SNMP, SSL/TLS registry settings, secure startup and +`AllowedPaths` registry keys, remove *Everyone* for anonymous users, remove unused +protocols, block malicious DLL loading. diff --git a/knowledge/progress.md b/knowledge/progress.md index b2c8c6b..e45412e 100644 --- a/knowledge/progress.md +++ b/knowledge/progress.md @@ -31,8 +31,8 @@ AID is not needed. |---|---|---|---| | 0 | IM 36K01A50 | Release Information | summarized ([notes](manuals/IM36K01A50-01EN.md)) | | 1 | IM 36K10J10 | System Design/Management | done except migration (phase 6) and debugging tools; skill `system-management` ([notes](manuals/IM36K10J10-01EN.md)) | -| 2 | IM 36K01C10 | CI Server Setup | not started | -| 2 | IM 36K01C30 | Security Guide | not started | +| 2 | IM 36K01C10 | CI Server Setup | summarized ([notes](manuals/IM36K01C10-01EN.md)); skill `installation-security` (draft) | +| 2 | IM 36K01C30 | Security Guide | summarized ([notes](manuals/IM36K01C30-01EN.md)); skill `installation-security` (draft) | | 3 | IM 36K10G10 | Tutorial | not started | | 4 | IM 36K10R10 | CI Portal Setup | not started | | 4 | IM 36K10R20 | Setup File Editor | not started | @@ -90,3 +90,10 @@ now come before classes and objects (phase 6), and the other interfaces follow a | J10 | Backup of `tls` folders | not practiced | n/a | Plan only; the actual backup tool is site-specific. | | J10 | Migration between systems (§5.6) | not practiced | pending | Needs engineered data; revisit after phase 6. | | J10 | Tuning checks (read-only) ([task](../.claude/skills/system-management/tasks/tuning-checks.md)) | passed | n/a | Read `dur.sup` (max processes 250), `itm.sup` (item pool 650,000 KB) and the automatic health snapshots `tls\log\smd_*.log` (common memory free, queue use per process, lock collisions). Debug launchers and interactive debuggers not practiced. | +| C10/C30 | Setup check script `tools/setup_check.ps1` ([task](../.claude/skills/installation-security/tasks/setup-check.md)) | practiced, awaiting confirmation | n/a | Read-only; 16 OK / 5 CHECK / 15 DIFF on the Win10 Pro test PC. | +| C10 | Read `ci_start.log` and web ports (`jwuiisg.sup`) | practiced, awaiting confirmation | n/a | All services started; SSL error [ISS-008](issues.md). | +| C10 | Start / stop CI Server | passed (phase 1) | n/a | Via the CI Service (elevated). Start-menu shortcuts not used. | +| C10 | New install, reinstall, upgrade, uninstall, licence | not practiced | n/a | Would reinstall or change the test system; only the installed R1.03 is available. Skipped. | +| C10 | Windows settings changes (power, virtual memory, Defender, updates, …) | not practiced | n/a | Changes the test PC's OS; needs the user's go-ahead. Skipped. | +| C10 | Vnet/IP drivers / Vnet/IP Interface Package | not practiced | n/a | No Vnet/IP card; not supported on Windows 10 Pro. | +| C30 | IT Security Tool, Domain Link Management, account utilities | not practiced | n/a | Not installed and not supported on Windows 10 Pro. | diff --git a/tools/README.md b/tools/README.md index 7d055c5..c2c289d 100644 --- a/tools/README.md +++ b/tools/README.md @@ -3,3 +3,7 @@ Helper scripts Claude can run. Scripts that read the manuals must not hard-code their location; take it from an argument or environment variable, with `C:\Users\Public\Yokogawa\tls\doc\EN\` as the default. + +| Script | Purpose | +|---|---| +| `setup_check.ps1` | Read-only check of a machine against the CI Server R1.03 setup and security requirements (skill `installation-security`) | diff --git a/tools/setup_check.ps1 b/tools/setup_check.ps1 new file mode 100644 index 0000000..8af3c53 --- /dev/null +++ b/tools/setup_check.ps1 @@ -0,0 +1,129 @@ +# CI Server R1.03 - read-only setup check +# Compares a machine with the Windows settings required by CI Server Setup (IM 36K01C10-01EN §2.1.2) +# and the IT security state described in the Security Guide (IM 36K01C30-01EN §2.2, §3.2). +# Changes nothing. Run in Windows PowerShell 5.1; some checks need an elevated session. +# Usage: powershell -NoProfile -ExecutionPolicy Bypass -File tools\setup_check.ps1 + +$results = New-Object System.Collections.Generic.List[object] +function Add-Result($area, $check, $expected, $actual, $ok) { + $status = 'CHECK' + if ($ok -eq $true) { $status = 'OK' } elseif ($ok -eq $false) { $status = 'DIFF' } + $results.Add([pscustomobject]@{ Status = $status; Area = $area; Check = $check; Expected = $expected; Actual = "$actual" }) +} +function Get-Reg($path, $name) { + try { (Get-ItemProperty -Path $path -Name $name -ErrorAction Stop).$name } catch { $null } +} + +# --- CI Server --------------------------------------------------------------- +$ci = $null +foreach ($k in 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*', 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*') { + foreach ($i in (Get-ItemProperty $k -ErrorAction SilentlyContinue)) { if ($i.DisplayName -like 'CI Server R*') { $ci = $i } } +} +if ($ci) { Add-Result 'CI Server' 'Installed version' '1.03.00' $ci.DisplayVersion ($ci.DisplayVersion -eq '1.03.00') } +else { Add-Result 'CI Server' 'Installed version' '1.03.00' 'not found' $false } +$svc = Get-Service StartCIServer -ErrorAction SilentlyContinue +if ($svc) { + Add-Result 'CI Server' 'CI Service state' 'Running (when in use)' $svc.Status $null + Add-Result 'CI Server' 'CI Service startup type' 'Automatic in operation; Manual during upgrade' $svc.StartType $null + $acct = (Get-CimInstance Win32_Service -Filter "Name='StartCIServer'" -ErrorAction SilentlyContinue).StartName + Add-Result 'CI Server' 'CI Service account' '.\CIX_PROCESS (default)' $acct ($acct -like '*CIX_PROCESS') +} +$vagw = Get-Service | Where-Object { $_.DisplayName -like 'VAGW*' } +Add-Result 'CI Server' 'VAGW Bossd service' 'present only if installed with IT Security Tool' ($(if ($vagw) { ($vagw | ForEach-Object { "$($_.DisplayName)=$($_.Status)" }) -join ', ' } else { 'not installed' })) $null + +# --- Operating system -------------------------------------------------------- +$os = Get-CimInstance Win32_OperatingSystem +$supported = @('Windows 10 Pro', 'Windows 10 Enterprise', 'Windows 10 IoT Enterprise', 'Windows Server 2016', 'Windows Server 2019', 'Windows Server IoT 2019') +$osOk = $false; foreach ($s in $supported) { if ($os.Caption -like "*$s*") { $osOk = $true } } +Add-Result 'Windows' 'Operating system' 'Win10 Pro/Enterprise/IoT LTSB 2016/LTSC 2019, Server 2016/2019' "$($os.Caption) build $($os.BuildNumber)" $osOk +if ($os.Caption -like '*Windows 10 Pro*') { Add-Result 'Windows' 'Windows 10 Pro note' 'Vnet/IP drivers and IT Security Tool not supported on Win10 Pro' 'Windows 10 Pro' $null } + +# Visual effects: "Let Windows choose" = VisualFXSetting 0 +$vfx = Get-Reg 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects' 'VisualFXSetting' +Add-Result 'Windows' 'Visual effects' "Let Windows choose (0)" $(if ($null -eq $vfx) { 'not set (default = Let Windows choose)' } else { $vfx }) ($null -eq $vfx -or $vfx -eq 0) + +# Virtual memory: custom size = 1.5 x RAM, not automatic +$ramMB = [math]::Round((Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory / 1MB) +$auto = (Get-CimInstance Win32_ComputerSystem).AutomaticManagedPagefile +$pf = Get-CimInstance Win32_PageFileSetting -ErrorAction SilentlyContinue +$pfText = if ($pf) { ($pf | ForEach-Object { "$($_.Name) $($_.InitialSize)-$($_.MaximumSize) MB" }) -join '; ' } else { 'system managed' } +$want = [math]::Round($ramMB * 1.5) +$pfOk = (-not $auto) -and $pf -and (($pf | Where-Object { $_.InitialSize -ge $want * 0.95 -and $_.MaximumSize -ge $want * 0.95 }) -ne $null) +Add-Result 'Windows' 'Virtual memory' "custom, initial = max = ~$want MB (1.5 x $ramMB MB RAM)" "automatic=$auto; $pfText" $pfOk + +# Processor scheduling: Programs = Win32PrioritySeparation 0x26 (38) or 2 +$prio = Get-Reg 'HKLM:\SYSTEM\CurrentControlSet\Control\PriorityControl' 'Win32PrioritySeparation' +Add-Result 'Windows' 'Processor scheduling' 'Programs (38 or 2)' $prio ($prio -eq 38 -or $prio -eq 2) + +# Power plan +$plan = (powercfg /getactivescheme) 2>$null +Add-Result 'Windows' 'Power plan' 'High performance; never sleep/hibernate, disk and display never off' $plan ($plan -match 'High performance') + +# Fast startup +$hib = Get-Reg 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Power' 'HiberbootEnabled' +Add-Result 'Windows' 'Fast startup (HiberbootEnabled)' '0' $hib ($hib -eq 0) + +# Windows Defender +$defPol = Get-Reg 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' 'DisableAntiSpyware' +$defSvc = Get-Service WinDefend -ErrorAction SilentlyContinue +Add-Result 'Windows' 'Windows Defender' 'turned off by policy (use Yokogawa-approved antivirus)' "policy DisableAntiSpyware=$defPol; service=$(if ($defSvc) { $defSvc.Status } else { 'none' })" ($defPol -eq 1) + +# Automatic Windows updates +$au = Get-Reg 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' 'NoAutoUpdate' +Add-Result 'Windows' 'Automatic Windows updates' 'Disabled by policy (NoAutoUpdate=1)' $au ($au -eq 1) + +# Scheduled drive optimization and component cleanup +foreach ($t in @(@('\Microsoft\Windows\Defrag\', 'ScheduledDefrag', 'Automatic drive optimization'), @('\Microsoft\Windows\Servicing\', 'StartComponentCleanup', 'Automatic cleanup'))) { + $task = Get-ScheduledTask -TaskPath $t[0] -TaskName $t[1] -ErrorAction SilentlyContinue + Add-Result 'Windows' $t[2] 'Disabled' $(if ($task) { $task.State } else { 'task not found' }) ($task -and $task.State -eq 'Disabled') +} + +# .NET Framework 3.5 +$net35 = Get-Reg 'HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP\v3.5' 'Install' +Add-Result 'Windows' '.NET Framework 3.5' 'installed' $(if ($net35 -eq 1) { 'installed' } else { 'not installed' }) ($net35 -eq 1) + +# DCOM default authentication level: Connect = 2 +$dcom = Get-Reg 'HKLM:\SOFTWARE\Microsoft\Ole' 'LegacyAuthenticationLevel' +Add-Result 'Windows' 'DCOM Default Authentication Level' 'Connect (2)' $(if ($null -eq $dcom) { 'not set (default = Connect)' } else { $dcom }) ($null -eq $dcom -or $dcom -eq 2) + +# Display scale 100 % +$dpi = Get-Reg 'HKCU:\Control Panel\Desktop\WindowMetrics' 'AppliedDPI' +Add-Result 'Windows' 'Display scale' '100 % (96 DPI)' $(if ($null -eq $dpi) { 'unknown' } else { "$dpi DPI" }) ($dpi -eq 96) + +# 8dot3 file naming +$d83 = (fsutil behavior query disable8dot3) 2>$null | Select-Object -First 1 +Add-Result 'Windows' '8dot3 file naming' 'state 2 (per volume) or 0 (enabled)' $d83 ($d83 -match 'is:\s*[02]\b|\b[02] \(') + +# Regional settings (must not change after IT security is applied) +Add-Result 'Windows' 'Regional format / UI language' 'set before applying IT security; do not change afterwards' "$((Get-Culture).Name) / $((Get-UICulture).Name)" $null + +# --- IT security (Security Guide) -------------------------------------------- +$groups = 'CIX_OPERATOR', 'CIX_ENGINEER', 'CIX_MAINTENANCE', 'CIX_OPC' +foreach ($g in $groups) { + $lg = Get-LocalGroup -Name $g -ErrorAction SilentlyContinue + Add-Result 'IT security' "Local group $g" 'exists after IT Security Tool (standalone)' $(if ($lg) { 'exists' } else { 'missing' }) ([bool]$lg) +} +foreach ($u in 'CIX_PROCESS', 'CTM_PROCESS') { + $lu = Get-LocalUser -Name $u -ErrorAction SilentlyContinue + Add-Result 'IT security' "Local user $u" 'exists' $(if ($lu) { "exists, enabled=$($lu.Enabled)" } else { 'missing' }) ([bool]$lu) +} +$itsec = Test-Path 'C:\Program Files (x86)\YOKOGAWA\IA\iPCS\Platform\Security' +Add-Result 'IT security' 'IT Security Tool installed' 'yes, when installed with ciserver-...-ITSecurity.exe' $(if ($itsec) { 'yes' } else { 'no' }) $itsec + +foreach ($p in (Get-NetFirewallProfile -ErrorAction SilentlyContinue)) { + Add-Result 'Firewall' "Profile $($p.Name)" 'Enabled' $p.Enabled ($p.Enabled -eq $true) +} +$ports = @{ 'TCP 8080' = 8080; 'TCP 8443' = 8443; 'UDP 17001' = 17001; 'UDP 17101' = 17101; 'UDP 18002' = 18002 } +$allow = Get-NetFirewallRule -Direction Inbound -Action Allow -Enabled True -ErrorAction SilentlyContinue | Get-NetFirewallPortFilter -ErrorAction SilentlyContinue +foreach ($name in $ports.Keys) { + $proto, $num = $name.Split(' ') + $hit = $allow | Where-Object { $_.Protocol -eq $proto -and ($_.LocalPort -contains "$num" -or $_.LocalPort -contains 'Any') } + Add-Result 'Firewall' "Inbound $name allowed" 'yes (web / secure web / DURM / SMDMON)' $(if ($hit) { 'yes' } else { 'no rule found' }) ([bool]$hit) +} + +# --- Output -------------------------------------------------------------------- +foreach ($r in ($results | Sort-Object Area, Check)) { + "[{0,-5}] {1} / {2}: {3} (expected: {4})" -f $r.Status, $r.Area, $r.Check, $r.Actual, $r.Expected +} +$sum = $results | Group-Object Status | ForEach-Object { "$($_.Name)=$($_.Count)" } +"Summary: $($sum -join ', ') (OK = matches, DIFF = differs, CHECK = review manually)"