cliu/ci-server-engineer
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add phase 2 setup and security summaries, setup check script

Browse source 
Summarize CI Server Setup and Security Guide, add the draft
installation-security skill and tools/setup_check.ps1 (read-only
check practiced on the test system), and log ISS-008/009.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Clio Liu 2026-09-30 14:09:30 +10:00
parent 2caf1c8590
commit 5e58499fe5
8 changed files with 495 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

32
.claude/skills/installation-security/SKILL.md Normal file
View file

@ -0,0 +1,32 @@
---
name: installation-security
description: >-
CI Server R1.03 installation, upgrade and Windows/IT security. Use when the user wants to
prepare Windows for CI Server, check whether a machine meets the setup requirements, install,
reinstall, upgrade or uninstall CI Server, apply or extend a licence, install CI Server Remote
Connect, set up Vnet/IP drivers or network addresses, apply the IT Security Tool, check or
open firewall ports, manage the CIX_ groups and CIX_PROCESS account, or run CI Server on a
virtual machine. Sources IM 36K01C10-01EN and IM 36K01C30-01EN.
---
# Installation and security (R1.03)
Background: `knowledge/manuals/IM36K01C10-01EN.md` (Setup) and
`knowledge/manuals/IM36K01C30-01EN.md` (Security Guide). Known issues:
`knowledge/manuals/IM36K01A50-01EN.md` (IT Security tool, install path, VMs).
Rules:
- Run the `system-check` skill first.
- Installing, upgrading, changing Windows settings or IT security needs an elevated session,
changes the machine and often needs restarts: follow the user's chosen way of working and
confirm before each step. In *prepare only* mode, produce a checklist for the user.
- Never copy old setup files over new ones after an upgrade: compare and merge.
| Task | Where | Status |
|---|---|---|
| Check a machine against the setup and security requirements | `tasks/setup-check.md` | draft, awaiting confirmation |
| New installation (physical, VM, dual-redundant): order of work, Windows settings, Vnet/IP, install, IT security, licence | Setup summary §2 | from docs |
| Start/stop, reinstall, upgrade (incl. HAC), extend licence, uninstall | Setup summary §3 | from docs |
| Install CI Server Remote Connect; web ports | Setup summary §2.4 | from docs |
| Firewall ports for CI Server and drivers | Security Guide summary §3 | from docs (web, DURM, SMDMON ports checked) |
| IT Security Tool, user management types, CIX_ groups/accounts, change service account | Security Guide summary §2, §5 | from docs |

46
.claude/skills/installation-security/tasks/setup-check.md Normal file
View file

@ -0,0 +1,46 @@
---
task: Check a machine against the CI Server setup and security requirements
version: R1.03
source: IM 36K01C10-01EN §1, §2.1.2, §3.2.12; IM 36K01C30-01EN §2.2, §3.2; practiced on the test system 2026-09-30
status: draft, awaiting confirmation
---
# Setup check (read-only)
```
powershell -NoProfile -ExecutionPolicy Bypass -File tools\setup_check.ps1
```
Run from the repo root, preferably elevated. Changes nothing. One line per check:
`[OK]` matches the manual, `[DIFF]` differs, `[CHECK]` needs a human decision.
## What it checks
| Area | Checks |
|---|---|
| CI Server | Installed version (1.03.00), CI Service state, startup type and account (`.\CIX_PROCESS`), VAGW service |
| Windows | Supported OS, visual effects, processor scheduling, virtual memory (custom, 1.5 × RAM), power plan, fast startup, Windows Defender policy, automatic updates policy, scheduled defrag and component cleanup, .NET 3.5, DCOM authentication level, display scale, 8dot3 names, regional settings |
| IT security | `CIX_OPERATOR`, `CIX_ENGINEER`, `CIX_MAINTENANCE`, `CIX_OPC` groups, `CIX_PROCESS` / `CTM_PROCESS` users, IT Security Tool installed |
| Firewall | Profiles enabled; inbound allowed for TCP 8080, 8443, UDP 17001, 17101, 18002 |
## Reading the result
- `[DIFF]` on a development PC is normal; for a production server, fix each item with the
Setup summary's Windows settings table (`knowledge/manuals/IM36K01C10-01EN.md` §2) or by
running the IT Security Tool.
- The script finds the firewall rules only as "some rule allows this port"; check the rule
scope separately for production.
- Also read `%TLS_LOG_PATH%\ci_start.log` after a start: every service should report
`… started` and the log ends with `CI Server started`; look for `-E-` and `failed` lines.
The first lines show the version and build (e.g. `R1.03.00 … (r10200M)`).
- The web ports actually used are `SECURE_PORT_NUMBER` / `NON_SECURE_PORT_NUMBER` in
`%TLS_ROOT_PATH%\tls\sup\jwuiisg.sup` (8443 / 8080 by default).
## Test system result (2026-09-30)
Windows 10 Pro 19045 development PC without the IT Security Tool: 16 OK, 5 CHECK, 15 DIFF.
Differences: firewall domain/private profiles off; no `CIX_` groups or `CTM_PROCESS` (IT
Security Tool not installed; not supported on Windows 10 Pro); fast startup on; Balanced power
plan; automatic virtual memory; Defender on; automatic updates, defrag and cleanup not
disabled. Web ports 8443/8080. `ci_start.log`: all services started, one SSL certificate error
(`knowledge/issues.md` ISS-008).

2
knowledge/issues.md
View file

@ -26,3 +26,5 @@ development system (see "Test system" in `progress.md`); they do not exist on ot
| ISS-005 | 2026-09-30 | DATABASE (`dssqld`) | Loading `04_item_his_df.qli` straight after creating the storage group gave 2 errors once; three other runs were clean. Error text not captured. | open | Added a 5 s pause in `load.cmd`. If it happens again, capture `04_item_his_df.qlo`. | `examples/CI-Eng-Sample/load.cmd`; `.claude/skills/system-management/tasks/load-remove-records.md` | | ISS-005 | 2026-09-30 | DATABASE (`dssqld`) | Loading `04_item_his_df.qli` straight after creating the storage group gave 2 errors once; three other runs were clean. Error text not captured. | open | Added a 5 s pause in `load.cmd`. If it happens again, capture `04_item_his_df.qlo`. | `examples/CI-Eng-Sample/load.cmd`; `.claude/skills/system-management/tasks/load-remove-records.md` |
| ISS-006 | 2026-09-30 | HISTORY (`ithloahis`) | Samples dated before the start of the current storage unit were not stored (no error shown); samples after it were. Also, a new storage group stored nothing until CI Server was restarted. | open | Confirm with History Management (IM 36K10L20) in phase 9: how to load into older units, and whether a restart is really required. | `.claude/skills/system-management/tasks/load-history.md`; `examples/CI-Eng-Sample/README.md`; `knowledge/manuals/IM36K10J10-01EN.md` command-line tools | | ISS-006 | 2026-09-30 | HISTORY (`ithloahis`) | Samples dated before the start of the current storage unit were not stored (no error shown); samples after it were. Also, a new storage group stored nothing until CI Server was restarted. | open | Confirm with History Management (IM 36K10L20) in phase 9: how to load into older units, and whether a restart is really required. | `.claude/skills/system-management/tasks/load-history.md`; `examples/CI-Eng-Sample/README.md`; `knowledge/manuals/IM36K10J10-01EN.md` command-line tools |
| ISS-007 | 2026-09-30 | INTEGRATION (monitoring) | `intdskmon` wrote 61.9 for a C: drive that is 61.9 % used / 38.1 % free, although the manual says it monitors the disk free space rate. `intspawn` did nothing when the command path was ~130 characters; a short path worked (limit unknown). | open | Confirm the disk value meaning and the path limit. | `.claude/skills/system-management/tasks/monitoring-processes.md`; `knowledge/manuals/IM36K10J10-01EN.md` §4.1.6; `examples/CI-Eng-Sample/monitoring/` | | ISS-007 | 2026-09-30 | INTEGRATION (monitoring) | `intdskmon` wrote 61.9 for a C: drive that is 61.9 % used / 38.1 % free, although the manual says it monitors the disk free space rate. `intspawn` did nothing when the command path was ~130 characters; a short path worked (limit unknown). | open | Confirm the disk value meaning and the path limit. | `.claude/skills/system-management/tasks/monitoring-processes.md`; `knowledge/manuals/IM36K10J10-01EN.md` §4.1.6; `examples/CI-Eng-Sample/monitoring/` |
| ISS-008 | 2026-09-30 | ACCESS (web/OPC UA server?) | `ci_start.log` on the test system shows `CppServerAPI::Run() failed: InitializeSslCtx(): SSL_CTX_use_certificate_chain_file() failed.` right after ACCESS Service starts. Which component and certificate is not known. | open | Identify in phase 7 (OPC Interface IM 36K10E20, Data Access IM 36K10L45). | `.claude/skills/installation-security/tasks/setup-check.md`; the phase 7 skill |
| ISS-009 | 2026-09-30 | Security Guide | DCOM port range printed as 20500–20550 in the firewall table but "2500–20550" in the OPC configuration table. Taken as a typo for 20500–20550. | open | Confirm on a system with IT security applied. | `knowledge/manuals/IM36K01C30-01EN.md` §4 |

159
knowledge/manuals/IM36K01C10-01EN.md Normal file
View file

@ -0,0 +1,159 @@
---
manual: IM 36K01C10-01EN
title: CI Server Setup
edition: 3rd Edition, Sep. 2023
version: R1.03
status: from docs (Windows settings checked read-only on the test system with tools/setup_check.ps1)
---
# CI Server Setup (R1.03)
New installation, maintenance (start/stop, reinstall, upgrade, licence, uninstall) and network
tools. Section numbers refer to the manual.
## 1. Before you start
- Needed: the CI Server software medium (or its ISO) and one **Activated License File per
server** (an upgrade needs one that includes the Upgrade License).
- Supported OS for R1.03: Windows 10 Pro / Enterprise (64-bit), Windows 10 Enterprise and IoT
Enterprise 2016 LTSB and 2019 LTSC, Windows Server 2016, Windows Server 2019, Windows Server
IoT 2019. On **Windows 10 Pro/Enterprise (non-LTSB/LTSC) the Vnet/IP drivers and the IT
Security Tool are not supported**. VMs run Windows Server 2019.
- Only listed software may coexist: Chrome / Firefox / Edge 112, Microsoft Office 2016/2019/365
(Excel Add-in), PI AF SDK 2.10.5 + .NET 4.6.2, Adobe Acrobat (Reader) DC, Yokogawa standard
antivirus, Standard Whitelisting Software for Endpoint Security. Anything else may disturb CI Server.
## 2. New setup
### Order of work (§2.1, physical machine)
1. (Vnet/IP only) Set DIP switches and fit the Vnet/IP card (VI702).
2. Configure Windows settings (below).
3. (Vnet/IP only) Install control bus driver and Vnet/IP open communication driver, then set
Windows network settings.
4. Install CI Server (with or without the IT Security Tool).
5. Apply IT security settings (IT Security Tool; Domain Link Management Tool for linked domain).
6. Apply the CI Server licence.
On a VM (§2.2): mount the ISO, Windows settings, (Vnet/IP) **Vnet/IP Interface Package**
instead of drivers/card, VM network settings, install, IT security, licence, then VM
settings (auto start/shutdown with host, allow RDP from thin clients, disable NetBIOS over
TCP/IP, network metrics favouring the plant network). On VMs, adapters not used for Vnet/IP
must not use 192.168.0.0/16. Dual-redundant platform: see §2.3 and IM 30A05C30.
### Windows settings (§2.1.2)
| Setting | Required value |
|---|---|
| Security patches | Apply per company policy before going live; patch promptly later |
| Visual effects | *Let Windows choose what's best* |
| Processor scheduling | *Programs* |
| Virtual memory | Custom size, initial = maximum = 1.5 × RAM (e.g. 6 GB RAM → 9216 MB); restart |
| Power | *High performance*; disk, sleep, hibernate, display: never; hybrid sleep off; wake timers off; power button = shut down |
| Fast startup | Off: run `<DVD>\Windows\Tool\HiberbootDisabled.bat` as administrator (`HiberbootEnabled` = 0); required before Vnet/IP drivers on Win10 |
| Windows Defender | Turned off by group policy (Server 2016: *Turn off Windows Defender*; 2019: *Turn off Windows Defender Antivirus*) |
| Automatic Windows updates | Disabled by group policy (*Configure Automatic Updates* = Disabled). With WSUS: install CI Server first, then disable from WSUS |
| Drive optimization | Scheduled optimization off |
| Automatic cleanup | Task Scheduler › Microsoft › Windows › Servicing › `StartComponentCleanup` disabled |
| Windows updates | KB5023702 (2023-03) on Win10 2019 LTSC / Server 2019, or folder permissions may be wrong |
| .NET Framework 3.5.1 | Installed (`dism /online /enable-feature /featurename:NetFX3 /all /Source:<DVD>:\sources\sxs /limitaccess`, or Server Manager feature) |
| DCOM | Default Authentication Level = *Connect*; restart |
| Display | Scale 100 % |
| 8dot3 names | `fsutil behavior set disable8dot3 2`; restart |
### Vnet/IP (§2.1.1, §2.1.3, §2.1.4)
- Card DIP switches: domain 1–16, station 1–64 (start from 64 downwards), each with odd
parity; action-mode switch all OFF. One card per computer; card before drivers.
- Drivers from `<DVD>\Windows\VnetVirtualProduct\VirtualProduct_CIServer_package*.zip` →
`installVirtProd.cmd` (VM: `installVirtProdVPF.cmd`), as administrator, antivirus off.
- Rename connections: *Ethernet*, *Vnet*, *VnetIPOpen* (VM: *VnetIPBUS1*, *VnetIPBUS2*,
*RemoteUINetwork*). Disable IPv6; Vnet uses only *Yokogawa Vnet Protocol* + IPv4.
- Default addresses: Ethernet `172.17.<domain>.<station>`/16; control bus `172.16.<domain>.<station>`/16;
Vnet/IP open `192.168.<128+domain>.<129+station>`/24; VM remote UI `172.18.<domain>.<station>`/16.
- Computer name = station name. Check `sc query VLTDI` = RUNNING.
- Never use Internet Connection Sharing, bridge connections or Homegroup.
- Run the TCP/IP Inconsistency Detect Tool before installing CI Server (§3.8).
### Installing CI Server (§2.1.5)
- Run as a local administrator (domain types: domain admin or local admin + domain credentials);
join the domain first for domain/combination management.
- Close applications, disable antivirus, never run two installers, never install where CI
Server Remote Connect is installed.
- `<DVD>\Windows\CIServer\ciserver-R<ver>-r<build>M-setup.exe` = CI Server only;
`…-ITSecurity.exe` = CI Server + IT Security Tool (also installs VAGW modules; install type
*CI Server and IT Security Tool*). Choose the install folder (no spaces if non-default,
see known issues), reboot.
- **Change the initial passwords of the predefined CI Server user accounts** (Engineering
Module manual).
### IT security (§2.1.6) and licence (§2.1.7)
- IT Security Tool: select *Standard Model* and the user management type; keep default items;
restart. The model must be the same across the system. Save/export settings if you change
defaults. Running the tool (also during upgrade) overwrites manual security changes.
- Licence: Start menu › *License Authorization Wizard* (admin) › select the activated licence
file › Finish.
### CI Server Remote Connect (§2.4)
On a CI View PC (never on a Portal or Core): browse to `http(s)://<portal>:<port>` (defaults
8080 / 8443), *Download (Windows)*, run `CI-rc-setup.exe`. Portal ports are in `jwuiisg.sup`
(Setup File Editor › *Client communication* tab); open them in the firewalls.
### Virtualization extras (§2.5)
RD Session Host + RD Licensing (per device) for USB redirection; limit connections to 1;
allow multiple sessions per user; enable *Windows Audio* and the *System Sound Service* task
for sound over RDP.
## 3. Maintenance
**Start/stop (§3.1)**: Start menu › CI Server › *Start CI Server* / *Stop CI Server*, or the
*CI Service* Windows service (set startup type *Automatic* for automatic start). An expired
licence gives an error at start.
**Reinstall / upgrade (§3.2)**, upgrades from R1.02 or earlier (needs a Product Maintenance
Licence):
1. Database consistency: `dsschk`, `dsschk -r`, `dsschk -e`, `dsschk -e -r` (upgrade only).
2. Stop CI Server; set the CI Service startup type to *Manual*.
3. Stop the *VAGW Bossd* service, then back up `%TLS_ALLUSERS_PATH%` and `%TLS_ROOT_PATH%\tls`
(plus project files).
4. On the Core (upgrade): delete in `%TLS_SAV_PATH%` `eqp*_main.*`, `eqp*_item.*`, `opx*.*`
(`.sav/.d01/.k01`) and `*.sqlite`.
5. Note changed setup files (Setup File Editor, *Status* = Changed) and copy
`tls\com`, `sup`, `tpl`, `src` and `%TLS_ALLUSERS_PATH%\wap`.
6. (Vnet/IP) Update drivers (uninstall, reinstall, restart) and network settings.
7. Install over the top (no uninstall); if IT Security Tool was installed before, install it again.
8. IT security, licence.
9. Restore: **compare and merge** changes into the new files (never copy old files over new
ones), including `wap\cfg\operatorInterfaces\DEPLOY\layouts\`; re-apply IT security.
10. Verify: start, `dsschk -e -r` three times, restart, check `%TLS_LOG_PATH%\ci_start.log`,
restore the startup type.
- ODBC: if the Simba client version differs, remove DSNs, uninstall and reinstall the client;
on R1.02 or older with the Simba server, uninstall the server before upgrading.
- Passwords of predefined CI Server accounts are reset to the initial ones: change them again.
**HAC upgrade (§3.3)**: stop standby, disconnect its network, upgrade and test offline, stop
standby, stop primary, reconnect standby and start it, upgrade primary, start it (sync resumes).
**Extend licence (§3.4)**: License Authorization Wizard while running; node name/number must
match; takes effect within an hour. New features need CI Server stopped first.
**Uninstall (§3.5, §3.6)**: back up, stop CI Server and VAGW Bossd, Programs and Features ›
CI Server › Uninstall, restart. Remote Connect: uninstall it, then CI Server (IT Security
definitions), then run `<DVD>\Windows\CIServer\ITSecurity\DeleteITSecurity.cmd`.
**TCP/IP tools (§3.8)**: from the VirtualProduct package `XCM3003\Module\Tool`:
`TcpipInconsistencyDetector.cmd` (check) and `TcpipInconsistencyRepair.cmd` (resets all NIC
IPv4 settings: note them first, re-enter after restart).
## Troubleshooting (Appendix 1)
| Problem | Workaround |
|---|---|
| Server Manager error, Microsoft updates fail (80070543), .NET install fails | Temporarily set DCOM Default Authentication Level to *Connect* (revert to *None* afterwards where the manual says so), restart |
| Cannot manage users in Control Panel | Use Computer Management › Local Users and Groups |
| Installed updates not listed | `wmic qfe list full` |
| Cannot change time zone (Server 2019 with UAC) | Run `timedate.cpl` as administrator |

114
knowledge/manuals/IM36K01C30-01EN.md Normal file
View file

@ -0,0 +1,114 @@
---
manual: IM 36K01C30-01EN
title: CI Server Security Guide
edition: 3rd Edition, Sep. 2023
version: R1.03
status: from docs (users/groups and firewall checked read-only on the test system)
---
# CI Server Security Guide (R1.03)
What the IT Security Tool changes, which Windows accounts and firewall openings CI Server
needs, and the related utilities. Section numbers refer to the manual.
## 1. Threats and measures
- Threats: attacks over the network, direct attacks at a terminal, theft of a computer/data.
- Measures: access control (files, folders, registry, DCOM/OPC, system commands), personal
firewall, stopping unused services, IT environment settings (NetBIOS, disk password), and
group policies (password/lockout, security options, software restriction, audit policies,
administrative templates, safe DLL search order).
- IT security settings **must** be applied at the area and process levels; business and
corporate levels follow the site's own policy.
## 2. Security model and user management
- CI Server supports only the **Standard model**: protects against network and terminal
attacks, **not** against theft. Password and lockout policies are *not* set by it (use
domain policy).
- User management types:
| Type | Accounts kept on | Notes |
|---|---|---|
| Standalone | Each computer | Small systems; admin and product maintenance rights not separable |
| Domain | Domain controller | Central; rights separable |
| Combination | Domain, plus local fallback | Local `_LCL` groups for emergencies |
| Linked domain (recommended for new systems) | Domain, linked to local groups | Apply *Standalone* first, join domain, then link with Domain Link Management Tool |
- Groups/accounts created by the IT Security Tool (standalone: local; domain types: on the
domain controller, with `_LCL` local helper groups):
| Name | Kind | Purpose |
|---|---|---|
| `CIX_OPERATOR` | Group | Operators |
| `CIX_ENGINEER` | Group | Engineering (Engineering / Edit Module) |
| `CIX_MAINTENANCE` | Group (also Administrators) | Installation and maintenance |
| `CIX_OPC` | Group | OPC configuration and communication |
| `CIX_PROCESS` | User | Runs CI Server services and CI OPC servers |
| `CTM_PROCESS` | User | Runs VAGW services |
| `RDC_PROCESS` | User | Dual-redundant platform only |
| `VNT_*` | Groups/users | Vnet/IP Interface Package (no sign-in rights) |
Use these accounts only for CI Server. Changing the security model may delete or rename groups.
## 3. Firewall (§3.2)
Windows Firewall on; block everything except what CI Server needs:
| Use | Port |
|---|---|
| Web / secure web (CI View, CI Portal) | TCP 8080 / 80, TCP 8443 / 443 |
| DURM between nodes | UDP 17001, 17101 (one per DURM line) |
| SMDMON (system log collection) | UDP 18002 |
| Remote desktop (only if needed, restrict users) | TCP 3389 |
| HAC | UDP 16000–16006 (`hac.sup`, `jhacProperties\application.properties`); HACW_HMI UDP 16010–16041 |
| ODBC (SimbaServer, Core only) | TCP 1583 |
| Alarm e-mail | TCP 25 |
| NTP/SNTP (not needed with Vnet/IP) | 123 |
| OPC classic | TCP 135, 139, DCOM 20500–20550 (customizable); UDP 137, 138 |
| OPC UA | UDP 4840 discovery; communication port configurable |
| Vnet equipment (`odeq.exe`) | TCP 44818 |
| Equipment drivers | Rockwell CIP / PLC5 / Fisher ROC TCP 44818; DAQ TCP 34260, 34434; DNP3 TCP 20000; FA-M3 TCP 12289; IEC 60870-5-104 TCP 2404; IEC 61850 TCP 102; MeTro TCP 7075; Modbus TCP 502; STARDOM FCX TCP 1090 |
| Windows domain | DNS 53, Kerberos 88, LDAP 389, SMB 445, GC 3268/3269, DHCP 67, discovery 137/138/1900/3702/5355 + TCP 2869/5357/5358, MADCAP 2535, AD Web 9389 |
| Dual-redundant platform (PRC) | TCP 34480, 34483–34486; UDP 1311 |
ICMP echo (ping) is allowed by the Standard model.
## 4. Other settings (§3.3–§3.6)
- Unused services disabled by the tool (depending on OS): Diagnostic Policy, Connected User
Experiences and Telemetry, dmwappushsvc, Downloaded Maps Manager, IP Helper, Program
Compatibility Assistant, Remote Registry, Shell Hardware Detection, Themes, Windows Push
Notifications, and others. DHCP Client must stay running.
- OPC: *Create permanent shared objects* right for `CIX_OPC`, `CIX_PROCESS`, `CTM_PROCESS`;
network access sharing model *Classic*; DCOM port range 20500–20550 (the manual's table
also prints "2500–20550", taken as a typo).
- NetBIOS over TCP/IP can be disabled (default with domain/combination management); then
configure HOSTS/DNS for name resolution.
- USB storage disabled; use the StorageDeviceCTL utility (members of `CIX_MAINTENANCE`) to
allow writing temporarily.
## 5. Tools (§4)
| Tool | Use |
|---|---|
| IT Security Tool (Start › YOKOGAWA Security) | *Setup* (model + management type), *Save*/*Restore* (with a default password for recreated accounts), *Change Password* of the saved file, *Import*/*Export*, *Information* (summary) |
| Domain Link Management Tool | Link/unlink the domain (linked domain management); sign in as local admin + `CIX_MAINTENANCE` |
| `PrepareReconstruction.cmd` then `ciserver-…-ITSecurity.exe` › *Apply IT Security only* | Re-apply with different target components |
| `Yokogawa.IA.iPCS.Platform.Security.CreateCIXProcess.exe [-p <password>]` (`<DVD>\Windows\CIServer\ITSecurity`) | Create `CIX_PROCESS` or set its password; same password on all collaborating computers; restart |
| `…CreateCTMProcess.exe [-p <password>]` | Same for `CTM_PROCESS` |
| `ITSecuritySettingItemExport.exe` | Export applied settings |
| `YWVNETCreateVNTUser` | Change passwords of the Vnet/IP Interface Package users (VM) |
**Changing the account that runs CI Server (§4.9)**: create the user, add it to
Administrators (and `RDC_GA_CLIENT` on a dual-redundant platform; `CIX_OPC` or
`CIX_OPC_LCL` when IT security is applied), set it on the *CI Service* Log On tab and on the
Identity tab of *CI OPC AE Server* and *CI OPC DA Server* in Component Services › DCOM Config.
## 6. Optional hardening (§5)
Extra settings the site may add: audit policies and event log sizes, disable recovery
console and Guest account, restrict audit log and removable media access, immediate
screen-saver password, SNMP, SSL/TLS registry settings, secure startup and
`AllowedPaths` registry keys, remove *Everyone* for anonymous users, remove unused
protocols, block malicious DLL loading.

11
knowledge/progress.md
View file

@ -31,8 +31,8 @@ AID is not needed.
|---|---|---|---| |---|---|---|---|
| 0 | IM 36K01A50 | Release Information | summarized ([notes](manuals/IM36K01A50-01EN.md)) | | 0 | IM 36K01A50 | Release Information | summarized ([notes](manuals/IM36K01A50-01EN.md)) |
| 1 | IM 36K10J10 | System Design/Management | done except migration (phase 6) and debugging tools; skill `system-management` ([notes](manuals/IM36K10J10-01EN.md)) | | 1 | IM 36K10J10 | System Design/Management | done except migration (phase 6) and debugging tools; skill `system-management` ([notes](manuals/IM36K10J10-01EN.md)) |
| 2 | IM 36K01C10 | CI Server Setup | not started | | 2 | IM 36K01C10 | CI Server Setup | summarized ([notes](manuals/IM36K01C10-01EN.md)); skill `installation-security` (draft) |
| 2 | IM 36K01C30 | Security Guide | not started | | 2 | IM 36K01C30 | Security Guide | summarized ([notes](manuals/IM36K01C30-01EN.md)); skill `installation-security` (draft) |
| 3 | IM 36K10G10 | Tutorial | not started | | 3 | IM 36K10G10 | Tutorial | not started |
| 4 | IM 36K10R10 | CI Portal Setup | not started | | 4 | IM 36K10R10 | CI Portal Setup | not started |
| 4 | IM 36K10R20 | Setup File Editor | not started | | 4 | IM 36K10R20 | Setup File Editor | not started |
@ -90,3 +90,10 @@ now come before classes and objects (phase 6), and the other interfaces follow a
| J10 | Backup of `tls` folders | not practiced | n/a | Plan only; the actual backup tool is site-specific. | | J10 | Backup of `tls` folders | not practiced | n/a | Plan only; the actual backup tool is site-specific. |
| J10 | Migration between systems (§5.6) | not practiced | pending | Needs engineered data; revisit after phase 6. | | J10 | Migration between systems (§5.6) | not practiced | pending | Needs engineered data; revisit after phase 6. |
| J10 | Tuning checks (read-only) ([task](../.claude/skills/system-management/tasks/tuning-checks.md)) | passed | n/a | Read `dur.sup` (max processes 250), `itm.sup` (item pool 650,000 KB) and the automatic health snapshots `tls\log\smd_*.log` (common memory free, queue use per process, lock collisions). Debug launchers and interactive debuggers not practiced. | | J10 | Tuning checks (read-only) ([task](../.claude/skills/system-management/tasks/tuning-checks.md)) | passed | n/a | Read `dur.sup` (max processes 250), `itm.sup` (item pool 650,000 KB) and the automatic health snapshots `tls\log\smd_*.log` (common memory free, queue use per process, lock collisions). Debug launchers and interactive debuggers not practiced. |
| C10/C30 | Setup check script `tools/setup_check.ps1` ([task](../.claude/skills/installation-security/tasks/setup-check.md)) | practiced, awaiting confirmation | n/a | Read-only; 16 OK / 5 CHECK / 15 DIFF on the Win10 Pro test PC. |
| C10 | Read `ci_start.log` and web ports (`jwuiisg.sup`) | practiced, awaiting confirmation | n/a | All services started; SSL error [ISS-008](issues.md). |
| C10 | Start / stop CI Server | passed (phase 1) | n/a | Via the CI Service (elevated). Start-menu shortcuts not used. |
| C10 | New install, reinstall, upgrade, uninstall, licence | not practiced | n/a | Would reinstall or change the test system; only the installed R1.03 is available. Skipped. |
| C10 | Windows settings changes (power, virtual memory, Defender, updates, …) | not practiced | n/a | Changes the test PC's OS; needs the user's go-ahead. Skipped. |
| C10 | Vnet/IP drivers / Vnet/IP Interface Package | not practiced | n/a | No Vnet/IP card; not supported on Windows 10 Pro. |
| C30 | IT Security Tool, Domain Link Management, account utilities | not practiced | n/a | Not installed and not supported on Windows 10 Pro. |

4
tools/README.md
View file

@ -3,3 +3,7 @@
Helper scripts Claude can run. Scripts that read the manuals must not hard-code their Helper scripts Claude can run. Scripts that read the manuals must not hard-code their
location; take it from an argument or environment variable, with location; take it from an argument or environment variable, with
`C:\Users\Public\Yokogawa\tls\doc\EN\` as the default. `C:\Users\Public\Yokogawa\tls\doc\EN\` as the default.
| Script | Purpose |
|---|---|
| `setup_check.ps1` | Read-only check of a machine against the CI Server R1.03 setup and security requirements (skill `installation-security`) |

129
tools/setup_check.ps1 Normal file
View file

@ -0,0 +1,129 @@
# CI Server R1.03 - read-only setup check
# Compares a machine with the Windows settings required by CI Server Setup (IM 36K01C10-01EN §2.1.2)
# and the IT security state described in the Security Guide (IM 36K01C30-01EN §2.2, §3.2).
# Changes nothing. Run in Windows PowerShell 5.1; some checks need an elevated session.
# Usage: powershell -NoProfile -ExecutionPolicy Bypass -File tools\setup_check.ps1
$results = New-Object System.Collections.Generic.List[object]
function Add-Result($area, $check, $expected, $actual, $ok) {
$status = 'CHECK'
if ($ok -eq $true) { $status = 'OK' } elseif ($ok -eq $false) { $status = 'DIFF' }
$results.Add([pscustomobject]@{ Status = $status; Area = $area; Check = $check; Expected = $expected; Actual = "$actual" })
}
function Get-Reg($path, $name) {
try { (Get-ItemProperty -Path $path -Name $name -ErrorAction Stop).$name } catch { $null }
}
# --- CI Server ---------------------------------------------------------------
$ci = $null
foreach ($k in 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*', 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*') {
foreach ($i in (Get-ItemProperty $k -ErrorAction SilentlyContinue)) { if ($i.DisplayName -like 'CI Server R*') { $ci = $i } }
}
if ($ci) { Add-Result 'CI Server' 'Installed version' '1.03.00' $ci.DisplayVersion ($ci.DisplayVersion -eq '1.03.00') }
else { Add-Result 'CI Server' 'Installed version' '1.03.00' 'not found' $false }
$svc = Get-Service StartCIServer -ErrorAction SilentlyContinue
if ($svc) {
Add-Result 'CI Server' 'CI Service state' 'Running (when in use)' $svc.Status $null
Add-Result 'CI Server' 'CI Service startup type' 'Automatic in operation; Manual during upgrade' $svc.StartType $null
$acct = (Get-CimInstance Win32_Service -Filter "Name='StartCIServer'" -ErrorAction SilentlyContinue).StartName
Add-Result 'CI Server' 'CI Service account' '.\CIX_PROCESS (default)' $acct ($acct -like '*CIX_PROCESS')
}
$vagw = Get-Service | Where-Object { $_.DisplayName -like 'VAGW*' }
Add-Result 'CI Server' 'VAGW Bossd service' 'present only if installed with IT Security Tool' ($(if ($vagw) { ($vagw | ForEach-Object { "$($_.DisplayName)=$($_.Status)" }) -join ', ' } else { 'not installed' })) $null
# --- Operating system --------------------------------------------------------
$os = Get-CimInstance Win32_OperatingSystem
$supported = @('Windows 10 Pro', 'Windows 10 Enterprise', 'Windows 10 IoT Enterprise', 'Windows Server 2016', 'Windows Server 2019', 'Windows Server IoT 2019')
$osOk = $false; foreach ($s in $supported) { if ($os.Caption -like "*$s*") { $osOk = $true } }
Add-Result 'Windows' 'Operating system' 'Win10 Pro/Enterprise/IoT LTSB 2016/LTSC 2019, Server 2016/2019' "$($os.Caption) build $($os.BuildNumber)" $osOk
if ($os.Caption -like '*Windows 10 Pro*') { Add-Result 'Windows' 'Windows 10 Pro note' 'Vnet/IP drivers and IT Security Tool not supported on Win10 Pro' 'Windows 10 Pro' $null }
# Visual effects: "Let Windows choose" = VisualFXSetting 0
$vfx = Get-Reg 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects' 'VisualFXSetting'
Add-Result 'Windows' 'Visual effects' "Let Windows choose (0)" $(if ($null -eq $vfx) { 'not set (default = Let Windows choose)' } else { $vfx }) ($null -eq $vfx -or $vfx -eq 0)
# Virtual memory: custom size = 1.5 x RAM, not automatic
$ramMB = [math]::Round((Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory / 1MB)
$auto = (Get-CimInstance Win32_ComputerSystem).AutomaticManagedPagefile
$pf = Get-CimInstance Win32_PageFileSetting -ErrorAction SilentlyContinue
$pfText = if ($pf) { ($pf | ForEach-Object { "$($_.Name) $($_.InitialSize)-$($_.MaximumSize) MB" }) -join '; ' } else { 'system managed' }
$want = [math]::Round($ramMB * 1.5)
$pfOk = (-not $auto) -and $pf -and (($pf | Where-Object { $_.InitialSize -ge $want * 0.95 -and $_.MaximumSize -ge $want * 0.95 }) -ne $null)
Add-Result 'Windows' 'Virtual memory' "custom, initial = max = ~$want MB (1.5 x $ramMB MB RAM)" "automatic=$auto; $pfText" $pfOk
# Processor scheduling: Programs = Win32PrioritySeparation 0x26 (38) or 2
$prio = Get-Reg 'HKLM:\SYSTEM\CurrentControlSet\Control\PriorityControl' 'Win32PrioritySeparation'
Add-Result 'Windows' 'Processor scheduling' 'Programs (38 or 2)' $prio ($prio -eq 38 -or $prio -eq 2)
# Power plan
$plan = (powercfg /getactivescheme) 2>$null
Add-Result 'Windows' 'Power plan' 'High performance; never sleep/hibernate, disk and display never off' $plan ($plan -match 'High performance')
# Fast startup
$hib = Get-Reg 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Power' 'HiberbootEnabled'
Add-Result 'Windows' 'Fast startup (HiberbootEnabled)' '0' $hib ($hib -eq 0)
# Windows Defender
$defPol = Get-Reg 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' 'DisableAntiSpyware'
$defSvc = Get-Service WinDefend -ErrorAction SilentlyContinue
Add-Result 'Windows' 'Windows Defender' 'turned off by policy (use Yokogawa-approved antivirus)' "policy DisableAntiSpyware=$defPol; service=$(if ($defSvc) { $defSvc.Status } else { 'none' })" ($defPol -eq 1)
# Automatic Windows updates
$au = Get-Reg 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' 'NoAutoUpdate'
Add-Result 'Windows' 'Automatic Windows updates' 'Disabled by policy (NoAutoUpdate=1)' $au ($au -eq 1)
# Scheduled drive optimization and component cleanup
foreach ($t in @(@('\Microsoft\Windows\Defrag\', 'ScheduledDefrag', 'Automatic drive optimization'), @('\Microsoft\Windows\Servicing\', 'StartComponentCleanup', 'Automatic cleanup'))) {
$task = Get-ScheduledTask -TaskPath $t[0] -TaskName $t[1] -ErrorAction SilentlyContinue
Add-Result 'Windows' $t[2] 'Disabled' $(if ($task) { $task.State } else { 'task not found' }) ($task -and $task.State -eq 'Disabled')
}
# .NET Framework 3.5
$net35 = Get-Reg 'HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP\v3.5' 'Install'
Add-Result 'Windows' '.NET Framework 3.5' 'installed' $(if ($net35 -eq 1) { 'installed' } else { 'not installed' }) ($net35 -eq 1)
# DCOM default authentication level: Connect = 2
$dcom = Get-Reg 'HKLM:\SOFTWARE\Microsoft\Ole' 'LegacyAuthenticationLevel'
Add-Result 'Windows' 'DCOM Default Authentication Level' 'Connect (2)' $(if ($null -eq $dcom) { 'not set (default = Connect)' } else { $dcom }) ($null -eq $dcom -or $dcom -eq 2)
# Display scale 100 %
$dpi = Get-Reg 'HKCU:\Control Panel\Desktop\WindowMetrics' 'AppliedDPI'
Add-Result 'Windows' 'Display scale' '100 % (96 DPI)' $(if ($null -eq $dpi) { 'unknown' } else { "$dpi DPI" }) ($dpi -eq 96)
# 8dot3 file naming
$d83 = (fsutil behavior query disable8dot3) 2>$null | Select-Object -First 1
Add-Result 'Windows' '8dot3 file naming' 'state 2 (per volume) or 0 (enabled)' $d83 ($d83 -match 'is:\s*[02]\b|\b[02] \(')
# Regional settings (must not change after IT security is applied)
Add-Result 'Windows' 'Regional format / UI language' 'set before applying IT security; do not change afterwards' "$((Get-Culture).Name) / $((Get-UICulture).Name)" $null
# --- IT security (Security Guide) --------------------------------------------
$groups = 'CIX_OPERATOR', 'CIX_ENGINEER', 'CIX_MAINTENANCE', 'CIX_OPC'
foreach ($g in $groups) {
$lg = Get-LocalGroup -Name $g -ErrorAction SilentlyContinue
Add-Result 'IT security' "Local group $g" 'exists after IT Security Tool (standalone)' $(if ($lg) { 'exists' } else { 'missing' }) ([bool]$lg)
}
foreach ($u in 'CIX_PROCESS', 'CTM_PROCESS') {
$lu = Get-LocalUser -Name $u -ErrorAction SilentlyContinue
Add-Result 'IT security' "Local user $u" 'exists' $(if ($lu) { "exists, enabled=$($lu.Enabled)" } else { 'missing' }) ([bool]$lu)
}
$itsec = Test-Path 'C:\Program Files (x86)\YOKOGAWA\IA\iPCS\Platform\Security'
Add-Result 'IT security' 'IT Security Tool installed' 'yes, when installed with ciserver-...-ITSecurity.exe' $(if ($itsec) { 'yes' } else { 'no' }) $itsec
foreach ($p in (Get-NetFirewallProfile -ErrorAction SilentlyContinue)) {
Add-Result 'Firewall' "Profile $($p.Name)" 'Enabled' $p.Enabled ($p.Enabled -eq $true)
}
$ports = @{ 'TCP 8080' = 8080; 'TCP 8443' = 8443; 'UDP 17001' = 17001; 'UDP 17101' = 17101; 'UDP 18002' = 18002 }
$allow = Get-NetFirewallRule -Direction Inbound -Action Allow -Enabled True -ErrorAction SilentlyContinue | Get-NetFirewallPortFilter -ErrorAction SilentlyContinue
foreach ($name in $ports.Keys) {
$proto, $num = $name.Split(' ')
$hit = $allow | Where-Object { $_.Protocol -eq $proto -and ($_.LocalPort -contains "$num" -or $_.LocalPort -contains 'Any') }
Add-Result 'Firewall' "Inbound $name allowed" 'yes (web / secure web / DURM / SMDMON)' $(if ($hit) { 'yes' } else { 'no rule found' }) ([bool]$hit)
}
# --- Output --------------------------------------------------------------------
foreach ($r in ($results | Sort-Object Area, Check)) {
"[{0,-5}] {1} / {2}: {3} (expected: {4})" -f $r.Status, $r.Area, $r.Check, $r.Actual, $r.Expected
}
$sum = $results | Group-Object Status | ForEach-Object { "$($_.Name)=$($_.Count)" }
"Summary: $($sum -join ', ') (OK = matches, DIFF = differs, CHECK = review manually)"