cliu
b85a65250c
Read-only re-check on the shared R1.05 test server plus a diff of the R1.03 and R1.05 manual editions. - installation-security: R1.05 OS list, Defender exceptions, IT security 2.0/3.0, LAPS, automatic configuration merge (jupgutl), PRM chapter, port 34597; setup_check.ps1 gets -Version (default 1.05.00). - data-access: L45 renumbered (new ch. 4 RESTful API), extended OPC UA functions off by default, OPC UA methods (OPCUAC_METHOD_CALL2_DF), Information Model Mapper, ServerConfig.xml in %TLS_SAV_PATH%. - equipment: Modbus unchanged; IEC 104/61850 run as EQT managers (eqtdbg, eqtfrcscn), IEC 61850 report control blocks, upgrade steps. - Issues ISS-076..090; R1.05 notes on ISS-003/008/032/034/061; progress and version-differences updated. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
4.2 KiB
4.2 KiB
| task | version | source | status |
|---|---|---|---|
| Read-only checks of ACCESS Service (OPC UA server, OPC clients, ODBC server, RESTful API) | R1.05 (first written for R1.03) | IM 36K10L45-01EN 5th ed. (Feb. 2026) §1–§3, §4.2, §7, §10, §11; IM 36K10E20-01EN 4th ed. §2.2; practiced on the R1.03 test system 2026-10-01; re-checked read-only on the R1.05 test server 2026-10-08 | verified on R1.05 (2026-10-08, read-only checks below); R1.03 results kept where marked |
ACCESS Service checks (read-only)
| Check | How | Result (R1.05 test server 2026-10-08 unless marked) |
|---|---|---|
| Processes | tasklist → opxuas.exe (UA server), opxuac.exe (one per OPC UA line + opxuac_mon), opxdas12.exe / opxaes.exe (only while a client is connected), opxdac.exe/opxaec.exe (per line), a javaw.exe for the RESTful API server; durwfp -p <name> -t 0 → 0 = attached |
opxuas, opxuac (OPXUAC_MON) running; no odbsrv (same on R1.03) |
| Ports | netstat -ano LISTENING: 34493 (OPC UA server), 1583 (ODBC), 34597 (RESTful API, R1.04+), 135 (DCOM) |
34493 yes, 34597 yes, 135 yes, 1583 no (R1.03: same, no 34597) |
| Start log | %TLS_LOG_PATH%\ci_start.log, umhlog.log |
InitializeSslCtx(): SSL_CTX_use_certificate_chain_file() failed + Process ODBSRV exited unexpectedly = ODBC server cannot load its certificate (ISS-008; R1.03 and R1.05) |
| ODBC settings | tls\sup\odbsrv.sup (PORT, USESSL), certificate %TLS_ROOT_PATH%\tls\pki\odbsrv\SampleServerCertificate.pem + key |
odbsrv.sup identical to R1.03, USESSL YES, folder missing |
| OPC UA server settings | tls\sup\opxuas.sup; endpoints and user tokens in ServerConfig.xml — R1.05: %TLS_SAV_PATH%\ServerConfig.xml (R1.03: %TLS_ROOT_PATH%\tls\exe; ISS-081); ignore commented XML |
Endpoint opc.tcp://[NodeName]:34493; Basic256Sha256 / Aes128_Sha256_RsaOaep / Aes256_Sha256_RsaPss with Sign or SignAndEncrypt; anonymous, user/password, certificate tokens on (unchanged from R1.03; the R1.05 file only adds SDK sections) |
| Extended OPC UA functions | findstr EXTENDED_FUNC in opxuas.sup and in the client's <process>.sup (template epauac_eqp.sup) |
OPXUAS_ENABLE_EXTENDED_FUNC = NO, OPXC_ENABLE_EXTENDED_FUNC = NO (product defaults): no OPC UA alarms, HistoryRead or PubSub until set to YES |
| OPC UA certificates | %TLS_ALLUSERS_PATH%\pki\opxuas\pkiserver\{own,trusted,rejected,issuers}; client …\pki\opxuac\pkiclient\{own,trusted,rejected,deleted,issuers}; dataset OPCUAC_PKI_CERTIFICATES_DF |
Server own ciserveruaserver.der; client own <host>_OPXUAC_MON.der; server rejected absent until the first rejection |
| Certificate validity | certutil -dump <file>.der and look at NotAfter |
Both own certificates valid 5 years from installation. The OPC UA client warns in the Historical Alarm Overview and the UMH message log before a client or server certificate expires (IM 36K10E20 4th ed. §2.2); lead time = hidden keyword OPXC_CERT_EXP_PERIOD_WARN, 2 months in epauac_eqp.sup |
| OPC Classic settings | tls\sup\opxsys.sup (tabs Alarm and Event Client, Data Access Server, Alarm & Event Server) |
Defaults; OPXAEC_SAFE_CON NO; new in R1.05: OPXAES_DIR_ALM = YES (A&E server, "Direct" alarm events; not in the manual, ISS-085) |
| OPC UA client config | export OPCUAC_LINE_DF, …_STATION_DF, …_SUBSCRIPTION_DF, …_POINT_DF, OPCUAC_METHOD_CALL2_DF |
R1.03: only the sample loopback. R1.05: dataset structure of line, station, subscription and point unchanged |
| RESTful API settings | tls\sup\jrstsrv.sup: JRST_NETWORK_PORT (34597), JRST_READ_ONLY_MODE (product default YES), JRST_MAX_RECORDS (default 100), JRST_USE_TWO_WAY_SSL (NO), JRST_USER_CACHE_TIME (600 s), JRST_CUSTOM_DATASETS; API keys in dataset API_KEYS_DF (export without records in reports) |
Keywords as in IM 36K10L45 5th ed. §4.2.1; compare the active values with the !DEFAULT block |
| Logs | %TLS_LOG_PATH%\OPXUAS.log, OpxUas_Sdk*.log, <UA client process>.log |
OPXUAS.log, OpxUas_Sdk*.log, OPXUAC_MON.log present |
Fixing the ODBC server (only if ODBC is licensed and wanted; admin): place a certificate and key
with the names above in %TLS_ROOT_PATH%\tls\pki\odbsrv\, or set USESSL = NO in odbsrv.sup
(unencrypted ODBC traffic — a security decision), then restart CI Server.