cliu
b85a65250c
Read-only re-check on the shared R1.05 test server plus a diff of the R1.03 and R1.05 manual editions. - installation-security: R1.05 OS list, Defender exceptions, IT security 2.0/3.0, LAPS, automatic configuration merge (jupgutl), PRM chapter, port 34597; setup_check.ps1 gets -Version (default 1.05.00). - data-access: L45 renumbered (new ch. 4 RESTful API), extended OPC UA functions off by default, OPC UA methods (OPCUAC_METHOD_CALL2_DF), Information Model Mapper, ServerConfig.xml in %TLS_SAV_PATH%. - equipment: Modbus unchanged; IEC 104/61850 run as EQT managers (eqtdbg, eqtfrcscn), IEC 61850 report control blocks, upgrade steps. - Issues ISS-076..090; R1.05 notes on ISS-003/008/032/034/061; progress and version-differences updated. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
27 lines
4.2 KiB
Markdown
27 lines
4.2 KiB
Markdown
---
|
||
task: Read-only checks of ACCESS Service (OPC UA server, OPC clients, ODBC server, RESTful API)
|
||
version: R1.05 (first written for R1.03)
|
||
source: IM 36K10L45-01EN 5th ed. (Feb. 2026) §1–§3, §4.2, §7, §10, §11; IM 36K10E20-01EN 4th ed. §2.2; practiced on the R1.03 test system 2026-10-01; re-checked read-only on the R1.05 test server 2026-10-08
|
||
status: verified on R1.05 (2026-10-08, read-only checks below); R1.03 results kept where marked
|
||
---
|
||
|
||
# ACCESS Service checks (read-only)
|
||
|
||
| Check | How | Result (R1.05 test server 2026-10-08 unless marked) |
|
||
|---|---|---|
|
||
| Processes | `tasklist` → `opxuas.exe` (UA server), `opxuac.exe` (one per OPC UA line + `opxuac_mon`), `opxdas12.exe` / `opxaes.exe` (only while a client is connected), `opxdac.exe`/`opxaec.exe` (per line), a `javaw.exe` for the RESTful API server; `durwfp -p <name> -t 0` → 0 = attached | `opxuas`, `opxuac` (`OPXUAC_MON`) running; no `odbsrv` (same on R1.03) |
|
||
| Ports | `netstat -ano` LISTENING: 34493 (OPC UA server), 1583 (ODBC), 34597 (RESTful API, R1.04+), 135 (DCOM) | 34493 yes, 34597 yes, 135 yes, 1583 **no** (R1.03: same, no 34597) |
|
||
| Start log | `%TLS_LOG_PATH%\ci_start.log`, `umhlog.log` | `InitializeSslCtx(): SSL_CTX_use_certificate_chain_file() failed` + `Process ODBSRV exited unexpectedly` = ODBC server cannot load its certificate (ISS-008; R1.03 and R1.05) |
|
||
| ODBC settings | `tls\sup\odbsrv.sup` (`PORT`, `USESSL`), certificate `%TLS_ROOT_PATH%\tls\pki\odbsrv\SampleServerCertificate.pem` + key | `odbsrv.sup` identical to R1.03, `USESSL YES`, folder missing |
|
||
| OPC UA server settings | `tls\sup\opxuas.sup`; endpoints and user tokens in `ServerConfig.xml` — R1.05: `%TLS_SAV_PATH%\ServerConfig.xml` (R1.03: `%TLS_ROOT_PATH%\tls\exe`; ISS-081); ignore commented XML | Endpoint `opc.tcp://[NodeName]:34493`; Basic256Sha256 / Aes128_Sha256_RsaOaep / Aes256_Sha256_RsaPss with Sign or SignAndEncrypt; anonymous, user/password, certificate tokens on (unchanged from R1.03; the R1.05 file only adds SDK sections) |
|
||
| Extended OPC UA functions | `findstr EXTENDED_FUNC` in `opxuas.sup` and in the client's `<process>.sup` (template `epauac_eqp.sup`) | `OPXUAS_ENABLE_EXTENDED_FUNC = NO`, `OPXC_ENABLE_EXTENDED_FUNC = NO` (product defaults): no OPC UA alarms, HistoryRead or PubSub until set to YES |
|
||
| OPC UA certificates | `%TLS_ALLUSERS_PATH%\pki\opxuas\pkiserver\{own,trusted,rejected,issuers}`; client `…\pki\opxuac\pkiclient\{own,trusted,rejected,deleted,issuers}`; dataset `OPCUAC_PKI_CERTIFICATES_DF` | Server own `ciserveruaserver.der`; client own `<host>_OPXUAC_MON.der`; server `rejected` absent until the first rejection |
|
||
| Certificate validity | `certutil -dump <file>.der` and look at `NotAfter` | Both own certificates valid 5 years from installation. The OPC UA client warns in the Historical Alarm Overview and the UMH message log before a client or server certificate expires (IM 36K10E20 4th ed. §2.2); lead time = hidden keyword `OPXC_CERT_EXP_PERIOD_WARN`, 2 months in `epauac_eqp.sup` |
|
||
| OPC Classic settings | `tls\sup\opxsys.sup` (tabs Alarm and Event Client, Data Access Server, Alarm & Event Server) | Defaults; `OPXAEC_SAFE_CON NO`; new in R1.05: `OPXAES_DIR_ALM = YES` (A&E server, "Direct" alarm events; not in the manual, ISS-085) |
|
||
| OPC UA client config | export `OPCUAC_LINE_DF`, `…_STATION_DF`, `…_SUBSCRIPTION_DF`, `…_POINT_DF`, `OPCUAC_METHOD_CALL2_DF` | R1.03: only the sample loopback. R1.05: dataset structure of line, station, subscription and point unchanged |
|
||
| RESTful API settings | `tls\sup\jrstsrv.sup`: `JRST_NETWORK_PORT` (34597), `JRST_READ_ONLY_MODE` (product default YES), `JRST_MAX_RECORDS` (default 100), `JRST_USE_TWO_WAY_SSL` (NO), `JRST_USER_CACHE_TIME` (600 s), `JRST_CUSTOM_DATASETS`; API keys in dataset `API_KEYS_DF` (export without records in reports) | Keywords as in IM 36K10L45 5th ed. §4.2.1; compare the active values with the `!DEFAULT` block |
|
||
| Logs | `%TLS_LOG_PATH%\OPXUAS.log`, `OpxUas_Sdk*.log`, `<UA client process>.log` | `OPXUAS.log`, `OpxUas_Sdk*.log`, `OPXUAC_MON.log` present |
|
||
|
||
Fixing the ODBC server (only if ODBC is licensed and wanted; admin): place a certificate and key
|
||
with the names above in `%TLS_ROOT_PATH%\tls\pki\odbsrv\`, or set `USESSL = NO` in `odbsrv.sup`
|
||
(unencrypted ODBC traffic — a security decision), then restart CI Server.
|