56 lines
3.3 KiB
Markdown
56 lines
3.3 KiB
Markdown
---
|
||
task: Check a machine against the CI Server setup and security requirements
|
||
version: R1.03
|
||
source: IM 36K01C10-01EN §1, §2.1.2, §3.2.12; IM 36K01C30-01EN §2.2, §3.2; practiced on the test system 2026-09-30
|
||
status: verified (2026-09-30)
|
||
---
|
||
|
||
# Setup check (read-only)
|
||
|
||
```
|
||
powershell -NoProfile -ExecutionPolicy Bypass -File tools\setup_check.ps1
|
||
```
|
||
|
||
Run from the repo root, preferably elevated. Changes nothing. One line per check:
|
||
`[OK]` matches the manual, `[DIFF]` differs, `[CHECK]` needs a human decision.
|
||
|
||
## What it checks
|
||
|
||
| Area | Checks |
|
||
|---|---|
|
||
| CI Server | Installed version (1.03.00), CI Service state, startup type and account (`.\CIX_PROCESS`), VAGW service |
|
||
| Windows | Supported OS, visual effects, processor scheduling, virtual memory (custom, 1.5 × RAM), power plan, fast startup, Windows Defender policy, automatic updates policy, scheduled defrag and component cleanup, .NET 3.5, DCOM authentication level, display scale, 8dot3 names, regional settings |
|
||
| IT security | `CIX_OPERATOR`, `CIX_ENGINEER`, `CIX_MAINTENANCE`, `CIX_OPC` groups, `CIX_PROCESS` / `CTM_PROCESS` users, IT Security Tool installed |
|
||
| Firewall | Profiles enabled; inbound allowed for TCP 8080, 8443, UDP 17001, 17101, 18002 |
|
||
|
||
## Reading the result
|
||
|
||
- `[DIFF]` on a development PC is normal; for a production server, fix each item with the
|
||
Setup summary's Windows settings table (`knowledge/manuals/IM36K01C10-01EN.md` §2) or by
|
||
running the IT Security Tool.
|
||
- The script finds the firewall rules only as "some rule allows this port"; check the rule
|
||
scope separately for production.
|
||
- Also read `%TLS_LOG_PATH%\ci_start.log` after a start: every service should report
|
||
`… started` and the log ends with `CI Server started`; look for `-E-` and `failed` lines.
|
||
The first lines show the version and build (e.g. `R1.03.00 … (r10200M)`).
|
||
- The web ports actually used are `SECURE_PORT_NUMBER` / `NON_SECURE_PORT_NUMBER` in
|
||
`%TLS_ROOT_PATH%\tls\sup\jwuiisg.sup` (8443 / 8080 by default).
|
||
- Folder rights (not in the script): setup files can hold passwords (e.g. `dbc.sup`). Check
|
||
who can read and change them:
|
||
`foreach ($r in (Get-Acl "$env:TLS_ROOT_PATH\tls\sup").Access) { "{0} : {1}" -f $r.IdentityReference, $r.FileSystemRights }`.
|
||
Under Program Files, Users can read; an install outside Program Files (e.g.
|
||
`C:\Yokogawa\CIServer`, seen on an R1.05 system) can inherit *Authenticated Users: Modify*,
|
||
so any signed-in user can change setup files (ISS-061). Fixing it is a site decision (IT
|
||
Security Tool).
|
||
|
||
## Test system result (2026-09-30)
|
||
|
||
Windows 10 Pro 19045 development PC without the IT Security Tool: 16 OK, 5 CHECK, 15 DIFF.
|
||
Differences: firewall domain/private profiles off; no `CIX_` groups or `CTM_PROCESS` (IT
|
||
Security Tool not installed; not supported on Windows 10 Pro); fast startup on; Balanced power
|
||
plan; automatic virtual memory; Defender on; automatic updates, defrag and cleanup not
|
||
disabled. Web ports 8443/8080. `ci_start.log`: all services started, one SSL certificate error
|
||
(`InitializeSslCtx(): SSL_CTX_use_certificate_chain_file() failed`): the ODBC server `odbsrv`
|
||
has `USESSL = YES` but no certificate in `%TLS_ROOT_PATH%\tls\pki\odbsrv`, so it exits at
|
||
start (harmless unless ODBC is used; fix in skill `data-access`, task `access-checks.md`;
|
||
`knowledge/issues.md` ISS-008).
|