cliu
e90ad790a2
New knowledge/r105-verification.md lists the R1.05 functions not available on the test server (not tested) and the read-only steps prepared for the user to verify on the server or in the GUI (eqpdbg, setup_check.ps1, Engineering Module forms) plus the CI-Eng-Sample load decision. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
195 lines
13 KiB
Markdown
195 lines
13 KiB
Markdown
---
|
||
manual: IM 36K01C30-01EN
|
||
title: CI Server Security Guide
|
||
edition: 5th Edition, Feb. 2026
|
||
version: R1.05 (first written for R1.03, 3rd Edition, Sep. 2023)
|
||
status: from docs (users/groups and firewall checked read-only on the R1.03 test system; listening ports, users and firewall checked read-only on the R1.05 test server, 2026-10-08; the IT Security Tool is not installed there and not supported on its Windows Server 2025, so IT security itself is not verified on R1.05)
|
||
---
|
||
|
||
# CI Server Security Guide (R1.05)
|
||
|
||
What the IT Security Tool changes, which Windows accounts and firewall openings CI Server
|
||
needs, and the related utilities. Section numbers refer to the 5th edition. Since R1.04 the
|
||
manual covers Windows Server 2022 instead of 2016; R1.05 adds Windows 11 Enterprise LTSC 2024
|
||
and **IT security version 3.0** (§7 below).
|
||
|
||
## 1. Threats and measures
|
||
|
||
- Threats: attacks over the network, direct attacks at a terminal, theft of a computer/data.
|
||
- Measures: access control (files, folders, registry, DCOM/OPC, system commands), personal
|
||
firewall, stopping unused services, IT environment settings (NetBIOS, disk password,
|
||
Delivery Optimization, Defender), and group policies (password/lockout, security options,
|
||
software restriction, audit policies, administrative templates, safe DLL search order).
|
||
- IT security settings **must** be applied at the area and process levels; business and
|
||
corporate levels follow the site's own policy.
|
||
|
||
## 2. Security model and user management
|
||
|
||
- CI Server supports only the **Standard model**: protects against network and terminal
|
||
attacks, **not** against theft.
|
||
- Password and lockout (§2.1, §3.6.1–3.6.2): in IT security 2.0 the password policy is not
|
||
applied (use domain policy), but the **account lockout policy is applied** (10 failed
|
||
sign-ins, counter reset after 15 min, locked for 15 min). In 3.0 both are settings of the
|
||
tool; for domain accounts set them on the domain controller or in the Default Domain Policy.
|
||
(The R1.03 version of this summary said lockout was not set; that was wrong in R1.03 too.)
|
||
- Upgrading from R1.03 or earlier with changed IT security defaults: a dialog asks to reset
|
||
the lockout values; answer Yes, then set custom values again (IM 36K01A50 §1.3).
|
||
- User management types:
|
||
|
||
| Type | Accounts kept on | Notes |
|
||
|---|---|---|
|
||
| Standalone | Each computer | Small systems; admin and product maintenance rights not separable |
|
||
| Domain | Domain controller | Central; rights separable |
|
||
| Combination | Domain, plus local fallback | Local `_LCL` groups for emergencies |
|
||
| Linked domain (recommended for new systems) | Domain, linked to local groups | Apply *Standalone* first, join domain, then link with Domain Link Management Tool |
|
||
|
||
- Groups/accounts created by the IT Security Tool (standalone: local; domain types: on the
|
||
domain controller, with `_LCL` local helper groups). **With IT security 3.0 only the
|
||
Standalone and Linked domain sets are created** (§2.2.1).
|
||
|
||
| Name | Kind | Purpose |
|
||
|---|---|---|
|
||
| `CIX_OPERATOR` | Group | Operators |
|
||
| `CIX_ENGINEER` | Group | Engineering (Engineering / Edit Module) |
|
||
| `CIX_MAINTENANCE` | Group (also Administrators) | Installation and maintenance |
|
||
| `CIX_OPC` | Group | OPC configuration and communication |
|
||
| `CIX_PROCESS` | User | Runs CI Server services and CI OPC servers |
|
||
| `CTM_PROCESS` | User | Runs VAGW services |
|
||
| `RDC_PROCESS` | User | Dual-redundant platform only |
|
||
| `VNT_*` | Groups/users | Vnet/IP Interface Package (no sign-in rights) |
|
||
|
||
Use these accounts only for CI Server. Changing the security model may delete or rename groups.
|
||
|
||
Verified (R1.05 test server, 2026-10-08): without the IT Security Tool, CI Server still
|
||
creates the local user `CIX_PROCESS` (member of Administrators) and runs *CI Service* with it;
|
||
there are no `CIX_` groups and no `CTM_PROCESS`. A local group `RDC_GA_CLIENT` with member
|
||
`CIX_PROCESS` also exists although the server is not a dual-redundant platform (ISS-089, no
|
||
action needed).
|
||
|
||
## 3. Firewall (§3.2)
|
||
|
||
Windows Firewall on; block everything except what CI Server needs. IT security 3.0 uses the
|
||
same exception list (§3.7.2).
|
||
|
||
| Use | Port |
|
||
|---|---|
|
||
| Web / secure web (CI View, CI Portal) | TCP 8080 / 80, TCP 8443 / 443 |
|
||
| RESTful API web server (`jrstsrv`, new in R1.04/R1.05) | TCP 34597 (`JRST_NETWORK_PORT` in `jrstsrv.sup`) |
|
||
| DURM between nodes | UDP 17001, 17101 (one per DURM line) |
|
||
| SMDMON (system log collection) | UDP 18002 |
|
||
| Remote desktop (only if needed, restrict users) | TCP 3389 |
|
||
| HAC | UDP 16000–16006 (`hac.sup`, `jhacProperties\application.properties`); HACW_HMI UDP 16010–16041 |
|
||
| ODBC (SimbaServer, Core only) | TCP 1583 |
|
||
| Alarm e-mail | TCP 25 |
|
||
| NTP/SNTP (not needed with Vnet/IP) | 123 |
|
||
| OPC classic | TCP 135, 139, DCOM 20500–20550 (customizable); UDP 137, 138 |
|
||
| OPC UA | UDP 4840 discovery; communication port configurable |
|
||
| Vnet equipment (`odeq.exe`) | TCP 44818 |
|
||
| Equipment drivers | Rockwell CIP / PLC5 / Fisher ROC TCP 44818; DAQ TCP 34260, 34434; DNP3 TCP 20000; FA-M3 TCP 12289; IEC 60870-5-104 TCP 2404; IEC 61850 TCP 102; MeTro TCP 7075; Modbus TCP 502; STARDOM FCX TCP 1090 |
|
||
| Windows domain | DNS 53, Kerberos 88, LDAP 389, SMB 445, GC 3268/3269, DHCP 67, discovery 137/138/1900/3702/5355 + TCP 2869/5357/5358, MADCAP 2535, AD Web 9389 |
|
||
| Dual-redundant platform (PRC) | TCP 34480, 34483–34486; UDP 1311 |
|
||
|
||
ICMP echo (ping) is allowed by the Standard model.
|
||
|
||
Verified (R1.05 test server, 2026-10-08): listening are TCP 8080/8443 (web), 34597 (RESTful
|
||
API), 34493 (OPC UA server `opxuas`), UDP 17001/17101 (DURM) and 18002 (SMDMON). The RESTful
|
||
API server also listens on **TCP 7073** on all interfaces; no manual mentions this port and
|
||
`jrstsrv.sup` has no keyword for it (ISS-087). Do not open it in the firewall.
|
||
|
||
## 4. Other settings (§3.3–§3.6)
|
||
|
||
- Unused services disabled by the tool (OS columns now Win10 LTSC, Win11 LTSC 2024, Server
|
||
2019, Server 2022): Diagnostic Policy, Connected User Experiences and Telemetry,
|
||
dmwappushsvc, Downloaded Maps Manager, IP Helper, Program Compatibility Assistant, Remote
|
||
Registry, Shell Hardware Detection, Themes, Windows Push Notifications, and others.
|
||
Delivery Optimization is no longer stopped; WinHTTP Web Proxy Auto-Discovery left the list.
|
||
DHCP Client must stay running.
|
||
- Delivery Optimization (§3.5.3): limited by policy (Server 2022: HTTP only; other listed OSs:
|
||
bypass) so updates do not spread between plant PCs.
|
||
- Defender (§3.5.4): the "turn off" policy is set on OSs older than Windows 11 and left
|
||
unconfigured on Windows 11; it has no effect on Win10 LTSC 2021 / Win11 LTSC 2024.
|
||
- OPC: *Create permanent shared objects* right for `CIX_OPC`, `CIX_PROCESS`, `CTM_PROCESS`;
|
||
network access sharing model *Classic*; DCOM port range 20500–20550 (the manual's table
|
||
still prints "2500–20550" in R1.05, taken as a typo).
|
||
- NetBIOS over TCP/IP can be disabled (default with domain/combination management); then
|
||
configure HOSTS/DNS for name resolution.
|
||
- USB storage disabled; use the StorageDeviceCTL utility (members of `CIX_MAINTENANCE`) to
|
||
allow writing temporarily.
|
||
|
||
## 5. Tools (§4)
|
||
|
||
| Tool | Use |
|
||
|---|---|
|
||
| IT Security Tool (Start › YOKOGAWA Security) | *Setup* (version 2.0/3.0, model, management type), *Save*/*Restore* (with a default password for recreated accounts), *Change Password* of the saved file, *Import*/*Export*, *Information* (summary) |
|
||
| Domain Link Management Tool | Link/unlink the domain (linked domain management); sign in as local admin + `CIX_MAINTENANCE` |
|
||
| `PrepareReconstruction.cmd` then `ciserver-…-ITSecurity.exe` › *Apply IT Security only* | Re-apply with different target components (CI Mobile View, General PC, domain controller) |
|
||
| Reapply on Remote Connect after an upgrade to R1.05 | Run the R1.05 `-ITSecurity.exe` installer again to reinstall the IT Security Tool (overwrite install), then apply (§4.8.1) |
|
||
| `ResetITSecCondition.cmd` (`<ISO drive>\Windows\CIServer\ITSecurity`) | First step when switching CI Mobile View, General PC or a domain controller between IT security 2.0 and 3.0 (§4.8.3–4.8.4) |
|
||
| `Yokogawa.IA.iPCS.Platform.Security.CreateCIXProcess.exe [-p <password>]` (`<ISO drive>\Windows\CIServer\ITSecurity`) | Create `CIX_PROCESS` or set its password; same password on all collaborating computers; restart |
|
||
| `…CreateCTMProcess.exe [-p <password>]` | Same for `CTM_PROCESS` |
|
||
| `ITSecuritySettingItemExport.exe` | Export applied settings |
|
||
| `YWVNETCreateVNTUser` | Change passwords of the Vnet/IP Interface Package users (VM) |
|
||
|
||
Installer options (App. 2.5): *CI Server and IT Security Tool* for CI Core / CI Portal; *IT
|
||
Security for multi-product environment* for CI View / CI Mobile View on a PC where another
|
||
Yokogawa product's IT security is applied; *Apply IT Security only* for CI Mobile View,
|
||
General PC and domain controller (avoid it where other products are installed). Applying the
|
||
wrong station type means reinstalling Windows. Version 3.0 always needs a licence number.
|
||
|
||
**Changing the account that runs CI Server (§4.9)**: create the user, add it to
|
||
Administrators (and `RDC_GA_CLIENT` on a dual-redundant platform; `CIX_OPC` or
|
||
`CIX_OPC_LCL` when IT security is applied), set it on the *CI Service* Log On tab and on the
|
||
Identity tab of *CI OPC AE Server* and *CI OPC DA Server* in Component Services › DCOM Config.
|
||
|
||
## 6. Optional hardening (§5)
|
||
|
||
Extra settings the site may add: audit policies and event log sizes, disable recovery
|
||
console and Guest account, restrict audit log and removable media access, immediate
|
||
screen-saver password, SNMP, SSL/TLS registry settings, secure startup and
|
||
`AllowedPaths` registry keys, remove *Everyone* for anonymous users, remove unused
|
||
protocols, block malicious DLL loading, show a notice on entry to a security zone (§5.26).
|
||
|
||
**Safe API use (§5.27, new)**: give each client application of the APIs (ODBC, OPC UA, web,
|
||
RESTful API, …) its own DSS user or authorization group with only the datasets and the
|
||
read/insert/update/delete rights it needs and a unique password; never run it as SYSTEM or
|
||
with an administrator account. The RESTful API is HTTPS only; use the newest TLS version
|
||
(§5.14). Treat exported data as sensitive and delete what is not needed.
|
||
|
||
## 7. IT security version 3.0 (new in R1.05)
|
||
|
||
From docs, not tested (IT Security Tool not available on the R1.05 test server) (§2.1, §3.7, §4.8.3–4.8.4, ch. 6). Installation: Setup summary §2.1.6.
|
||
- Chosen in the IT Security Tool next to 2.0; needs a licence number per computer. The full
|
||
setting list is a PDF installed with the tool. Settings are grouped in categories (Access
|
||
Control, Firewall per profile, System Services, Password Policy, Account Lockout Policy,
|
||
Security Options, Administrative Templates, Removable Storage Access, …); access control,
|
||
firewall exceptions, OPC, HDD password and software restriction work as in 2.0.
|
||
- Defaults worth knowing:
|
||
- Unticked by default (tick them on *Select Setting Items* if wanted): screen lock after
|
||
inactivity, 15-minute limit for idle RDP sessions, password-protected screen saver,
|
||
SMB signing (Windows 11 signs by default; switch it off on both sides if a product
|
||
cannot cope).
|
||
- Ticked by default: Kerberos limited to AES (a domain user may get a "current
|
||
credentials" prompt; reset that user's password or untick the item), Internet Explorer 11
|
||
disabled, network level authentication and a single session per RDP user, Print Spooler
|
||
refuses client connections, no PnP redirection over RDP, auto logon disabled.
|
||
- PowerShell script-block logging and transcription are on, so a password typed in
|
||
PowerShell ends up in the log: run security utilities that take passwords in cmd.
|
||
- CD/DVD access can be denied only with the Group Policy Editor, not with the tool.
|
||
- Built-in accounts (§3.7.18, §3.7.22): disable or rename the built-in Administrator and
|
||
Guest; avoid names containing admin, root or su; on the dual-redundant platform rename
|
||
ADMINISTRATOR / PATCHUSER with the Redundancy Management Tool.
|
||
- LAPS (§3.7.23): only with linked domain management and 3.0. After installing it (Setup
|
||
summary §2.1.6), enable *Enable Local Admin Password Management* in the GPO of the OU of the
|
||
target computers. The built-in Administrator then gets a different, rotating password on
|
||
each computer (read it with LAPS UI on the domain controller), so do not use that account
|
||
for CI Server.
|
||
- Switching CI Mobile View, General PC or a domain controller between 2.0 and 3.0 (§4.8.3–4.8.4):
|
||
sign in as a `CIX_MAINTENANCE` administrator, run `ResetITSecCondition.cmd`, start the tool
|
||
and choose the version. Back to 2.0: first *Restore* the file
|
||
`PrepareToChangeITSecVer.hed` under `C:\ProgramData\Yokogawa\IA\iPCS\Platform\Security\System\Extension\3.0`.
|
||
For linked domain management, leave the domain, reapply, rejoin and relink.
|
||
- Central management with Active Directory (ch. 6): on the domain controller create a GPO,
|
||
*Import Settings* from `CIX_Standard_2.0.zip` or `CIX_Standard_3.0.zip` (from
|
||
`…\ITSecurity\GPOFiles\<version>`; 3.0 comes from the IT security 3.0 medium), and link it
|
||
to the OU of the CI Server computers. Apply IT security on every client first; change
|
||
settings only in the GPO on the domain controller.
|