cliu
5e58499fe5
Summarize CI Server Setup and Security Guide, add the draft installation-security skill and tools/setup_check.ps1 (read-only check practiced on the test system), and log ISS-008/009. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
114 lines
6.2 KiB
Markdown
114 lines
6.2 KiB
Markdown
---
|
||
manual: IM 36K01C30-01EN
|
||
title: CI Server Security Guide
|
||
edition: 3rd Edition, Sep. 2023
|
||
version: R1.03
|
||
status: from docs (users/groups and firewall checked read-only on the test system)
|
||
---
|
||
|
||
# CI Server Security Guide (R1.03)
|
||
|
||
What the IT Security Tool changes, which Windows accounts and firewall openings CI Server
|
||
needs, and the related utilities. Section numbers refer to the manual.
|
||
|
||
## 1. Threats and measures
|
||
|
||
- Threats: attacks over the network, direct attacks at a terminal, theft of a computer/data.
|
||
- Measures: access control (files, folders, registry, DCOM/OPC, system commands), personal
|
||
firewall, stopping unused services, IT environment settings (NetBIOS, disk password), and
|
||
group policies (password/lockout, security options, software restriction, audit policies,
|
||
administrative templates, safe DLL search order).
|
||
- IT security settings **must** be applied at the area and process levels; business and
|
||
corporate levels follow the site's own policy.
|
||
|
||
## 2. Security model and user management
|
||
|
||
- CI Server supports only the **Standard model**: protects against network and terminal
|
||
attacks, **not** against theft. Password and lockout policies are *not* set by it (use
|
||
domain policy).
|
||
- User management types:
|
||
|
||
| Type | Accounts kept on | Notes |
|
||
|---|---|---|
|
||
| Standalone | Each computer | Small systems; admin and product maintenance rights not separable |
|
||
| Domain | Domain controller | Central; rights separable |
|
||
| Combination | Domain, plus local fallback | Local `_LCL` groups for emergencies |
|
||
| Linked domain (recommended for new systems) | Domain, linked to local groups | Apply *Standalone* first, join domain, then link with Domain Link Management Tool |
|
||
|
||
- Groups/accounts created by the IT Security Tool (standalone: local; domain types: on the
|
||
domain controller, with `_LCL` local helper groups):
|
||
|
||
| Name | Kind | Purpose |
|
||
|---|---|---|
|
||
| `CIX_OPERATOR` | Group | Operators |
|
||
| `CIX_ENGINEER` | Group | Engineering (Engineering / Edit Module) |
|
||
| `CIX_MAINTENANCE` | Group (also Administrators) | Installation and maintenance |
|
||
| `CIX_OPC` | Group | OPC configuration and communication |
|
||
| `CIX_PROCESS` | User | Runs CI Server services and CI OPC servers |
|
||
| `CTM_PROCESS` | User | Runs VAGW services |
|
||
| `RDC_PROCESS` | User | Dual-redundant platform only |
|
||
| `VNT_*` | Groups/users | Vnet/IP Interface Package (no sign-in rights) |
|
||
|
||
Use these accounts only for CI Server. Changing the security model may delete or rename groups.
|
||
|
||
## 3. Firewall (§3.2)
|
||
|
||
Windows Firewall on; block everything except what CI Server needs:
|
||
|
||
| Use | Port |
|
||
|---|---|
|
||
| Web / secure web (CI View, CI Portal) | TCP 8080 / 80, TCP 8443 / 443 |
|
||
| DURM between nodes | UDP 17001, 17101 (one per DURM line) |
|
||
| SMDMON (system log collection) | UDP 18002 |
|
||
| Remote desktop (only if needed, restrict users) | TCP 3389 |
|
||
| HAC | UDP 16000–16006 (`hac.sup`, `jhacProperties\application.properties`); HACW_HMI UDP 16010–16041 |
|
||
| ODBC (SimbaServer, Core only) | TCP 1583 |
|
||
| Alarm e-mail | TCP 25 |
|
||
| NTP/SNTP (not needed with Vnet/IP) | 123 |
|
||
| OPC classic | TCP 135, 139, DCOM 20500–20550 (customizable); UDP 137, 138 |
|
||
| OPC UA | UDP 4840 discovery; communication port configurable |
|
||
| Vnet equipment (`odeq.exe`) | TCP 44818 |
|
||
| Equipment drivers | Rockwell CIP / PLC5 / Fisher ROC TCP 44818; DAQ TCP 34260, 34434; DNP3 TCP 20000; FA-M3 TCP 12289; IEC 60870-5-104 TCP 2404; IEC 61850 TCP 102; MeTro TCP 7075; Modbus TCP 502; STARDOM FCX TCP 1090 |
|
||
| Windows domain | DNS 53, Kerberos 88, LDAP 389, SMB 445, GC 3268/3269, DHCP 67, discovery 137/138/1900/3702/5355 + TCP 2869/5357/5358, MADCAP 2535, AD Web 9389 |
|
||
| Dual-redundant platform (PRC) | TCP 34480, 34483–34486; UDP 1311 |
|
||
|
||
ICMP echo (ping) is allowed by the Standard model.
|
||
|
||
## 4. Other settings (§3.3–§3.6)
|
||
|
||
- Unused services disabled by the tool (depending on OS): Diagnostic Policy, Connected User
|
||
Experiences and Telemetry, dmwappushsvc, Downloaded Maps Manager, IP Helper, Program
|
||
Compatibility Assistant, Remote Registry, Shell Hardware Detection, Themes, Windows Push
|
||
Notifications, and others. DHCP Client must stay running.
|
||
- OPC: *Create permanent shared objects* right for `CIX_OPC`, `CIX_PROCESS`, `CTM_PROCESS`;
|
||
network access sharing model *Classic*; DCOM port range 20500–20550 (the manual's table
|
||
also prints "2500–20550", taken as a typo).
|
||
- NetBIOS over TCP/IP can be disabled (default with domain/combination management); then
|
||
configure HOSTS/DNS for name resolution.
|
||
- USB storage disabled; use the StorageDeviceCTL utility (members of `CIX_MAINTENANCE`) to
|
||
allow writing temporarily.
|
||
|
||
## 5. Tools (§4)
|
||
|
||
| Tool | Use |
|
||
|---|---|
|
||
| IT Security Tool (Start › YOKOGAWA Security) | *Setup* (model + management type), *Save*/*Restore* (with a default password for recreated accounts), *Change Password* of the saved file, *Import*/*Export*, *Information* (summary) |
|
||
| Domain Link Management Tool | Link/unlink the domain (linked domain management); sign in as local admin + `CIX_MAINTENANCE` |
|
||
| `PrepareReconstruction.cmd` then `ciserver-…-ITSecurity.exe` › *Apply IT Security only* | Re-apply with different target components |
|
||
| `Yokogawa.IA.iPCS.Platform.Security.CreateCIXProcess.exe [-p <password>]` (`<DVD>\Windows\CIServer\ITSecurity`) | Create `CIX_PROCESS` or set its password; same password on all collaborating computers; restart |
|
||
| `…CreateCTMProcess.exe [-p <password>]` | Same for `CTM_PROCESS` |
|
||
| `ITSecuritySettingItemExport.exe` | Export applied settings |
|
||
| `YWVNETCreateVNTUser` | Change passwords of the Vnet/IP Interface Package users (VM) |
|
||
|
||
**Changing the account that runs CI Server (§4.9)**: create the user, add it to
|
||
Administrators (and `RDC_GA_CLIENT` on a dual-redundant platform; `CIX_OPC` or
|
||
`CIX_OPC_LCL` when IT security is applied), set it on the *CI Service* Log On tab and on the
|
||
Identity tab of *CI OPC AE Server* and *CI OPC DA Server* in Component Services › DCOM Config.
|
||
|
||
## 6. Optional hardening (§5)
|
||
|
||
Extra settings the site may add: audit policies and event log sizes, disable recovery
|
||
console and Guest account, restrict audit log and removable media access, immediate
|
||
screen-saver password, SNMP, SSL/TLS registry settings, secure startup and
|
||
`AllowedPaths` registry keys, remove *Everyone* for anonymous users, remove unused
|
||
protocols, block malicious DLL loading.
|