cliu
5e58499fe5
Summarize CI Server Setup and Security Guide, add the draft installation-security skill and tools/setup_check.ps1 (read-only check practiced on the test system), and log ISS-008/009. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
129 lines
8.9 KiB
PowerShell
129 lines
8.9 KiB
PowerShell
# CI Server R1.03 - read-only setup check
|
|
# Compares a machine with the Windows settings required by CI Server Setup (IM 36K01C10-01EN §2.1.2)
|
|
# and the IT security state described in the Security Guide (IM 36K01C30-01EN §2.2, §3.2).
|
|
# Changes nothing. Run in Windows PowerShell 5.1; some checks need an elevated session.
|
|
# Usage: powershell -NoProfile -ExecutionPolicy Bypass -File tools\setup_check.ps1
|
|
|
|
$results = New-Object System.Collections.Generic.List[object]
|
|
function Add-Result($area, $check, $expected, $actual, $ok) {
|
|
$status = 'CHECK'
|
|
if ($ok -eq $true) { $status = 'OK' } elseif ($ok -eq $false) { $status = 'DIFF' }
|
|
$results.Add([pscustomobject]@{ Status = $status; Area = $area; Check = $check; Expected = $expected; Actual = "$actual" })
|
|
}
|
|
function Get-Reg($path, $name) {
|
|
try { (Get-ItemProperty -Path $path -Name $name -ErrorAction Stop).$name } catch { $null }
|
|
}
|
|
|
|
# --- CI Server ---------------------------------------------------------------
|
|
$ci = $null
|
|
foreach ($k in 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*', 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*') {
|
|
foreach ($i in (Get-ItemProperty $k -ErrorAction SilentlyContinue)) { if ($i.DisplayName -like 'CI Server R*') { $ci = $i } }
|
|
}
|
|
if ($ci) { Add-Result 'CI Server' 'Installed version' '1.03.00' $ci.DisplayVersion ($ci.DisplayVersion -eq '1.03.00') }
|
|
else { Add-Result 'CI Server' 'Installed version' '1.03.00' 'not found' $false }
|
|
$svc = Get-Service StartCIServer -ErrorAction SilentlyContinue
|
|
if ($svc) {
|
|
Add-Result 'CI Server' 'CI Service state' 'Running (when in use)' $svc.Status $null
|
|
Add-Result 'CI Server' 'CI Service startup type' 'Automatic in operation; Manual during upgrade' $svc.StartType $null
|
|
$acct = (Get-CimInstance Win32_Service -Filter "Name='StartCIServer'" -ErrorAction SilentlyContinue).StartName
|
|
Add-Result 'CI Server' 'CI Service account' '.\CIX_PROCESS (default)' $acct ($acct -like '*CIX_PROCESS')
|
|
}
|
|
$vagw = Get-Service | Where-Object { $_.DisplayName -like 'VAGW*' }
|
|
Add-Result 'CI Server' 'VAGW Bossd service' 'present only if installed with IT Security Tool' ($(if ($vagw) { ($vagw | ForEach-Object { "$($_.DisplayName)=$($_.Status)" }) -join ', ' } else { 'not installed' })) $null
|
|
|
|
# --- Operating system --------------------------------------------------------
|
|
$os = Get-CimInstance Win32_OperatingSystem
|
|
$supported = @('Windows 10 Pro', 'Windows 10 Enterprise', 'Windows 10 IoT Enterprise', 'Windows Server 2016', 'Windows Server 2019', 'Windows Server IoT 2019')
|
|
$osOk = $false; foreach ($s in $supported) { if ($os.Caption -like "*$s*") { $osOk = $true } }
|
|
Add-Result 'Windows' 'Operating system' 'Win10 Pro/Enterprise/IoT LTSB 2016/LTSC 2019, Server 2016/2019' "$($os.Caption) build $($os.BuildNumber)" $osOk
|
|
if ($os.Caption -like '*Windows 10 Pro*') { Add-Result 'Windows' 'Windows 10 Pro note' 'Vnet/IP drivers and IT Security Tool not supported on Win10 Pro' 'Windows 10 Pro' $null }
|
|
|
|
# Visual effects: "Let Windows choose" = VisualFXSetting 0
|
|
$vfx = Get-Reg 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects' 'VisualFXSetting'
|
|
Add-Result 'Windows' 'Visual effects' "Let Windows choose (0)" $(if ($null -eq $vfx) { 'not set (default = Let Windows choose)' } else { $vfx }) ($null -eq $vfx -or $vfx -eq 0)
|
|
|
|
# Virtual memory: custom size = 1.5 x RAM, not automatic
|
|
$ramMB = [math]::Round((Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory / 1MB)
|
|
$auto = (Get-CimInstance Win32_ComputerSystem).AutomaticManagedPagefile
|
|
$pf = Get-CimInstance Win32_PageFileSetting -ErrorAction SilentlyContinue
|
|
$pfText = if ($pf) { ($pf | ForEach-Object { "$($_.Name) $($_.InitialSize)-$($_.MaximumSize) MB" }) -join '; ' } else { 'system managed' }
|
|
$want = [math]::Round($ramMB * 1.5)
|
|
$pfOk = (-not $auto) -and $pf -and (($pf | Where-Object { $_.InitialSize -ge $want * 0.95 -and $_.MaximumSize -ge $want * 0.95 }) -ne $null)
|
|
Add-Result 'Windows' 'Virtual memory' "custom, initial = max = ~$want MB (1.5 x $ramMB MB RAM)" "automatic=$auto; $pfText" $pfOk
|
|
|
|
# Processor scheduling: Programs = Win32PrioritySeparation 0x26 (38) or 2
|
|
$prio = Get-Reg 'HKLM:\SYSTEM\CurrentControlSet\Control\PriorityControl' 'Win32PrioritySeparation'
|
|
Add-Result 'Windows' 'Processor scheduling' 'Programs (38 or 2)' $prio ($prio -eq 38 -or $prio -eq 2)
|
|
|
|
# Power plan
|
|
$plan = (powercfg /getactivescheme) 2>$null
|
|
Add-Result 'Windows' 'Power plan' 'High performance; never sleep/hibernate, disk and display never off' $plan ($plan -match 'High performance')
|
|
|
|
# Fast startup
|
|
$hib = Get-Reg 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Power' 'HiberbootEnabled'
|
|
Add-Result 'Windows' 'Fast startup (HiberbootEnabled)' '0' $hib ($hib -eq 0)
|
|
|
|
# Windows Defender
|
|
$defPol = Get-Reg 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' 'DisableAntiSpyware'
|
|
$defSvc = Get-Service WinDefend -ErrorAction SilentlyContinue
|
|
Add-Result 'Windows' 'Windows Defender' 'turned off by policy (use Yokogawa-approved antivirus)' "policy DisableAntiSpyware=$defPol; service=$(if ($defSvc) { $defSvc.Status } else { 'none' })" ($defPol -eq 1)
|
|
|
|
# Automatic Windows updates
|
|
$au = Get-Reg 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' 'NoAutoUpdate'
|
|
Add-Result 'Windows' 'Automatic Windows updates' 'Disabled by policy (NoAutoUpdate=1)' $au ($au -eq 1)
|
|
|
|
# Scheduled drive optimization and component cleanup
|
|
foreach ($t in @(@('\Microsoft\Windows\Defrag\', 'ScheduledDefrag', 'Automatic drive optimization'), @('\Microsoft\Windows\Servicing\', 'StartComponentCleanup', 'Automatic cleanup'))) {
|
|
$task = Get-ScheduledTask -TaskPath $t[0] -TaskName $t[1] -ErrorAction SilentlyContinue
|
|
Add-Result 'Windows' $t[2] 'Disabled' $(if ($task) { $task.State } else { 'task not found' }) ($task -and $task.State -eq 'Disabled')
|
|
}
|
|
|
|
# .NET Framework 3.5
|
|
$net35 = Get-Reg 'HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP\v3.5' 'Install'
|
|
Add-Result 'Windows' '.NET Framework 3.5' 'installed' $(if ($net35 -eq 1) { 'installed' } else { 'not installed' }) ($net35 -eq 1)
|
|
|
|
# DCOM default authentication level: Connect = 2
|
|
$dcom = Get-Reg 'HKLM:\SOFTWARE\Microsoft\Ole' 'LegacyAuthenticationLevel'
|
|
Add-Result 'Windows' 'DCOM Default Authentication Level' 'Connect (2)' $(if ($null -eq $dcom) { 'not set (default = Connect)' } else { $dcom }) ($null -eq $dcom -or $dcom -eq 2)
|
|
|
|
# Display scale 100 %
|
|
$dpi = Get-Reg 'HKCU:\Control Panel\Desktop\WindowMetrics' 'AppliedDPI'
|
|
Add-Result 'Windows' 'Display scale' '100 % (96 DPI)' $(if ($null -eq $dpi) { 'unknown' } else { "$dpi DPI" }) ($dpi -eq 96)
|
|
|
|
# 8dot3 file naming
|
|
$d83 = (fsutil behavior query disable8dot3) 2>$null | Select-Object -First 1
|
|
Add-Result 'Windows' '8dot3 file naming' 'state 2 (per volume) or 0 (enabled)' $d83 ($d83 -match 'is:\s*[02]\b|\b[02] \(')
|
|
|
|
# Regional settings (must not change after IT security is applied)
|
|
Add-Result 'Windows' 'Regional format / UI language' 'set before applying IT security; do not change afterwards' "$((Get-Culture).Name) / $((Get-UICulture).Name)" $null
|
|
|
|
# --- IT security (Security Guide) --------------------------------------------
|
|
$groups = 'CIX_OPERATOR', 'CIX_ENGINEER', 'CIX_MAINTENANCE', 'CIX_OPC'
|
|
foreach ($g in $groups) {
|
|
$lg = Get-LocalGroup -Name $g -ErrorAction SilentlyContinue
|
|
Add-Result 'IT security' "Local group $g" 'exists after IT Security Tool (standalone)' $(if ($lg) { 'exists' } else { 'missing' }) ([bool]$lg)
|
|
}
|
|
foreach ($u in 'CIX_PROCESS', 'CTM_PROCESS') {
|
|
$lu = Get-LocalUser -Name $u -ErrorAction SilentlyContinue
|
|
Add-Result 'IT security' "Local user $u" 'exists' $(if ($lu) { "exists, enabled=$($lu.Enabled)" } else { 'missing' }) ([bool]$lu)
|
|
}
|
|
$itsec = Test-Path 'C:\Program Files (x86)\YOKOGAWA\IA\iPCS\Platform\Security'
|
|
Add-Result 'IT security' 'IT Security Tool installed' 'yes, when installed with ciserver-...-ITSecurity.exe' $(if ($itsec) { 'yes' } else { 'no' }) $itsec
|
|
|
|
foreach ($p in (Get-NetFirewallProfile -ErrorAction SilentlyContinue)) {
|
|
Add-Result 'Firewall' "Profile $($p.Name)" 'Enabled' $p.Enabled ($p.Enabled -eq $true)
|
|
}
|
|
$ports = @{ 'TCP 8080' = 8080; 'TCP 8443' = 8443; 'UDP 17001' = 17001; 'UDP 17101' = 17101; 'UDP 18002' = 18002 }
|
|
$allow = Get-NetFirewallRule -Direction Inbound -Action Allow -Enabled True -ErrorAction SilentlyContinue | Get-NetFirewallPortFilter -ErrorAction SilentlyContinue
|
|
foreach ($name in $ports.Keys) {
|
|
$proto, $num = $name.Split(' ')
|
|
$hit = $allow | Where-Object { $_.Protocol -eq $proto -and ($_.LocalPort -contains "$num" -or $_.LocalPort -contains 'Any') }
|
|
Add-Result 'Firewall' "Inbound $name allowed" 'yes (web / secure web / DURM / SMDMON)' $(if ($hit) { 'yes' } else { 'no rule found' }) ([bool]$hit)
|
|
}
|
|
|
|
# --- Output --------------------------------------------------------------------
|
|
foreach ($r in ($results | Sort-Object Area, Check)) {
|
|
"[{0,-5}] {1} / {2}: {3} (expected: {4})" -f $r.Status, $r.Area, $r.Check, $r.Actual, $r.Expected
|
|
}
|
|
$sum = $results | Group-Object Status | ForEach-Object { "$($_.Name)=$($_.Count)" }
|
|
"Summary: $($sum -join ', ') (OK = matches, DIFF = differs, CHECK = review manually)"
|