cliu
83af63ab53
Full manual diffs (C50, R30, C60, L20, C40, L35, R10, R20, J10, L30, L50, P30, G10, C10) and read-only checks on the shared R1.05 test server where the permission system allowed them. Skills and summaries moved to R1.05. Issues ISS-092..129 (gaps 104-107, 114-115, 130-131 unused); ISS-074 closed (manual and software agree), ISS-091 corrected by ISS-119. version-differences: unlisted manual changes and installed-only changes. r105-verification: V5-V9 and new not-tested rows. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
78 lines
3.2 KiB
Markdown
78 lines
3.2 KiB
Markdown
---
|
||
task: Check web access for CI View (read-only)
|
||
version: R1.05 (first written for R1.03)
|
||
source: IM 36K10R10-01EN §2.2, §3.4, §4.3 (5th Edition, Feb. 2026); installed jwuiisg.sup (R1.05); practiced on the test system 2026-09-30
|
||
status: verified (read-only) on R1.03 (2026-09-30) and on the R1.05 test server (2026-10-08); access from another PC through the R1.05 Access Control settings not tested
|
||
---
|
||
|
||
# Check web access for CI View
|
||
|
||
Confirms that CI View PCs can reach this CI Portal (or CI Core + CI Portal) node. Nothing is
|
||
changed. CI Server must be running.
|
||
|
||
## 1. Configured ports
|
||
|
||
```powershell
|
||
$f = Join-Path $env:TLS_ROOT_PATH 'tls\sup\jwuiisg.sup'
|
||
Select-String -Path $f -Pattern '^(SECURE_PORT_NUMBER|NON_SECURE_PORT_NUMBER)\b'
|
||
```
|
||
|
||
Defaults: HTTPS 8443, HTTP 8080.
|
||
|
||
## 2. Ports are listening
|
||
|
||
```powershell
|
||
(Get-NetTCPConnection -State Listen -LocalPort 8080,8443).LocalPort
|
||
```
|
||
|
||
Both ports should be listed. Nothing listed: CI Server (USER Service) is not running, or the
|
||
ports were changed.
|
||
|
||
## 3. Remote Connect page
|
||
|
||
```powershell
|
||
(Invoke-WebRequest -UseBasicParsing http://localhost:8080/).StatusCode
|
||
```
|
||
|
||
Expect `200`. This is the page CI View users open as `http://<node>:8080/` to download
|
||
Remote Connect; Remote Connect then uses HTTPS on 8443. From another PC the firewall must
|
||
allow both ports (skill `installation-security`). With `HTTP_TO_HTTPS_REDIRECT = YES`
|
||
`Invoke-WebRequest` follows the redirect to HTTPS and may fail on the server certificate;
|
||
read the HTTP status alone with `curl.exe -s -o NUL -w "%{http_code}" http://localhost:8080/`
|
||
(not tested with YES). If the site has narrowed `HOSTNAME_WHITELISTING`, a CI View must use
|
||
one of the listed names (opening the page by IP address may then fail; not tested).
|
||
|
||
On R1.05 the page also returns the default security headers from the *Security* tab of
|
||
`jwuiisg.sup` (R10 summary §4.3, ISS-111). To see them (`curl.exe` is part of Windows):
|
||
|
||
```powershell
|
||
curl.exe -k -s -I https://localhost:8443/
|
||
```
|
||
|
||
Expect `X-Content-Type-Options`, `X-Frame-Options`, `Strict-Transport-Security`,
|
||
`X-XSS-Protection`, `Cache-Control: no-store`, `Referrer-Policy`,
|
||
`X-Permitted-Cross-Domain-Policies` and a `Content-Security-Policy` line. The R1.03 file
|
||
set only `X-Frame-Options` and no CSP.
|
||
|
||
## 4. Displays deployed
|
||
|
||
The operator interface serves displays from
|
||
`%TLS_WAP_PATH%\cfg\operatorInterfaces\DEPLOY\` (`components`, `displays`, `layouts`,
|
||
`locales`, `symbols`, `thresholds`). On a separate CI Portal these must be copied from CI
|
||
Core or another portal, and every portal needs the same copy.
|
||
|
||
```powershell
|
||
Get-ChildItem -Name (Join-Path $env:TLS_WAP_PATH 'cfg\operatorInterfaces\DEPLOY')
|
||
```
|
||
|
||
## Test system (2026-09-30)
|
||
|
||
8080 and 8443 listening (one process), page returned 200, the six `DEPLOY` folders present.
|
||
|
||
## R1.05 test server (2026-10-08, read-only)
|
||
|
||
Steps 1–4 as above: 8080 and 8443 listening (one `javaw.exe` running as the CI Server
|
||
service account), `http://localhost:8080/` and `https://localhost:8443/` both 200, the page
|
||
offers `CI-rc-setup.exe` (Remote Connect), the six `DEPLOY` folders present, and the seven
|
||
headers plus CSP listed above on both ports. Install paths differ from R1.03 (here
|
||
`C:\Yokogawa\CIServer`), so always use the `TLS_*` variables.
|