ci-server-engineer/knowledge/manuals/IM36K01C30-01EN.md

manual	title	edition	version	status
IM 36K01C30-01EN	CI Server Security Guide	3rd Edition, Sep. 2023	R1.03	from docs (users/groups and firewall checked read-only on the test system)

CI Server Security Guide (R1.03)

What the IT Security Tool changes, which Windows accounts and firewall openings CI Server needs, and the related utilities. Section numbers refer to the manual.

1. Threats and measures

• Threats: attacks over the network, direct attacks at a terminal, theft of a computer/data.
• Measures: access control (files, folders, registry, DCOM/OPC, system commands), personal firewall, stopping unused services, IT environment settings (NetBIOS, disk password), and group policies (password/lockout, security options, software restriction, audit policies, administrative templates, safe DLL search order).
• IT security settings must be applied at the area and process levels; business and corporate levels follow the site's own policy.

2. Security model and user management

• CI Server supports only the Standard model: protects against network and terminal attacks, not against theft. Password and lockout policies are not set by it (use domain policy).
• User management types:

Type	Accounts kept on	Notes
Standalone	Each computer	Small systems; admin and product maintenance rights not separable
Domain	Domain controller	Central; rights separable
Combination	Domain, plus local fallback	Local _LCL groups for emergencies
Linked domain (recommended for new systems)	Domain, linked to local groups	Apply Standalone first, join domain, then link with Domain Link Management Tool

• Groups/accounts created by the IT Security Tool (standalone: local; domain types: on the domain controller, with _LCL local helper groups):

Name	Kind	Purpose
CIX_OPERATOR	Group	Operators
CIX_ENGINEER	Group	Engineering (Engineering / Edit Module)
CIX_MAINTENANCE	Group (also Administrators)	Installation and maintenance
CIX_OPC	Group	OPC configuration and communication
CIX_PROCESS	User	Runs CI Server services and CI OPC servers
CTM_PROCESS	User	Runs VAGW services
RDC_PROCESS	User	Dual-redundant platform only
VNT_*	Groups/users	Vnet/IP Interface Package (no sign-in rights)

Use these accounts only for CI Server. Changing the security model may delete or rename groups.

3. Firewall (§3.2)

Windows Firewall on; block everything except what CI Server needs:

Use	Port
Web / secure web (CI View, CI Portal)	TCP 8080 / 80, TCP 8443 / 443
DURM between nodes	UDP 17001, 17101 (one per DURM line)
SMDMON (system log collection)	UDP 18002
Remote desktop (only if needed, restrict users)	TCP 3389
HAC	UDP 16000–16006 (hac.sup, jhacProperties\application.properties); HACW_HMI UDP 16010–16041
ODBC (SimbaServer, Core only)	TCP 1583
Alarm e-mail	TCP 25
NTP/SNTP (not needed with Vnet/IP)	123
OPC classic	TCP 135, 139, DCOM 20500–20550 (customizable); UDP 137, 138
OPC UA	UDP 4840 discovery; communication port configurable
Vnet equipment (odeq.exe)	TCP 44818
Equipment drivers	Rockwell CIP / PLC5 / Fisher ROC TCP 44818; DAQ TCP 34260, 34434; DNP3 TCP 20000; FA-M3 TCP 12289; IEC 60870-5-104 TCP 2404; IEC 61850 TCP 102; MeTro TCP 7075; Modbus TCP 502; STARDOM FCX TCP 1090
Windows domain	DNS 53, Kerberos 88, LDAP 389, SMB 445, GC 3268/3269, DHCP 67, discovery 137/138/1900/3702/5355 + TCP 2869/5357/5358, MADCAP 2535, AD Web 9389
Dual-redundant platform (PRC)	TCP 34480, 34483–34486; UDP 1311

ICMP echo (ping) is allowed by the Standard model.

4. Other settings (§3.3–§3.6)

• Unused services disabled by the tool (depending on OS): Diagnostic Policy, Connected User Experiences and Telemetry, dmwappushsvc, Downloaded Maps Manager, IP Helper, Program Compatibility Assistant, Remote Registry, Shell Hardware Detection, Themes, Windows Push Notifications, and others. DHCP Client must stay running.
• OPC: Create permanent shared objects right for CIX_OPC, CIX_PROCESS, CTM_PROCESS; network access sharing model Classic; DCOM port range 20500–20550 (the manual's table also prints "2500–20550", taken as a typo).
• NetBIOS over TCP/IP can be disabled (default with domain/combination management); then configure HOSTS/DNS for name resolution.
• USB storage disabled; use the StorageDeviceCTL utility (members of CIX_MAINTENANCE) to allow writing temporarily.

5. Tools (§4)

Tool	Use
IT Security Tool (Start › YOKOGAWA Security)	Setup (model + management type), Save/Restore (with a default password for recreated accounts), Change Password of the saved file, Import/Export, Information (summary)
Domain Link Management Tool	Link/unlink the domain (linked domain management); sign in as local admin + CIX_MAINTENANCE
PrepareReconstruction.cmd then ciserver-…-ITSecurity.exe › Apply IT Security only	Re-apply with different target components
Yokogawa.IA.iPCS.Platform.Security.CreateCIXProcess.exe [-p <password>] (<DVD>\Windows\CIServer\ITSecurity)	Create CIX_PROCESS or set its password; same password on all collaborating computers; restart
…CreateCTMProcess.exe [-p <password>]	Same for CTM_PROCESS
ITSecuritySettingItemExport.exe	Export applied settings
YWVNETCreateVNTUser	Change passwords of the Vnet/IP Interface Package users (VM)

Changing the account that runs CI Server (§4.9): create the user, add it to Administrators (and RDC_GA_CLIENT on a dual-redundant platform; CIX_OPC or CIX_OPC_LCL when IT security is applied), set it on the CI Service Log On tab and on the Identity tab of CI OPC AE Server and CI OPC DA Server in Component Services › DCOM Config.

6. Optional hardening (§5)

Extra settings the site may add: audit policies and event log sizes, disable recovery console and Guest account, restrict audit log and removable media access, immediate screen-saver password, SNMP, SSL/TLS registry settings, secure startup and AllowedPaths registry keys, remove Everyone for anonymous users, remove unused protocols, block malicious DLL loading.