Installation and Administration Guide

Transcription

1 Installation and Administration Guide Product Version: Publication date: 7/21/2011 Copyright , LINOMA SOFTWARE LINOMA SOFTWARE is a division of LINOMA GROUP, Inc.

2 Table of Contents Introduction... 4 Administration... 5 Pre-Installation Notes... 6 Port Number Usage... 6 Installation Windows... 7 Requirements... 7 Installing GoAnywhere Services on Windows... 7 Installation Linux... 8 Requirements... 8 Installing GoAnywhere Services on Linux... 8 Installation UNIX, AIX, HP-UX, Solaris... 9 Requirements... 9 Installing GoAnywhere Services... 9 Installation IBM i (iseries) Requirements Required licensed programs Required PTFs IBM i components installed Installing GoAnywhere Services on IBM i Initial Configuration Customizing Installation Settings Changing GoAnywhere Services Port Numbers Changing ports using the browser interface Changing ports using the CFGGAS command on IBM i Changing ports by manually editing the configuration file Disabling HTTP or HTTPS Connectors SSL (HTTPS) Configuration Firewall Recommendations Installation in the DMZ Installation in the Private Network Installation with GoAnywhere Gateway Product Administration Starting and Stopping GoAnywhere Services Windows instructions Linux and UNIX instructions IBM i instructions Upgrading GoAnywhere Services Configuring HTTP Proxy Windows upgrade instructions Linux and UNIX upgrade instructions IBM i upgrade instructions Linoma Software Page 2

3 Backups and Replication Backing up GoAnywhere Services User Data Automatically Backing Up the GoAnywhere Services Database (to Disk) Manually Backing Up the GoAnywhere Services Database (to Disk) Replicating GoAnywhere Services User Data (for High Availability) Replication Failover GoAnywhere IBM i Commands Uninstalling GoAnywhere Services Product Windows uninstall instructions Linux and UNIX uninstall instructions IBM i uninstall instructions License agreement and limited warranty Contacting Linoma Software Linoma Software Page 3

4 Introduction GoAnywhere Services tm is a secure file server that allows trading partners and employees to connect to your organization and easily exchange files within a fully managed and audited environment. Popular file transfer and encryption standards are supported without the need for proprietary client software. GoAnywhere Services is an on-premises solution that allows for localized control, user management and security of your data. GoAnywhere Services includes the following comprehensive features: Installs to Windows, Linux, AIX, IBM i (iseries), UNIX, Solaris and HP-UX FTP server component with support for SSL (Explicit SSL) SFTP server component for secure FTP transfers over SSH FTPS server component for secure FTP transfers over SSL (Implicit SSL) HTTPS web client for simple browser-based file transfers AS2 server component for receiving EDI and other documents over secured connections Highly scalable with support for multiple concurrent file transfer sessions Browser-based interface for all administrative and monitoring functions Unlimited administrative users with configurable individual roles Wizards and templates for creating trading partner accounts quickly Trading partner permission controls for specific services (FTP, SFTP, FTPS, HTTPS, AS2), actions (e.g. upload, download, etc.) and directories Event Triggers - Send alerts or perform actions on files when user-defined events occur (e.g. upload, download, invalid login, etc.) Integrated key management tools for SSH Keys and SSL Certificates Detailed audit logs for all activity (e.g. logins, file transfers, errors and other events) No programming or special skills required to set up Integrates with GoAnywhere Director tm for a cohesive managed file transfer solution Linoma Software Page 4

5 Administration GoAnywhere Services Installation and Administration Guide Authorized users can utilize GoAnywhere Service s web-based Administrator to perform configuration and monitoring within the product. The following components are available within the Administrator: Define global settings for GoAnywhere Services Configure the properties for the FTP, SFTP, FTPS, HTTPS and AS2 services Define administrative users, user groups and their permissions Define trading partner accounts (web users) Authorize services (e.g. FTP, SFTP, FTPS, HTTPS, AS2) to individual web users and groups Restrict web users to certain directories Grant permissions (upload, download, delete, rename, etc.) to individual web users and groups Create and manage event triggers and their actions Create and manage SSL certificates and SSH keys View the active sessions for logged-in users with the ability terminate (kick) sessions View audit logs using a variety of criteria (e.g. web user id, date, time, status, file name, remote IP address, event, etc.). Optionally export those logs Linoma Software Page 5

6 Pre-Installation Notes Port Number Usage GoAnywhere Services Installation and Administration Guide GoAnywhere Services will utilize port numbers on the server for its various modules. Listed below are the default port numbers that will be used. Port Number Description 9000 Administrator functions over HTTP 9001 Administrator functions over HTTPS 9005 Shutdown port for GoAnywhere Services 443 HTTPS/AS2 service for trading partners 21 FTP service for trading partners 990 FTPS service for trading partners 22 SFTP service for trading partners These port numbers can be overridden either during the installation or at any time after the installation Linoma Software Page 6

7 Installation Windows GoAnywhere Services Installation and Administration Guide GoAnywhere Services can be installed onto a Windows server for enterprise usage. GoAnywhere Services can also be installed onto Windows desktops or laptops, which is useful for individual development and testing purposes. Both 32-bit and 64-bit versions of Windows are supported. A Windows installation wizard is provided for GoAnywhere Services which installs the product files into the directory of your choice. GoAnywhere Services will be implemented as a Windows Service which will automatically start (by default) when Windows starts. Requirements - Operating Systems supported: Windows 2003 Windows 2008 R2 Windows XP Windows Vista Windows 7 - Disk space: 125 MB - Minimum memory: 256 MB Installing GoAnywhere Services on Windows Perform the following steps to install the GoAnywhere Services product onto a Windows machine. 1. Login to the target Windows system as an administrator. 2. Download the GoAnywhere Services installer.exe file from the URL provided by Linoma Software. Note: If you have a 64-bit operating system, make sure to download the 64-bit version. 3. Execute the downloaded.exe file and follow the prompts on the screens. 4. If you did not choose to start the GoAnywhere Services application server within the installer, then you can manually start this server by following these instructions: a. Go to Control Panel -> Administrative tools -> Services. b. In the Services window, right-click on the GoAnywhere Services and select Start. c. Within seconds after starting the GoAnywhere Services, its status should be updated to Started. If not, please contact Linoma Software technical support. 5. The installation and startup of GoAnywhere Services is complete. Now you should proceed to the Initial Configuration instructions on page 16. Note: The GoAnywhere Services is configured in Windows as an automatic startup Service. This means that the GoAnywhere Services will automatically start whenever Windows starts Linoma Software Page 7

8 Installation Linux GoAnywhere Services Installation and Administration Guide GoAnywhere Services can be installed onto a Linux server for enterprise usage. GoAnywhere Services can also be installed onto Linux desktops or laptops, which is useful for individual development and testing purposes. Both 32-bit and 64-bit versions of Linux are supported. A graphical installation wizard is provided for GoAnywhere Services which installs the product files into the directory of your choice. Requirements - Disk space: 125 MB - Minimum Memory: 256 MB Installing GoAnywhere Services on Linux Perform the following steps to install the GoAnywhere Services onto a Linux system. 1. Login to the target Linux system as root. 2. Download the GoAnywhere Services Linux installer file from the URL provided by Linoma Software. 3. If you have a graphical desktop for Linux, execute the downloaded installer file and follow the prompts on the screens. Otherwise, execute the downloaded installer file with a c option (e.g. installer_filename.sh -c) and follow the prompts. 4. Start the GoAnywhere Services by following these instructions: a. Open a Terminal window. b. Change the working directory to the directory where GoAnywhere Services was installed (for example, cd /usr/local/linoma_software/goanywhere_services) c. Start the GoAnywhere Services by executing the following shell script:./gaservices.sh start 5. The installation and startup of GoAnywhere Services is complete. Now you should proceed to the Initial Configuration instructions on page 16. Tip: You can setup GoAnywhere Services so it starts automatically when the Linux system is booted. Please refer to your operating system manual for more details on setting up auto-start services. You can execute gaservices.sh from your startup scripts Linoma Software Page 8

9 Installation UNIX, AIX, HP-UX, Solaris GoAnywhere Services can be installed onto a server for enterprise usage. This page includes installation instructions for UNIX, Solaris (SPARC and Intel), AIX and HP-UX servers. An installation wizard is provided for GoAnywhere Services which installs the product files into the directory of your choice. Requirements - Disk space usage: 125 MB - Memory usage: 256 MB - JRE (Java Runtime Environment) or higher [ Note: 1.6.x is recommended ] Installing GoAnywhere Services Perform the following steps to install GoAnywhere Services onto a UNIX, Solaris (SPARC and Intel), AIX or HP-UX server. 1. Login to the server as root. 2. Download the GoAnywhere Services UNIX installer file from the URL provided by Linoma Software. 3. Open a Terminal window 4. Change the directory to where the installer file was downloaded (e.g. cd /root/desktop) 5. If needed, set the Executable bit on the file (e.g. chmod 755 gaservices1_0_0_unix.sh) 6. Run the installer (e.g../gaservices1_0_0_unix.sh) 7. The installer will attempt to find a compatible JRE (Java Runtime Environment) for the installation process. Follow the steps below if the installer cannot find a compatible JRE: a. Define an environment variable named "INSTALL4J_JAVA_HOME" to point to the home directory of the JRE (e.g. export INSTALL4J_JAVA_HOME=/usr/lib/jvm/java sun/jre). b. Clear the Installer cache by removing the file named ".install4j" from your home directory (e.g. rm /root/.install4j). c. Run the installer again (e.g../gaservices1_0_0_unix.sh). 8. Follow the on-screen instructions to complete the installation. 9. JCE policy files must be copied to the JRE s (Java Runtime Environment) security folder in order to support encryption functions in GoAnywhere Services: For IBM platforms (e.g. AIX), copy the JCE policy files of US_export_policy.jar and local_policy.jar from the jce_policy_files/ibm folder (located under the GoAnywhere Services installation folder) to the jre/lib/security folder (located under the JRE's installation directory). For all other platforms (e.g. Solaris), copy the JCE policy files of US_export_policy.jar and local_policy.jar from the jce_policy_files/sun folder (located under the GoAnywhere Services installation folder) to the jre/lib/security folder (located under the JRE's installation directory). (continued on next page) Linoma Software Page 9

10 10. Start the GoAnywhere Services by following these instructions: a. Open a Terminal window. b. Change the working directory to the directory where GoAnywhere Services is installed (for example, cd /usr/local/linoma_software/goanywhere_services) c. Start the GoAnywhere Services by executing the following shell script:./gaservices.sh start. d. If you receive an error indicating that no JRE could be found, set an environment variable named "JAVA_HOME" to point to the JRE s home directory (e.g. export JAVA_HOME=/usr/lib/jvm/java sun/jre) and try starting GoAnywhere Services again. 11. The installation and startup of GoAnywhere Services is complete. Now you should proceed to the Initial Configuration instructions on page 16. Tip: You can setup GoAnywhere Services so it starts automatically when the system is booted. Please refer to your operating system manual for more details on setting up autostart services. You can execute gaservices.sh from your startup scripts Linoma Software Page 10

11 Installation IBM i (iseries) GoAnywhere Services can be installed on IBM i systems which meet the following requirements. Requirements Operating System: i5/os V5R3 or higher Disk space: 75 MB Memory: 256 MB Required licensed programs The following IBM i licensed programs are prerequisites to the installation of GoAnywhere Services, which are dependent on i5/os release. i5/os Release Licensed Program Product Option Description V5R3 5722JV1 7 Java Developer Kit AC3 *BASE Crypto Access Provider 5722SS1 30 QShell 5722SS1 33 Portable App Solutions Environment V5R4 5722JV1 8 J2SE bit 5722SS1 30 QShell 5722SS1 33 Portable App Solutions Environment V6R1 5761JV1 8 J2SE bit 5761SS1 30 QShell 5761SS1 33 Portable App Solutions Environment V7R1 5761JV1 8 J2SE bit 5770SS1 30 QShell 5770SS1 33 Portable App Solutions Environment To check if the licensed programs (listed above) are installed on your IBM i, execute the command GO LICPGM and select option 10 to display the installed licensed programs. Press F11 twice from that screen to display the Product Options. If these licensed programs are not loaded on your IBM i, they may be available on the IBM software CDs that came with your IBM i. Otherwise, you will have to request those licensed programs from IBM, which are normally provided at no charge. (continued on next page) Linoma Software Page 11

12 Required PTFs The following IBM i Program Temporary Fixes (PTFs) and Group PTFs are prerequisites to installing GoAnywhere. V5R3 Individual PTF TL04153 for LICPGM Group PTF SF99530 (minimum level of 4153) Individual PTF SI17619 for LICPGM 5722SS1 (If you want to encrypt or zip 4Gb+ sized files) V5R4 Group PTF SF99291 (minimum level of 17) V6R1 Group PTF SF99562 (minimum level of 5) V7R1 Group PTF None Use the command DSPPTF to verify that the required individual PTFs are applied. Use the command WRKPTFGRP to verify that the required group PTFs are applied. IBM i components installed The following components will be installed onto the IBM i by the GoAnywhere Services installation process: A IBM i library will be created, which will contain the GoAnywhere Services commands and program objects. The default library name is GASERVICES, which can be changed during installation. An IFS folder will be created, which will contain the GoAnywhere Services software components. The default IFS folder name is /linoma/gaservices, which can be changed during installation. Optional: The policy files named US_export_policy.jar and local_policy.jar will be installed into the security directory of the Java Development Kit (JDK). These policy files are used to support encryption functions in GoAnywhere. - For V5R3, this directory is "/QIBM/ProdData/Java400/jdk15/lib/security". - For V5R4 and higher, the directory is "QOpenSys/QIBM/ProdData/JavaVM/jdk50/32bit/jre/lib/security" or "QOpenSys/QIBM/ProdData/JavaVM/jdk60/32bit/jre/lib/security" Linoma Software Page 12

13 Installing GoAnywhere Services on IBM i Perform the following steps to install the GoAnywhere Services product onto the IBM i. 1. Sign on to the IBM i with the QSECOFR user profile OR with a profile which has *ALLOBJ authority. 2. Create a temporary Save file on your IBM i by executing the following i5/os command: CRTSAVF FILE(QGPL/GASERVICES) 3. The GoAnywhere Services software needs to be uploaded to your IBM i using FTP. Before proceeding, make sure the FTP server is running on the IBM i. To start the native FTP server on the IBM i, you can issue the i5/os command of STRTCPSVR SERVER(*FTP) 4. Download the GoAnywhere Services installer (for IBM i) from the URL provided by Linoma Software. 5. Extract the files from the installer ZIP file into a new temporary folder on your workstation. One of the extracted files will be named GASERVICES.SAVF. 6. FTP the extracted GASERVICES.SAVF file from your PC to the Save file on the IBM i (that was created in step 2). Listed below are instructions for a Windows user: Open a DOS window. Enter the DOS command FTP <hostname>, where <hostname> is the host name or IP address of your IBM i. Login with your i5/os user id and password, then enter the following highlighted FTP commands: ftp> BINARY ftp> LCD \<tempdir> ftp> CD qgpl ftp> PUT gaservices.savf gaservices ftp> QUIT (switches the FTP session to binary mode) (<tempdir> is the PC directory containing the file named GASERVICES.SAVF) (changes the remote directory to the QGPL library) (sends the PC file GASERVICES.SAVF to the IBM i Save file named GASERVICES) (ends your FTP session) 7. Restore the installation objects into QTEMP by executing the following i5/os command: RSTOBJ OBJ(*ALL) SAVLIB(QTEMP) DEV(*SAVF) SAVF(QGPL/GASERVICES) 8. Delete the temporary Save file by executing the following i5/os command (optional): DLTF FILE(QGPL/GASERVICES) 9. If QTEMP library is not in your library list, then add it by executing the following i5/os command: ADDLIBLE LIB(QTEMP) POSITION(*FIRST) (continued on next page) Linoma Software Page 13

14 10. Prompt (F4) the command QTEMP/INSTALLGAS for installing GoAnywhere Services. The following screen appears. Type choices, press Enter. Install GoAnywhere Services (INSTALLGAS) Install library GASERVICES Install IFS directory '/linoma/gaservices' Install policy files *YES *YES, *NO Administration port Secure administration port HTTPS service port FTP service port FTPS service port SFTP service port Shutdown port Parameter descriptions: Field name Install library Install IFS directory Install policy files Administration port Secure administration port HTTPS service port FTP service port FTPS service port SFTP service port Description The library to contain the GoAnywhere Services product objects. The specified library name must not already exist. The directory to contain the GoAnywhere Services product files. The specified directory name must not already exist. Indicate if policy files should be installed into the security directory of the Java Development Kit (JDK). These files are used to support the encryption processes in GoAnywhere Services. It is strongly recommended to use the default setting of *YES. The port number that the GoAnywhere Services Administrator runs under (using HTTP). Default is * The port number that the GoAnywhere Services Administrator runs under (using HTTPS). Default is * The port number to run the HTTPS/AS2 service under (for trading partner file transfers). Default is 443. * The port number to run the FTP service under (for trading partner file transfers). Default is 21. * The port number to run the FTPS service under (for trading partner file transfers). Default is 990. * The port number to run the SFTP service under (for trading partner file transfers). Default is 22. * Shutdown port The port number which the GoAnywhere Services will listen to for shutdown requests. Default is * * Note: To check if the port number is already in use, run the i5/os command of NETSTAT and select option 3. Then press F14 to see the numeric port numbers. 11. After reviewing and/or modifying the parameters on the INSTALLGAS command, press enter to start the installation process. (continued on next page) Linoma Software Page 14

15 12. Prompt (F4) the command GASERVICES/STRGAS for starting the GoAnywhere Services subsystem. The following screen will be displayed. Type choices, press Enter. Start GoAnywhere Services (STRGAS) Server user profile *CURRENT Name, *CURRENT For the Server User Profile parameter, keep the default of *CURRENT if you want to run the GoAnywhere Services application under your user profile. Otherwise, specify a different user profile to run the GoAnywhere Services application server under. Note: The user profile specified on the STRGAS command must be enabled on the IBM i. This profile must have *USE authority to the STRSBS command and *RWX authority to the IFS folders where GoAnywhere Services is installed. For security purposes, you may want to create a new user profile and consistently use that profile on the STRGAS command. Then you would only have to grant authority for the GoAnywhere installation IFS folders to that user profile. 13. Press enter on the STRGAS command to start the GoAnywhere Services subsystem. 14. Execute the WRKACTJOB (Work with Active Jobs) command to confirm that the GoAnwhere Services subsystem is running. You should find a subsystem which has the same name as the library name that was specified on the INSTALLGAS command in step 10 (named GASERVICES by default). This subsystem should contain one job, which is the GoAnywhere Services application. 15. The installation and startup of GoAnywhere Services is complete. Now you should proceed to the Initial Configuration instructions on page 16. Tip: The GoAnywhere Services can automatically start when the System i is powered up (IPL). To perform this automatic startup, place the STRGAS command in the System i startup CL program (after the start of TCPIP). CL example: QSYS/STRTCP /* Start TCP */ DLYJOB DLY(120) /* Wait for TCP to fully start */ GASERVICES/STRGAS /* Start GoAnywhere Services */ Linoma Software Page 15

16 Initial Configuration GoAnywhere Services Installation and Administration Guide Follow the instructions below to request a license key, test the installation and perform initial configuration of GoAnywhere Services. 1. To access the GoAnywhere Services Administrator using a standard HTTP connection, open your browser and type the URL of where [hostname] is the host name or IP address of the GoAnywhere Services and [portnumber] is the port number of the GoAnywhere Services Administrator. The default HTTP port for the Administrator is Example: Otherwise, to access the GoAnywhere Services Administrator over a secure HTTPS connection, open your browser and type the URL of The default HTTPS port for the Administrator is Example: 2. You should then be presented with a login screen for the GoAnywhere Services Administrator. 3. Login with your user name and password. The default user name is administrator and the default password is goanywhere. 4. The GoAnywhere Services Administrator dashboard should then be displayed. 5. A product license key (either a trial key or permanent key) is required to use GoAnywhere Services. If you have not received this license key from Linoma Software, then request the key by following the instructions below: a. Select the Administration drop-down menu. b. Select the License sub menu. c. Choose the Request a License option. d. Follow the instructions on that screen to request a license from Linoma Software Linoma Software Page 16

17 6. After receiving the product license key, you can install the key by following the instructions below: a. Select the Administration drop-down menu. b. Select the License sub menu. c. Choose the Install License option. d. Click on the Browse button and select the license key file on your workstation. e. After choosing the file, click on Install button to install the license. f. If successful, the license information should be displayed on the screen. 7. Review and adjust the global settings in GoAnywhere Services by following the instructions below: a. Select the Administration drop-down menu. b. Choose the "Global Settings" options. c. Review the settings on the tabs and make any changes as needed. Read the on-line help text for each setting to understand its purpose. d. Be sure to specify the settings for your SMTP server on the SMTP Settings tab. This will allow GoAnywhere Services to send alerts when certain events occur. e. Note that some changes to the Global Settings will take effect only when GoAnywhere Services is restarted. 8. By default, GoAnywhere Services will authenticate user passwords against its own internal database. Optionally you can configure GoAnywhere Services to authenticate user passwords against a Windows Active Directory, a generic LDAP server or an IBM i system within your organization. Follow the steps below if you want to authenticate passwords against one of these servers: a. Select the Security drop-down menu. b. Choose the Login Methods menu option. c. Click on the link Add Login Method. d. Key in a name (to assign the login method) and then choose the login type. e. If you choose Windows Active Directory as the login type: Specify the URL of the Active Directory to authenticate passwords against. The URL should be in the format ldap://[hostname]:[port]. For example, ldap://mydomainhostname:389 or ldap:// :389. The default port for the Active Directory Server is 389. The default port for an SSL enabled connection is 636. Specify the Domain name of the Active Directory. For example, MYDOMAIN. f. If you choose Generic LDAP as the login type: Specify the URL of the LDAP server to authenticate passwords against. The URL should be in the format ldap://[hostname]:[port]. For example, ldap://mydomainhostname:389 or ldap:// :389. The default port for a LDAP Server is 389. The default port for an SSL enabled connection is 636. Specify the DN Pattern. The variable ${user} must be included in the DN pattern and will be replaced with the username during login. For example, cn=${user},ou=users,dc=example,dc=com. g. If you choose IBM i as the login type: Specify the IP address or host name of the IBM i to authenticate passwords against. g. Click on the Save button to save the settings. h. From the Login Methods screen, choose the default login method and click the Save button Linoma Software Page 17

18 9. The passwords for the included administrator and root user ids will always be authenticated against GoAnywhere Services internal database. For security purposes, you should change the passwords for these users by following the instructions below. a. Select the Security drop-down menu. b. Choose the Users menu option. c. Click on the reset password button next to the administrator user name. d. Key in the new password on the screen and click on the Reset button. e. Click on the reset password button next to the root user name. f. Key in the new password on the screen and click on the Reset button. g. Record the new passwords in a safe place. 10. Manage the settings for the services (FTP, FTPS, SFTP, HTTPS, AS2) which you want to make available to your trading partners by following the instructions below: a. Select the Administration drop-down menu. b. Choose the Manage Services menu option. c. Follow the instructions in the on-line help to learn how to adjust settings for the various services. d. After adjusting any settings, you can click on the icon to start (or restart) the service. 11. Be sure to read the backup instructions on page 30 to learn how to backup GoAnywhere Services configurations and settings, which should be performed on a regular basis. 12. Also be sure to read the Firewall recommended settings on page Linoma Software Page 18

19 Customizing Installation Settings Changing GoAnywhere Services Port Numbers By default, GoAnywhere Services administrator will utilize port numbers 9000, 9001 and 9005 on your system for the following functions: 9000 is the default HTTP port which users can connect (from their browsers) for performing administration in GoAnywhere Services serves the same function as port 9000, but uses a HTTPS (SSL-protected) connection is the default port for requesting a shutdown of GoAnywhere Services from a remote system. You can change these port numbers within the GoAnywhere Services browser-based administrator interface, or by using the CFGGAS command for IBM i or by making direct changes to a GoAnywhere Services configuration file. Changing ports using the browser interface 1. Open a browser window and log into the GoAnywhere Services administrator. 2. Select the Administration drop-down menu. Please note that you 3. Select the Admin Server Configuration sub menu. cannot change the 4. Select the Listener node in the tree. shutdown port through the browser interface. 5. Specify the new port number and click on the Save button. 6. The GoAnywhere Services server must be restarted for the changes to take effect. Changing ports using the CFGGAS command on IBM i 1. Log in to the IBM i using a terminal session. 2. End the GoAnywhere Services subsystem by running the command ENDGAS 3. Run the command CFGGAS 4. Under the "Port Information" section, edit the port numbers as needed by choosing option You may also want to change the "URL" under the "Run Project Defaults" section to match the port number to the new "Server Port". 6. Save the settings and restart GoAnywhere Services by running the command STRGAS. Changing ports by manually editing the configuration file 1. Stop the GoAnywhere Services server (if it is running). 2. Edit the configuration file [Install_Dir]/tomcat/conf/server.xml, where [Install_Dir] is the installation directory of GoAnywhere Services. 3. Change the port number for the HTTP or HTTPS connectors. Example: <Connector port="9000" /> 4. Change the port number for the shutdown listener. Example: <Server port="9005" shutdown="shutdown"> 5. Save the configuration file. 6. Start the GoAnywhere Services server Linoma Software Page 19

20 Disabling HTTP or HTTPS Connectors GoAnywhere Services is initially configured to support both HTTP and HTTPS (SSL) connectors for its web-based Administrator. If you want to disable one of these connectors, then follow the instructions below. a. Stop the GoAnywhere Services server (if it is running). b. Open the configuration file [Install_Dir]/tomcat/conf/server.xml, where [Install_Dir] is the installation directory for GoAnywhere Services. c. Locate the following XML code: <Server port="9005" shutdown="shutdown"> </Server> <Service name="catalina"> <Connector name= default port="9000" /> <Connector name="secured" port="9001" protocol="http/1.1" SSLEnabled="true" enablelookups="false" disableuploadtimeout="true" scheme="https" secure="true" clientauth="false" sslprotocol="tls" algorithm="sunx509" keystorefile="[install_dir]\userdata\keys\x509\privatekeys.jks" keystorepass="goanywhere" keyalias="test" /> d. If you do not want to use the HTTP (only use HTTPS) connector, then delete or comment out the line of code illustrated in blue. e. If you do not want to use the HTTPS (only use HTTP) connector, then delete or comment out the lines of code illustrated in green. f. If installing to IBM JVM (e.g. IBM i), then set the algorithm= IbmX509 g. Save the configuration file. h. Start the GoAnywhere Services server. Note: To comment out XML code, enclose the code with the following indicators <!-- to begin the comment --> to end the comment Example: <!-- <Connector port="9000" /> --> Linoma Software Page 20

21 SSL (HTTPS) Configuration A certificate is shipped with GoAnywhere Services, which is used (by default) when a user connects to the GoAnywhere Services administrator through their browser over HTTPS. While this default certificate works for establishing a secure channel, users will see warnings about a host name mismatch when they connect. This is because the host name in the shipped certificate will be different than the host name of the machine which you installed GoAnywhere Services to. To avoid these host mismatch warnings, it is recommended to create your own certificate (for your machine s host name) and update the GoAnywhere Services configuration file with the new certificate information. Follow the instructions below to create a new certificate and update the GoAnywhere Services configuration file: 1. From within the GoAnywhere Services browser-based Administrator, create a new certificate in the Default Private Keys Store. Read the section Creating a New SSL Certificate in the on-line help text to learn how to create a certificate. Note that the Common Name in the new certificate must match the domain name, host name, or IP address of the server on which GoAnywhere Services is installed. 2. Open the configuration file [Install_Dir]/tomcat/conf/server.xml, where [Install_Dir] is the installation directory for GoAnywhere Services. Then modify the value in the keyalias attribute to be the alias of the new certificate you created in step Linoma Software Page 21

22 Firewall Recommendations GoAnywhere Services Installation and Administration Guide If you want to make GoAnywhere Services available to external clients over the internet, it is important that you only open certain port numbers to the machine in which GoAnywhere Services is installed. This can be controlled through your firewall settings. The firewall settings will depend on whether if the GoAnywhere Services software is installed in your DMZ (Demilitarized Zone) or the Private (internal) network, and whether if it is used in conjunction with Linoma Software s GoAnywhere Gateway TM product. The following diagrams show the firewall settings to use if the default port numbers were used during the installation of GoAnywhere Services. (Please note that the IP addresses shown are for demonstration purposes only.) Installation in the DMZ This diagram illustrates GoAnywhere Services as installed in the DMZ. Notes: In order to administer GoAnywhere Services from any workstations in the private network, ports 9000 and 9001 will need to be opened (through the backend firewall) from the private network to GoAnywhere Services in the DMZ. If external trading partners need access to the file transfer protocols (e.g. SFTP, FTP, HTTPS, AS2, FTPS) in GoAnywhere Services, those port numbers (e.g. 21, 22, 443, 990) need to be opened through the frontend firewall to GoAnywhere Services in the DMZ. Additionally, if employees (on the private network) need to access those file transfer protocols in GoAnywhere Services, the port numbers will need to be opened through the backend firewall from the private network to GoAnywhere Services in the DMZ. If trigger events in GoAnywhere Services need to call Projects in the GoAnywhere Director product, then ports 8000 and 8001 need to be opened (through the backend firewall) from GoAnywhere Services to GoAnywhere Director in the private network Linoma Software Page 22

23 Installation in the Private Network GoAnywhere Services Installation and Administration Guide This diagram illustrates GoAnywhere Services as installed in the Private network. Notes: If external trading partners need access to the file transfer protocols (e.g. SFTP, FTP, HTTPS, AS2, FTPS) in GoAnywhere Services, those port numbers (e.g. 21, 22, 443, 990) need to be opened through the firewall to GoAnywhere Services in the private network Linoma Software Page 23

24 Installation with GoAnywhere Gateway GoAnywhere Services Installation and Administration Guide This diagram illustrates GoAnywhere Services as installed in the Private network, in conjunction with GoAnywhere Gateway (a separate licensed product from Linoma Software) in the DMZ. This configuration allows your organization to keep sensitive files, credentials and logs in the Private network. This configuration also does not require any incoming ports opened into the Private network, which provides a high level of security. Notes: In order to establish control and data channels from GoAnywhere Services to GoAnywhere Gateway, ports 9100 and 9101 will need to be opened (through the backend firewall) from the Private Network to GoAnywhere Gateway in the DMZ. Port 9102 will also need to be opened from the Private Network to GoAnywhere Gateway for Forward Proxy services. The port numbers (e.g. 21, 22, 443, 990 and ) for the desired file transfer protocols (e.g. FTP, SFTP, HTTPS, FTPS, AS2) need to be opened through the frontend firewall to GoAnywhere Gateway in the DMZ. More information about GoAnywhere Gateway can be found at Linoma Software Page 24

25 Product Administration GoAnywhere Services Installation and Administration Guide Starting and Stopping GoAnywhere Services Windows instructions Start the GoAnywhere Services by following these instructions: 1. Go to the Windows machine and logon with an administrator account. 2. Go to Control Panel -> Administrative tools -> Services. 3. In the Services window, right-click on the GoAnywhere Services and select Start. Within seconds after starting the GoAnywhere Services, its status should be updated to Started. Stop the GoAnywhere Services by following these instructions: 1. Go to the Windows machine and logon with an administrator account. 2. Go to Control Panel -> Administrative tools -> Services. 3. In the Services window, right-click on the GoAnywhere Services and select Stop. Linux and UNIX instructions Start the GoAnywhere Services by following these instructions: 1. Open a Terminal window. 2. Change the working directory to the directory where GoAnywhere Services is installed (for example, cd /usr/local/linoma_software/goanywhere_services) 3. Start the GoAnywhere Services by executing the following shell script:./gaservices.sh start Stop the GoAnywhere Services by following these instructions: 1. Open a Terminal window. 2. Change the working directory to the directory where GoAnywhere Services is installed (for example, cd /usr/local/linoma_software/goanywhere_services) 3. Stop the GoAnywhere Services by executing the following shell script:./gaservices.sh stop IBM i instructions Start the GoAnywhere Services by executing the i5/os command of STRGAS Stop the GoAnywhere Services by executing the i5/os command of ENDGAS The STRGAS and ENDGAS commands are located in the GoAnywhere Services installation library, which is named GASERVICES by default Linoma Software Page 25

26 Upgrading GoAnywhere Services Configuring HTTP Proxy GoAnywhere Services Installation and Administration Guide Updates (new versions) for GoAnywhere Services can be downloaded from Linoma Software s server. Read the instructions below to learn how to configure the Proxy settings (if your organization uses a proxy server) and then read the platform-specific instructions (on the following pages) on how to apply the updates. If your organization uses a Proxy Server, then you need to configure those proxy settings in GoAnywhere Services before you can retrieve web updates: 1. Click Administration > Global Preferences from the main drop-down menu. 2. Click the HTTP Proxy tab near the right end of the tab set. 3. Specify the type of proxy to use. DIRECT, HTTP, or SOCKS. DIRECT represents a direct connection, or the absence of a proxy. HTTP represents proxy for high-level protocols such as HTTP or FTP. SOCK represents a SOCKS (V4 or V5) proxy. 4. Specify the host name of the proxy server. 5. Specify the port number used by the proxy server. 6. Specify the username to use in order to connect to the proxy server. This is only necessary if the proxy server requires authentication. 7. Specify the password to use in order to connect to the proxy server. This is only necessary if the proxy server requires authentication. 8. Click the Save button. 9. Continue with the upgrade instructions on the following pages Linoma Software Page 26

27 Windows upgrade instructions GoAnywhere Services Installation and Administration Guide 1. Login to GoAnywhere Services browser-based Administrator. 2. Select the Administration drop-down menu and then choose the Check for Updates option. Follow the instructions on that screen to download any updates. 3. After the updates are downloaded, then login to the Windows system as an administrator. 4. Go to Control Panel -> Administrative tools -> Services. 5. In the Services window, right-click on the GoAnywhere Services and select Stop. Within seconds after stopping the GoAnywhere Services, its status should change to blanks. 6. Open a Command window and change the directory to $INSTALL_DIR\upgrader, where $INSTALL_DIR is the directory where GoAnywhere Services is installed. The default install directory is C:\Program Files\Linoma Software\GoAnywhere Services. 7. Run the batch file named upgrade.bat to start the upgrade process. When the upgrade finishes, a message should indicate that the upgrade was successful. 8. Restart the service by right-clicking on the GoAnywhere Services and select Start. Its status should be updated to Started Linoma Software Page 27

28 Linux and UNIX upgrade instructions GoAnywhere Services Installation and Administration Guide 1. Login to GoAnywhere Services browser-based Administrator. 2. Select the Administration drop-down menu and then choose the Check for Updates option. Follow the instructions on that screen to download any updates. 3. After the updates are downloaded, then login to the Linux system as root. 4. Open a Terminal window. 5. Change the working directory to the directory where GoAnywhere Services was installed (for example, cd /usr/local/linoma_software/goanywhere_services) 6. Stop the GoAnywhere Services by executing the following shell script:./gaservices.sh stop 7. Change the working directory to the GoAnywhere Services subdirectory of upgrader. (for example, cd upgrader) 8. Upgrade the GoAnywhere Services product by executing the following shell script:./upgrade.sh 9. When the upgrade finishes, a message should indicate that the upgrade was successful. 10. Change the working directory back to the GoAnywhere Services installation directory (for example, cd /usr/local/linoma_software/goanywhere_services) 11. Restart the GoAnywhere Services by executing the following shell script:./gaservices.sh start Linoma Software Page 28

29 IBM i upgrade instructions GoAnywhere Services Installation and Administration Guide 1. Login to GoAnywhere Services browser-based Administrator. 2. Select the Administration drop-down menu and then choose the Check for Updates option. Follow the instructions on that screen to download any updates. 3. After the updates are downloaded, then login to the IBM i with the QSECOFR user profile OR with a profile which has *ALLOBJ authority. 4. Execute the following i5/os commands. These commands are located in the GoAnywhere installation library, which is named GASERVICES by default. a. End the GoAnywhere Services by executing the ENDGAS command. b. Wait until the GoAnywhere Services subsystem is ended. c. Apply the update by executing the UPGRADEGAS command. d. Start the GoAnywhere Services by executing the STRGAS command Linoma Software Page 29

30 Backups and Replication GoAnywhere Services Installation and Administration Guide Backing up GoAnywhere Services User Data All user data and configurations for GoAnywhere Services are stored in a folder called userdata, which is located under the GoAnywhere Services installation directory. The default paths to the userdata folder for each platform is listed below: - IBM i: /linoma/gaservices/userdata - Windows: C:\Program Files\Linoma Software\GoAnywhere Services\userdata - Linux and UNIX: /usr/local/linoma_software/goanywhere_services/userdata IMPORTANT: You should backup the GoAnywhere Services userdata folder (and its contents) in your regular backup processes. It is recommended to backup this userdata folder at least daily. NOTE: If using the embedded Derby database (which is the default) in GoAnywhere Services: If you plan to perform backups while GoAnywhere Services is running, then you should exclude the subfolder userdata/database/gaservices from your backup processes since there will be a lock on the files in this subfolder (which is the embedded Derby database). However, this Derby database is saved nightly (by default) to a subfolder named userdata/database/backups, which you should backup Linoma Software Page 30

31 Automatically Backing Up the GoAnywhere Services Database (to Disk) These instructions only apply if using the default embedded Derby database in GoAnywhere Services. By default, GoAnywhere Services will perform an automatic backup (to disk) of its embedded Derby database every day at midnight. The database backup files are created in the folder of [Install_Dir]/userdata/database/backups, where [Install_Dir] is If not using the embedded Derby database, you should backup the GoAnywhere Services tables (in your designated database) using your regular database backup procedures. the installation directory for GoAnywhere Services. By default, database backup files are retained for the last 7 days. Follow the instructions below to modify the database backup settings: 1. From the main menu, select Administration > Database Manager. 2. The current backup settings will appear on the screen. Enable Database Backup Specify whether or not the GoAnywhere Services embedded database should be backed up automatically on a scheduled basis. It is highly recommended that the database backup remains enabled in case any data needs to be recovered. Backup Directory Specify the directory to store the database backups, which is relative to the installation directory. Keep Backups for Specify the number of days (1 30) to keep the database backup files. Backup files that are older than the specified number of days will be automatically deleted following each backup process. Schedule Type Specify if the schedule is Hourly or Daily. Run Every Specify the frequency that the automatic database backup should run. 3. Click the Save button Linoma Software Page 31

32 Manually Backing Up the GoAnywhere Services Database (to Disk) These instructions only apply if using the default embedded Derby database in GoAnywhere Services. To backup the GoAnywhere Services database manually: 1. Select the drop-down menu of Administration and then select Database Configuration. 2. Click the Backup tab. The current backup settings will be shown. 3. Click the Backup Now button at the bottom of the screen. 4. When the system completes the backup process, a message will be displayed with the location to which the database was backed up Linoma Software Page 32

33 Replicating GoAnywhere Services User Data (for High Availability) GoAnywhere Services user data can be replicated to another system for high availability and failover purposes. GoAnywhere Services does not have a built-in replication function, so you will need to use a separate tool to replicate the necessary data to the high availability (HA) machine. If using the embedded Derby database in GoAnywhere Services, please note that it cannot be replicated while it is running (due to locks), so the HA machine can only be sent a backup of the database. The timing of this database backup is controlled under the Administration->Database Configuration menu. Replication Follow the steps below to set up replication: 1. Install GoAnywhere Services onto the HA machine using one of the regular installation methods (depending on your OS) outlined earlier in this manual. 2. Get a license key from Linoma Software for the HA machine and install it. 3. Test the GoAnywhere Services installation on the HA machine to make sure it works properly. 4. Shut down the GoAnywhere Services subsystem/service on the HA machine, since GoAnywhere Services should not be running on both the production and HA machines at the same time. 5. Set up your HA tool to replicate the folder named userdata, which is located under the GoAnywhere Services installation directory on the production machine. The userdata folder contains all user data and configurations for GoAnywhere Services. Make sure to include all the subfolders under the userdata folder, except DO NOT replicate the subfolder named /userdata/database/gaservices/ since there will be a lock on that subfolder while GoAnywhere Services is running. This subfolder contains the embedded database, which is saved nightly (by default) to the subfolder named userdata/database/backups. WARNING: If you want to replicate the entire GoAnywhere Services installation directory, then do not replicate the file named gaservices.lic since that file contains the license key that is specific for that particular machine. If the license key is replicated to the HA machine, it will generate a license error in GoAnywhere Services on the HA machine and will not allow it to execute. Failover The steps to follow in order to run GoAnywhere Services on the HA machine depends on if your production machine is still up-and-running. If your production machine is down and you want to switch to the HA machine: 1. If using the embedded (Derby) database in GoAnywhere Services: On the HA machine, unzip the latest backup of the GoAnywhere Services database (found in subfolder named userdata/database/backups) into the subfolder named /userdata/database/gaservices. Please note that the database will only be as up-to-date as the last time the database was backed up on the production machine. 2. Start the GoAnywhere Services subsystem/service on the HA machine. (continued on next page) Linoma Software Page 33