Recommended steps for XP SP2 DCOM and Firewall Setup

Transcription

1 Recommended steps for XP SP2 DCOM and Firewall Setup Page 1 of 2 Windows XP Service Pack 2 (SP2) Support Advisory Center DCOM for XP SP2 Setup Tutorial - Introduction This tutorial will soon also be incoporated into/included in our standard DCOM Tutorial downloadable help file that we include with most of our OPC products. The concepts in this tutorial can be applied to any OPC application using DCOM on a Windows XP system with XP2. The screenshots and setups shown are based on having our OPC Quick Client connect to our TOP Server on a remote PC. The information is all you should have to change to a system that was running using DCOM before installing XP SP2. If you are setting up a new system these settings can be the first ones made before following the rest of our standard DCOM tutorial. DCOM with XP SP2 requires two new steps. The first is the new Windows Firewall The second is Limits that can be set in DCOM security to overcome a weakness that would allow programs to set their own DCOM security limits regardless of what the user configured. Before you begin, you must have available: The names of all OPC client and OPC server applications you will be configuring on each PC. You need the "friendly name" - i.e. TOP Server is one of our OPC Servers You need the actual "executable name" - i.e. the executable for TOP server is named Servermain.exe Users of Software Toolbox products, Click for a list of applications, their filenames, and install locations. Clearly understand which PC has the OPC client portion of your application, and which PC has the OPC server portion of your application. All of this information would have been gathered in the impact assessment portion of your Best Practices analysis. Disclaimer: The information contained in these pages is based on our testing with the release candidate of XP Service Pack 2. Although this information is based on "best practices" as judged by the authors, Software Toolbox and the authors of this document assume no responsibility or direct, indirect, or consequential liability for its accuracy or suitability for a users particular application. The reader is responsible for proper application to their particular situation and for the decision to deploy Windows XP SP2 in their environment.

2 Recommended steps for XP SP2 DCOM and Firewall Setup Page 2 of 2 Home XPSP2_BestPractices XPSP2_DCOMSetup XPSP2_ProductStatus P: (US-Sales) or (Support & International), F: A East Charles Street, Matthews, North Carolina, USA Copyright Software Toolbox, Inc., , All Rights Reserved Worldwide. No Copying or Reposting Without Written Permission of Software Toolbox Inc.

3 Firewall Page 1 of 5 Windows XP Service Pack 2 (SP2) Support Advisory Center DCOM for XP SP2 Setup Tutorial - Step 1 Windows Firewall Settings The Windows Firewall settings are found by going to Start- Control Panel and choosing the Windows Firewall icon. The screen below is the first one shown. We suggest using the Windows Firewall and setting it to the On setting shown below. If you choose "Don't allow exceptions" you will not be able to use DCOM or do any remote OPC Connections. We suggest leaving this unchecked. If you choose Off you are turning of the firewall and you can skip the part of the DCOM configuration. This is NOT RECOMMENDED except for testing purposes or for internal networks which you know you have otherwise secured from attack. You assume responsibility if you turn off the Windows Firewall. Next Click on the Exceptions Tab to perform two key steps:

4 Firewall Page 2 of 5 1. Enable incoming and outgoing DCOM network access by opening TCP/IP port Enable OPCEnum.exe access to DCOM 3. Allow each OPC client and server access to network resources The screen below already has opcenum.exe and some OPC client and OPC Server applications enabled as exceptions, and a port opened for DCOM. Step 1A - Enabling DCOM: Should be performed on: Client and Server Computers DCOM isn't associated with any one executable (unlike your OPC clients and OPC servers) so we will enable it by adding a port. Click on the the Add Port button.

5 Firewall Page 3 of 5 You need to fill out this dialog box exactly as shown above for DCOM to work. Port 135 is the standard Port number that DCOM uses. TCP must be checked. When done click OK. If you choose to click on the Change scope button in the Add a Port Dialog, we recommend the setting above. Any change to this requires advanced knowledge of the network system you are using and is beyond the scope of this tutorial. Step 1B - Enable OPCEnum.exe Should be performed on: OPC Server Computers at a minimum. OPCEnum.exe is a standard OPC application installed by nearly every OPC server on the market. It should be in the \Windows\System32\ directory if present. The purpose of OPCEnum.exe is to allow remote OPC clients connect to a computer with OPC servers installed and ask the computer the question "Give me a list of your available OPC servers" and get a response. The OPC client can then pick the desired OPC server from the list and obtain the necessary data from the remote PC to then be able to establish a connection to that remote OPC server. If this step is not performed, or is not successful on any PCs where you have OPC servers installed, then the symptoms will be that your OPC client PCs will not be able to browse the remote PC for a list of available OPC servers.

6 Firewall Page 4 of 5 For the reasons above, It is critical that OPCEnum.exe be added as an exception. To Add OPCEnum.exe, from the Windows Firewall Exceptions tab, click the Add Program button: Then in the resulting dialog you can browse to \Windows\System32\ and pick OPCEnum.exe to add as an exception. Step 1C - Enable OPC Client and OPC Server Applications Should be performed on: Client Computers for OPC Client Applications, Server computers for OPC Server applications. This step is where your list of OPC client and server applications is important. Users of Software Toolbox products, Click for a list of applications, their filenames, and install locations. 1. The applications may already appear in the exceptions dialog but need to be marked as exceptions - they would appear potentially using their "friendly name" 2. If the applications are not already in the Exceptions list, you will need to know the name of the application executable (EXE) and its location on your hard drive so you can add it to the list. Adding an Application: As an example, we'll use an OPC client application that needs to be added to the exceptions list. These steps are the same whether you are adding an OPC client or OPC server application. On the Windows Firewall Exceptions tab, click on the Add Programs button. Using the dialog below, you can browse to the target application EXE on your hard drive to add it to the Exceptions list. No changes are required to the areas of setup accessed by the Change Scope button unless your vendor specific instructions suggest that you make a change there.

7 Firewall Page 5 of 5 Special Notes: If you have written your own OPC client application using all of your own code or using a rapid development tool like our OPC Data Control ActiveX you may need to add two different client side executables: First, the name you assigned to your compiled application will determine what application you need to add on the client side. Second, if you need to be able to test in debug mode, remember that you will need to add the name of the EXE that corresponds to your development environment needs to be added. For example, if you use VB6, you need to also add VB6.exe if you plan to work in Visual Basic 6 and test/debug a client application you are writing. If you have written your own OPC server application, the same concepts apply. You must add the name of your application and potentially the executable that corresponds to your development environment. By adding your OPC server as an exception, you automatically take care of allowing traffic between the OPC server and the devices it communicates with because granting an exception in the Windows Firewall opens network traffic for that application for all ports. Summary: All EXE programs using OPC remotely should be added. It is critical that you add the port for DCOM, grant an exception for OPCEnum.exe, and grant exceptions for any OPC Clients or OPC Servers that you want to do any remote OPC Connections with. You have to do this on any Server or Client PC that has XP SP2 installed. Any affected programs that are not on the exceptions list to start with will have to be added by clicking on the Add Program button. Once this is all complete you can click OK and exit out of the Windows Firewall settings. You are done with the first step. Disclaimer: The information contained in these pages is based on our testing with the release candidate of XP Service Pack 2. Although this information is based on "best practices" as judged by the authors, Software Toolbox and the authors of this document assume no responsibility or direct, indirect, or consequential liability for its accuracy or suitability for a users particular application. The reader is responsible for proper application to their particular situation and for the decision to deploy Windows XP SP2 in their environment. Home XPSP2_BestPractices XPSP2_DCOMSetup XPSP2_ProductStatus P: (US-Sales) or (Support & International), F: A East Charles Street, Matthews, North Carolina, USA Copyright Software Toolbox, Inc., , All Rights Reserved Worldwide. No Copying or Reposting Without Written Permission of Software Toolbox Inc.

8 DCOMLimits Page 1 of 5 Windows XP Service Pack 2 (SP2) Support Advisory Center DCOM for XP SP2 Setup Tutorial - Step 2 Limits in DCOM Security within DCOM Config This setup step is only required on the computer where your OPC server is running. The second step requires you to go to the Windows Start button and click Run. Open the Component Services tree as shown below. Right Click on My Computer Icon and choose properties

9 DCOMLimits Page 2 of 5 The dialog above will open. Click on the COM Security tab to configure the default DCOM settings for this PC

10 DCOMLimits Page 3 of 5 The new components with XP SP2 are the two Edit limit buttons shown above. The critical action here is to add Anonymous Logon for both Access and Launch Permissions or opcenum.exe will not work and your OPC client will not be able to browse for remote OPC servers on the affected machine. The reason for this is that OPCEnum.exe (which is an OPC Foundation supplied application), is written to initialize security to allow Anonymous connections - it does not look for specific users. Both Access and Launch Permissions must be set to allow everything. Subsets of Everyone can be used but must not be more restrictive than the settings set found under the Edit Default buttons for both Access and Launch Permissions or they will override them. Note: If you have, or are using a web-based OPC client hosted on a webserver for example, then you should add the user-account that your webserver/web-application uses. The default account that IIS uses is: IUSR_<your computer name> Click Edit Limits under both Access and Launch Permissions then add the users as shown below. You may also have additional users included based on your user specific application requirements.

11 DCOMLimits Page 4 of 5 Notes: Also make sure that the advanced user and group settings have the right usernames and groups added to allow the Other PC's to connect

12 DCOMLimits Page 5 of 5 Disclaimer: The information contained in these pages is based on our testing with the release candidate of XP Service Pack 2. Although this information is based on "best practices" as judged by the authors, Software Toolbox and the authors of this document assume no responsibility or direct, indirect, or consequential liability for its accuracy or suitability for a users particular application. The reader is responsible for proper application to their particular situation and for the decision to deploy Windows XP SP2 in their environment. Home XPSP2_BestPractices XPSP2_DCOMSetup XPSP2_ProductStatus P: (US-Sales) or (Support & International), F: A East Charles Street, Matthews, North Carolina, USA Copyright Software Toolbox, Inc., , All Rights Reserved Worldwide. No Copying or Reposting Without Written Permission of Software Toolbox Inc.

13 Summary Page 1 of 1 Windows XP Service Pack 2 (SP2) Support Advisory Center DCOM for XP SP2 Setup Tutorial - Summary The information presented in this setup should be supplemented if appropriate with any vendor specific details for your own specific applications. Also, this tutorial is meant as a supplement to regular proper DCOM setup. You may also wish to consult our regular DCOM tutorial for additional help with regular DCOM setup. If you have questions regarding systems involving an application licensed from Software Toolbox, please us at support@softwaretoolbox.com. Be sure to indicate which Software Toolbox product(s) are involved in the application. Disclaimer: The information contained in these pages is based on our testing with the release candidate of XP Service Pack 2. Although this information is based on "best practices" as judged by the authors, Software Toolbox and the authors of this document assume no responsibility or direct, indirect, or consequential liability for its accuracy or suitability for a users particular application. The reader is responsible for proper application to their particular situation and for the decision to deploy Windows XP SP2 in their environment. Home XPSP2_BestPractices XPSP2_DCOMSetup XPSP2_ProductStatus P: (US-Sales) or (Support & International), F: A East Charles Street, Matthews, North Carolina, USA Copyright Software Toolbox, Inc., , All Rights Reserved Worldwide. No Copying or Reposting Without Written Permission of Software Toolbox Inc.