fåíéêåéí=péêîéê=^çãáåáëíê~íçêûë=dìáçé

Transcription

1 fåíéêåéí=péêîéê=^çãáåáëíê~íçêûë=dìáçé

2 Internet Server FileXpress Internet Server Administrator s Guide Version Version Created on 29 May, 2014

3 2014 Attachmate Corporation and its licensors. All rights reserved. Based on materials copyright TIBCO Software Inc. All Rights Reserved. No part of the documentation materials accompanying this Attachmate software product may be reproduced, transmitted, transcribed, or translated into any language, in any form by any means, without the written permission of Attachmate. The content of this document is protected under copyright law even if it is not distributed with software that includes an end user license agreement. The content of this document is furnished for informational use only, is subject to change without notice, and should not be construed as a commitment by Attachmate. Attachmate assumes no responsibility or liability for any errors or inaccuracies that may appear in the informational content contained in this document. Attachmate, the Attachmate logo, Reflection, and FileXpress are registered trademarks of Attachmate in the USA. All other trademarks, trade names, or company names referenced herein are used for identification only and are the property of their respective owners. Attachmate Corporation 705 5th Avenue South Seattle, WA USA Third Party Notices Third-party copyrights and notices, including license texts and other materials passed through in compliance with third party license terms, can be found in a thirdpartynotices.txt file in the program installation folder.

4 Table of Contents Table of Contents 1 GETTING STARTED FileXpress Internet Server Workflow Accessing the FileXpress Administrative Console Set up Connections to Remote Servers Add an FTP Server Add an FTPS Server Add an SSH Server Add an AS2 Server Add a Platform Server Start Internal Transfer Servers Start the FTP Transfer Server Start the FTP Transfer Server using FTPS Start the SSH Transfer Server Start the AS2 Transfer Server Start the Platform Server Responder Configuring PGP Encrypted Transfers Uploading PGP Encrypted Files from a Client Downloading PGP Encrypted Files to a Client Enabling PGP Encryption for Transfers to a Remote Server Adding a Transfer Definition Troubleshooting your Transfers ADMINISTRATIVE CONSOLE REFERENCE Transfers Add Transfer Manage Transfers OnDemand Users Add User Optional User Properties Available Rights Manage Users Transfer Groups Departments Servers Add Server Manage Servers Server Credentials Administration System Configuration Transfer Servers Keys Activity License Authenticators LDAP Sync Lockout Reports Audits Diagnostics iv

5 Table of Contents Statistics Help DELEGATED ADMINISTRATION Administrative Functions and Rules Active Users Audits Departments Diagnostics Transfer Server Configuration Groups Internet Checkpoints Internet Transfers License Server Server Credentials Statistics System Configuration Users EXTENDED FEATURES Executing an Internet Server File Transfer as a Post Processing Action Configuring the Target Internet Server system Configuring the Windows environment Configuring a UNIX environment Directory Transfers Directory Transfers using the Command Line Processing Configuring FileXpress for Support Send to Users when New or Updated Transfers are Available Send Notifications of File Transfer Success and Failure Templates File Tokens File Token Examples FTP and SSH Proxy FTP Proxy Description FTP Server FTP Server Example Multi-Language Support Changing the Database Userid or Password SAMPLE JMS XML JMS XML Schema and XML files ID INFORMATION AND FIELD LENGTHS ID Details Field Lengths INDEX v

6 Getting Started 1 Getting Started FileXpress Internet Server is a file transfer gateway that enables you to safely exchange files with external partners, or to transfer files internally using any combination of supported protocols. The Internet Server supports transfers using HTTPS, FTP, FTPS, SFTP, PGP over FTP, AS2, and the proprietary Platform Server protocol (CFI). Transfers can be converted from any supported protocol to another. The Internet Server allows for file data to be streamed directly from external users to an internal destination with no data at rest in the DMZ. Additional features include: Administrative console Provides a web-based user interface to configure and manage FileXpress Internet Servers. You can install this administrative console on the same computer that runs the Internet Server, or on a different computer. FileXpress Internet Transfer Clients FileXpress supports three web-based transfer clients that are installed with the Internet Server. FileXpress Desktop Client A Windows file transfer application that enables users to configure site connections and transfer files without requiring the administrator to set up transfer definitions. This client provides a graphical user interface that supports drag-and-drop file transfer. The Desktop Client is a ClickOnce application that can be installed or launched from a web browser. File transfer command line utility (CFInternet) Enables you to execute and audit Internet Server transfers. RocketStream Accelerator RocketStream is an optional feature, available on Windows systems, that provides accelerated data transfers using the Internet. 1.1 FileXpress Internet Server Workflow These are the basic steps to set up Internet Server and configure FileXpress transfers. 1. Start the Administrative Console (page 2). 2. Apply your License Key: Management > License > Add License Key. For details, see the FileXpress Internet Server Installation Guide. 3. Configure global settings. Administration > System Configuration > Global Settings notifications are a powerful tool available to you with FileXpress. You can use them to notify users when a transfer is ready, and provide them with a personalized link they can use to launch one of the FileXpress Internet Transfer Clients. You can also send notifications to administrators with information about successful and failed transfers. Configuring global settings is a prerequisite for using these features. 4. Define the users and groups who will be able to perform transfers. Use either or both of the following methods: o Add users directly to the FileXpress database: Users > Add User (page 22). o Add users to the FileXpress database from an LDAP server: Administration > Authenticators (page 84). 1

7 Getting Started 5. (Optional) Set up connections to remote servers: Servers > Add Servers By default, you can transfer files to and from the Internet Server host. In most cases, you will want to configure connections to additional servers. These servers can be in your internal network or on hosts managed by your business partners. Supported server types are listed here. (Page links go to Getting Started topics for selected server types.) Platform Server (page 7) Internet Server JMS FTP (page 4) LOCAL SSH (page 5) AS2 (page 6) 6. (Optional) Configure and start the FileXpress internal servers: Administration > Transfer Servers For each client protocol you want to support, you need to configure and start an internal Transfers Servers. HTTPS is enabled by default. FTP (page 7) FTPS (page 8) SSH (page 8) AS2 (page 9) Platform Server (page 9) 7. Add Transfer Definitions: Transfer > Add Transfer (page 13). Use Transfer Definitions to provide users with the ability to transfer files. Options configured in these definitions include which users and groups will have access to the transfer, whether these users can upload and/or download files, the server that will act as the source or destination for transferred files, the local client and server filenames, and the file transfer protocols that will be allowed. 1.2 Accessing the FileXpress Administrative Console To connect to the administrative console: 1. Open a web browser. This can be on any computer with access to your server. 2. If you installed using fxcc as the context root, you can launch the administrative console using the following shortcut URL. (See the note below if you use a different context). For example: -OR- Enter the full connection URL, shown below, which works for installations using any context root. Replace [context] with your value: For example: 2

8 Getting Started 3. Enter admin for both the user name and password. (This is the default administrator account. You can add and edit users using Users > Manage Users.) Notes: The default port value is 443. If you installed both Internet Server and Command Center you should use the Command Center Administrative Console. The default port for Command Center is The context root portion of the full URL is configured during installation. This document shows sample URLs using the full URL format with fxcc as the context. If you accepted the default value, replace fxcc with cfcc. If you specified a context other than "fxcc" during your installation, you can provide support for shortcut URLs by modifying the redirection files. Locate the redirection files in: <FileXpress_install>\server\webapps\ROOT To change the URL for the administrative console, open the admin file in a text editor and replace fxcc in this file with your context root. If you had the installer create a keystore for you, you ll see a warning when you make this connection. If you replace the self-signed certificate created by the installer with one signed by a trusted Certificate Authority, this warning will go away. (This procedure is described in the FileXpress Internet Server Installation Guide.) For testing, you can ignore this error each time you connect, or install the certificate into your Trusted Root Certificate Authorities store. The main page of the FileXpress Internet Server administrative console is shown below. Note: This image shows the options available if you are using Internet Server alone. If have installed both Internet Server and Command Center, and you connect to the Command Center's Administrative console, you will see additional options available to you. 3

9 Getting Started 1.3 Set up Connections to Remote Servers By default, you can transfer files to and from the Internet Server host. In most cases, you will want to configure connections to additional servers. These servers can be running on hosts in your internal network or on hosts managed by your business partners. The next sections outline the basic steps for configuring connections to different types of these remote servers Add an FTP Server Use this procedure to configure FileXpress to support transfers to and from a remote FTP server. 1. Go to Servers > Add Server. 2. Under Required Server Information: o Add a descriptive server name and specify the server's IP address. o IP Port defaults to 21 for FTP. Enter the port number if the FTP server is listening on a non-default port. o Set Server Type to FTP. o Specify a value for Server Platform. This helps FileXpress determine which commands to send to the server. This can help avoid problems that you might encounter if you leave this as 'Unspecified.' Note: In some cases the correct platform type is not the same as the platform that the server is running on. An FTP server that runs on Windows may emulate a UNIX FTP server. In this case you would set Server Platform to 'UNIX.' 3. Expand Server Credentials. Specify a user and password. This account is used by default to provide access to files on the FTP server. 4. Click Add Add an FTPS Server Use this procedure to configure FileXpress to support transfers to and from a remote FTP server using FTPS. For more detailed information about configuring FTPS certificates, see Technical Note Go to Servers > Add Server. 2. Under Required Server Information: o Add a descriptive server name and specify the server's IP address. o Set IP Port to the port your server uses for SSL/TLS. The default port used by most FTPS servers is 990. o Set Server Type to FTP. 4

10 Getting Started o Specify a value for Server Platform. This helps FileXpress determine which commands to send to the server. This can help avoid problems that you might encounter if you leave this as 'Unspecified.' Note: In some cases the correct platform type is not the same as the platform that the server is running on. An FTP server that runs on Windows may emulate a UNIX FTP server. In this case you would set Server Platform to 'UNIX.' 3. Expand FTP Options. o Change Connection Security Type to either Explicit SSL or Implicit SSL. The type depends on your FTPS server. o Set FTP System Key to Default, or select a client key that you have created or imported. This certificate is used if your server requires a certificate for client authentication. Note: When you select Explicit or Implicit SSL, the Add Server pane requires you to select an FTP System Key, even though it may not be required for connections to your server. 4. Expand Server Credentials. o Specify and user name and password. If your server supports password authentication, this password is used by default to provide access to files on the FTP server. 5. Click Add. Use the next procedure to configure FileXpress to trust the certificate presented by the FTPS server. 1. Obtain the FTPS server certificate in base-64 format and open it in a text editor. 2. Go to Administration > Keys > FTP Public Keys > Add FTP Key. 3. For Apply key to click Server. For Select FTP Server, select the FTPS server you added. 4. Set Status to Enabled. 5. Copy the contents of the certificate into the text box (including the BEGIN CERTIFICATE and END CERTIFICATE lines). 6. Click Continue Add an SSH Server Use this procedure to configure FileXpress to support transfers to and from a remote SSH server. 1. Go to Servers > Add Server. 2. Under Required Server Information: o Add a descriptive server name and specify the server's IP address. o IP Port defaults to 22 for SSH. Enter the port number if the SSH server is listening on a non-default port. o Set Server Type to SSH. o Specify a value for Server Platform. This helps FileXpress determine which commands to send to the server. This can help avoid problems that you might encounter if you leave this as 'Unspecified.' 3. Expand Server Credentials. Specify a user and password. This account is used by default to provide access to files on the SSH server. It is also possible configure FileXpress to authenticate to the server using public key or certificate authentication. For details, see Technical Note

11 Getting Started 4. Click Add. 5. Go to Servers > Manage Servers and click the link to the SSH server you added. Click Retrieve public key from this ssh server Add an AS2 Server Use this procedure to support connections where FileXpress initiates a transfer to or from a business partner's AS2 server. Before you begin: Add a user for your AS2 trading partner. For this user, under Optional User Properties, you must set Client Protocols Allowed to AS2. (Setting Client Protocols Allowed to All does NOT include AS2). Obtain the following from your trading partner: their AS2 ID (AS2 Identifier), their AS2 URL, their Public Encryption Certificate and (if required) their Signing Certificate in a Base64 format. To add the AS2 server: 1. Configure an AS2 System key by creating a new key or importing a key pair provided by your business partner. (Administration > Keys > AS2 System Keys > Create (or Import) AS2 Key). Select Set as Default Key. 2. Go to Servers > Add Server. 3. Under Required Server Information, specify the following. All other fields should not be changed. o Enter a descriptive Server Name. o For IP Name, enter the AS2 URL you received from your trading partner. o Set Server Type to AS2. 4. Expand AS2 Options. o For Partner AS2 ID, enter the AS2 ID you received from your trading partner. o For User ID, specify the user you created for this partner. o Under Partner Public Certificates, copy the certificate information you received from your partner. 5. Click Add. If you created the AS2 System Key, you will need to provide the contents of the public certificate to your business partner. Go to Administration > AS2 System Keys > Manage AS2 System Keys. Click your key and expand AS2 Public Certificate. 6

12 Getting Started Add a Platform Server Use this procedure to configure FileXpress to support transfers to and from a remote FileXpress Platform Server responder. 1. Go to Servers > Add Server. 2. Under Required Server Information: o Add a descriptive server name and specify the server's IP address. o IP Port defaults to for Platform Servers. Enter the port number if the Platform Server is listening on a non-default port. o Set Server Type to FTP. o Specify a value for Server Platform. This helps FileXpress determine which commands to send to the server. This can help avoid problems that you might encounter if you leave this as 'Unspecified.' 3. Expand Server Credentials. Specify a user and password. This account is used by default to provide access to files on the Platform Server host. 4. Click Add. 1.4 Start Internal Transfer Servers If you don't start any of the internal Transfer Servers, FileXpress supports HTTPS transfers to and from the FileXpress Internet Transfer Clients. FileXpress can also support transfers from clients that use other protocols. For each protocol you want to support, you need to configure and start an internal Transfer Server. For example, if your users connect from an SFTP client, you need to configure and start the SSH Transfer Server. The following procedures outline how to configure and start each of the supported server types Start the FTP Transfer Server Use this procedure to support connections to the Internet Server from FTP Clients. 1. Enable the FTP server (Administration > Transfer Servers > FTP Server > Configure FTP Server). Set Enabled to Yes and click Update. 2. Start the FTP server (Administration > Transfer Servers > FTP Server > FTP Server Status). Click Start Server. 7

13 Getting Started Start the FTP Transfer Server using FTPS Use this procedure to support connections to the Internet Server from FTPS Clients. 1. Create an FTP System Key (Administration > Keys > FTP System Keys > Create FTP Key). Fill in required settings, select Set as Default Key, then create the key. 2. Configure the FTP server (Administration > Transfer Servers > FTP Server > Configure FTP Server). o Set Enabled to Yes. o For SSL Port specify the SSL port used by the server. The default port used by most FTPS servers is 990. o If you want to enforce SSL connections, set SSL Only Connection to Yes. o Click Update. 3. Start the FTP server (Administration > Transfer Servers > FTP Server > FTP Server Status). Click Start Server. Some FTPS clients require the FTPS server certificate to be imported into the client s trusted certificate store prior to making the connection. You can export the FTP System certificate to import into your client's list of trusted certificates. For details, see Technical Note FileXpress authenticates the client user using password authentication by default. You can also configure FileXpress to authenticate the client user using a certificate presented by the client. See Technical Note Start the SSH Transfer Server Use this procedure to support connections to the Internet Server from SFTP Clients 1. Create an SSH System Key (Administration > Keys > SSH System Keys > Create SSH Key). Fill in required settings, select Set as Default Key, then create the key. 2. Configure the SSH server (Administration > Transfer Servers > SSH Server > Configure SSH Server). o Set Enabled to Yes. o IP Port is set to 22 by default. If you have a third party SSH server running on your Internet Server host, it may already be listening on this port. In this case, specify a different listening port for the Internet Server. o Click Update. 3. Start the SSH server (Administration > Transfer Servers > SSH Server > SSH Server Status). Click Start Server. FileXpress authenticates the client user using password authentication by default. You can also configure FileXpress to authenticate the client user using a public key presented by the client. For details, see Technical Note

14 Getting Started Start the AS2 Transfer Server Use this procedure to support connections where a business's partner's AS2 client initiates a transfer to or from the FileXpress AS2 server. 1. Create an AS2 System Key (Administration > Keys > AS2 System Keys > Create AS2 Key). Fill in required settings, select Set as Default Key, then create the key. 2. Configure the AS2 server (Administration > Transfer Servers > Server > Configure AS2 Server). o Set Enabled to Yes. o Edit the values for Receive URL and Async Response URL. In both fields edit yourserver to read your server name. Change port to your web server s non-ssl port number. Most commonly used port numbers for this are 8080 for Tomcat, and 9080 for WebSphere. o Define the Local AS2 ID. This will become your default AS2 ID. You can define another Local AS2 ID in the server definition if needed. o Click Update. 3. Start the AS2 server (Administration > Transfer Servers > AS2 Server > AS2 Server Status). Click Start Server. You will need to provide the following values to your business partner: your Local AS2 ID, your receive URL, and your AS2 Public Certificate. To copy the contents of the public certificate, go to Administration > AS2 System Keys > Manage AS2 System Keys. Click your key and expand AS2 Public Certificate Start the Platform Server Responder Use this procedure to support connections in which a Platform Server initiates transfers to and from the Internet Server's internal Platform Server. 1. Enable the Platform Server (Administration > Transfer Servers > Platform Server > Configure Platform Server). Set Enabled to Yes and click Update. 2. Start the Platform server (Administration > Transfer Servers > Platform Server > Platform Server Status). Click Start Server. 9

15 Getting Started 1.5 Configuring PGP Encrypted Transfers PGP encryption is used to encrypt the contents of a file before it is transferred. The file can then be stored in encrypted format, or decrypted after it is received. PGP encryption can be used in combination with any of the supported transfer protocols except SSH Uploading PGP Encrypted Files from a Client Use this procedure to configure transfer of a PGP encrypted file from a client to the Internet Server. The client encrypts the file using a public key provided by the Internet Server Administrator. Internet Server decrypts the file using the private PGP System Key. To set up this transfer: 1. Create a PGP System Key (Administration > Keys > PGP System Keys > Create PGP Key). Fill in required settings, select Set as Default Key, then create the key. 2. Provide the client user with the Internet Server's PGP public key. The user will need to copy the contents of the key into a file and import the key into their key ring. (Refer to the PGP program instructions for information about importing and exporting PGP keys.) You can use either of the following methods to distribute the key: o If users connect using one of the FileXpress Internet Transfer Clients, they can click Keys > PGP: Display System Public Key. -or- o Copy the contents of the PGP public key and send this to the client user in or in a text file. To do this, go to go to Administration > PGP System Keys > Manage PGP System Keys. Click the key name, expand PGP Public Key, and copy the contents of the text box. 3. Create a Transfer Definition for the upload (Transfer > Add Transfer). o Set Transfer direction to Upload to Server. o Do not set Client Protocols Allowed to SSH; this protocol is not supported for PGP transfers. o Expand PGP Information and select Decrypt. (This option configures the Internet Server to decrypt the uploaded file, as shown in the diagram above. This is not required. If you do not enable this, the transferred file remains encrypted on the destination server.) Downloading PGP Encrypted Files to a Client Use this procedure to configure transfer of a PGP encrypted file from the Internet Server to a PGP enabled client. FileXpress Internet Server encrypts the file using the client's public PGP key. The client's PGP program can decrypt the file using its private PGP key. 10

16 Getting Started To set up this transfer: 1. Add the user's public key to Internet Server. You can use either of the following methods: o If users connect using one of the FileXpress Internet Transfer Clients, and they have been given rights to upload PGP keys, they can upload keys using the client. To do this, go to Keys, expand PGP Public Key, enter the key contents, then click Continue. -oro Obtain the client user's PGP public key and go to Administration > Keys > PGP Public Keys > Add PGP Key. Set Apply key to User and select the user who will be doing this transfer. Set Status to Enabled. Copy the PGP public key into the text box, and click Continue. Click Continue again in the confirmation page to add the key. 2. Create a Transfer Definition for the download (Transfer > Add Transfer). o Set Transfer direction to Download to Client. o Do not set Client Protocols Allowed to SSH; this protocol is not supported for PGP transfers. o Expand PGP Information, select Encrypt, and specify the encryption options you want to use Enabling PGP Encryption for Transfers to a Remote Server When PGP is enabled for a server, files uploaded to this server are encrypted. Encrypted files on the server are then decrypted during downloads to a client. To add a PGP enabled remote server: 1. Create a PGP System Key (Administration > Keys > PGP System Keys > Create PGP Key). Fill in required settings, select Set as Default Key, then create the key. 2. Go to Servers > Add Server. o Provide the information under Required Server Information. Note: Do not set the Server Type to SSH; this protocol is not supported for PGP transfers. o Expand Server Credentials and specify a username and password to provide access to files on this server. o Expand PGP Information, select PGP Enabled, then configure values under Encrypt and Decrypt. 3. Configure FileXpress to encrypt transfers to this server using the FileXpress PGP public key: o Copy the contents of the PGP public key. To do this, go to go to Administration > Keys > PGP System Keys > Manage PGP System Keys. Click your key, expand PGP Public Key, and copy the entire contents of the text box. 11

17 Getting Started o Go to Administration > Keys > PGP Public Keys > Add PGP Key. For Apply key to click Server. For Select Server, select the PGP server name. Set Status to Enabled. Paste the contents of the public key into the text box, and click Continue. Click Continue again in the confirmation page to add the key. 4. Create a Transfer Definition for the upload (Transfer > Add Transfer). For this transfer: o For Server Name, select your PGP enabled server. o Do not set Client Protocols Allowed to SSH; this protocol is not supported for PGP transfers. When a user uploads a file to this remote server, it will be encrypted with the PGP System public key. When a user downloads a file from this remote server it will be decrypted using the PGP System private key. 12

18 Getting Started 1.6 Adding a Transfer Definition Use Transfer Definitions to provide users with the ability to transfer files. Options configured in these definitions include which users and groups will have access to the transfer, whether these users can upload and/or download files, the server that will act as the source or destination for transferred files, the local client and server filenames, and the file transfer protocols that will be allowed. To create a new Transfer Definition: 1. Go to Transfer > Add Transfer. 2. Fill in Required Transfer Information for this transfer: Client File Name Server File Name Directory Transfer Description Authorized User Id Authorized Group Id Server Name Transfer direction Client Protocols Allowed A suggested file location on the client computer. This value can be updated by the client that initiates the transfer request. A file or directory on the server. File tokens are supported for upload transfers. The following file tokens are also supported for downloads: #(Date), #(Date1), #(Date2), #(Date3), #(LocalUserId). See File Tokens (page 123). The value you enter and supported syntax depends on the transfer protocol and your server's operating system. If this is an SSH or FTP server, the path should be relative to the home directory of the user whose credentials you are using to get access. If this is a Platform Server, use full path information. Select Yes to enable a user to transfer the contents of an entire directory. (This does not automatically transfer the whole directory.) When Directory Transfer is set to Yes, the value you specify for Server File Name should identify a directory. Description is a brief description of the file. Make the transfer available to an individual user. Make the transfer available to a group of users. Specify the server that is the source and/or destination for this transfer. The options include *LOCAL (the Internet Server host) and any remote servers you have added. See Set up Connections to Remote Servers (page 4). Select either Upload to the Server, Download to the Client, or Both. Setting Both creates two transfer definitions. One used for uploads and one for downloads. Select the protocol that is allowed for this transfer. The default is ALL. Department Used with Delegated Administration (page 99). Virtual Alias Defines a directory mapping. in the client view the value you specify for Virtual Alias replaces the actual server location. This alias is used in FTP, SSH, and Platform Server transfers. 13

19 Getting Started 3. Configure optional parameters as needed for your transfer. Server Properties Additional Transfer Properties Notification Post Processing Actions JMS Properties z/os Properties Unix Properties PGP Properties Client Permissions Configure server credentials and encryption. Credentials configured here override any credentials configured in both the server definition and in the Add Server Credentials page. Define Transfer Descriptions, Data Properties, Accessibility, Checkpoint Restart and Diagnostic information. One of the more important fields is the Write Mode. Use it to define rules to determine when the file can be written to the server. For example, a Write Mode of Create allows a transfer to complete only if the file does not exist on the server. Note that this parameter is for Uploads only. For a download, the Write Mode of Create-Replace is always used. Send s when a Transfer Definition is created (or updated), when a file transfer completes successfully, and/ or when a transfer fails. Customizable templates (page 118) determine the content of these notifications. Configure actions to take place when a transfer completes. See page 18. Configure transfers conducted to and from a JMS server. Configure file creation properties for uploads to a z/os system. Specify file permissions for uploads to a UNIX system. Configure PGP encryption options. Specify additional actions that can be taken by FTP, SFTP, and FileXpress Desktop clients. These include the ability to view files and directories when uploading, delete and rename files, create and remove directories, override the transfer mode (ASCII or binary), and pass through commands to a destination server. 4. Click Add to complete the transfer definition Troubleshooting your Transfers Audit records are written and saved in the database after both successful and unsuccessful transfers. You can view these records to find information to troubleshoot your transfer definitions. To view the audit records, go to Reports > Audits > Search Audits. 14

20 2 The FileXpress administrative console is a web-based application for configuring FileXpress. This chapter describes its features. Note: For detailed information about the options available on each configuration panel, click Help: 2.1 Transfers Use the Transfers menu to add and manage transfer definitions Add Transfer Use Add Transfer page to create transfer definitions. These definitions determine which files are available to client users. Navigation: Transfers > Add Transfer Notes: You must have the AdministratorRight or UpdateTransferDefinitionRight in order to add an Internet Transfer definition. See Available Rights on page 26. Click on the Add From Existing Transfer link to see a list of existing transfers, then click on the Transfer Id to copy the definition. The new definitions will not contain the Authorized User Id or Authorized Group Id. This information must be entered for each new Transfer defined. 15

21 Required Transfer Information Defines the most important parameters needed to create a transfer definition. Caution: On some systems, the following conditions will result in files being uploaded to the root of the file system: Server Name is *LOCAL, the server definition includes no value for Server File Name Prefix (page 22), and Server File Name is set to /#(TokenName).Server Properties Defines parameters specific to the Server Name selected in the Required Information section. 16

22 Additional Transfer Properties Note: Checkpoint Restart is not supported when using PGP encryption or transfer to/from an AS2 server and should be set to No. 17

23 Notification Configures FileXpress to send notifications. For information about configuring notifications, see Processing on page 115. Post Processing Actions Allows you to perform up to four actions to be completed when a file transfer request has completed. The COMMAND options available for PPA from Internet Server depend on the type of server receiving the transfer: If the server is FTP or SSH, two internal (FUSUTIL) commands are supported: Delete and Rename. If the Server is Platform Server, PPA can use commands or processes that are native to the computer on which PS is running (in addition to Delete and Rename). If the Server is *LOCAL, PPA can use commands or processes that are native to the computer on which Internet Server is running (in addition to Delete and Rename). Note: Post Processing Actions cannot use commands that require a graphical user interface. 18

24 The example below shows how you can use the Rename command to rename a file after a successful transfer. This example uses three PPA Tokens. These tokens are replaced by actual values when the command is executed. For example, %LFILE is replaced by the file name, including full path information. Click the PPA Token List link to the right of the Data field to see a complete list of supported tokens To delete the file, you could use the following command: Delete %LFILE The Delete and Rename commands can also be used in the following formats: Delete file Rename file1 file2 FUSUTIL D file FUSUTIL Delete file FUSUTIL R file1 file2 FUSUTIL Rename file1 file2 JMS Properties Used for file transfer conducted between a JMS server and FileXpress Internet Server. 19

25 z/os Properties Used only when creating a file on the z/os system through an Upload operation. You use these parameters to define information about the file to be created. Unix Properties Used only when creating a file on a UNIX system through an Upload operation. PGP Information Defines the PGP Information that can be associated with a transfer. Note: PGP is not supported for SSH transfers. 20

26 Client Permissions Defines the permissions that are allowed when conducting this transfer using an FTP, SSH, or Desktop Client. Note: Allow Client Transfer Mode can be used for FTP file transfers to other FTP servers or the FileXpress FTP server (*LOCAL) Manage Transfers Navigation: Transfers > Manage Transfer Notes You must have the AdministratorRight or UpdateTransferDefinitionRight in order to add an Internet Transfer definition. See Available Rights on page 26. Open Selection Criteria to filter the list. You can enter search criteria for any combination of the following: File Id, Server File Name, Description, Authorized User Id, Authorized Group Id, Server Name and Department. Use a percent sign (%) as a wildcard character. Click List Transfer by Users link to view a list of transfer for a particular user. This displays a list of users. Click the User Id for a listing of transfer definitions for that user OnDemand Use OnDemand to configure connections to the Desktop Client using the Site Manager. Users or departments authorized to connect to supported servers will see the Site Manager menu item displayed in their Desktop Client File menu, and can use items on this menu to configure connections to these servers. See the FileXpress Desktop Client User Guide for more information about Site Manager. Notes: Administrators must have AdministratorRight or UpdateOnDemandRight to add or manage the OnDemand sites. Users must have OnDemandTransferRight to use OnDemand sites. When you configure connections using the Site Manager, the Desktop Client connects to the FileXpress Internet server using HTTPS, then uses SSH, FTP(S) or CFI (Platform) for the connection from the Internet Server to the designated remote server. 21

27 Add OnDemand Site Navigation: Transfers > OnDemand > Add OnDemand Site Notes: Users must be granted the OnDemandTransferRight before they will appear in the User Ids list. "All Users" will be visible as an option after you have configured one or more users with OnDemandTransferRight. Specifying "All Users" allows only those users with this right to connect to the specified server(s). The Host Name/IP Address field identifies one or more hosts that the specified user(s) can connect to using the Desktop Client Site Manager. You can use wildcards to identify multiple servers (for example *.attachmate.com). 2.2 Users Use the Users menu to define and manage users, transfer groups and departments Add User Navigation: Users > Add User Notes: In order for users to be able to use Internet Server to transfer files, you need to add them to the FileXpress database. The administrative user must have the AdministratorRight or UpdateTransferUserRight in order to add and manage users. 22

28 Required User Information The Required User Information area opens by default when you add a user: Add from Existing User Click Add From Existing User to copy an existing user's definition to a new definition. Notes: The new user definition will have the same Available Rights and contain the same Optional User Properties of the User Id that was selected. The User Id, Full Name, and password of the existing user are not included in the new definition; you need to specify new values for these fields. You can edit any of the existing values in the user definition before you add the new user. The FileXpress installation process adds several Template Users automatically to the database. You can use these users as templates, or add additional users to use as templates. 23

29 The Collector and ArchiveUser Id s are used to create Server Credentials for server(s) that will also have the collection and archive option turned on. There are no rights given to these IDs. The default Template Users and their assigned rights are listed here: Template User ID admin Rights Assigned AdministratorRight TransferRight ArchiveUser AuditorUser (No rights assigned) ViewAlertRight ViewAuditRight ViewGroupRight ViewServerCredentialRight ViewServerRight ViewTransferDefinitionRight ViewUserRight Collector HelpDeskUser (No rights assigned) HelpDeskRight UpdateSessionRight ViewAlertRight ViewAuditRight ViewGroupRight ViewUserRight TransferUser TransferRight Authentication Options Defines a users client authentication method for FTP, SSH, and HTTPS client connections. Notes: These settings override the global settings defined using System Configuration. Specify a value for Certificate DN if Trusted Certificates are added using Administration > Keys > Trusted Certificates > Add Trusted Certificates. For more information on FTP and SSH certificate configuration, see Certificate Authentication on page 77. For more information on configuring HTTPS certificate authentication, see Add HTTPS Public Key on page

30 2.2.2 Optional User Properties Defines a variety of parameters that are not required. 25

31 PGP Information Defines the PGP settings that can be configured for the user. By default the user is set to Default and uses the global PGP settings configured using System Configuration. Set Allow User to Add PGP Key to allow the user to add PGP Public keys to the FileXpress database. PGP is not supported for SSH transfers Available Rights Below is a list of rights that can be assigned to a FileXpress user, along with a description of what each right is for and how it will work when using and not using Delegated Administration (Departments). Description using Right AdministratorRight DBReportRight Description Allows a user to perform all administrative functions within the FileXpress system. This right does not include TransferRight or FTTransferRight or any functions that correspond to these rights. (Applies only if Command Center shares the database.) Allows a user to view and generate Database Reports from the Reports>Database Reports menu. Delegated Administration Allows a user to perform all administrative functions within their Department. This right does not include TransferRight or FTTransferRight or any functions that correspond to these rights. The Department Administrator cannot update Server or Server Credentials unless given UpdateServerRight and UpdateServerCredentialRight. (Applies only if Command Center shares the database.) Allows a user to view and generate Database Reports from the Reports>Database Reports menu. DeleteAuditRight Allows any user to delete Audit Record. Allows any user to delete Audit Record. Department checking will not be done. FTAdminRight FTTransferRight (Applies only if Command Center shares the database.) Add and update Platform Transfer definitions, but NOT execute transfers. In combination with either ViewServerRight or AdministratorRight, manage Platform nodes, user profiles, and responder profiles. (Applies only if Command Center shares the database.) Allows a user to execute Platform Transfers. However, this right will NOT allow a user to update a Platform Transfer definition. (Applies only if Command Center shares the database.) Add and update Platform Transfer definitions, but NOT execute transfers. In combination with either ViewServerRight or AdministratorRight, manage Platform nodes, user profiles, and responder profiles. (Applies only if Command Center shares the database.) Allows a user to execute Platform Transfers. However, this right will NOT allow a user to update a Platform Transfer definition. 26

32 Right HelpDeskRight OnDemandTransferRight TransferRight UpdateAlertRight UpdateAS2SystemKeyRight UpdateCheckpointRight UpdateFTTransferRight UpdateGroupRight UpdateOnDemandRight UpdatePGPKeyRight UpdatePGPSystemKeyRight UpdatePublicKeyRight UpdateServerCredentialRight UpdateServerRight Description Allows a user to change another user s password, turn on and off the disable flag for a user as well as turn on and off the lock flag for a user. Allows a user the ability to use the FileXpress Desktop Client's Site Manager to set up and conduct on demand transfers. Allows a user to execute FileXpress Internet Server transfers. Allows a user to Update Alert records and view Alerts that have occurred. Allows a user to add and manage AS2 System Keys. Allows a user to access the FileXpress Internet Checkpoints web page and delete Checkpoints taken. (Applies only if Command Center shares the database.) Allows a user to update Platform Transfers defined under Management>Platform Transfers>Manage Platform Transfers. This right will NOT allow the user to execute Platform Transfers. Allows a user to view and update FileXpress groups. Allows a user the ability to add or remove the OnDemand Sites. Allows a user to add and manage PGP public keys. Allows a user to add and manage FileXpress PGP system keys. Allows a user to add and manage FileXpress FTP, SSH, and HTTPS public keys. Allows a user to view or update Server Credential records. Allows a user to view or update FileXpress server definitions. Description using Delegated Administration Allows a user to change another user s password, turn on and off the disable flag for a user as well as turn on and off the lock flag for a user. Allows a user the ability to use the FileXpress Desktop Client's Site Manager to set up and conduct on demand transfers. Allows a user to execute FileXpress Internet Server transfers. Allows a user to Update Alert records and view Alerts that have occurred. Allows a user to add and manage AS2 System Keys. Allows a user to access the FileXpress Internet Checkpoints web page and delete Checkpoints taken for their department. (Applies only if Command Center shares the database.) Allows a user to update Platform Transfers defined under Management>Platform Transfers>Manage Platform Transfers. This right will NOT allow the user to execute Platform Transfers. Allows a user to view and update FileXpress groups. Allows a user the ability to add or remove the OnDemand Sites assigned to other users within their department. Allows a user to add and manage PGP public keys. Allows a user to add and manage FileXpress PGP system keys. Allows a user to add and manage FileXpress FTP, SSH, and HTTPS public keys. Allows a user to view or Server Credential records. Allows a user to view or update FileXpress server definitions in their own Department. New Servers cannot be added. 27

33 Right UpdateSessionRight UpdateSystemKeyRight UpdateTransferDefinitionRight UpdateTransferUserRight ViewAlertRight ViewAuditRight ViewCheckpointRight ViewFTTransferRight ViewGroupRight ViewOnDemandRight Description Allows a user to view and delete active user sessions. Allows a user to add and manage the System keys available under Management>Keys. Allows a user to view and update Internet Transfer definitions. Allows a user to view and update FileXpress users. Only TransferRight and OnDemandTransferRight can be given to a user unless you are an administrator. The Super Administrator can assign any right to a user. Note: When assigning this right to a user you must also assign either the ViewGroupRight or the UpdateGroupRight. Allows a user to view Alert records and view Alerts that have occurred. Allows a user to view Audit records and update the Audit Search Filter. Allows a user to access the FileXpress Internet Checkpoints web page and view Checkpoints taken. (Applies only if Command Center shares the database.) Allows a user to view Platform Transfers defined under Management>Platform Transfers>Manage Platform Transfers This right will NOT allow the user to add, update, or execute Platform Transfers. Allows a user to view FileXpress groups. Allows a user to view FileXpress OnDemand Site records. Description using Delegated Administration Allows a user to view and delete active user sessions. Allows a user to add and manage the system keys available under Management>Keys. Allows a user to view and update Internet Transfer definitions. Allows a user to view and update FileXpress users. Only TransferRight and OnDemandTransferRight can be given to a user unless you are an administrator. The Department Administrator can assign any rights to a user within their Department except UpdateServerRight and UpdateServerCredentialRight. Note: When assigning this right to a user you must also assign either the ViewGroupRight or the UpdateGroupRight. Allows a user to view Alert records and view Alerts that have occurred. Allows a user to view Audit records and update the Audit Search Filter. Allows a user to access the FileXpress Internet Checkpoints web page and view Checkpoints taken for their department. (Applies only if Command Center shares the database.) Allows a user to view Platform Transfers defined under Management>Platform Transfers>Manage Platform Transfers within their Department. This right will NOT allow the user to add, update, or execute Platform Transfers. Allows a user to view FileXpress groups. Allows a user to view FileXpress OnDemand Site records. ViewPGPKeyRight Allows a user to view PGP public keys. Allows a user to view PGP public keys. ViewPublicKeyRight Allows a user to view FileXpress FTP, SSH, and HTTPS public keys. Allows a user to view the FileXpress FTP, SSH, and HTTPS public keys. 28

34 Right ViewServerCredentialRight ViewServerRight ViewSessionRight ViewTransferDefinitionRight ViewUserRight Description Allows a user to view FileXpress Server credentials. Allows a user to view FileXpress Server records. Allows a user to view active user sessions. Allows a user to view FileXpress Internet Transfer records. Allows a user to view FileXpress users and the rights associated with those users. Description using Delegated Administration Allows a user to view FileXpress Server credentials. Allows a user to view FileXpress Server records. New Servers cannot be added. Allows a user to view active user sessions. Allows a user to view FileXpress Internet Transfer records. Allows a user to view FileXpress users and the rights associated with those users. 29