My Monitor. Installation Guide.

Transcription

1 My Monitor Installation Guide

2 My Monitor Installation Guide Copyright 2014 Monitor Business Machines Ltd The software contains proprietary information of Monitor Business Machines Ltd. It is provided under a license agreement containing restrictions on use and disclosure and is also protected by copyright law. Reverse engineering of the software is prohibited. Information in this document is subject to change without notice. Companies, names, and data used in examples herein are fictitious unless otherwise noted. No part of this document may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without the express written permission of Monitor Business Machines Ltd. All rights reserved. No part of this work may be reproduced in any form or by any means - graphic, electronic, or mechanical, including photocopying, recording, taping, or information storage and retrieval systems - without the written permission of the publisher. While every precaution has been taken in the preparation of this document, the publisher and the author assume no responsibility for errors or omissions, or for damages resulting from the use of information contained in this document or from the use of programs and source code that may accompany it. In no event shall the publisher and the author be liable for any loss of profit or any other commercial damage caused or alleged to have been caused directly or indirectly by this document. Monitor Business Machines Ltd. 31a Normanby Road, Mt Eden, Auckland 1024, NEW ZEALAND Printed: March 2014 The Monitor Logo and Supervisor are registered trademarks of Monitor Business Machines Ltd. Any other products that are referred to in this document may be either trademarks and/or registered trademarks of the respective owners. The publisher and the author make no claim to these trademarks.

3 Contents Introduction Product Overview System Requirements Site Security Assumptions Made Windows 2003 Server Windows 2008 Server Windows 2008 Server R Configure SQL Server 2005/ Installing and Configuring PHP 5 PHP Installation Procedure... 5 Connecting to the Real-Time Export Database 8 Creating an ODBC DSN for the Real-Time... Export Database 8 Installing the My Monitor Website for IIS-5.1 or IIS-6 16 Set the IUSR Account's Database Privileges Locating an existing user Raising the IUSR account's... Privileges 20 Creating a new IUSR account Upgrade the Real-Time Export Database Lower the IUSR Account's Database... Privileges 29 Installing the My Monitor Website for IIS-7 33 Set the IUSR Account's Database Privileges Create an IUSR User Raising the IUSR account's... Privileges of an existing user 44 Upgrade the Real-Time Export Database Lower the IUSR Account's Database... Privileges 49 Accessing the My Monitor Website 53 Security 54 Use IIS 6 or Later Restrict Access Rights for Internet Account Remove SSL v Remove Custom Headers Customise Error Pages Appendix A Troubleshooting PHP Settings Required php.ini File... Settings 57 ioncube Loader Contents i

4 ii Contents

5 Introduction Product Overview My Monitor provides a web-based interface to Supervisor Net accounts. The web site user, either a parent or student, can use the site to monitor and manage Supervisor Net accounts. The site offers the following facilities: See the balance of all accounts belonging to one or more associated Supervisor Net users. Add money to accounts using a secure credit card payment system. Transfer money between accounts. Generate detailed and summary reports. Receive reports automatically on a daily, weekly, or monthly basis. Lock and unlock accounts. Users can change their own PIN number in the event of losing their card. Parents can set daily limits on their children's accounts. Users can receive notifications when their balance is low. Users can pay library fees online Parents can pay school fees and fines online System Requirements Supervisor Net or later with an available WPY license. IIS Web Server 5.1 or later with CGI installed. Monitor's Build of PHP or later. SMTP (Mail) Server on the Supervisor Net machine or on another server. MS SQL Server or SQL Express ODBC driver for SQL Server. 64-bit Windows is not supported for the web server operating system because PHP is not currently available on this platform. Site Security Monitor strongly recommends that My Monitor is only used on a secure web server. If it is used on an unsecured server your users address, password, and all the text shown on the pages is sent between the client browser and web server in clear text. This could be intercepted by malicious users monitoring the network. Using a secure server ensures that your users details are not compromised. An unsecured site uses the HTTP protocol, while a secured site uses HTTPS and all communication between the browser and server is encrypted. In order to set up a secure server, you must purchase and install a SSL certificate from a licensing company like Thawte ( or Verisign ( These companies offer a range of SSL products, with pricing depending on the security level and duration of the license. Monitor also recommends that you pay close attention to the configuration of your web server and PHP to ensure that the site is not vulnerable to attacks. Introduction 1

6 Assumptions Made Windows 2003 Server Supervisor Net is installed and working correctly with a spare WPY (Supervisor Webpay) license. IIS6 is installed as the default web server on Port 80 and working correctly. PHP is not installed. If PHP is installed and is not in the directory C:\PHP, and your IIS document root directory is not C:\inetpub\wwwroot you will have to modify the paths shown in Installing and Configuring PHP to match your settings. The user installing My Monitor has ddladmin rights to the Supervisor Net database. Windows 2008 Server Supervisor Net is installed and working correctly with a spare WPY (Supervisor Webpay) license. IIS7 is installed as the default web server on Port 80 and working correctly. CGI has been installed as an option on IIS. PHP is not installed. If PHP is installed and is not in the directory C:\PHP, and your IIS document root directory is not C:\inetpub\wwwroot you will have to modify the paths shown in Installing and Configuring PHP to match your settings. The user installing My Monitor has ddladmin rights to the Supervisor Net database. Windows 2008 Server R2 Supervisor Net is installed and working correctly with a spare WPY (Supervisor Webpay) license. IIS7 is installed as the default web server on Port 80 and working correctly. CGI has been installed as an option on IIS. PHP is not installed. If PHP is installed and is not in the directory C:\PHP, and your IIS document root directory is not C:\inetpub\wwwroot you will have to modify the paths shown in Installing and Configuring PHP to match your settings. The user installing My Monitor has ddladmin rights to the Supervisor Net database. 2 Assumptions Made

7 Configure SQL Server 2005/2008 You must configure SQL Server to operate with local and remote TCP/IP access. This can be done using the SQL Server Configuration Manager, as shown below: 1. Click Start All Programs Microsoft SQL Server (2005/2008) Configuration Tools SQL Server Configuration Manager to open the SQL Server Configuration Manager 2. Expand the SQL Server Network Configuration tree and select Protocols for SQLEXPRESS 3. Right click on TCP/IP and select Enable 4. Click OK on the warning Configure SQL Server 2005/2008 3

8 4 5. The TCP/IP status should now read Enabled 6. You must restart the SQL Server services for these changes to take effect. To do so, select SQL Server Services in the left hand pane. 7. In the right hand pane, right click on SQL Server (SQLEXPRESS) and select Restart 8. Close the SQL Server Configuration Manager window. Now SQL Server will accept local and remote TCP/IP connections Configure SQL Server 2005/2008

9 Installing and Configuring PHP PHP Installation Procedure Install PHP by running the application Monitor_PHP_setup_v2.0_(PHP_5.3.3).exe supplied by Monitor. This application will install PHP, and the ioncube Loader. It also configures PHP with options suitable for running My Monitor. If you are upgrading from a previous version of PHP, you must first stop the IIS service then restart it once the installation is complete. Alternatively you may wish to uninstall the current version of PHP. 1. Run the Monitor_PHP_setup_v2.0_(PHP_5.3.3).exe application. Click Next to continue. Installing and Configuring PHP 5

10 2. 6 For best performance, accept the default choices made by the installation application. Installing and Configuring PHP

11 3. Click the Finish button to complete the installation. Installing and Configuring PHP 7

12 Connecting to the Real-Time Export Database Creating an ODBC DSN for the Real-Time Export Database If you have already installed Supervisor Net on this machine, the default ODBC DSN will already exist. You may move to the next section. If you are installing My Monitor onto a different machine from Supervisor Net, you need to create an ODBC DSN. If you name the DSN as SupervisorNet, it will simplify configuration of My Monitor Open the Data Sources (ODBC) application in the Administrative Tools menu. Connecting to the Real-Time Export Database

13 2. Select the System DSN tab. 3. Click the Add button. 4. Select SQL Native Client from the list of drivers and click Finish. This displays the Create a New Data Source to SQL Server window. Connecting to the Real-Time Export Database 9

14 10 5. Enter a name for the DSN, we recommend using SupervisorNet. 6. Enter a description, such as Supervisor Net Real-Time Export. 7. Select your SQL Server instance name from the Server drop-down list. Click Next to continue. Connecting to the Real-Time Export Database

15 8. Use the default settings as shown below. Click Next to continue. Connecting to the Real-Time Export Database 11

16 9. 12 Tick Change the default database to and pick SupervisorNet from the drop-down list. Click Next to continue. Connecting to the Real-Time Export Database

17 10. Use the defaults for this dialog. Click Finish to continue, this opens the Test Data Source dialog box. Connecting to the Real-Time Export Database 13

18 11. Check the connection by clicking Test Data Source. 14 Connecting to the Real-Time Export Database

19 12. If the test was successful, click OK and close the data sources window, otherwise review your settings. Your ODBC DSN is set up. Connecting to the Real-Time Export Database 15

20 Installing the My Monitor Website for IIS-5.1 or IIS-6 This section details how to Install the My Monitor website using IIS-5.1 or IIS-6. For IIS-7, please refer to the Installing the My Monitor Website for IIS-7 section. Once you have installed all of the prerequisite software you can install the My Monitor web site. If you have already created the ODBC DSN (or installed Supervisor Net) and you, as the installer, have ddladmin rights to the Supervisor Net database, then the installation process will upgrade the Supervisor Net database as required by My Monitor. Otherwise you will need to do this manually as shown in the next section. When you run the My Monitor installation wizard you will be asked to select your web server root directory. For most IIS installations this will be C:\inetpub\wwwroot. The installer will copy files to your system resulting in the following directory being created: C:\inetpub\wwwroot\mymonitor Run the mymonitor_setup.exe program. Click Next in the welcome dialog box. Installing the My Monitor Website for IIS-5.1 or IIS-6

21 2. Read and accept the license agreement and click Next. Installing the My Monitor Website for IIS-5.1 or IIS-6 17

22 18 3. Click Next, this sets destination folder to C:\inetpub\wwwroot. 4. If the folder already exists, click the Yes button to proceed with the installation. Installing the My Monitor Website for IIS-5.1 or IIS-6

23 5. Click Install to proceed with the installation. 6. Click the Finish button in the Finished dialog box. The My Monitor website is now installed. Set the IUSR Account's Database Privileges After you have installed the My Monitor web site, the Real-Time export database must be upgraded. This upgrade process creates a table called WebConfig which holds your My Monitor site settings. Before you can upgrade the database you must raise the privileges of the IUSR account. You need to give the IUSR account membership of these roles: db_datareader db_datawriter db_ddladmin Locating an existing user By default, IIS-5.1 & IIS-6 use the IUSR_<computername> account to access My Monitor's PHP files when people use the My Monitor site. In this example, the computer's name is PBSUPERVISOR, so the IUSR account is IUSR_PBSUPERVISOR. To locate the IUSR account, follow these steps: Installing the My Monitor Website for IIS-5.1 or IIS-6 19

24 1. Open the SQL Server Management Studio tool and connect to the database 2. Open the Security tree to the Logins folder 3. If the IUSR account exists it will be visible in the Logins folder as shown below: 4. If the IUSR account exists, double click to open the account and raise its privileges. If it does not, you can create it with the necessary privileges. Raising the IUSR account's Privileges Raising IUSR privileges 1. Select the User Mapping item in the left-hand pane. Tick the SupervisorNet database and give the IUSR account the following roles: - db_datareader - db_datawriter - db_ddladmin 20 Installing the My Monitor Website for IIS-5.1 or IIS-6

25 2. Click OK. The IUSR account now possesses the necessary privileges and should appear in the Logins folder as shown below: Installing the My Monitor Website for IIS-5.1 or IIS-6 21

26 The IUSR account now possesses the necessary privileges to upgrade the Real-Time Export Database. Creating a new IUSR account Right click on the Logins folder and select New Login... Installing the My Monitor Website for IIS-5.1 or IIS-6

27 2. Click Search... Installing the My Monitor Website for IIS-5.1 or IIS-6 23

28 24 3. Click Advanced Click Find Now. Installing the My Monitor Website for IIS-5.1 or IIS-6

29 5. Select the IUSR_<computername> account (in this example it is IUSR_PBSUPERVISOR) and click OK Installing the My Monitor Website for IIS-5.1 or IIS-6 25

30 6. 26 The IUSR account should be displayed in the Enter the object name to select field as shown below. Click OK Installing the My Monitor Website for IIS-5.1 or IIS-6

31 Upgrade the Real-Time Export Database Now that you have given the computer's IUSR account the correct privileges you can login to My Monitor's admin pages and upgrade the Real-Time export database. The admin pages enable you to customise My Monitor to work for your particular site. 1. Point your web browser to you will see a blank login page. 2. Enter the name and password of your Supervisor Net MASTER user account. In this example it is administrator. 3. Type into the SOAP Server Address field. 4. Type 8082 into the Port field. 5. Click the Login button to login to My Monitor's administrator page. If the IUSR account possesses the necessary privileges to upgrade the Real-Time Export Database, the login will be successful and the upgrade is complete. You can now move onto the next section and lower the IUSR account's privileges. If an error is displayed, please move on to step 6 below. Installing the My Monitor Website for IIS-5.1 or IIS-6 27

32 28 6. If the IUSR account does not have the correct privileges, you will see the error displayed below. Refer to the previous section for instructions on how to set the IUSR account's permissions. Once this is done, click upgrade to continue. 7. You should see a message saying the upgrade is successful. Click the OK Button, this will take you back to the Administration page. 8. Click the red Log Out link in the top left-hand corner of the page to return to the login page. Installing the My Monitor Website for IIS-5.1 or IIS-6

33 9. Close your web browser window. You have upgraded your Real-Time Export database successfully. If you encounter any problems when running My Monitor, check the c:\php\logs\phperror.log file - this may help you to ascertain what is causing the issue. Lower the IUSR Account's Database Privileges After you have updated the Real-Time Export Database, you must lower the IUSR account's privileges down to a safer level. To do so: 1. Open the SQL Server Management Studio tool and connect to the database 2. Open the Security tree to the Logins folder 3. Right-click on the IUSR account and select Properties Installing the My Monitor Website for IIS-5.1 or IIS-6 29

34 4. 30 Click on User Mapping in the left-hand pane Installing the My Monitor Website for IIS-5.1 or IIS-6

35 5. Select the Supervisor Net database and remove the tick from the db_ddladmin item Installing the My Monitor Website for IIS-5.1 or IIS-6 31

36 32 6. Click OK to save the IUSR account settings 7. Close the Microsoft SQL Server Management Studio tool Installing the My Monitor Website for IIS-5.1 or IIS-6

37 Installing the My Monitor Website for IIS-7 This section details how to Install the My Monitor website using IIS-7. For IIS-5.1 and IIS-6, please refer to the Installing the My Monitor Website for IIS-5.1 or IIS-6 section. Once you have installed all of the prerequisite software you can install the My Monitor web site. If you have already created the ODBC DSN (or installed Supervisor Net) and you, as the installer, have ddladmin rights to the Supervisor Net database, then the installation process will upgrade the Supervisor Net database as required by My Monitor. Otherwise you will need to do this manually as shown in the next section. When you run the My Monitor installation wizard you will be asked to select your web server root directory. For most IIS installations this will be C:\inetpub\wwwroot. The installer will copy files to your system resulting in the following directory being created: C:\inetpub\wwwroot\mymonitor 1. Run the mymonitor_setup.exe program. Click Next in the welcome dialog box. Installing the My Monitor Website for IIS-7 33

38 2. 34 Read and accept the license agreement and click Next. Installing the My Monitor Website for IIS-7

39 3. Click Next, this sets destination folder to C:\inetpub\wwwroot. Installing the My Monitor Website for IIS-7 35

40 36 4. If the folder already exists, click the Yes button to proceed with the installation. 5. Click Install to proceed with the installation. Installing the My Monitor Website for IIS-7

41 6. Click the Finish button in the Finished dialog box. Installing the My Monitor Website for IIS-7 37

42 The My Monitor website is now installed. Set the IUSR Account's Database Privileges After you have installed the My Monitor web site, the Real-Time export database must be upgraded. This upgrade process creates a table called WebConfig which holds your My Monitor site settings. Before you can upgrade the database you must create an IUSR user in SQL Server Management Studio and tick these Database roles: db_datareader db_datawriter db_ddladmin Create an IUSR User By default, IIS-7 uses the NT AUTHORITY\IUSR account to access My Monitor's PHP files when people use the My Monitor site. To create the NT AUTHORITY\IUSR login, follow these steps: 1. Open the SQL Server Management Studio tool and connect to the database. 2. Open the Security tree to the Logins folder. 38 Installing the My Monitor Website for IIS-7

43 3. Right click on the Logins and select New Login. 4. Beside the Login Name field, click on the Search Box. 5. A new box will appear, select the Advanced Button. Installing the My Monitor Website for IIS-7 39

44 6. Click on the Find Now button to the right of the dialog box. This will bring up all the User permissions. Select IUSR from the search results and click OK. 40 Installing the My Monitor Website for IIS-7

45 7. This will return you to the main New Login box. Click on User Mapping. Installing the My Monitor Website for IIS-7 41

46 8. Tick the Supervisor Net check box and give IUSR the db_datareader, db_datawriter and db_ddladmin roles. 9. Click OK, to finish creating the IUSR User. The newly created NT AUTHORITY\IUSR account should now appear under Logins. 42 Installing the My Monitor Website for IIS-7

47 10. Close the SQL Server Management Studio tool. The IUSR account you have created also possesses the necessary privileges to upgrade the Real-Time Export Database. Installing the My Monitor Website for IIS-7 43

48 Raising the IUSR account's Privileges of an existing user Where the NT AUTHORITY\IUSR account already exists, you can follow these steps to raise the IUSR account's Privileges Right click on the IUSR account and select Properties. Installing the My Monitor Website for IIS-7

49 2. Click on User Mapping in the left-hand panel. Installing the My Monitor Website for IIS-7 45

50 3. Tick the Supervisor Net check box and give IUSR the db_datareader, db_datawriter and db_ddladmin roles. 4. Click OK to save the IUSR account settings. 5. Close the SQL Server Management Studio tool. The IUSR account now possesses the necessary privileges to upgrade the Real-Time Export Database. Upgrade the Real-Time Export Database Now that you have given the computer's IUSR account the correct privileges you can login to My Monitor's admin pages and upgrade the Real-Time export database. The admin pages enable you to customise My Monitor to work for your particular site. 1. Point your web browser to you will see a blank login page. 2. Enter the name and password of your Supervisor Net MASTER user account. In this example it is administrator Type into the SOAP Server Address field.velvet Installing the My Monitor Website for IIS-7

51 4. Type 8082 into the Port field. 5. Click the Login button to login to My Monitor's administrator page. If the IUSR account possesses the necessary privileges to upgrade the Real-Time Export Database, the login will be successful and the upgrade is complete. You can now move onto the next section and lower the IUSR account's privileges. If an error is displayed, please move on to step 6 below. 6. If the IUSR account does not have the correct privileges, you will see the error displayed below. Refer to the previous section for instructions on how to set the IUSR account's permissions. Once this is done, click upgrade to continue. Installing the My Monitor Website for IIS-7 47

52 48 7. You should see a message saying the upgrade is successful. Click the OK Button, this will take you back to the Administration page. 8. Click the red Log Out link in the top left-hand corner of the page to return to the login page. Installing the My Monitor Website for IIS-7

53 9. Close your web browser window. You have upgraded your Real-Time Export database successfully. If you encounter any problems when running My Monitor, check the c:\php\logs\phperror.log file - this may help you to ascertain what is causing the issue. Lower the IUSR Account's Database Privileges After you have updated the Real-Time Export Database, you must lower the IUSR account's privileges down to a safer level. To do so: Installing the My Monitor Website for IIS-7 49

54 50 1. Open the SQL Server Management Studio tool and connect to the database 2. Open the Security tree to the Logins folder 3. Right click on the IUSR account and select Properties Installing the My Monitor Website for IIS-7

55 4. Click on User Mapping in the left-hand pane Installing the My Monitor Website for IIS-7 51

56 52 5. Select the Supervisor Net database and remove the tick from the db_ddladmin item 6. Click OK to save the IUSR account settings 7. Close the SQL Server Management Studio tool Installing the My Monitor Website for IIS-7

57 Accessing the My Monitor Website The My Monitor website can now be configured to suit the site's requirements. Please refer to the My Monitor Administrator's Guide for information regarding configuration. To access the My Monitor Administrator login page, open your web browser and point it to mymonitor/admin. The following page should be displayed: To access the user login page, open your web browser and point it to mymonitor. The following page should be displayed: Accessing the My Monitor Website 53

58 Security This section contains guidelines on how to improve the security of the My Monitor web application. The application itself has measures to prevent hostile intrusion. Some of these measures are: Parameterized SQL to prevent SQL injection Validation of all GET and POST parameters Uniqueness of all form requests to prevent cross-site request forgery and session hijacking Session termination after a configurable time period. In addition there are web site configuration settings that can improve security: Restrict access rights for the internet guest account Use IIS 6 (Windows 2003 Server) or later Use of SSL Use IIS 6 or Later Security is improved in later versions of IIS. It is highly recommended that My Monitor runs on Microsoft Windows Server 2008 or later. The installation should be maintained with the latest security updates. Restrict Access Rights for Internet Account By default, the internet guest account is: IUSR_<machine_name> for IIS 5 or IIS 6 IUSR for IIS 7. If you have enabled the internet account with ddladmin rights to the SupervisorNet database, you should remove these rights after first logging into the My Monitor Administration/ Configuration pages. The install package will automatically upgrade the database as required on subsequent upgrades of My Monitor. (This assumes that the Installation user has ddladmin rights to the database.) If you create an ODBC data source called SupervisorNet before running the installer for the first time, you will not need to give the internet account ddladmin rights at all. The installer will be able to upgrade the database automatically. If you are running My Monitor on Windows Server 2003/Service Pack 2 (or later) or on Windows 2008 Server or later, then the My Monitor installer will restrict the internet account as follows: no rights to the bin sub-folder no rights to the tools sub-folder no rights to the docs sub-folder. If you are running an earlier version of windows, you can and should remove access to these folders manually. If you want to prevent anonymous users from having any access to the Administration pages, you can manually remove anonymous access to the mymonitor/admin. Then users will be prompted for their Windows login before accessing the admin pages. They will still need to enter a Supervisor Net login. 54 Security

59 Remove SSL v2.0 If your web site uses SSL, you should disable use of SSL 2.0. Only SSL 3.0 or later, or TLS 1.0 should be configured on your site. The following instructions are copied from Microsoft support article at microsoft.com/default.aspx?scid=kb;en-us; Refer to it for more details: Microsoft Windows Server stores information about different security-enhanced channel protocols that Windows Server supports. This information is stored in the following registry key: HKey_Local_Machine\System\CurrentControlSet\Control\SecurityProviders \SCHANNEL\Proto cols Typically, this key contains the following subkeys: PCT 1.0 SSL 2.0 SSL 3.0 TLS 1.0 Each key holds information about the protocol for the key. Any one of these protocols can be disabled at the server. To do this, you create a new DWORD value in the server subkey of the protocol. You set the DWORD value to " " By default, PCT is not enabled on Microsoft Windows Server 2003 or later. To disable the SSL 2.0 protocol so that IIS does not try to negotiate using the SSL 2.0 protocol, follow these steps: 1. Click Start, click Run, type regedit, and then click OK. 2. In Registry Editor, locate the following registry key: HKey_Local_Machine\System\CurrentControlSet\Control\SecurityProviders \SCHANN EL\Protocols\SSL 2.0\Server 3. On the Edit menu, click Add Value. 4. In the Data Type list, click DWORD. 5. In the Value Name box, type Enabled, and then click OK. (If this value is present, double-click the value to edit its current value). 6. Type in Binary Editor to set the value of the new key equal to "0". 7. Click OK. Restart the computer. Security 55

60 Remove Custom Headers Header information can identify versions of server software to potential hackers. Removing this information stalls the hacker from searching for and exploiting specific vulnerabilities associated with software versions. Open IIS Manager and perform the following steps to disable custom headers: 1. Open the properties of the website. 2. Choose the "HTTP Headers" tab. 3. Under Custom HTTP header section choose "X-Powered-By: PHP" or "X-Powered-By: ASP. Net" 4. Press Delete. 5. Customise Error Pages By default error pages are displayed when an application or page error occurs. For example a 404 error page is displayed when a page is requested that does not exist. These default error pages reveal information about the internal structure of the application. My Monitor provides replacements for these pages. You must configure the IIS properties of the My Monitor application to use these custom pages in place of the default pages. The replacement pages in My Monitor are ErrorSystem.php and ErrorHttp.php. Suggested usage is to enable ErrorSystem.php for HTTP 50x errors and ErrorHttp.php for HTTP 40x errors. Index.php can replace the default error page for HTTP 404 and HTTP 403 errors. In IIS 6, the custom error page settings are located on the Custom Errors tab of the Properties dialog for the My Monitor virtual directory. In IIS 7 they are located on the Error Pages section. To change an error page: 56 select the relevant HTTP Error code in the dialog click Edit on the resulting dialog, select URL (from a combo on IIS 6 or a radio button on IIS 7) type in the required page relative to the web site root e.g. /MyMonitor/ErrorHttp.php click OK to save the changes. Security

61 Appendix A Troubleshooting PHP Settings Required php.ini File Settings This section is provided for reference, it provides details of php.ini settings required by My Monitor. If you have installed the Monitor supplied PHP package (see PHP Installation Procedure), it is assumed that your PHP installation is working correctly and no action is required in this section. PHP needs the following settings in the php.ini file. (The php.ini file is usually found in either the PHP installation directory or in c:\windows): Appendix A 57

62 The following standard PHP extensions need to be enabled: curl, gd2, mcrypt, mhash, openssl and sock ets. Locate the extensions section of the ini file (lines beginning with 'extension=') and ensure the following lines do not have semicolons at the start of the line: extension=php_curl.dll extension=php_gd2.dll extension=php_mcrypt.dll (Not required in PHP 5.3) extension=php_mhash.dll (Not required in PHP 5.3) extension=php_openssl.dll extension=php_sockets.dll extension=php_ldap.dll extension=php_win32service.dll extension=php_mbstring.dll extension=php_xmlrpc.dll The following options must be set: display_errors = Off register_globals = Off log_errors = On 58 Appendix A

63 error_log = "c:\php\logs\php_error.log" (Or another file as required) error_reporting = E_ALL & ~E_DEPRECATED odbc.defaultlrl = 8192 session.use_cookies = 1 session.use_only_cookies = 1 session.cookie_lifetime = 1800 output_buffering = 4096 memory_limit = 16M The following options should also be set for security: expose_php = Off allow_url_open = Off allow_url_include = Off safe_mode = Off safe_mode_gid = Off max_execution_time = 30 max_input_time = 60 post_max_size = 8M max_input_nesting_levels = 64 fastcgi.logging = 0 fastcgi.impersonate = 1 cgi.force_redirect = 0 expose_php = Off You must stop and start your web server for changes to the php.ini file to come into effect. ioncube Loader This section is provided for reference, it provides ioncube Loader settings required by My Monitor. If you have installed the Monitor PHP package (see PHP Installation Procedure), the ioncube loader will already be configured and no action is required in this section. The ioncube Loader is required for operation of the site. The My Monitor PHP files are encrypted, the ioncube loader decrypts them when users request pages from IIS. 1. Download the loader installation from 2. Install the ioncube loader in your PHP directory. Monitor's PHP install package installs the loader files into c:\php\ioncube 3. Read the ioncube loader's readme files on how to install the loader 4. Open your php.ini file using Notepad. Appendix A 59

64 5. If using PHP 5.3, the Win 5.3 loader DLL (VC9 NTS) must be enabled in the php.ini file. This is done by adding this line to the end of your php.ini file: [Zend] zend_extension = C:\PHP\ionCube\ioncube_loader_win_5.3.dll Save the changes to your php.ini file Restart your web services. Appendix A

65 Monitor Business Machines Ltd 31a Normanby Road, Mt Eden, Auckland 1024, New Zealand. Phone: Web: