REQUIREMENTS LIVEBOX.

Transcription

1 2015 REQUIREMENTS LIVEBOX

2 LiveBox Srl does not release declarations or guarantees about this documentation and its use and decline any expressed or implied commercial or suitability guarantee for a specific purpose. LiveBox Srl reserve one s right to review this publication and to make changes to the content, anytime, without any obligation to notify it to any person or entity about that revisions or changes. In addition, LiveBox Srl does not release declarations or guarantees about any software e in particular does not recognise any expressed or implied commercial or suitable guarantee for a specific purpose. LiveBox Srl reserve one s right to review this publication and to make changes to any LiveBox software part, anytime, without any obligation to notify any person or entity about that revisions or changes LiveBox Srl. All rights reserved. Any part of this publication can be reproduced, duplicated, stored on a recovery system, or sent without the editor s expressed written approval. 1

3 LiveBox is a private cloud software that allows you to store, share and edit data stored in a corporate datacenter offering an high security level. It is a multiplatform system accessibile from every mobile and remote device that guarantees business continuity and protects corporate files at all times. For further details regarding LiveBox platform functionality and the use of its applications we ask you to refer to our web site: and to the technical documentation contained in it. LiveBox Support Team 2

4 Index 1. LIVEBOX, A PRIVATE FILE SHARING REQUIREMENTS AND INSTALLATION LIVEBOX SERVER ROLES... Errore. Il segnalibro non è definito. 2.2 REQUIREMENTS... 5 REQUIREMENTS UTILIZED PROTOCOLS: FIREWALL RULES... 6 MINIMAL REQUIREMENTS FOR THE INTERNET PUBLICATION INSTALLATION TYPOLOGIES... 9 ONE INSTALLATION (STANDALONE)... 9 TWO LEVELS INSTALLATION THREE LEVELS INSTALLATION INSTALLATION IN A BUSINESS CONTINUITY MODE

5 1. LIVEBOX, A PRIVATE FILE SHARING LiveBox is a private file sharing platform with a client/server architecture. The server is located inside of the customer infrastructure, ensuring privacy and security of the data. Having an internet connection with public IP (or recorded on a dynamic naming service) it is possible to guarantee accessibility from remote. It can be realized from standard compatible browsers HTML5 (IE 10, Firefox, Chrome, Opera, Safari), from OS Android systems (4.x), from ios systems (from 6.x), from Windows systems (from XP SP3, 32 bit or 64 bit), from Mac OSX (>= 10.7). During 2014 will ensure the platform support Windows Phone 8. The paradigms that lead to our development platform are two: - The installation and the use inside your own hardware infrastructure. - Sharing contents, in a private and secure way, without files relocation. 4

6 2. REQUIREMENTS AND INSTALLATION LiveBox system is characterized from four main server. Everyone defines a role: - Web server (finishes HTTPS sessions toward client, and supplies operative features to the application language) that concerns the integration with LDAP+SAMBA (to set up the proxy, the request that comes from the application server without tamper with privacy of its domain credentials or LDAP) it concerns the server application, that executes PHP code for all the user operations. - File server (encrypted data repository) - Database server (communicate with server application to exchange data related to the permissions, filesharing, work group creation, etc; does not contain data characterized from credentials; it is characterized from the devices hash saved and authorized) - Push Server (executes the synchronization data for the user on mobile devices or on PC) For medium environments the first three roles are managed by a server (its IP is published on Internet) to receive all the applicative flow from client to LiveBox server. Database role is managed from a specific server (protected in an internal DMZ net area not approachable from Internet). The last role is generally managed from a specific server. Its purpose it is to sync data on different devices (from and towards), so it has to be achievable from and towards Internet through just an IP (NAT One-to-One). For virtual installations, we advice the following best practices: LiveBox s Virtual machines needs eagerzeroed thick virtual disk LiveBox s Virtual machines needs X GB of RAM, Y vcpu, 1NIC gb-eth (for X and Y values, see the table below [2.2]) Delete of all the possible snapshots Install vmware-tools Power management policy of the physical server in order to be High performance (BIOS setting and Esx server setting) 2.1 REQUIREMENTS 1 to 500 users: 4 CPU Multi Core and 6 Gb RAM Storage depends on how big must be users home folder. 500 to 1000 users: 4 CPU Multi Core and 8 Gb RAM. Storage depends on how big must be users home folder to 2000 users: 2 Frontend with: o 4 CPU Multi Core and 8 Gb RAM. 3 DBMS: with: 4 CPU Multi Core and 12 Gb RAM. o Storage depends on how big must be users home folder. 5

7 2000 to 3000 users: 3 Frontend with: o 4 CPU Multi Core and 8 Gb RAM. 3 DBMS with: o 4 CPU Multi Core and 12 Gb RAM. Storage depends on how big must be users home folder to 4000 users: 4 Frontend with: o 4 CPU Multi Core and 8 Gb RAM. 5 DBMS with: o 4 CPU Multi Core and 12 Gb RAM. Storage depends on how big must be users home folder to 5000 users: 5 Frontend with: o 4 CPU Multi Core and 8 Gb RAM. DBMS with: o 4 CPU Multi Core and 12 Gb RAM. Storage depends on how big must be users home folder. Please note that when assigning every user quota, the 10% of the total user quota will be reserved for the garbage and 20% for the versioning quota. The LiveBox OS essential is GNU/Linux. Software is compatible with all the Debian and Redhat assignments (6,7). LiveBox can be installed on physical Hardware or in architecture virtualized. In addition, the dependencies for the installation are: - Apache 2 - Openssl - MariaDB (>= 10.x) - Openfire - Samba - PHP 5 - Git The installation is simplified from an installer and from the environment setup, that install the dependences already listed. REQUIREMENTS UTILIZED PROTOCOLS: FIREWALL RULES Communication application web client: All_WAN -> IP_public_Application_Server All_LAN -> IP_private_Application_Server HTTPS HTTPS 6

8 Server communication with LDAP, DNS and mail server IP_Application_Server,IP_Push_Server,IP_DB_Server-> DNS_Server IP_Application_Server,IP_Push_Server-> LDAP_Server IP_Application_Server,IP_Push_Server-> MAIL_Server Server installation communication multilevel IP_Application_Server->IP_Push_Server IP_Application_Server->IP_DB_Server Communication for licensing, updates, installation (from Debian distro): IP_LB_Servers hub.liveboxcloud.com IP_LB_Servers git.liveboxcloud.com IP_LB_Servers ftp.de.debian IP_LB_Servers security.updates.org IP_LB_Servers IP_pubblico_Push_Server IP_LB_Servers All_WAN UDP_53 TCP_389 TCP_25 TCP_9090 TCP_3306 TCP_80, TCP_443 TCP_80, TCP_443 TCP_80, TCP_443 TCP_80, TCP_443 TCP_5222,TCP_5223 TCP_5222,TCP_5223 For a correct firewall configuration of the push notifications system for Android, ios and Windows Phone/RT, please refer to the following documentations: Android: Apple ios: PG/Chapters/CommunicatingWIthAPS.html Windows Phone: 7

9 MINIMAL REQUIREMENTS FOR THE INTERNET PUBLICATION You can consult LiveBox system from mobile devices and remotes PC. In a specific architecture clients can access to the IP that corresponds to the web server application (in https). Client access from another IP, on XMPP protocol, at least 1 public IP (the publication in https of the Application_Server; publication of the 5222 port and 5223 for Push server; the public push server IP has to be NAT One_to_One mode). To show web certificate in https you need to know the DNS manteiner of the second level domain. Web certificate can be also produced from its own internal Certification Authority, imported on device manually (with obvious reduction of maintainability). LiveBox system is integrated in the Active Directory in case of are efficents the following requirements: - Have user credentials only for reading in LDAP - Have DN user (Distinguished Name) - Have DN domain - Have BN (Base Name) through which execute the search users query - The application can import only users that have a full mail field (to flag mail field is necessary to send the welcome message that warns that the user in AD has added as LiveBox user). 8

10 3 INSTALLATION TYPOLOGIES LiveBox installation can be realized in place of user characteristics of the infrastructure, security characteristics, superabundance and management. There you are just some of the possible configurations, based on patterns of multi-tier architecture. ONE INSTALLATION (STANDALONE) In this case the system is characterized from only a server, that performs all the functions: Local web application Push Server REST services Option database and LiveBox users The infrastructure advantages are located in a smaller system difficulty, but it can be exposed to the smaller resilience in case of logical or physical security. Picture 1: Installation layout in standalone mode 9

11 TWO LEVELS INSTALLATION In this case the system is characterized from two server: Reverse Proxy in DMZ on server 1 Application + Push Server, Database and Storage on server 2 This infrastructure advantages are located in the physical server separation displayed to the client access (from Internet and Intranet), that can guarantee an high resilience degree in logical or physical security. Picture 2: Installation layout on two levels 10

12 THREE LEVELS INSTALLATION In this case the system is characterized from three server: Proxy Reverse in DMZ on server 1 Application + Push Server and Storage on server 2 Database on server 3 The advantages of this infrastructure are located in the physical server separation exposed to the users client access, (from Internet and Intranet), that can guarantee an high resilience degree in logical or physical security; configurations and users LiveBox database is physically located in a physically separated server and in a separated net from FW respect to the web application. Picture 3: Installation layout on three levels 11

13 INSTALLATION IN A BUSINESS CONTINUITY MODE In the enterprise environments, it is necessary that the services are accessibles without interruption. In this case each of that levels that may represent a PoF (Point of Failure) are replicated in a system that can ensure the functionality of the single level. Generally is not possible to exclude a service degradation, because the passage through network nodes that can preserve the TTL of the sessions (with stateful inspection FW), which can cause a TCP session, requires a retransmission. Persistence mechanisms, browser caching etc. can damage further user service usability, but not the service feature in its entirety or data entirety. In this case the system is characterized at least of 8 server: Proxy reverse in Active configuration / Passive of Apache Web application set up Active / Passive of Apache Options and users database in configuration Cluster Active / Passive of Mysql Storage containing the disk space of two server database and data encrypted files on an NFS configuration on host record with rsync between the two storage or by multipath, even on separate physical servers. To the benefits related to the infrastructure without PoF contrasts a greater management complexity. 12