Safeguard Web Viewer Own Server Installation Manual Version 1.07 Revision 1.06
Table of Contents TABLE OF CONTENTS... 2 1.1 1.2 INTRODUCTION... 3 TECHNICAL REQUIREMENTS... 4 1.2.1 Communication Ports... 5 1.2.2 Changing Communication Ports after going live... 5 1.2.3 Before installing the Web Viewer... 6 1.2.4 Additional PHP settings... 6 1.3 PREPARING THE PHP ENVIRONMENT... 7 1.3.1 PHP Version... 7 1.3.2 Required Modules... 7 1.3.3 Setting up the PHP environment on a Windows Server... 8 1.3.4 HTTP Server Configuration... 10 1.4 PREPARING THE MYSQL ENVIRONMENT... 11 1.4.1 Unicode Support... 11 INSTALLING THE WEB VIEWER... 12 1.5 1.6 1.7 1.8 1.9 ACTIVATING THE WEB VIEWER... 16 BACKING UP AND RECOVERING THE SYSTEM... 19 MOVING THE WEB VIEWER TO A NEW SERVER... 20 UPGRADING THE WEB VIEWER... 21 Web Viewer Own Server v1.07 - Revision 1.06 2016 Locklizard Ltd Page 2 of 21
1.1 Introduction This manual has been prepared as a guide to organizations that have decided to carry out their own installation of the Locklizard Safeguard Web Viewer. It has not been prepared for the novice user. Those who are not already competent and experienced server systems administrators should NOT attempt to perform the deployment of the Web Viewer and should use the Locklizard implementation service. You must be familiar with the implementation and day-to-day operation of the MySQL database and PHP, whether on the Windows or Linux platforms, and securing those environments. Locklizard do not provide detailed guidance on the alternative aspects of how you might choose to implement third party products (just as we do not provide guidance on how to configure Windows or Linux server installations). Locklizard support team do not provide support on the installation of the Web Viewer or configuration of third party software, or offer consultancy advice on operational matters such as choice of passwords, performance, hardening of servers in support of security policy, backup and recovery strategies and so on. It remains the customer s responsibility to address day-to-day operational and security policy considerations which Locklizard cannot be aware of or take account of. For example, it is up to the publisher to make sure the server is not vulnerable to script injection (e.g. make sure that the database user does not have super-user rights and is limited to the Locklizard database table), to make sure Apache is configured securely and updated so it not exposed to PHP vulnerabilities, and that PHP and MySQL modules are configured tightly (e.g. not allowing PHP scripts to run outside of their folder or not allowing the MySQL admin privileges on the database server itself). Some implementation steps require the installer to carry out manual operations, edit applications environments and make other changes. This requires a reasonable degree of knowledge of the installation and technical skill in order to carry out the tasks correctly and reliably. Web Viewer Own Server v1.07 - Revision 1.06 2016 Locklizard Ltd Page 3 of 21
Accordingly, Locklizard do not provide any warranty where customers have carried out their own deployment, and any work required from Locklizard to support customers in this activity or to carry out investigations, remedial work or corrections are charged in advance at Locklizard s customary consultancy rates which are available by quotation on request from sales@locklizard.com. For those without the necessary expertise, Locklizard supply a paid installation service where technicians will remotely install the necessary server components for a working system, including installation of third party software, and consulting advice where appropriate. The Locklizard implementation service is designed to deliver a consistent implementation that will perform correctly with the required components. 1.2 Technical Requirements The Web Viewer can be installed on the following server operating systems: Linux - Red Hat, Suse, or Fedora Windows - 2003 and above IMPORTANT NOTE: Full root access is required for installation and a domain name MUST be assigned to the server. The minimum hardware specification is: Intel Celeron dual-core 2.0 GHz or higher, 1 GB DDR RAM, 120 GB IDE hard drive (minimum spec). The following external packages MUST be installed on the server: 1. MySQL version 5.1 or above 2. PHP version 5.3.8 or above (x64 recommended) 3. Apache HTTP server Web Viewer Own Server v1.07 - Revision 1.06 2016 Locklizard Ltd Page 4 of 21
Locklizard recommend that you install MySQL version 5.1.73 and PHP version 5.3.16, as these have been shown to be stable operating environments. 1.2.1 Communication Ports The Safeguard Writer communicates with the Web Viewer using specific ports. You MUST specify the ports that you are going to use when Apache is first installed (the two standard ports are specified in Apache's config file, normally httpd.conf), although you can change these at a later stage by editing the file php.ini. Organizations often block access to non-standard ports, so using non-standard ports is NOT recommended unless your implementation is internal and you have complete administrative control over port allocation. Be aware that your users will have to have access to the port that you designate from their own PC - in other words, it MUST be left open for incoming and outgoing client/server communications. Locklizard use port 80 for our own servers when publishers do not insist on the security of an SSL connection to protect information, and port 443 where publishers feel it appropriate to protect the communications between the Writer and Admin System applications and the Web Viewer. IMPORTANT NOTE: Using ports 80 or 443 requires root (admin) rights to be granted to the server application, and without additional controls could open a system to hackers who could potentially remotely run commands that would normally require root rights. It is up to you as the publisher to secure (harden) your server accordingly. This is NOT a service provided by Locklizard. 1.2.2 Changing Communication Ports after going live If you decide to change the port numbers after you have issued Writer licenses to your administrators, then you MUST re-issue these licenses because the port number to be used is contained in the license file. Web Viewer Own Server v1.07 - Revision 1.06 2016 Locklizard Ltd Page 5 of 21
Administrators MUST remove (delete) their keystores, and only then re-register using the new license files for the new port address to take effect. 1.2.3 Before installing the Web Viewer Before you install the Web Viewer make sure your Publisher license has the Web Viewer feature enabled. If Locklizard are hosting the Safeguard Administration System and you are hosting the Web Viewer, you need to let us know the URL address where the Web Viewer will be hosted so that we can enable it on your account. If you are hosting the Safeguard Administration System you need to have the Administration System installed this MUST be build 167 or later, your Publisher account created, and the server URL from your Publisher account pointing to where the Web Viewer will be installed. 1.2.4 Additional PHP settings The document upload limit is set through PHP settings. You can modify the values upload_max_filesize and post_max_size in your php.ini file to suit your requirements. You may also need to modify the open_basedir settings so that your upload folder (where encrypted documents are stored) is accessible through PHP scripts. After modifying the php.ini file, you will need to restart your HTTP server so that it picks up the new configuration settings. Web Viewer Own Server v1.07 - Revision 1.06 2016 Locklizard Ltd Page 6 of 21
1.3 Preparing the PHP environment 1.3.1 PHP Version The PHP version installed on your server must be identical to the PHP build for the Locklizard Web Server. For example, if you have PHP 5.3 installed then you must use the Locklizard Web Server build for PHP 5.3 and no other. 1.3.2 Required Modules The PHP installation that you provide must include the following modules, and they must be active, not simply present: 1. MCrypt v2.5.7 or above The following example shows how to activate the MCrypt module and check the result to make sure that it is active: i. Download the file libmcrypt.dll to the Windows\System32 folder ii. Open the php.ini file (usually found in the main Windows folder) iii. Find the section that has lots of lines with ;extension=php_xxxx.dll iv. If a line with ;extension=php_mcrypt.dll exists, remove the semicolon from the start of the line, otherwise add a new line extension=php_mcrypt.dll v. Restart your computer to activate the php.ini file vi. Use the phpinfo() function to check that MCrypt is active. 2. MySQL module v4.1.20 or above This enables PHP to access the MySQL server database. The free community edition version can be downloaded here. 3. ioncube PHP loader This is required to read PHP scripts encoded with the ioncube Encoder. Installation instructions can be downloaded from http://www.ioncube.com/loader_installation.php Web Viewer Own Server v1.07 - Revision 1.06 2016 Locklizard Ltd Page 7 of 21
Locklizard Administration System build 167 and above requires ioncube v4.4.3 and above. The version you require depends on the ioncube loaders you have installed which is determined by the PHP version you have installed. Our scripts are the same but the ioncube loaders are encrypted differently for different PHP versions. 4. BZip2 v1.0.5 or above This is required for the backup/restore modules internal to Safeguard, and for the license emails zip feature to work. 5. ZLIB v1.2.2 or above This is required for the backup/restore modules internal to Safeguard, and for the license emails zip feature to work. 6. GD v2.0.34 or above with PNG support enabled This is required for the statistics graphics display. 7. CURL v7.19 or above with curl_exec enabled 8. OpCache (bundled with PHP 5.5.0 and later) or X-cache the version you install is dependent on your PHP version. This is optional for caching and optimizing the PHP intermediate code. 9. mbstring this must be enabled 1.3.3 Setting up the PHP environment on a Windows Server The following instructions are for IIS on a Windows 2008 Server. 1. Install Windows Server (2008) 2. Open the server manager and navigate to: Roles > Add Roles > Web Server (IIS) > click Add the required features 3. Tick ASP.NET > click Add the required features 4. Click Next > Install Web Viewer Own Server v1.07 - Revision 1.06 2016 Locklizard Ltd Page 8 of 21
5. Once finished reboot and open Internet Explorer. Navigate to http://localhost to verify that IIS is running. You should see the IIS logo. 6. Run the web platform installer found here: http://www.microsoft.com/web/downloads/platform.aspx. NOTE: You may need to add download.microsoft.com to your trusted sites list to do the above. 7. Once open, search for PHP and add PHP 5.4.24. 8. Then search for MySQL and add MySQL Windows 5.5. 9. Click Install. 10. Enter a default password and continue. 11. Now install ioncube loader. Determine whether you are using VC9 or VC11, and if you are running a thread-safe version of PHP. You can check that by accessing your php_info. 12. Download the corresponding version from the download page http://www.ioncube.com/loaders.php 13. Copy the ioncube folder from the archive into your Windows\System32 folder. 14. Open your PHP.ini file and add the line: zend_extension=c:\windows\system32\ioncube\ioncube_loader_win_ 5.4.dll NOTE: If you are using a thread-safe version then you need to specify zend_extension_ts= instead. 15. Note that MCrypt, BZIP2, ZLIB and GD, mentioned in 1.3.1 Required Modules are usually part of the web installer PHP package, so you do NOT have to install these separately. You DO however need to check that they did install correctly with the PHP package you selected. 16. Restart IIS. 17. Re-check your PHPinfo page to see that ioncube and the other required modules are running correctly. Web Viewer Own Server v1.07 - Revision 1.06 2016 Locklizard Ltd Page 9 of 21
18. For easier MySQL administration you can download MySQL Workbench from: http://www.mysql.com/products/workbench/ Now the environment is ready. NOTE: If you later load PHPMyAdmin for SQL administration and it is displayed in German then select English from the language drop down menu on the main PHPMyAdmin page. 1.3.4 HTTP Server Configuration Set DirectoryIndex to honor index.php as well as index.html. Web Viewer Own Server v1.07 - Revision 1.06 2016 Locklizard Ltd Page 10 of 21
1.4 Preparing the MySQL environment Follow the steps below: 1. Install MySQL. 2. Create an empty MySQL database. 3. Create a user with full rights on that database. 4. Allocate a password to that user. The actual names and passwords are chosen by you and should obey your installation standards for both format and length. 1.4.1 Unicode Support If you want to support Unicode (required for the display of non-ascii/foreign language characters such as Japanese and Chinese) then your MySQL database must be configured to support this. This MUST be done at first installation if it is to be available. Web Viewer Own Server v1.07 - Revision 1.06 2016 Locklizard Ltd Page 11 of 21
1.5 Installing the Web Viewer 1. Unzip, and then upload via FTP, the installation files that you have been supplied with to the server you are going to go live on. For example, if you want the server to be accessible from http://domain.com/folder/ then the files should be uploaded to C:\inetpub\wwwroot\folder. If you want the server to be accessible from a subdomain, you should upload it where http://subdomain.domain.com points to on the local file system (e.g. C:\inetpub\wwwroot\subdomain). The install URL in step 3 would then be http://www.subdomain.domain.com/foldername/setup/install.php IMPORTANT NOTE: The installation directory must NOT be more than two folders deep. For example http://domain.com/folder1/folder2/ is acceptable whereas http://domain.com/folder1/folder2/folder3 is not. 2. In the root folder for the uploaded files (if you uploaded the files to a folder called domain.com/foldername/, the root folder is considered to be foldername ), create an empty file called llw-config.php. This file MUST have full write access rights set on it. The upload folder must be owned by Apache or the user that is set to start HTTP, and the webserver or webserver group must have permission to write to the upload folder. You can use your FTP client to change the file permissions properties to CHMOD 666 (or whatever is appropriate in your environment, e.g. 775) to achieve this. 3. Open your web browser and connect to the following URL: http://www.domain.com/foldername/setup/install.php) and follow the wizard installation steps as shown below. IMPORTANT NOTE: Make sure a domain name is used in the URL and NOT http://localhost. Web Viewer Own Server v1.07 - Revision 1.06 2016 Locklizard Ltd Page 12 of 21
Diagram 1: MySQL Database Settings In the above dialog, enter the details for your MySQL database. Diagram 2: MySQL Database Settings confirmation Diagram 3: Logon details for the Web Viewer admin account Web Viewer Own Server v1.07 - Revision 1.06 2016 Locklizard Ltd Page 13 of 21
The information you enter in Diagram 3 above is used to make the connection between your Publisher account and the Web Viewer. Here you enter the default Web Viewer local folder where documents will be stored (upload folder), the Safeguard Administration System location (licensing URL), and your Publisher login credentials (the ones you currently use to login to your Safeguard administration system). You MUST specify the ll-webviewer/ folder at the end of the Locklizard Licensing URL (you MUST also include the / at the end of the folder name). So, if the admin system is installed at http://domain.com you must set the licensing URL for the Web Viewer to http://domain.com/llwebviewer/. Note that documents can be stored on a network drive as long as the path is accessible by PHP. If the Safeguard Administration System is hosted on your own server you first need to create your Publisher account and then enter those credentials in the above fields. These credentials will be used when logging in to the Web Viewer after the installation has finished. If you are using non-standard ports for the Safeguard Administration System then the URL connection must also contain the port number. If the Safeguard Administration System is hosted by Locklizard then you need to enter your Publisher login credentials (the ones you logon to the Safeguard Administration system with). The LockLizard Licensing URL field is the URL for your hosted Safeguard Administration System. Either way the Safeguard Administration System must be accessible from the current installation because the logon credentials will be checked with the server before proceeding further. IMPORTANT NOTE: SET THE UPLOAD FOLDER JUST ABOVE THE WEB ROOT FOLDER (WWW FOLDER) TO MAXIMIZE FILE SECURITY, SO THAT DOCUMENTS ARE NOT ACCESSIBLE THROUGH A DIRECTLY-ENTERED URL. ALSO, MAKE SURE THE UPLOAD FOLDER PATH EXISTS, IS EMPTY, IS ACCESSIBLE THROUGH PHP, AND HAS FULL WRITE PERMISSIONS (CHMOD 666) OR WHATEVER IS APPROPRIATE IN YOUR ENVIRONMENT (E.G. 775). Web Viewer Own Server v1.07 - Revision 1.06 2016 Locklizard Ltd Page 14 of 21
Diagram 4: Installation confirmation 4. After the installation is done, REMOVE the write rights of the llwconfig.php file - use your FTP client to change them to CHMOD 644. 5. The /setup folder that was created during these steps can now be erased (it is no longer required, and as a security measure, removing it will prevent anyone from incorrectly trying to reinstall a new server over the existing one). Web Viewer Own Server v1.07 - Revision 1.06 2016 Locklizard Ltd Page 15 of 21
1.6 Activating the Web Viewer Before you can start using the Web Viewer you have to register by following the instructions below. 1. Login to the Web Viewer as a Publisher using the log in link on the final Wizard page as shown in Diagram 4. This URL connection allows you to setup your Web Viewer license and activate the system. This is also the location from where you will manage your published documents. The Username and Password are the same as those you entered during the Wizard installation as shown in Diagram 3 (Publisher username and Publisher Password). Diagram 6: Web Viewer Publisher login. If you have closed the Wizard then you can manually enter the login URL into your browser. If the root folder domain.com/server_url/ were used, the login URL you would enter for this step would be http://www.domain.com/server_url/index.php?publisher Web Viewer Own Server v1.07 - Revision 1.06 2016 Locklizard Ltd Page 16 of 21
You will need to edit this if you have used a different domain/root folder. Once logged in to Web Viewer as a Publisher you will see the following screen: Diagram 7: Web Viewer license required 2. Select the here link (from the License Required message), or click on the License button (top right corner) and copy the install ID that is displayed there. Diagram 8: Set server license 3. Email the install ID to Locklizard Support (support@locklizard.com). Locklizard will generate the unique license authorization code for your installation and will email this back to you. Web Viewer Own Server v1.07 - Revision 1.06 2016 Locklizard Ltd Page 17 of 21
4. Once you receive the license authorization code, paste it into the License code field. 5. Press the Save Changes button to activate your license. Diagram 9: Active license 6. Once you have activated your license you can then start publishing documents for the Web Viewer. NOTE: If you need to change the Licensing URL your license status will be invalidated and a new license code request will be required. Web Viewer Own Server v1.07 - Revision 1.06 2016 Locklizard Ltd Page 18 of 21
1.7 Backing up and recovering the system You are strongly advised to perform regular backups of the MySQL database. That is where all your data concerning the published documents, user settings, sessions, etc. and the Web Viewer license are held. This information cannot be regenerated by the Web Viewer. If a reinstallation of the system is required, you just need to reinstall the Web Viewer as it was first implemented, and restore the latest copy of the database. Please be sure to note that there may be data loss between the time of the last backup and the time of system failure. If the database and the Web Viewer are re-installed on the same computer(s) that they were originally installed on, then you will not require a new license response code from Locklizard. However, if a server system has been rebuilt or has been replaced with a new one, then a new license code may be required. In that event email Locklizard Support and advise them of your requirement. Please be aware that there may be time delays before new codes can be issued. Make sure you have your MySQL logon information handy as this is required to backup and restore the database. The MySQL login and connection values are stored in the file llw-config.php. This file should be part of the backup and recovery process to avoid the need to recreate new MySQL credentials at startup. It is also recommended that you take a complete image backup of the server, so you can restore it at a later date on the same machine. Using this method avoids you having to reinstall the server files, if something goes wrong with the server itself. Web Viewer Own Server v1.07 - Revision 1.06 2016 Locklizard Ltd Page 19 of 21
1.8 Moving the Web Viewer to a new Server If you need to change servers at any time in the future then follow the steps below: 1. If possible, upgrade your existing (old) server so that it is on the latest release of the Locklizard Web Viewer. Contact Locklizard support for the latest upgrade package. You will need to have a current support and maintenance agreement to do this. 2. Backup the MySQL database. This is where all data concerning the licensing of documents, publications and customers is held. 3. Install the third party server components on the new server. 4. Install the Locklizard Web Viewer on the new server following the instructions in this manual. You will need to enter your MySQL login details for the MySQL database you have just restored, so make sure you have this information to hand. 5. Once you have installed the Web Viewer on your new server, email the INSTALL ID to support@locklizard.com so we can generate your license code. 6. Restore the MySQL database onto the new server. 7. Enter your license code. 8. You will also need to re-register the Writer software before protecting PDF documents. Remove your Writer keystore (use the Remove Keystore option from the Windows Start menu > Locklizard > Safeguard > PDF Writer menu) and then re-register using the license file accessed from your Safeguard MASTER administration system using the link. Web Viewer Own Server v1.07 - Revision 1.06 2016 Locklizard Ltd Page 20 of 21
1.9 Upgrading the Web Viewer If you want to upgrade the Web Viewer to a later release then follow the steps below: 1. Backup the server; 2. Make sure you have installed the latest version of ioncube. If you update ioncube you will need to restart the server before this takes effect and this must be done before you continue the upgrade of the Web Viewer. 3. Extract the files to your document root folder (for example, c:\ inetpub\wwwroot) replacing what s there. IMPORTANT NOTE: Don t overwrite llw-config.php or your mysql settings will be lost and you will have to re-install the server; 4. Login to the Web Viewer as a Publisher; 5. A warning will be displayed that an upgrade has been performed; 6. Delete the setup folder from the htdocs directory for security reasons. Web Viewer Own Server v1.07 - Revision 1.06 2016 Locklizard Ltd Page 21 of 21