DocSTAR NetConnect Installation Guidesupport.docstar.com › portal › docstar › techdvd › Manuals... · 3. Install Microsoft IIS Security Lockdown Tool 4. Install DocSTAR NetConnect

NNeettCCoonnnneecctt vv11..00 IInnssttaallllaattiioonn GGuuiiddee

RReevviissiioonn 77 88//77//22000022

NNeettCCoonnnneecctt vv11..00 IInnssttaallllaattiioonn G iiddee Gu

RReevviissiioonn 77 88//77//22000022 u

Table of Contents Table of Contents IInnttrroodduuccttiioonn Section 1: DocSTAR NetConnect v1.0 Requirements & Installation CD ...................................... 11 Section 1: DocSTAR NetConnect v1.0 Requirements & Installation CDSection 2: DocSTAR NetConnect v1.0 Installation ............................................................................................................ 33 Section 2: DocSTAR NetConnect v1.0 Installation

Step 1: Install DocSTAR NetConnect License on DocSTAR Host ............................... 4 Step 2: Verify that Internet Information Server (IIS) is enabled with proper settings .... 4 Step 3: Install Microsoft IIS Security Lockdown Tool.................................................... 6 Step 4: Install DocSTAR NetConnect v1.0 Software.................................................. 10 Step 5: Install DocSTAR Digital Certificate (for SSL Communications)...................... 13 Step 6: Final NetConnect Setup ................................................................................. 18 Step 7: Test DocSTAR NetConnect Installation on Host............................................ 21 Step 8: Configure Router Connections for DocSTAR NetConnect............................. 24 Step 9: Configure and Test DocSTAR NetConnect remote clients ............................ 26

Appendix A: NetConnect Installation Files ................................................................................................................................ 2299 Appendix A: NetConnect Installation FilesAppendix B: NetConnect Additions to DSHOST Service/Desktop...................................................... 3300 Appendix B: NetConnect Additions to DSHOST Service/Desktop

DocSTAR NetConnect v1.0 Installation Guide

Introduction Introduction DocSTAR NetConnect v1.0 is an optional software module that allows a DocSTAR v3.x Departmental or Enterprise System to become a Secure Internet accessible Document Imaging System. Through the use of today’s widely available Secure High-Speed WAN/Internet Connections, DocSTAR can now become ‘The Electronic Filing System People want to use remotely’. DocSTAR NetConnect allows a client computer to access the DocSTAR Host over the Internet in the same fashion that they access the DocSTAR Host from their LAN. From a DocSTAR User perspective, the operation of DocSTAR is exactly the same. If the DocSTAR user is using a Laptop that is attached to the LAN when they are in the office and connects via a High-Speed WAN/Internet connection when they are at home, they can easily switch from LAN to Internet Mode and back as necessary.

Conceptual Overview

DocSTAR NetConnect v1.0 Installation Guide

Section 1:: DDooccSSTTAARR NNeettCCoonnnneecctt vv11..00 RReeqquuiirreemmeennttss && IInnssttaallllaattiioonn CCDD Section 1

This section will familiarize you with the minimum requirements to install DocSTAR NetConnect v1.0 Software and the contents of the DocSTAR NetConnect v1.0 Installation CD. The following listed DocSTAR Host System minimum requirements must be satisfied before DocSTAR NetConnect v1.0 Software can be installed on the DocSTAR Host System. Please keep in mind, although the minimum requirements may be satisfied, performance may not be adequate. For this reason, there is a recommended specification (for better performance) next to the minimum requirement for hardware. Note: The installation of DocSTAR NetConnect v1.0 should only be performed by DocSTAR v3.x Enterprise DocSTAR Service Engineers (EDSE). Important Note: When selecting a high-speed Internet connection (for the DocSTAR NetConnect Host) and Internet Service Provider, be sure that hosting a Web Server is allowed and the required port (port 80 for http and/or port 443 for SSL) is open for Internet requests.

DocSTAR Host System Requirements

Hardware Minimum Requirement Recommended Processor Pentium III based DocSTAR Host Pentium 4 based DocSTAR Host RAM 256 MB 512 MB (or higher) SVGA Monitor 32-bit Color

1024 x 768 Resolution 32-bit Color

1024 x 768 Resolution Hard Drive Space (for DocSTAR NetConnect v1.0 software)

2 MB 2 MB

WAN/Internet Connection Bandwidth requirement may increase as the # of concurrent client connections increases

Business Cable, Business DSL, Dedicated Frame Relay, or T1 with

a Static IP Address

Dedicated Frame Relay, T1 or higher with a Static IP address

Software Minimum Requirement Recommended

Operating System MS Windows 2000 Server MS Windows 2000 Server Existing DocSTAR Software Version (Host)

DocSTAR Version 3.x Departmental or Enterprise

DocSTAR Version 3.x Departmental or Enterprise

DocSTAR Client Requirements (to use DocSTAR v3.x in ‘Internet Mode’)

Hardware Minimum Requirement Recommended

Processor Pentium II Pentium III (or higher) RAM 64 MB 256 MB (or higher) SVGA Monitor 256 Color

800 x 600 Resolution 32-bit Color

1024 x 768 Resolution Hard Drive Space (for DocSTAR v3.x software)

100 MB 100 MB (or higher)

CD-ROM Drive For Installing Software For Installing Software WAN/Internet Connection High-Speed Connection

(Cable/DSL/Frame Relay/T1) High-Speed Connection

(Cable/DSL/Frame Relay/T1)

Software Minimum Requirement Recommended Operating System Windows 98 Windows 2000 Professional or

Server Microsoft Internet Explorer MS IE 4.0 SP2 or higher MS IE 5.0

DocSTAR NetConnect v1.0 Installation Guide Page1

The DocSTAR NetConnect v1.0 Installation CD The DocSTAR NetConnect v1.0 Installation CD contains the following: iislockd.exe - Contains the Microsoft Internet Information

Services (IIS) Security Lockdown Tool installation program. This program is not used by the DocSTAR NetConnect v1.0 setup program. This program should be run before installing NetConnect v1.0 software.

SETUP.EXE - The DocSTAR NetConnect v1.0 setup program.

Page 2 DocSTAR NetConnect v1.0 Installation Guide - v3.x

Section 2:: DDooccSSTTAARR NNeettCCoonnnneecctt vv11..00 IInnssttaallllaattiioonn Section 2

This section will guide you through the installation of DocSTAR NetConnect v1.0 Software.

DocSTAR NetConnect Architecture

The diagram below provides a simplified graphical representation of the architecture of DocSTAR NetConnect v1.0.

Installation Steps Below is a list of the installation steps to be performed:

1. Install DocSTAR NetConnect License on DocSTAR Host 2. Verify that Internet Information Server (IIS) is enabled with proper settings 3. Install Microsoft IIS Security Lockdown Tool 4. Install DocSTAR NetConnect v1.0 Software 5. Install DocSTAR Digital Certificate (for SSL Communications) 6. Create Local User Account for remote access (if necessary) 7. Test DocSTAR NetConnect Installation on Host 8. Configure Router Connections for DocSTAR NetConnect 9. Configure and Test DocSTAR NetConnect remote clients

Note: Appendices A & B provide detailed information about installation files and modifications made to the DSHost Service/Desktop. *Important Note: In all of the following steps, you must be logged into the Windows 2000 Server DocSTAR Host as Administrator. This assures that you will have the necessary rights to perform the installation properly.


Step 1: Install DocSTAR NetConnect License on DocSTAR Host Purpose: This step enables the DocSTAR Host to communicate with DSProxy.DLL and the presence of the license also provides an indication to the DSHost Service/Desktop that virtual web shares must be established every time it starts, see Appendices A & B. DSProxy.DLL provides an intermediate communication step between DSServer.DLL (processes all client requests) and Listen.ASP (Active Server Page that actually ‘listens’ for internet client requests).

With the DocSTAR NetConnect Certificate in hand, call DocSTAR Technical Support and add the DocSTAR NetConnect License (as well as any additional licenses necessary) to the Hardware Key on the DocSTAR Host System using the DocSTAR Administration Program.

Step 2: Verify that Internet Information Server (IIS) is enabled with proper settings Purpose: This step verifies that Internet Information Services are enabled and set properly in order to provide the Web Services necessary for Listen.ASP (Active Server Page) to function properly, see Appendix A.

On Microsoft Windows 2000 Server, Internet Information Services (IIS) is enabled by default. If IIS has been disabled, it must be enabled again. Using the Control Panel\Add/Remove Programs select Add/Remove Windows Components and verify that Internet Information Services are enabled and verify that the options are set as shown in the following screens:


The details should be set as follows:

Scroll down to verify the rest of the settings, as shown below.


Step 3: Install Microsoft IIS Security Lockdown Tool Purpose: This step installs the Microsoft IIS Security Lockdown Tool. This tool modifies the way IIS is configured and installs URLScan (a special Internet request filter) to provide better security for Web Servers. This helps prevent hackers, viruses, worms and other unwanted Internet traffic from attacking the Web Server. Important Note: Installation of the IIS Security Lockdown Tool is considered the minimum security measure required to provide a reasonably safe and secure DocSTAR Web Server Solution.

Insert the DocSTAR NetConnect v1.0 CD into the CD-ROM drive and run iislockd.exe.

You will see the Welcome screen. Click Next.


If you instead see the This Server Was Already Configured screen, the Internet Lockdown tool has already been installed. Click Cancel to exit the lockdown tool and continue with Step 4.

You will see the License Agreement screen. Select I agree and click Next.


You will see the Select Server Template screen. Select Dynamic Web Server

(ASP enabled) and click Next. This Web Server Template will configure IIS with the optimum security options for a Dynamic Web Server that uses Active Server Pages (such as DocSTAR w/NetConnect).

You will see the URLScan screen. Make sure the checkbox is checked and click Next.


You will see the Ready to Apply Settings screen. Click Next.

You will see the Applying Security Settings screen. Click Next.


You will see the Completing the Internet Information Services Lockdown

Wizard screen. Click Finish.

Step 4: Install DocSTAR NetConnect v1.0 Software Purpose: This step installs the DocSTAR NetConnect v1.0 Software. The files installed and changes made to the DSHost Service/Desktop are outlined in Appendices A & B.

Insert the DocSTAR NetConnect v1.0 CD into the CD-ROM drive and run SETUP.EXE.


You will see the Select DocSTAR Host screen. Enter the computer name of

the DocSTAR Host and click Next.

You will see the Start Installation screen. Click Next.


You will see the Installation Complete screen. Click Finish.


Step 5: Install DocSTAR Digital Certificate (for SSL Communications) Purpose: This step installs the DocSTAR Digital Certificate for SSL communications. SSL (Secure Sockets Layer) provides an added level of security when accessing information over the Internet. Most Internet online banking and shopping transactions use SSL. SSL allows a web client and web server to set up encrypted communications between them, thereby making the communications much more secure. A Digital Certificate is necessary and used by IIS to identify itself to a web client and set up the SSL encryption scheme between them. DocSTAR NetConnect installs a DocSTAR generic, unsigned, and untrusted Digital Certificate for DocSTAR clients and the DocSTAR NetConnect Host to be able to communicate over the Internet using SSL (if desired and setup appropriately as will be shown later). Unsigned and untrusted Digital Certificates function just as signed and trusted certificates. The only difference between them is that signed and trusted Digital Certificates are generated by a Trusted Certificate Authority (such as VeriSign). Signed and trusted Digital Certificates can be obtained (for a fee) from a Trusted Certificate Authority and used in place of the generic Digital Certificate supplied by DocSTAR (if desired).

Right-click on My Computer and select Manage. You will see the Computer Management screen. Right-click on Default Web Site and select Properties.


You will see the Default Web Site Properties screen. Select the Directory

Security tab.

You will see the Directory Security tab. Select the Server Certificate button from the Secure communications area.


You will see the Welcome to the Web Server Certificate Wizard screen. Click Next.

You will see the Server Certificate screen. Select Import a certificate from a Key Manager backup file and click Next.


You will see the Import screen. Type C:\DOCSTAR\docstar.key and click

Next.

You will see the Key Manager Certificate Password screen. Type docstar and click Next.


You will see the Imported Certificate Summary screen. Click Next.

You will see the Completing the Web Server Certificate Wizard screen. Click Finish.


Step 6: Final NetConnect Setup Purpose: In this step, the final NetConnect Setup is completed. A user account may be created for the remote client to use to login. This is only necessary if a user account(s) doesn’t already exist for this purpose. There can either be one user account used for all remote client logins or each remote client login can use it’s own login. Note: If the DocSTAR Host System is logging into a Domain, accounts that exist in the Domain can be used to login to the DocSTAR Host System.

Launch the DocSTAR Administration program. You will see the Administration Screen.

Click on the NetConnect button. You will see the NetConnect Setup screen. Set Authentication and IIS Log File parameters desired. Enter the name of the Windows NT/2000 Domain that will be the Default Logon Domain (if using Domain accounts to logon).


Click OK to accept the changes and exit the Administration program. To create a Local account to logon to DocSTAR through NetConnect:

Right-click on My Computer and select Manage. You will see the Computer Management screen. Right-click on Local Users and Groups\Users and select New User.


You will see the New User screen. You can choose to create one generic DocSTAR account (for all remote users) or create an individual account for each user that will be accessing remotely. Note: This step is not necessary if the DocSTAR host is logging into a Domain and each user, that will be accessing remotely through NetConnect, already has an account in the Domain that will be used to validate their remote access. Be careful when setting the user name and password, since they are case sensitive.


Step 7: Test DocSTAR NetConnect Installation on Host Purpose: In this step, the DocSTAR NetConnect installation will be tested locally using a web browser. The DocSTAR NetConnect software setup installs a default.htm test page to test the proper operation of DocSTAR NetConnect over http and/or SSL connections from a web browser. To test standard http communications:

Launch a web browser (such as Internet Explorer) and type in the following address (if the computer name of the DocSTAR Host is DocSTAR, if it is not then substitute the DocSTAR Host computer name). Press Enter.

If IIS and DocSTAR NetConnect are installed properly and running, you should see the Enter Network Password screen. Enter the user account information that was setup in Step 6. Click Next.

If IIS and DocSTAR NetConnect are installed properly, you should now see the test page displayed successfully as shown below.


To test SSL communications:

Launch a web browser (such as Internet Explorer) and type in the following address (if the computer name of the DocSTAR Host is DocSTAR, if it is not then substitute the DocSTAR Host computer name). Press Enter. Note: When communicating over SSL notice that https is used in the address instead of http.

If IIS and DocSTAR NetConnect are installed properly and running, you should see the Security Alert screen. This is a standard warning that the Server Digital Certificate is an unsigned and untrusted certificate. Click Yes.


If IIS and DocSTAR NetConnect are installed properly and running, you should see the Enter Network Password screen. Enter the user account information that was setup in Step 6. Click Next.


If IIS and DocSTAR NetConnect are installed properly for SSL communications,

you should now see the test page displayed successfully as shown below. Note: When a successful SSL connection has been established there will be a picture of a lock in the bottom status bar.

Step 8: Configure Router Connections for DocSTAR NetConnect Purpose: In this step, information is presented to facilitate the proper setup of a router used to connect the DocSTAR NetConnect Host to the Internet. Due to the wide variety of routers and high-speed connections available, it is not possible to offer detailed instructions for configuring every make and model of router or type of connection and Internet Service Provider. It is highly recommended that these configuration settings be discussed with and setup by the customer’s Network Administrator. Important Note: Depending on the type of connection (at the DocSTAR NetConnect Host location) and the Service Agreement between the Internet Service Provider and the Customer, hosting a Web Server may be restricted or prohibited. In addition, the Internet Service Provider may elect to block port 80 for incoming requests (this will prevent Internet users from connecting to the DocSTAR NetConnect Host through standard http communication, however SSL (https) communications may still be functional). When selecting a high-speed Internet connection (for the DocSTAR NetConnect Host) and Internet Service Provider, be sure that hosting a Web Server is allowed and the required port (port 80 for http and/or port 443 for SSL) is open for Internet requests.


First, obtain the Static IP Address of the Router on the WAN/Internet side (this is the IP Address that the Internet sees when communicating with the router). In some cases, there may be multiple Static IP Addresses assigned to one router. If so, one must be selected for use with DocSTAR NetConnect. Record it below. Static IP Address of Router (WAN/Internet side): _____._____._____._____ Second, obtain the Static IP Address of the DocSTAR NetConnect Host on the LAN. Record it below. Static IP Address of DocSTAR NetConnect Host: _____._____._____._____ In order for the DocSTAR NetConnect Host to receive and respond to Internet requests the following ports need to be open for inbound and outbound communication. Note: You may choose to have the DocSTAR NetConnect Host receive and respond to standard http requests only, SSL https requests only, or both. For standard http communication: Port 80 must be open For SSL https communication: Port 443 must be open In addition, since the DocSTAR NetConnect Host cannot be addressed directly from the Internet, the following ports need to be forwarded to the DocSTAR NetConnect Host by the router. Note: This will configure the router to send all Internet Requests addressed to the Static IP Address of the router (WAN/Internet side) on these ports to the DocSTAR NetConnect Host. This is necessary for DocSTAR NetConnect to function properly. For standard http communication: Port 80 must be forwarded to the Static IP Address

of the DocSTAR NetConnect Host For SSL https communication: Port 443 must be forwarded to the Static IP

Address of the DocSTAR NetConnect Host As an example, the forwarding configuration of a sample LinkSys Router is shown below (the Static IP Address of the DocSTAR NetConnect Host in this example is 192.168.1.100):


Step 9: Configure and Test DocSTAR NetConnect remote clients Purpose: This is the final step in which remote clients will be setup and tested. To setup remote clients you will need to have the Static IP Address of the Router used with the DocSTAR NetConnect Host (or the Static IP Address selected for use with DocSTAR NetConnect). This was recorded in Step 8.

Install DocSTAR v3.x Software on the remote client station. When you see the Select DocSTAR Host Settings screen set the Internet Settings as follows: Default Connection Type: Internet DocSTAR Host Name: DOCSTAR (in this example) Use SSL (Encryption): Selected (in this example) Host Domain Name: 204.149.160.85 (in this example)

(this is the Static IP Address of the Router) Host Domain Address /dsnc/ Note: You will have to enter Internet User Name and Password settings from the DocSTAR Setup screen.


From the DocSTAR Setup screen verify the settings are correct and enter the Internet User Name and Password information from Step 6.


It is also recommended that you select the Station Settings tab and check the Show Progress Dialog Box on Long Operations checkbox. (This will allow remote clients to monitor the progress of long operations).

You should now be able to access DocSTAR remotely. If DocSTAR is not able to run properly, you may use the Internet Explorer test procedure outlined in Step 7 to verify that it has been set up properly. Note: If using test procedure from Step 7, substitute the DocSTAR Host Name ‘DOCSTAR’ with the Static IP Address of the router in the address bar.

or


Appendix A:: NNeettCCoonnnneecctt IInnssttaallllaattiioonn FFiilleess Appendix A

The following files are installed, to the directory locations listed, during the NetConnect installation process:

DSProxy.DLL C:\DocSTAR DocSTAR.key C:\DocSTAR TLBINF32.DLL C:\winnt\system32 Hisecweb.inf C:\winnt\security\templates Listen.ASP C:\inetpub\wwwroot\dsnc Upload.ASP C:\inetpub\wwwroot\dsnc Default.htm C:\inetpub\wwwroot\dsnc DocSTAR_01.gif C:\inetpub\wwwroot\dsnc DocSTAR_14.jpg C:\inetpub\wwwroot\dsnc DocSTAR_nav_home.gif C:\inetpub\wwwroot\dsnc Handinmonitor.gif C:\inetpub\wwwroot\dsnc

File Definitions:

DSProxy.DLL o Called by Listen.ASP o Translates XML Requests o Calls DSServer.DLL o Returns the response in XML

DocSTAR.key o Generic, unsigned and untrusted digital certificate used for SSL

communications TLBINF32.DLL

o Used by DSProxy.DLL. Listen.ASP

o Receives request from Client o Creates the connection to DSProxy.DLL o Passes the request to DSProxy.DLL o Returns the result of the call to the client

Upload.ASP o Uploads files to the specified location

Default.htm o Default/test html page displayed when directly connecting to the Server from

a web browser DocSTAR_01.gif

o Graphic used by Default.htm DocSTAR_14.gif

o Graphic used by Default.htm DocSTAR_nav_home.gif

o Graphic used by Default.htm Handinmonitor.gif

o Graphic used by Default.htm


Appendix B:: NNeettCCoonnnneecctt AAddddiittiioonnss ttoo DDSSHHOOSSTT SSeerrvviiccee//DDeesskkttoopp Appendix B The following actions are added to the DSHOST Service/Desktop and are executed each time the DSHost Service/Desktop is started:

Creates a virtual web share for the DocSTAR directory (usually C:\DOCSTAR) Creates a virtual web share for the Archive directory (usually E:\ARCHIVE) Creates a virtual web share for the Two-Tier Storage directory (usually D:\DOCS)

Note: The above virtual web shares are created using the same naming convention as their hidden LAN network shares. The properties for the above shares are set as follows, each time the DSHOST Service/Desktop is started:

Read Access: Yes (Allows reading of a file) Write Access: No (Does not allow writing of a file) Directory Browsing: No (Does not allow directory browsing) Client Logging: No (Does not write client requests to a log file) Anonymous Access: No (Does not allow anonymous access) NTLM Authentication: No (Does not use NTLM Authentication scheme) Basic Authentication: Yes (Uses Basic Authentication scheme) Enable Default Doc: No (Does not allow a default.htm/asp file) Access Script: No (Does not allow .asp file execution)

The directory C:\inetpub\wwwroot\dsnc is assigned the following properties:

Read Access: Yes (Allows reading of a file) Write Access: No (Does not allow writing of a file) Directory Browsing: No (Does not allow directory browsing) Client Logging: No (Does not write client requests to a log file) Anonymous Access: No (Does not allow anonymous access) NTLM Authentication: No (Does not use NTLM Authentication scheme) Basic Authentication: Yes (Uses Basic Authentication scheme) Enable Default Doc: Yes (Allows a default.htm/asp file) Access Script: Yes (Allows .asp file execution)

Important Note: If any of the above IIS settings are manually reconfigured, the DSHOST Service/Desktop will reset them back to the settings shown above, the next time it is started.


Documents

DocSTAR NetConnect Installation Guidesupport.docstar.com › portal › docstar › techdvd › Manuals... · 3. Install Microsoft IIS Security Lockdown Tool 4. Install DocSTAR NetConnect