Sun ONE logo     Previous     Contents     Index     Next     
Sun ONE Portal Server, Secure Remote Access 6.0 Installation Guide



Chapter 2   Installing the Sun ONE Portal Server, Secure Remote Access 6.0


This chapter includes instructions for installing the Sun ONE Portal Server, Secure Remote Access software.

This chapter contains the following sections:



Overview of Installing Sun ONE Portal Server, Secure Remote Access

You can install the Secure Remote Access components on the Portal Server node, or on a non-Portal Server node.

See Table 1-1, "Components and Nodes," on page 10 for details.

To start using the gateway:

  • Secure Remote Access support must be installed on the Sun ONE Portal Server node


    Note This component is installed by default when you choose "Install Portal Server" in a fresh installation of the Sun ONE Portal Server, Secure Remote Access. This component is available as a separate installable option if you are installing the Secure Remote Access software over an existing installation of the Sun ONE Portal Server.


  • Sun ONE Portal Server must be running


    Caution

    		You must install Sun ONE Portal Server before installing any of the Secure Remote Access components. During installation, the Secure Remote Access script requires information related to Sun ONE Portal Server, such as the name of the machine where Sun ONE Portal Server is installed, the domain, the sub-domain and the IP address.


Default answers for the installation questions are indicated in square brackets. For example: [y]/n indicates that y is the default.


Installation Log File

A log of the installation is stored in /var/sadm/install/logs/pssetup.pid. When you start the installation script, it displays the complete name of the log. The log can be helpful if you are trying to diagnose a problem related to installation.

You can view the log file on a separate terminal window as the installation proceeds using:

tail -f /var/sadm/install/logs/pssetup.pid



Installing the Sun ONE Portal Server and Secure Remote Access Support


Installing the Sun ONE Portal Server also installs Secure Remote Access support. If you are installing Secure Remote Access on an open mode installation of the Sun ONE Portal Server, "Install Secure Remote Access support" is available as a separate option.


Note WebNFS is required for NetFile support. WebNFS is installed as part of the Secure Remote Access support, if it does not already exist on the machine.



To Install Sun ONE Portal Server and Secure Remote Access Support

  1. Log in as root to the machine on which Sun ONE Portal Server needs to be installed, or has been installed.

    You need root access to install the Sun ONE Portal Server, Secure Remote Access.

  2. Change directories to where the installation program is located. Use the following command:

    cd exact path

  3. Type ./pssetup.

    The license agreement is displayed.

  4. Specify if you accept the license agreement. To accept, type yes.

  5. The installation script displays the Remove options menu.

    The Remove options are displayed in case you want to remove components that you might have installed earlier. The installation script displays a list of all detected components, and you can choose the component that you want to remove.


    Caution

    		Choosing Remove all uninstalls Sun ONE Directory Server and iPlanet Directory Server Access Management Edition. If Sun ONE Portal Server is installed on the same machine, uninstalling these components will cause Sun ONE Portal Server to stop functioning.


  6. Type the number corresponding to the Continue with install option.

    The Install options menu is displayed.

  7. Type the number corresponding to the Install Portal Server or Install Secure Remote Access support option.

    The installation prompts you for certain details. See the Checklist for Installing Portal Server for details.

  8. The installation script displays the installation summary. Type y to use these settings. Type n if you want to start from the beginning.

    The installation is completed.

    The Install options screen is displayed again. You can choose to install another component or exit from the installation.



Installing the Gateway on the Sun ONE Portal Server Node

This procedure assumes that Sun ONE Portal Server is already installed on the machine.

For configuring the gateway with the portal server in SSL mode, the CA certificate of the portal server's web server needs to be added to the gateway's certificate database. Export the CA certificate from the web server and add it to the gateway's certificate database using the certadmin tool.


To Install the Gateway on the Sun ONE Portal Server Node

  1. Log in as root to the machine on which Sun ONE Portal Server has been installed.

    You need root access to install the Sun ONE Portal Server, Secure Remote Access.

  2. Change directories to where the installation program is located. Use the following command:

    cd exact path

  3. Type ./pssetup

    The license agreement is displayed.

  4. Specify if you accept the license agreement. To accept, type yes.

  5. The installation script displays the Remove options menu.

    The Remove options are displayed in case you want to remove components that you might have installed earlier. The installation script displays a list of all detected components, and you can choose the component that you want to remove.


    Caution

    		Choosing Remove all uninstalls Sun ONE Directory Server and iPlanet Directory Server Access Management Edition. If Sun ONE Portal Server is installed on the same machine, uninstalling these components will cause Sun ONE Portal Server to stop functioning.


  6. Type the number corresponding to the Continue with install option.

    The Install options screen is displayed.

  7. Choose the option to install the gateway.

    The Gateway installation summary appears.

    The installation summary is obtained from the details provided during the installation of the Sun ONE Portal Server.

  8. Type n if you do not want to use the settings displayed in the Gateway installation summary. Type y to continue installing with the displayed settings.

  9. If you chose n in step 8, the installation prompts you for certain details.

    See the Checklist for Installing the Gateway on a Sun ONE Portal Server Node for details.

  10. The installation script displays the new Gateway installation summary. Type y to use these settings. Type n if you want to start from the beginning.

  11. If you chose y in step 10, the gateway installation is completed.

    The Install options screen is displayed again. You can choose to install another component or exit from the installation.



Installing Netlet Proxy on the Sun ONE Portal Server Node

The gateway ensures a secure communication channel between the remote client machine and the gateway. Netlet Proxy extends this secure communication channel from the client, through the gateway to the Netlet proxy that resides in the intranet. This restricts the number of open ports in a firewall between the demilitarized zone (DMZ) and the intranet.


Note Netlet proxy is optional and you may choose not to install this proxy during the installation. You can also choose to install the Netlet proxy on a non-Sun ONE Portal Server node. See "Installing Netlet Proxy on a Non-Sun ONE Portal Server Node" on page 47.


For configuring the Netlet proxy with the portal server in SSL mode, the CA certificate of the portal server's web server needs to be added to the Netlet proxy's certificate database. Use the certadmin tool to create a certificate database for the Netlet proxy, and export the CA certificate from the web server to the Netlet proxy's certificate database.


To Install the Netlet Proxy on the Sun ONE Portal Server Node

  1. Log in as root to the machine on which Sun ONE Portal Server has been installed.

    You need root access to install the Sun ONE Portal Server, Secure Remote Access.

  2. Change directories to where the installation program is located. Use the following command:

    cd exact path

  3. Type ./pssetup.

    The license agreement is displayed.

  4. Specify if you accept the license agreement. To accept, type yes.

  5. The installation script displays the Remove options menu.

    The Remove options are displayed in case you want to remove components that you might have installed earlier. The installation script displays a list of all detected components, and you can choose the component that you want to remove.


    Caution

    		Choosing Remove all uninstalls Sun ONE Directory Server and iPlanet Directory Server Access Management Edition. If Sun ONE Portal Server is installed on the same machine, uninstalling these components will cause Sun ONE Portal Server to stop functioning.


  6. Type the number corresponding to Continue with install.

    The installation script displays the Install options menu.

  7. Type the number corresponding to Install Netlet Proxy.

    The JDK installation summary and the Netlet proxy installation summary are displayed.

  8. Choose y to continue installing the Netlet proxy with the displayed settings. Choose n to change some of the settings.

  9. If you chose n in step 8, the installation prompts you again for details.

    See the Checklist for Installing Netlet Proxy on a Sun ONE Portal Server Node for details.

  10. The installation script displays the new Netlet proxy installation summary. Type y to use these settings. Type n if you want to start from the beginning.

    The Netlet proxy installation is completed when you type y.

    The Install options screen is displayed again. You can choose to install another component or exit from the installation.



Installing Rewriter Proxy on the Sun ONE Portal Server Node

Install the rewriter proxy to redirect HTTP requests to the rewriter proxy instead of directly to the destination host. The rewriter proxy in turn sends the request to the destination server.

If you do not specify a proxy, the gateway component makes a direct connection to intranet computers when a user tries to access one of those intranet computers.


Note You can install the rewriter proxy only on the Sun ONE Portal Server node. The basic purpose of the rewriter proxy is to extend the secure connection from the gateway to the Sun ONE Portal Server. This purpose is not achieved if the rewriter proxy is installed on any node other than the Sun ONE Portal Server node.

The option to install the rewriter proxy is available only if Portal Server is already installed on the machine.


For configuring the rewriter proxy with the portal server in SSL mode, the CA certificate of the portal server's web server needs to be added to the rewriter proxy's certificate database. Export the CA certificate from the web server and add it to the rewriter proxy's certificate database using the certadmin tool.

This procedure asks you if you want to install a self-signed certificate. If you choose yes, the install script prompts you for certificate-related details such as the organization name and division name. If you choose to install your own certificate at a later point, the details are not asked, but a certificate database is still created.


To Install the Rewriter Proxy on the Sun ONE Portal Server

  1. Log in as root to the machine on which Sun ONE Portal Server has been installed.

    You need root access to install the Sun ONE Portal Server, Secure Remote Access.

  2. Change directories to where the installation program is located. Use the following command:

    cd exact path

  3. Type ./pssetup.

    The license agreement is displayed.

  4. Specify if you accept the license agreement. To accept, type yes.

  5. The installation script displays the Remove options menu.

    The Remove options are displayed in case you want to remove components that you might have installed earlier. The installation script displays a list of all detected components, and you can choose the component that you want to remove.


    Caution

    		Choosing Remove all uninstalls Sun ONE Directory Server and iPlanet Directory Server Access Management Edition. If Sun ONE Portal Server is installed on the same machine, uninstalling these components will cause Sun ONE Portal Server to stop functioning.


  6. Type the number corresponding to Continue with install.

    The installation script displays the Install options menu.

  7. Type the number corresponding to Install Rewriter Proxy.

    The JDK installation summary and the Rewriter Proxy installation summary are displayed.

  8. Choose y to continue installing the Rewriter proxy with the displayed settings. Choose n to change some of the settings.

  9. If you chose n in step 8, the installation prompts you for certain details.

    See the Checklist for Installing Rewriter Proxy for details.

  10. The installation script displays the new Rewriter Proxy installation summary. Type y to use these settings. Type n if you want to start from the beginning.

    The Rewriter Proxy installation is completed when you type y.

    The Install options screen is displayed again. You can choose to install another component or exit from the installation.



Installing the Gateway on a Non-Sun ONE Portal Server Node

It is recommended that the gateway be installed on a machine other than the Sun ONE Portal Server machine.

For configuring the gateway with the portal server in SSL mode, the CA certificate of the portal server's web server needs to be added to the gateway's certificate database. Export the CA certificate from the web server and add it to the gateway's certificate database using the certadmin tool.

This procedure asks you if you want to install a self-signed certificate. If you choose yes, the install script prompts you for certificate-related details such as the organization name and division name. If you choose to install your own certificate at a later point, the details are not asked, but a certificate database is still created.


Caution

For security reasons, it is recommended that no other software is installed on the same machine as the gateway.



To Install the Gateway on a Non-Sun ONE Portal Server Node

  1. Log in as root to the machine on which you want to install the gateway component.

    You need root access to install the Sun ONE Portal Server: Secure Remote Access.

  2. Change directories to where the installation program is located. Use the following command:

    cd exact path

  3. Type ./pssetup.

    The license agreement is displayed.

  4. Specify if you accept the license agreement. To accept, type yes.

    The installation script displays the Install options.

  5. Type the number corresponding to the Install Gateway option.

    The installation prompts you for certain details. See the Checklist for Installing Gateway on a non-Sun ONE Portal Server Node for details.

    The Install options screen is displayed again. You can choose to install another component or exit from the installation.



Installing Netlet Proxy on a Non-Sun ONE Portal Server Node

The Netlet proxy can be installed on the Sun ONE Portal Server node or on an independent node.


Note You cannot install Netlet proxy on the same machine as the gateway. The main purpose of the Netlet proxy is to restrict the number of open ports between the gateway and the Sun ONE Portal Server server to 1. Installing the Netlet proxy on the gateway machine will result in multiple ports being opened in the firewall between the gateway and the Sun ONE Portal Server server.

You can install the Netlet proxy on a portal server machine, and choose a portal server installation on a different machine for this Netlet proxy to work with.


For configuring the Netlet proxy with the portal server in SSL mode, the CA certificate of the portal server's web server needs to be added to the Netlet proxy's certificate database. Use the certadmin tool to create a certificate database for the Netlet proxy, and export the CA certificate from the web server to the Netlet proxy's certificate database.


To Install Netlet Proxy on a Non-Sun ONE Portal Server Node

  1. Log in as root to the machine on which Sun ONE Portal Server has been installed.

    You need root access to install the Sun ONE Portal Server, Secure Remote Access.

  2. Change directories to where the installation program is located. Use the following command:

    cd exact path

  3. Type ./pssetup.

    The license agreement is displayed.

  4. Specify if you accept the license agreement. To accept, type yes.

    The installation script displays the Install options.

  5. Type the number corresponding to the Install Netlet proxy option.

    The installation prompts you for certain details. See the Checklist for Installing Netlet Proxy on a non-Sun ONE Portal Server Node for details.

    The Install options screen is displayed again. You can choose to install another component or exit from the installation.



Installing Secure Remote Access Migration Tools

You need to install the SRA Migration Tools to migrate the gateway components from previous versions to Sun ONE Portal Server, Secure Remote Access 6.0.


Note If you have a standalone gateway installed, and you need to migrate certificates on the gateway, you need to install the SRA Migration Tools on the gateway machine. Otherwise, you can install the SRA Migration Tools on the Portal Server machine.



To Install the Secure Remote Access Migration Tools

  1. Log in as root to the machine on which Sun ONE Portal Server has been installed.

    You need root access to install the Sun ONE Portal Server, Secure Remote Access.

  2. Change directories to where the installation program is located. Use the following command:

    cd exact path

  3. Type ./pssetup.

    The license agreement is displayed.

  4. Specify if you accept the license agreement. To accept, type yes.

    The installation script displays the Install options.

  5. Type the number corresponding to the Install SRA Migration Tools option.

    If you have not installed the Portal Server Migration Tools, you are prompted for the base directory in which to install the SRA Migration Tools.

    If you have installed the Portal Server Migration Tools, no questions are asked. The SRA Migration Tools are installed in the same directory in which the Portal Server Migration Tools are installed.

    The Install options screen is displayed again. You can choose to install another component or exit from the installation.



Post Installation Tasks

After installion, do the following to start the gateway and run the required tasks:

  1. Start the gateway using the following command:

    InstallDir/SUNWps/bin/gateway -n new profile name start

    default is the default gateway profile that is created during installation. You can create your own profiles later, and restart the gateway with the new profile. See Creating a Gateway Profile in Chapter 2, "Administering the Gateway" in the Sun ONE Portal Server, Secure Remote Access 6.0 Administration Guide.

    If you have multiple gateway instances, use:

    InstallDir/SUNWps/bin/gateway start

    This command starts all the gateway instances configured on that particular node.

    InstallDir/SUNWps/bin/gateway stop

    This command stops all the gateway instances that are running on that particular node.


    Caution

    		Ensure that only the configuration files for the instances that you want to start are in the /etc/opt/SUNWps directory.



    Note This step is not required if you chose y for the "Start Gateway after installation" option during the gateway installation.


  2. Run the following command to check if the gateway is running on the specified port:

    netstat -an | grep port number


    Note The default gateway port is 443.


    If the gateway is not running, start the gateway in the debug mode, and view messages that are printed on the console. Use the following command to start the gateway in debug mode:

    InstallDir/SUNWps/bin/gateway -n profilename start debug

    Also view the log files after setting the gateway.debug attribute in the platform.conf.profilename file to message. See the section Understanding the platform.conf File in Chapter 2, Administering the Gateway in the Sun ONE Portal Server, Secure Remote Access 6.0 Administrator's Guide for details.

  3. Run Sun ONE Portal Server in the secure mode by typing the gateway URL in your browser:

    https://gateway machine name:portnumber

    If you have chosen the default port (443) during installation, you need not specify the port number.


    Note Before starting the Netlet proxy and the rewriter proxy, ensure that the gateway profile is updated with the Netlet proxy and the rewriter proxy options.


  4. Login to the iPlanet Directory Server Access Management Edition admin console as administrator using the username amadmin, and using the password specified during installation.

You can now create new organizations, roles, and users and assign required services and attributes in the admin console.


Caution

Ensure that you enable the Access List service for all users, to allow access through the gateway.



Previous     Contents     Index     Next     
Copyright 2002 Sun Microsystems, Inc. All rights reserved.

Last Updated September 23, 2002