This chapter outlines the planning process for a secure installation, describes several recommended deployment topologies for the systems, and includes the following information:
To better understand security needs, the following questions must be asked:
You can protect many of the resources in the production environment. Consider the type of resources that you want to protect when determining the level of security to provide. When using DIVAdirector, protect the following resources:
There are proxy folders containing low resolution clips. They are primarily on local or remote disks connected to the DIVAdirector system. Independent access to these disks (not through DIVAdirector) presents a security risk. This type of external access might be from a rogue system that reads or writes to these disks, or from an internal system that accidentally provides access to these disk devices.
There are Database Disk and Backup Disk resources used to build DIVAdirector. They are typically local or remote disks connected to the DIVAdirector systems. Independent access to these disks (not through DIVAdirector) presents a security risk. This type of external access might be from a rogue system that reads or writes to these disks, or from an internal system that accidentally provides access to these disk devices.
DIVAdirector system configuration settings must be protected from operating system level non-administrator users. In general, these settings are protected automatically by operating system level administrative users. Making the configuration files writable to non-administrative operating system users presents a security risk. Sensitive files encompass all application configuration files contained in the installation directory including:
www\Web.config
Api\Oracle.DIVAdirector.Api.exe.config
TaskManager\Oracle.DIVAdirector.TaskManager.exe.config
DIVAdirector Database\pg_hba.conf
DIVAdirector Database\postgresql.conf
In general, the resources described in the previous section must be protected from all non-administrator access on a configured system, or from a rogue external system that can access these resources through the WAN or FC fabric.
Protection failures against strategic resources can range from inappropriate access where data is accessed outside of normal DIVAdirector operations, to data corruption when there is writing to disk or tape outside of normal permissions.
By default, DIVAdirector will install a generic DD5 certificate for securing connections. During installation you are presented the option to upload your own certificate. Your certificate must be approved by a certificate authority. If you want to upgrade your certificate after installation, run the Oracle DIVAdirector Certificate Utility and follow the prompts to import the new certificate.
Connections to Oracle DIVA Enterprise Connect (DIVAEC) can, and should, be secured using the certificate provided by the DIVAEC installer (see the Oracle DIVA Enterprise Connect Installation, Configuration, and Operations Guide, and the Oracle DIVA Enterprise Connect Security Guide for details). This certificate must be installed into the Local Machine – Trusted Root Authority, and you must place a reference to it in the Windows hosts file under C:\Windows\System32\drivers\etc\hosts. After you enter the information in the hosts file, you must set the following keys to the provided host name:
Configuration Files:
C:\Program Files (x86)\DIVAdirector 5\www\Web.config C:\Program Files (x86)\DIVAdirector 5\TaskManager\Oracle.DIVAdirector.TaskManager.exe.config
Key to Modify:
<add key="DIVArchiveApiUrl" value="https://<new host name>:9444/diva/service/rest/2.2/DIVArchiveWS_REST" />
You can set up PostgreSQL SSPI Pass-Through Authentication after DIVAdirector is upgraded if you are using the same domain user account to run all DIVAdirector services, the IIS application pool, and PostgreSQL. This configuration removes the need to have plain text user names and passwords in the connection strings.
Follow the instructions at https://wiki.postgresql.org/wiki/Configuring_for_single_sign-on_using_SSPI_on_Windows to enable SSPI for PostgreSQL.
After you complete the instructions, you must update the configuration files for each of the following DIVAdirector services. You must modify the configuration files in the following default locations:
C:\Program Files(x86)\DIVAdirector 5\www\Web.config
C:\Program Files (x86)\Divadirector 5\TaskManager\Oracle.DIVAdirector.TaskManager.exe.config
C:\Program Files (x86)\Divadirector 5\Api\Oracle.DIVAdirector.Api.exe.config
C:\Program Files (x86)\Divadirector 5\Tools\DDServices\DIVADirectorServices.exe.config
In each of the services the key will be the same:
<connectionStrings>
<add name="DIVAdirectorContext"
connectionString="Server=localhost;Database=DIVAdirector;User Id=postgres;Password=MANAGER;" providerName="Npgsql"
/>
</connectionStrings>
You must modify the connection string parameter as follows:
connectionString="Server=localhost;Database=DIVAdirector;Integrated Security=true;Include Realm=true;"