Contents

Minimum Security Configuration Guide

- 1 Configuring LDAP Authenticator Class.exe Permissions

- 2 Configuring Permissions in the Windows Registry

- 3 Granting Permission to IIS Metabase

- 4 Configuring Folder Access to the Web User Account

- 4.1 Configuring Anonymous Access

- 4.2 Configuring Virtual Directories

- 5 Configuring Application Pools

- 6 Configuring Permissions for Log/Application Files and Folders

- 7 Configuring HTTPS

- 8 Documentation Accessibility

Oracle® Argus Insight

Minimum Security Configuration Guide

Release 8.1.1

E88816-01

September 2017

This document describes how to configure security settings for the Argus Insight application. You configure these settings after you install Argus Insight. For details about installing the application, see the Oracle Argus Insight Installation Guide.

Contents

- Section 1, "Configuring LDAP Authenticator Class.exe Permissions"

- Section 2, "Configuring Permissions in the Windows Registry"

- Section 3, "Granting Permission to IIS Metabase"

- Section 4, "Configuring Folder Access to the Web User Account"

- Section 5, "Configuring Application Pools"

- Section 6, "Configuring Permissions for Log/Application Files and Folders"

- Section 7, "Configuring HTTPS"

- Section 8, "Documentation Accessibility"

1 Configuring LDAP Authenticator Class.exe Permissions

You need to grant permissions to the LDAP Authenticator Class.exe file, which is the executable for the Argus Insight application.

In addition, you need to create a domain user who will have access to the web servers and all network services that will be configured in Argus Insight. The instructions in this document use an example user, named safety_user. You need to substitute safety_user with the name of the domain user that you create.

Note:
You need to complete the instructions in this section for each web server in your installation.

To configure the permissions for the Argus Insight application:

1. Go to the web server.

2. Click Start, and select Run.
The Run command dialog box appears.

3. In the Open field, enter MMC comexp.msc /32, and click OK.
The Component Services screen appears.

4. Navigate to Console Root > Component Services > Computers > My Computer > DCOM Config.

5. Right-click LDAP Authenticator Class (that is, Argus Insight application), and select Properties from the menu.

6. Click the Security tab.

7. Modify the Launch and Activation Permissions as follows:

1. Select the Customize option.

2. Click Edit.
The Launch and Activation Permission dialog box appears.

3. To add the domain user who will have launch and activation permissions, click Add.

4. For the Local Launch option and the Local Activation option, select the Allow check box.

5. For the Remote Launch option and the Remote Activation option, select the Deny check box.

6. Click OK.

7. Click Yes in response to the message about Deny permissions.

8. Modify the Access Permissions as follows:

1. Select the Customize option.

2. Click Edit.
The Access Permission dialog box appears.

3. To add the domain user who will have access permissions, click Add.

4. For the Local Access option, select the Allow check box.

5. For the Remote Access option, select the Deny check box.

6. Click OK.

7. Click Yes in response to the message about Deny permissions.

9. Modify the Configuration Permissions as follows:

Note:
If the Minimum Security user is the Service Accounts user, skip this step.

1. Select the Customize option.

2. Click Edit.
The Change Configuration Permission dialog box appears.

3. To add the domain user who will have configuration permissions, click Add.

4. For the Full Control option and the Read option, select the Allow check box.

5. Click OK.

10. Click OK to save the changes and close the LDAP Authenticator Class Properties dialog box.

2 Configuring Permissions in the Windows Registry

To configure permissions in the Windows system registry:

1. Open the Windows Registry Editor:

1. Click Start, and select Run.
The Run command dialog box appears.

2. In the Open field, enter regedit.

3. Click OK.

2. Navigate to the following folder:
HKEY_USERS\S-1-5-20

3. Right-click the S-1-5-20 folder, and select Permissions.
The Permissions for S-1-5-20 dialog box appears.

4. To add the domain user, click Add.

5. For the Full Control option, select the Allow check box.

6. Click OK.

3 Granting Permission to IIS Metabase

To grant permission to IIS metabase:

1. Use the Run as administrator option to open and run Command Prompt screen.

Note:
Make sure you run the following command as administrator.

2. Grant the safety_user permission to access IIS metabase:
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727>aspnet_regiis.exe -ga "safety_user"

4 Configuring Folder Access to the Web User Account

This section, which describes how to configure folder access to the web user account, includes the following topics:

- Section 4.1, "Configuring Anonymous Access"

- Section 4.2, "Configuring Virtual Directories"

The instructions in this section assume your installation has a domain server and all servers are configured in that domain.

4.1 Configuring Anonymous Access

On every web server, configure Anonymous access as follows:

1. Navigate to Internet Information Services (IIS) Manager.

2. Double-click Authentication.

3. Right-click Anonymous Authentication, and from the drop-down menu, click Edit.
The Edit Anonymous Authentication Credentials dialog box appears.

4. To define the user credentials for the Safety domain user (safety_user), click Set.

5. Click OK to save the changes.

4.2 Configuring Virtual Directories

On every web server, you must configure the following virtual directories to connect as the Safety domain user (safety_user):

- Cancel

- PDFReports

To configure these virtual directories:

1. Select one of the virtual directories, and click Basic Settings.
The Edit Application dialog box appears.

2. Click Connect as.
The Connect As dialog box appears.

3. Select the Specific user option, and click Set.
The Set Credentials dialog box appears.

4. Enter the user name and password for the Safety domain user (safety_user).

5. Click OK until all the open dialog boxes are closed.

6. Repeat the process for the other virtual directories.

5 Configuring Application Pools

You must configure the following application pools to run under the safety_user identity:

- Argus Insight App Pool

- CancelQuery Pool

To configure these pools:

1. Select Application Pools to open the Application Pools page.

2. Select one of the application pools that you must configure.

3. Click Advanced Settings.
The Advanced Settings dialog box appears.

4. Expand Process Model.

5. Edit the Identity.

6. Select the Custom account option, and click Set.
The Set Credentials dialog box appears.

7. Enter the user name and password for the Safety domain user (safety_user).

8. Click OK until all the open dialog boxes are closed.

9. Repeat the process for the other application pools.

6 Configuring Permissions for Log/Application Files and Folders

You must assign the Safety domain user (safety_user) the proper read, modify, and execute permissions for the following folders and files:

- C:Windows\AI.ini

- C:Windows\ArgusSecureKey.ini

- C:\Temp

- Insight_Installation_Directory\ArgusInsight\Bin\Log

- Insight_Installation_Directory\ArgusInsight\CacheTemp

- Insight_Installation_Directory\ArgusInsight\PDFReports

- Insight_Installation_Directory\ArgusInsight\Upload

To configure the permissions:

1. Navigate to the appropriate file or folder.

2. Open the Permissions dialog box.

3. Select the Allow check box for the following permissions:

- Modify

- Read & execute

- Read

Note:
Do not provide Full control for any of these folders or files.

4. Click OK to save the changes.

5. Repeat the process for the other files and folders.

7 Configuring HTTPS

To configure HTTPS:

1. Log in to the web server.

2. Start Internet Information Services (IIS) Manager.

3. Select the server node, select the Server Certificates icon in the IIS section, and click Open Feature.

4. Create or import your SSL certificate.

5. Wait until the certificate is created.

6. Navigate to Sites, select Argus Insight, and click Bindings.

7. Click Add.
The Add Site Binding dialog box appears.

1. In the Type drop-down list, select https.

2. In the Port field, enter the SSL port to bind.

3. In the SSL certificate drop-down list, select Argus Insight.

4. Click OK to save the changes.

HTTPS is now enabled for Argus Insight.

To ensure the SSL connection is required:

1. Navigate to Sites, and select Argus Insight.

2. Select the SSL Settings icon in the IIS section.

3. Click Require SSL.

4. Click Apply.

8 Documentation Accessibility

For information about Oracle's commitment to accessibility, visit the Oracle Accessibility Program website at http://www.oracle.com/pls/topic/lookup?ctx=acc&id=docacc.

Access to Oracle Support

Oracle customers that have purchased support have access to electronic support through My Oracle Support. For information, visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=info or visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=trs if you are hearing impaired.

Minimum Security Configuration Guide, Release 8.1.1

E88816-01

Copyright © 2017, Oracle and/or its affiliates. All rights reserved.

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, then the following notice is applicable:

U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government.

This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications.

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group.

This software or hardware and documentation may provide access to or information about content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services unless otherwise set forth in an applicable agreement between you and Oracle. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services, except as set forth in an applicable agreement between you and Oracle.

Oracle Legal Notices

Copyright Notice

Copyright © 1994-2017, Oracle and/or its affiliates. All rights reserved.

License Restrictions Warranty/Consequential Damages Disclaimer

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

Warranty Disclaimer

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

Restricted Rights Notice

If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, then the following notice is applicable:

U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government.

Hazardous Applications Notice

This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications.

Trademark Notice

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group.

Third-Party Content, Products, and Services Disclaimer

This software or hardware and documentation may provide access to or information about content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services unless otherwise set forth in an applicable agreement between you and Oracle. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services, except as set forth in an applicable agreement between you and Oracle.

Pre-General Availability Draft Documentation Notice

If this document is in public or private pre-General Availability status:

This documentation is in pre-General Availability status and is intended for demonstration and preliminary use only. It may not be specific to the hardware on which you are using the software. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to this documentation and will not be responsible for any loss, costs, or damages incurred due to the use of this documentation.

Private Pre-General Availability Draft Documentation Notice

If this document is in private pre-General Availability status:

The information contained in this document is for informational sharing purposes only and should be considered in your capacity as a customer advisory board member or pursuant to your pre-General Availability trial agreement only. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions. The development, release, and timing of any features or functionality described in this document remains at the sole discretion of Oracle.

This document in any form, software or printed matter, contains proprietary information that is the exclusive property of Oracle. Your access to and use of this confidential material is subject to the terms and conditions of your Oracle Master Agreement, Oracle License and Services Agreement, Oracle PartnerNetwork Agreement, Oracle distribution agreement, or other license agreement which has been executed by you and Oracle and with which you agree to comply. This document and information contained herein may not be disclosed, copied, reproduced, or distributed to anyone outside Oracle without prior written consent of Oracle. This document is not part of your license agreement nor can it be incorporated into any contractual agreement with Oracle or its subsidiaries or affiliates.

Documentation Accessibility

For information about Oracle's commitment to accessibility, visit the Oracle Accessibility Program website at http://www.oracle.com/pls/topic/lookup?ctx=acc&id=docacc.

Access to Oracle Support

Oracle customers that have purchased support have access to electronic support through My Oracle Support. For information, visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=info or visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=trs if you are hearing impaired.