Service Installation

Default Security Mode

During service installation, the connection mode, default security mode, and default security passphrase can be specified using the following command line options:

--connect <0|1> --security-mode <none|passphrase|tls_srp|tls_x509> --passphrase-clear "my passphrase"|--peer-certificate-name "<certificate subject name>"

If the service image file is reset then the component will listen for the passphrase that was specified here during installation.

The table below summarizes the default values for the security mode and the related command line options for different inmation components.

Table 1. Default Communication and Security Settings
Default	Core	Connector	Server	Relay
--connect	1 (active)^[1]	0 (passive)	1 (active)	0 (passive)
--security mode	tls_srp^[1]	tls_srp	tls_srp	tls_srp
--passphrase-clear	<empty> (default passphrase)	<empty> (default passphrase)	<empty>	<empty>

[1] applies to local Cores only

X.509 Security Mode

X.509 Certificate Based Authentication can be used between core and connectors and between master and local cores. To do so, X.509 certificates (based on Microsoft Windows AD) are required.

When a component is operating in TLS-X.509 security mode, it will need to find a valid certificate from Windows Local Machine Certificate Store. Beside its validity, the certificate is expected to have an exportable private key. Upon initial installation, the component will attempt to find a certificate with a subject name that matches the fully qualified DNS name of the component host and use it for authenticating with the remote peer. After a successful connection with the peer, it is possible to configure a different subject name via the Self Certificate Selection property of the corresponding object.

Local machine certificates can be requested manually or configured by your system administrator for auto-enrollment.

Generally for X.509 authentication, the objects representing the services in DataStudio have to be prepared before the services are installed. For Connector objects see How to add a Connector.
Local Cores form an exception to this rule. See How to create a Local Core for their general installation and X.509 configuration.

For X.509 authentication, non-core-services have to be installed with the Windows Command Prompt Setup, adding the following aruments to the installation command:

 --security-mode TLS_X509 --peer-certificate-name "<certificate subject name>"

Replace <certificate subject name> with the subject name of the certificate used by the peer component.

Within the context of TLS-X.509 security mode, the peer component for connectors can be master or local core. For local cores, the peer component is a master core.

Currently, this security mode is not supported across relays.

Making Changes to the Security Configuration

The defaults cannot be changed after the service is installed. The current security mode and passphrase can be changed later after a successful first connection. To reset the default passphrase to the factory default, see changing-passphrase section.

See Changing the Security Configuration section to learn how to change the configuration later. Also note that the passphrase-clear option denotes a passphrase used by either the TLS-SRP or the Passphrase security mode, depending on which mode is selected (explicitly or by default).Using the --connect option typically requires the usage of the --corehost and / or`--coreport` options as well, such that the connector knows the address of the host running the inmation Core service. Use the command: `inmation.exe -h ` for a list of supported command line options.

Examples

Install a passive Connector with the custom default passphrase I am secure. Connector components will be in TLS-SRP security mode by default:

inmation.exe -i connector --passphrase-clear "I am secure"

Install an active Connector (with default TLS-SRP security) and the factory default passphrase, connecting to an inmation Core service running on CORESVR:

inmation.exe -i connector --connect 1 --corehost CORESVR

Install an active Connector in Passphrase security mode, using a custom default passphrase, connecting to an inmation Core service running on CORESVR:

inmation.exe -i connector --security-mode passphrase --passphrase-clear "My pass phrase" --connect 1 --corehost CORESVR

Install an active Connector with TLS_X509 security mode with CERTIFICATE SUBJECT as the certificate subject name, connecting to an inmation Core service running on CORESVR:

inmation.exe -i connector --connect 1 --corehost CORESVR --security-mode TLS_X509 --peer-certificate-name "CERTIFICATE SUBJECT"

Install a (OPC) Server using a custom default passphrase. Server components will have security mode Passphrase by default:

inmation.exe -i Server --passphrase-clear "my passphrase"

In older versions (v1.18 and below) the Server service name is OPC.COM so the name Server can be substituted for this in any command line operations. An example of the and the command line syntax would be: ..\inmation.root\bin\inmation.exe -i OPC.COM --passphrase-clear "my passphrase" When upgrading from an older version of system:inmation to the newest version, the name OPC.COM may be retained as the server name. This is dependent on the older installation’s version number. The OPC.COM and Server services will operate the same way.