Produced by Araxis Merge on 3/13/2019 2:49:37 PM Central Daylight Time. See www.araxis.com for information about Merge. This report uses XHTML and CSS2, and is best viewed with a modern standards-compliant browser. For optimum results when printing this report, use landscape orientation and enable printing of background images and colours in your browser.
| # | Location | File | Last Modified |
|---|---|---|---|
| 1 | C:\AraxisMergeCompare\Pri_un\DSM\Direct Implementation\java\assembly\stock\src\books\users-guide | depl-hisp-only.confluence | Tue Mar 12 21:54:20 2019 UTC |
| 2 | C:\AraxisMergeCompare\Pri_re\DSM-scrubbed\Direct Implementation\java\assembly\stock\src\books\users-guide | depl-hisp-only.confluence | Wed Mar 13 13:39:03 2019 UTC |
| Description | Between Files 1 and 2 |
|
|---|---|---|
| Text Blocks | Lines | |
| Unchanged | 2 | 1314 |
| Changed | 1 | 2 |
| Inserted | 0 | 0 |
| Removed | 0 | 0 |
| Whitespace | |
|---|---|
| Character case | Differences in character case are significant |
| Line endings | Differences in line endings (CR and LF characters) are ignored |
| CR/LF characters | Not shown in the comparison detail |
No regular expressions were active.
| 1 | h1. HISP O nly Deploy ment (no s ource) | |
| 2 | ||
| 3 | This secti on outline s step by step instr uctions on installin g and depl oying a Ba re Metal i nstance of the Java reference implementa tion. The instructi ons contai ns steps f or a selec t list of software p latforms s uch as Win dows, Free BSD, Ubunt u, CentOS, and RedHa t Enterpri se linux. | |
| 4 | ||
| 5 | h2. Major Updates in Version 2 .0+ | |
| 6 | ||
| 7 | Version 2. 0 of the B are Metal assembly a dded three major fun ctional en hancements from the previous 1 .x release s: | |
| 8 | ||
| 9 | * Support of the del ivery noti fication i mplementat ion [guide |http://wi ki.directp roject.org /file/deta il/Impleme ntation+Gu ide+for+De livery+Not ification+ in+Direct+ v1.0.pdf] for timely and relia ble delive ry. | |
| 10 | * Support for common message f ailure sce narios inc luding com mon bounce messages with conte xt appropr iate failu re informa tion. | |
| 11 | * Experime ntal suppo rt for the Apache Ja mes server 3.0-beta4 release. | |
| 12 | ||
| 13 | From a dep loyment an d configur ation pers pective, t he key dif ferences a re the add ition of t he message monitorin g service deployed i n Tomcat a nd changes to the Ja mes config .xml file for suppor t of the d elivery no tification guide and other fai lure scena rios. If you are up grading fr om version 1.x, be a ware of th e addition of the ne w monitori ng service and the c onfig.xml changes. Also note that the T omcat star tup file ( catalina.s h) increas es the max perm gen size. | |
| 14 | ||
| 15 | If you ins talling 2. 0 and late r from scr atch, the appropriat e changes have alrea dy been in cluded in the assemb ly. | |
| 16 | ||
| 17 | *NOTE:* Ja mes 3 supp ort is onl y experime ntal. The re are no guarantees that it w ill work w ith all co nfiguratio ns, and th e final re lease of J ames 3 may change si gnificantl y from the current b eta-4 rele ase. | |
| 18 | ||
| 19 | h2. Major Updates in Version 3 .0+ | |
| 20 | ||
| 21 | Version 3. 0 of the B are Metal assembly a dded the p olicy enab lement mod ule as an optional c omponent. | |
| 22 | ||
| 23 | From a dep loyment pe rspective, there are no differ ences betw een 2.x an d 3.x when installin g the requ ired compo nents othe r than upd ated versi ons of com ponents. Configurat ion of the policy en able modul e is descr ibed in th e direct-p olicy libr ary users [guide|../ ../../../d irect-poli cy/1.0/use rs-guide/d ev-sta.htm l]. | |
| 24 | ||
| 25 | h2. Major Updates in Version 4 .0+ | |
| 26 | ||
| 27 | Version 4. 0 of the B are Metal assembly i ntroduced a number o f new feat ures focus ed on real world pro duction is sues. The se include : | |
| 28 | * A comple te re-impl ementation of the co nfiguratio n service API using a RESTful paradigm. | |
| 29 | ** Support s a plugga lbe authen tication m odel and a BasicAuth model by default. | |
| 30 | * Mandator y encrypti on of p12 files stor ed in the configurat ion servic e. Pre-ex isting p12 files wil l remain u nencrypted , but it i s highly a dvised tha t you re-i mport them . | |
| 31 | * Support of PKCS12 hardware t okens for storage of p12 secre t keys. | |
| 32 | * RDBMS ba sed auditi ng support and plugg able audit ing config uration. | |
| 33 | * Default TLS edge e ncryption for IMAP, POP3, and SMTP in Ja mes 3. | |
| 34 | ||
| 35 | From a dep loyment pe rspective, there are some key configurat ion change s to take advantage of the new features. These wi ll be disc ussed in t heir appro priate sec tions. | |
| 36 | ||
| 37 | h2. Major Updates in Version 5 .0+ | |
| 38 | ||
| 39 | Version 5. 0 focused on increas ed key sec urity and paying tec hnology de bts. Feat ures inclu de: | |
| 40 | * Complian ce with Ap plicabilit y Statemen t [v1.2|ht tp://wiki. directproj ect.org/Ap plicabilit y+Statemen t+for+Secu re+Health+ Transport+ v1.2]. | |
| 41 | * Enhance security f or private key prote ction and cryptograp hic operat ions. | |
| 42 | * Support for policy enablemen t in the D NS server | |
| 43 | * Config-u i updated to use the REST conf iguration API. | |
| 44 | * Updated documentat ion for si ngle use c ertificate implement ation. | |
| 45 | ||
| 46 | h2. Assump tions | |
| 47 | ||
| 48 | * User is running on e of the f ollowing s oftware pl atforms. Other plat forms are supported and may on ly require d slight v ariations of the ins tructions listed thi s section, but the B are Metal install ha s only bee n validate d on the f ollowing p latforms: | |
| 49 | ** Windows | |
| 50 | *** Server 2003 or l ater | |
| 51 | *** XP SP2 or later | |
| 52 | ** Ubuntu Linux | |
| 53 | *** 10.10 (Maverick Meerkat) * Deprecated Support* | |
| 54 | *** 11.04 (Natty Nar whal) *Dep recated Su pport* | |
| 55 | *** 11.10 (Oneiric O celot) *De precated S upport* | |
| 56 | *** 12.04 (Precise P angolin) | |
| 57 | *** 12.10 (Quantal Q uetzal) | |
| 58 | *** 13.04 (Raring Ri ngtail) | |
| 59 | *** 13.10 (Saucy Sal amander) | |
| 60 | *** 14.04 (Trusty Ta hr) | |
| 61 | *** 14.10 (Utopic Un icorn) | |
| 62 | *** 15.04 (Vivid Ver vet) | |
| 63 | *** 15.10 (Wily Were wolf) | |
| 64 | ** FreeBSD 9.1 | |
| 65 | ** CentOS 5+ | |
| 66 | ** RHEL 5. 5+ | |
| 67 | * Assumed that the i nstall has administr ative priv ileges on the instal l box. | |
| 68 | ** Root or sudo acce ss for lin ux/unix ba sed platfo rms | |
| 69 | ** Adminis trator pri vileges fo r Windows based plat forms | |
| 70 | * Assumed user has r egistered a domain w ith an acc redited do main regis trar such as [GoDadd y|http://w ww.godaddy .com/] | |
| 71 | ||
| 72 | h2. Genera l Tools an d Runtimes | |
| 73 | ||
| 74 | The refere nce implem entation r equires so me tools t o be avail able on th e platform to instal l and run the Bare M etal compo nents. | |
| 75 | ||
| 76 | * Unzip | |
| 77 | * Ant | |
| 78 | * Java SE 6, 7, or 8 | |
| 79 | ||
| 80 | h3. Unzip | |
| 81 | ||
| 82 | An unzip t ool is req uired to u npack the stock asse mbly. Rec ommended t ools and i nstallatio n location s are list ed below: | |
| 83 | ||
| 84 | _Windows_ | |
| 85 | ||
| 86 | Any one of the follo wing will work for W indows: | |
| 87 | ||
| 88 | * [Winzip| www.winzip .com] | |
| 89 | * [WinRar| http://www .win-rar.c om/downloa d.html] | |
| 90 | ||
| 91 | _Ubuntu_ | |
| 92 | ||
| 93 | Install un zip using the follow ing comman d: | |
| 94 | ||
| 95 | {code} | |
| 96 | sudo apt- get instal l unzip | |
| 97 | {code} | |
| 98 | ||
| 99 | _CentOS/RH EL_ | |
| 100 | ||
| 101 | Unzip tool s should a lready be installed, but if no t execute the follow ing comman ds with ro ot or sudo privilege s: | |
| 102 | ||
| 103 | {code} | |
| 104 | yum insta ll unzip | |
| 105 | yum insta ll gzip | |
| 106 | yum insta ll tar | |
| 107 | {code} | |
| 108 | ||
| 109 | h3. Ant | |
| 110 | ||
| 111 | The Ant to ol is used for setti ng the dom ain name i n the Apac he James s erver. | |
| 112 | ||
| 113 | _Windows_ | |
| 114 | ||
| 115 | Download A pache Ant from the f ollowing l ocation an d follow i n the inst all instru ctions und er Documen tation/Man ual locate d on the u pper left side of th e site bel ow | |
| 116 | ||
| 117 | * [Apache Ant|http:/ /ant.apach e.org/bind ownload.cg i] | |
| 118 | ||
| 119 | _Ubuntu_ | |
| 120 | ||
| 121 | Install an t using th e followin g command: | |
| 122 | ||
| 123 | {code} | |
| 124 | sudo apt- get instal l ant | |
| 125 | {code} | |
| 126 | ||
| 127 | _CentOS/RH EL_ | |
| 128 | ||
| 129 | TDB | |
| 130 | ||
| 131 | _FreeBSD_ | |
| 132 | ||
| 133 | Install an t using th e followin g command (should ru n as root or with el evated pri vileges): | |
| 134 | ||
| 135 | {code} | |
| 136 | pkg_add - r apache-a nt | |
| 137 | {code} | |
| 138 | ||
| 139 | FreeBSD al so does no t come wit h _wget_ b y default. Install wget using the follo wing comma nd: | |
| 140 | ||
| 141 | {code} | |
| 142 | pkg_add - r wget | |
| 143 | {code} | |
| 144 | ||
| 145 | h3. Java S E | |
| 146 | ||
| 147 | The Java 6 , 7, and 8 SE platfo rms provid es the run time envir onment tha t all of t he Bare Me tal compon ents will run in. T he package has been tested wit h both. | |
| 148 | ||
| 149 | _Windows_ | |
| 150 | ||
| 151 | Download a nd install the Java 6, 7, or 8 JRE from Oracle's d ownload we b [site|ht tp://www.o racle.com/ technetwor k/java/jav aseproduct s/download s/index.ht ml]. Afte r installi ng the JRE , set the JAVA_HOME environmen t variable by follow ing the in structions below: | |
| 152 | ||
| 153 | * Right cl ick on "My Computer" (may be i n differen t location s dependin g on the W indows ver sion) and select Pro perties | |
| 154 | * If runni ng later v ersions of Windows, you may be presented "Control\ System" pa nel. If s o, click A dvanced sy stem setti ngs on the left side of the wi ndow. | |
| 155 | * In the S ystem Prop erties Dia log, click the Advan ced tab an d then cli ck Environ ment Varia bles. | |
| 156 | * Under Sy stem Varia bles click New. | |
| 157 | * Use the following settings e xample sub stituting with the a ppropriate folder: | |
| 158 | ||
| 159 | {code} | |
| 160 | Variable Name: JAVA _HOME | |
| 161 | Variable Value: C:\ Program Fi les\java\j re6 | |
| 162 | {code} | |
| 163 | ||
| 164 | * Click OK on all sc reens. | |
| 165 | ||
| 166 | _Ubuntu 10 .10 - 11.1 0_ | |
| 167 | ||
| 168 | Install Su n Java 6 J DK. By def ault it is not inclu ded in the shipped r epository, and needs to be add ed manuall y. After i nstalling, you need to update java-alter natives to use the n ewly insta lled Java version in stead of s hipped ver sion. | |
| 169 | ||
| 170 | *Note:* Fo r Ubuntu 1 0.10 Maver ick, the a dd-apt-rep ository co mmand may not be not available . Instead, uncomment or add th e canonica l reposito ry "_http: //archive. canonical. com/ lucid partner_" in the /e tc/apt/sou rces.list and follow the remai nder of th e steps. | |
| 171 | ||
| 172 | {code} | |
| 173 | sudo add- apt-reposi tory "deb http://arc hive.canon ical.com/ lucid part ner" | |
| 174 | sudo apt- get update | |
| 175 | sudo apt- get instal l sun-java 6-jdk | |
| 176 | sudo upda te-java-al ternatives -s java-6 -sun | |
| 177 | export JA VA_HOME=/u sr/lib/jvm /java-6-su n | |
| 178 | echo "exp ort JAVA_H OME=$JAVA_ HOME" | su do tee -a /etc/envir onment | |
| 179 | {code} | |
| 180 | ||
| 181 | *Note:* It is okay t o ignore t he "no alt ernative" error mess ages displ ayed after running t he update- java-alter natives co mmand. | |
| 182 | ||
| 183 | _Ubuntu 12 .04 - 15.1 0_ | |
| 184 | ||
| 185 | The Oracle JREs are supported in the [We bUpdt8|htt ps://launc hpad.net/~ webupd8tea m/+archive /java] Per sonal Pack age Archiv e (PPA) wh ich automa tically do wnloads an d installs the JRE. | |
| 186 | ||
| 187 | To install PPA, foll ow the com mands belo w: | |
| 188 | ||
| 189 | *Note:* Th e add-apt- repository command m ay not be available. Adding t he python- software-p roperties package sh ould resol ve this is sue. It i s also oka y to ignor e the "no alternativ e" error m essages di splayed af ter runnin g the upda te-java-al ternatives command. | |
| 190 | ||
| 191 | {code} | |
| 192 | sudo apt- get instal l python-s oftware-pr operties | |
| 193 | sudo add- apt-reposi tory ppa:w ebupd8team /java | |
| 194 | sudo apt- get update | |
| 195 | {code} | |
| 196 | ||
| 197 | To install Java 6: | |
| 198 | ||
| 199 | {code} | |
| 200 | sudo apt- get instal l oracle-j ava6-insta ller | |
| 201 | sudo upda te-java-al ternatives -s java-6 -oracle | |
| 202 | export JA VA_HOME=/u sr/lib/jvm /java-6-or acle | |
| 203 | echo "exp ort JAVA_H OME=$JAVA_ HOME" | su do tee -a /etc/envir onment | |
| 204 | {code} | |
| 205 | ||
| 206 | To install Java 7: | |
| 207 | ||
| 208 | {code} | |
| 209 | sudo apt- get instal l oracle-j ava7-insta ller | |
| 210 | sudo upda te-java-al ternatives -s java-7 -oracle | |
| 211 | export JA VA_HOME=/u sr/lib/jvm /java-7-or acle | |
| 212 | echo "exp ort JAVA_H OME=$JAVA_ HOME" | su do tee -a /etc/envir onment | |
| 213 | {code} | |
| 214 | ||
| 215 | _CentOS/RH EL_ | |
| 216 | ||
| 217 | Obtain/dow nlaod the JDK 6 Upda te 29 pack age using the follow ing comman d for the appropriat e processo r architec ture: | |
| 218 | ||
| 219 | x86 (32 bi t) | |
| 220 | {code} | |
| 221 | wget http ://downloa d.oracle.c om/otn-pub /java/jdk/ 6u29-b11/j dk-6u29-li nux-i586-r pm.bin | |
| 222 | {code} | |
| 223 | ||
| 224 | x64 (64 bi t) | |
| 225 | {code} | |
| 226 | wget http ://downloa d.oracle.c om/otn-pub /java/jdk/ 6u29-b11/j dk-6u29-li nux-x64-rp m.bin | |
| 227 | {code} | |
| 228 | ||
| 229 | After down loading, e xecute the following commands to install the JDK f or the app ropriate p rocessor a rchitectur e: | |
| 230 | ||
| 231 | x86 (32 bi t) | |
| 232 | {code} | |
| 233 | chmod 755 jdk-6u29- linux-i586 -rpm.bin | |
| 234 | sudo ./jd k-6u29-lin ux-i586-rp m.bin | |
| 235 | {code} | |
| 236 | ||
| 237 | x64 (64 bi t) | |
| 238 | {code} | |
| 239 | chmod 755 jdk-6u29- linux-x64- rpm.bin | |
| 240 | sudo ./jd k-6u29-lin ux-x64-rpm .bin | |
| 241 | {code} | |
| 242 | ||
| 243 | After inst alling, yo u need to update jav a alternat ives to us e the newl y installe d Java ver sion inste ad of ship ped versio n. Start b y creating alternati ves for th e new java commands installed above. Ex ecute the following commands t o set the Sun JDK: | |
| 244 | ||
| 245 | {code} | |
| 246 | sudo alte rnatives - -install / usr/bin/ja va java /u sr/java/jd k1.6.0_22/ bin/java 1 00 | |
| 247 | sudo alte rnatives - -install / usr/bin/ja r jar /usr /java/jdk1 .6.0_22/bi n/jar 100 | |
| 248 | sudo alte rnatives - -install / usr/bin/ja vac javac /usr/java/ jdk1.6.0_2 2/bin/java c 100 | |
| 249 | ||
| 250 | sudo alte rnatives - -config ja va | |
| 251 | sudo alte rnatives - -config ja r | |
| 252 | sudo alte rnatives - -config ja vac | |
| 253 | {code} | |
| 254 | ||
| 255 | Finally se t the JAVA _HOME envi ronment va riable for the new J DK using t he followi ng command s: | |
| 256 | ||
| 257 | {code} | |
| 258 | export J AVA_HOME=/ usr/java/j dk1.6.0_22 | |
| 259 | echo "ex port JAVA_ HOME=$JAVA _HOME" | s udo tee -a /etc/envi ronment | |
| 260 | {code} | |
| 261 | ||
| 262 | _FreeBSD_ | |
| 263 | ||
| 264 | Obtain/dow nlaod the JDK 6 usin g the pkg\ _add comma nd if you do not alr eady have Java 6 ins talled. T his step u ses the op enjdk6 imp lementatio n as the O racle inst alltation generally requires b uilding th e distribu tion from the _ports _ and is a much more involved process (s hould run as root or with elev ated privi leges). | |
| 265 | ||
| 266 | {code} | |
| 267 | pkg_add -r openjdk 6 | |
| 268 | set JAVA _HOME=/usr /local/ope njdk6 | |
| 269 | sed -i . bak 's/set env=/seten v=JAVA_HOM E=\/usr\/l ocal\/open jdk6,/g' / etc/login. conf | |
| 270 | cap_mkdb /etc/logi n.conf | |
| 271 | {code} | |
| 272 | ||
| 273 | h3. Java C ryptograph ic Extensi ons | |
| 274 | ||
| 275 | The Sun JR E/JDK requ ires the J CE policy jars to be updated t o allow fo r unlimite d strength encryptio n. The po licy files must be d ownloaded separately and copie d in the J RE library . | |
| 276 | ||
| 277 | For all pl atforms, d ownload th e jce poli cy file us ing a web browser. For Unix/L inux syste ms, it may be necess ary to man ually copy or FTP th e file fro m a system with a UI to the Un ix/Linux n ode. | |
| 278 | ||
| 279 | * [Java 6| http://www .oracle.co m/technetw ork/java/j avase/down loads/jce- 6-download -429243.ht ml] | |
| 280 | * [Java 7| http://www .oracle.co m/technetw ork/java/j avase/down loads/jce- 7-download -432124.ht ml] | |
| 281 | * [Java 8| http://www .oracle.co m/technetw ork/java/j avase/down loads/jce8 -download- 2133166.ht ml] | |
| 282 | ||
| 283 | _Windows_ | |
| 284 | ||
| 285 | Unzip the downloaded file and copy the j ar files f rom the jc e director y to the J AVA_HOME/j re/lib/sec urity fold er (Exampl e: C:\Prog ram Files\ java\jre6\ lib\securi ty). Over write the existing f iles. | |
| 286 | ||
| 287 | _All Linux /Unix/Free BSD_ | |
| 288 | ||
| 289 | From the d irectory w here you d ownloaded and placed the jce z ip file, r un the fol lowing com mands: | |
| 290 | ||
| 291 | {code} | |
| 292 | unzip <jc e zip file name> | |
| 293 | cd <Unzip ped Direct ory Name> | |
| 294 | sudo cp l ocal_polic y.jar $JAV A_HOME/jre /lib/secur ity | |
| 295 | sudo cp U S_export_p olicy.jar $JAVA_HOME /jre/lib/s ecurity | |
| 296 | {code} | |
| 297 | ||
| 298 | ||
| 299 | h2. Obtain Reference Implement ation Stoc k Assembly | |
| 300 | ||
| 301 | The stock assembly c ontains al l of the p re-assembl ed and con figured co mponents o f the Bare Metal dep loyment. Download t he latest version of the stock assembly from the m aven centr al [reposi tory|http: //repo2.ma ven.org/ma ven2/org/n hind/direc t-project- stock/] or the Sonat ype [repos itory|http s://oss.so natype.org /content/r epositorie s/snapshot s/org/nhin d/direct-p roject-sto ck/]. | |
| 302 | ||
| 303 | *Note:* Th e maven ce ntral repo sitory may black lis t some IP ranges suc h as virut al machine s running in the Ama zon EC2 cl oud. Use the Sonaty pe reposit ory if you are block ed from th e maven ce ntral repo sitory. | |
| 304 | ||
| 305 | The assemb ly contain s a root d irectly na med _direc t_ and has the follo wing folde rs under t he root. | |
| 306 | ||
| 307 | * apache-t omcat-7.0. 41 | |
| 308 | * DirectDN SServices | |
| 309 | * ConfigTo ols | |
| 310 | * james-2. 3.2 | |
| 311 | * apache-j ames-3.0-b eta4 | |
| 312 | * tools | |
| 313 | ||
| 314 | _Windows_ | |
| 315 | ||
| 316 | From a bro wser, down load the d esired ver sion of th e assembly from one the reposi tories abo ve. | |
| 317 | ||
| 318 | Example: D ownload ve rsion 5.1 - [direct- project-st ock-5.1.ta r.gz|https ://oss.son atype.org/ content/re positories /releases/ org/nhind/ direct-pro ject-stock /5.1/direc t-project- stock-5.1. tar.gz]. After down loading, u nzip the c ontents to appropria te install ation loca tion. | |
| 319 | ||
| 320 | _All Linux /Unix_ | |
| 321 | ||
| 322 | Obtain the URL for a ppropriate version o f the asse mbly and d ownload it the /opt directory by running wget comm and from t he /opt di rectory. For exampl e, to down load versi on direct- project-st ock-5.1.ta r.gz from maven cent ral, use t he followi ng command s: | |
| 323 | {code} | |
| 324 | cd /opt | |
| 325 | sudo wget http://re po2.maven. apache.org /maven2/or g/nhind/di rect-proje ct-stock/5 .1/direct- project-st ock-5.1.ta r.gz | |
| 326 | {code} | |
| 327 | ||
| 328 | If you are denied ac cess to th e location above, tr y the Sona type repos titory usi ng the fol lowing com mand. | |
| 329 | {code} | |
| 330 | cd /opt | |
| 331 | sudo wget https://o ss.sonatyp e.org/cont ent/reposi tories/rel eases/org/ nhind/dire ct-project -stock/5.1 /direct-pr oject-stoc k-5.1.tar. gz | |
| 332 | {code} | |
| 333 | ||
| 334 | Extract th e contents of the as sembly and set the D IRECT HOME logical u sing the f ollowing c ommand. N ote the na me of the tar.gz fil e if you d ownloaded a differen t version: | |
| 335 | ||
| 336 | {code} | |
| 337 | sudo tar xvfz direc t-project- stock-5.1. tar.gz | |
| 338 | export DI RECT_HOME= `pwd`/dire ct | |
| 339 | echo "exp ort DIRECT _HOME=$DIR ECT_HOME" | sudo tee -a /etc/e nvironment | |
| 340 | {code} | |
| 341 | ||
| 342 | _FreeBSD_ | |
| 343 | ||
| 344 | Obtain the URL for a ppropriate version o f the asse mbly and d ownload it the /opt directory by running wget comm and from t he /opt di rectory. You may ne ed to init ially crea te the /op t director y. For ex ample, to download v ersion dir ect-projec t-stock-3. 0.tar.gz f rom maven central, u se the fol lowing com mands: | |
| 345 | ||
| 346 | {code} | |
| 347 | cd / | |
| 348 | mkdir opt | |
| 349 | cd /opt | |
| 350 | sudo wget http://re po2.maven. apache.org /maven2/or g/nhind/di rect-proje ct-stock/5 .1/direct- project-st ock-5.1.ta r.gz | |
| 351 | {code} | |
| 352 | ||
| 353 | If you are denied ac cess to th e location above, tr y the Sona type repos titory usi ng the fol lowing com mand. | |
| 354 | {code} | |
| 355 | cd /opt | |
| 356 | sudo wget https://o ss.sonatyp e.org/cont ent/reposi tories/rel eases/org/ nhind/dire ct-project -stock/5.1 /direct-pr oject-stoc k-5.1.tar. gz | |
| 357 | {code} | |
| 358 | ||
| 359 | Extract th e contents of the as sembly and set the D IRECT HOME logical u sing the f ollowing c ommand. N ote the na me of the tar.gz fil e if you d ownloaded a differen t version: | |
| 360 | ||
| 361 | {code} | |
| 362 | sudo tar xvfz direc t-project- stock-5.1. tar.gz | |
| 363 | sed -i .b ak 's/sete nv=/setenv =DIRECT_HO ME=\/opt\/ direct,/g' /etc/logi n.conf | |
| 364 | cap_mkdb /etc/login .conf | |
| 365 | {code} | |
| 366 | ||
| 367 | You will n eed to log out or pos siblly reb oot at thi s point in order for the globa l DIRECT_H OME variab le to take affect. Failing to reboot wi ll cause t he setdoma in script to fail in later ste ps. | |
| 368 | ||
| 369 | {code} | |
| 370 | reboot | |
| 371 | {code} | |
| 372 | ||
| 373 | h2. Launch Tomcat | |
| 374 | ||
| 375 | Before run ning the J ames mail servier, t he configu ration and message m onitiroing services must be ru nning and some minim um configu ration com pleted. A ll of thes e services run insid e the Tomc at web ser ver. | |
| 376 | ||
| 377 | To start t he tomcat server, ru n the foll owing comm and from t he DIRECT HOME/apach e-tomcat-7 .0.41/bin directory. | |
| 378 | ||
| 379 | _Windows_ | |
| 380 | {code} | |
| 381 | startup | |
| 382 | {code} | |
| 383 | ||
| 384 | _All Unix/ Linux/Free BSD_ | |
| 385 | {code} | |
| 386 | sudo ./st artup.sh | |
| 387 | {code} | |
| 388 | ||
| 389 | *Note:* It may take a few minu tes for th e web serv er to fini sh loading as it mus t initiall y deploy a ll of the services w hen run fo r the firs t time. | |
| 390 | ||
| 391 | To validat e that Tom cat and th e configur ation serv ices loade d successf ully, laun ch a brows er window against th e server n ode with t he followi ng URL: | |
| 392 | ||
| 393 | {code} | |
| 394 | http://<s erver>:808 1/config-u i | |
| 395 | {code} | |
| 396 | ||
| 397 | You should be presen ted with t he configu ration ui login [scr een|../../ ../../gate way/4.2/us ers-guide/ smtp-depl- wsconfig.h tml] | |
| 398 | ||
| 399 | h2. Domain Name and Certificat e Generati on | |
| 400 | ||
| 401 | The first step in ru nning your mail serv er is conf iguring th e domain a nd a loadi ng a trust anchor an d certific ate(s) int o the conf iguration ui. | |
| 402 | ||
| 403 | First dete rmine your HISPs dom ain name. Depending on the ty pe of cert ificate re solution s ervices yo u wish to host, your domain na ming conve ntion may slightly d iffer. Re gardless o f the cert ificate ho sting mode l, you wil l need to have to ha ve registe red domain . For thi s document , we will assume you have a do main regis tered call ed example .com. | |
| 404 | ||
| 405 | *Note:* Re fer to the Direct Pr oject DNS Configurat ion [Guide |http://wi ki.directp roject.org /DNS+Confi guration+G uide] as a starting point for determinin g your DNS naming co nvention. | |
| 406 | ||
| 407 | Now that w e have our registere d domain, we will ho st our HIS P Direct m essaging u nder the d omain dire ct.example .com. | |
| 408 | ||
| 409 | The next s tep is cre ate a root certifica te (anchor ) for our domain and an X.509 certificat e or pair of X.509 c ertificate s for encr ypting/dec rypting an d signing message. There are many diffe rent optio ns for get ting these certiicat es such as using ope nssl or ob taining a certificat e from a c omercial t hird party such as D igiCert. However th e Direct P roject ref erence imp lementatio n assembly ships wit h a tool c alled cert Gen for ge nerating r oot CAs an d certific ates for t he purpose of pilots and inter op testing . | |
| 410 | ||
| 411 | *NOTE* The certifica tes genera ted by the certGen t ool implem ent certif icates tha t represen t trust an chors and end entity certifica tes for do mains and individual Direct ad dresses. However, t hese certi ficates do not imple ment a ful ly functio naly PKI ( public key infrastru cture) whi ch would i nclude mul titude of additiona operationa l aspects. PKIs are generally implement ed by thir d party CA s such as DigiCert o r VeriSign , but can by impleme nted by in dividual i nstutition s if they resources to do so. PKI imple mentation is outside the scope of this d ocument. | |
| 412 | ||
| 413 | Full docum entation f or the cer tGen tool can be fou nd [here|. ./../../.. /agent/2.2 /users-gui de/dev-cer t-gen.html ]. The do cumentatio n in the c ertGen lin k runs the certGen t ool from t he referen ce implemn tation sou rce tree. In the Ba re Metal a ssembly, t he certGen tool is f ound under the /dire ct/tools d irectory t hat was ex tracted fr om the tar .gz file. | |
| 414 | ||
| 415 | Run the ce rtGen tool from tool s director y using th e followin g command: | |
| 416 | ||
| 417 | _Windows_ | |
| 418 | {code} | |
| 419 | certGen | |
| 420 | {code} | |
| 421 | ||
| 422 | _All Unix/ Linux/Free BSD_ | |
| 423 | {code} | |
| 424 | ./certGen .sh | |
| 425 | {code} | |
| 426 | ||
| 427 | h3. Certif icate Gene ration | |
| 428 | ||
| 429 | Now create a CA for your domai n. In the certGen t ool, enter a common name (CN:) for your new CA. F or our dom ain direct .example.c om, we mig ht use som ething lik e _Direct. Example.Co m Root CA_ . Fill th e other fi elds as ne eded. It is recomme nded you s et the exp iration to 1 year, t he key str enth to at least 204 8 bytes, a nd provide a passwor d for your CA's priv ate key. | |
| 430 | ||
| 431 | After crea ting the C A, create a leaf cer t and usin g your dom ain name a s the CN: field and fill in al l other fi elds as ne eded. It is recomme nded you s et the exp iration to at least 1 year, th e key stre ngth to at least 204 4 bytes, a nd provide a passwor d for your private k ey. After creating your CA an d certific ate, you s hould have the follo wing simil arly named files in your /tool s director y (assumin g the dire ct.example .com domai n and no e mail addre ss entered in the CA dialog. If an emai l address is entered , then the CA files will have the eamil address in the file name inste ad of the CN field). | |
| 432 | ||
| 433 | * Direct.E xample.com Root CA.d er = Root CA file (t rust ancho r for you HISP) | |
| 434 | * Direct.E xample.com Root CAKe y.der - Ro ot CA priv ate key fi le | |
| 435 | * direct.e xample.com .der - Org certifica te file | |
| 436 | * direct.e xample.com Key.der - Org certif icate priv ate key fi le | |
| 437 | * direct.e xample.com .p12 - Org certifica te PKCS12 file | |
| 438 | ||
| 439 | h4. Single Use Certi ficates | |
| 440 | ||
| 441 | The certGe n tool doe s support generating single us e certific ates. If you wish t o implemen t single u se certifi cates, ref er to this specific [chapter|. /depl-sing le-use-cer ts.html]. | |
| 442 | ||
| 443 | h2. Import Anchors a nd Certifi cates | |
| 444 | ||
| 445 | Before the James mai l server c an be run, you must create you domain in the confi guration u i tool and import an chors and certificat es. Follo w the step s below to create yo ur domain and import your trus t anchor a nd certifi cate(s). A full des cription o f the conf ig ui and operations can be fo und [here| ../../../. ./gateway/ 4.2/users- guide/smtp -depl-wsco nfig.html] . | |
| 446 | ||
| 447 | # Log into http://<s erver>:808 1/config-u i with use rname: AI and passw ord: AI | |
| 448 | ## Click C reate New Domain. | |
| 449 | ## Enter t he Domain Name and P ostmaster E-Mail Add ress for t he domain this HISP will be ha ndling. T ypical pos tmaster ad dress is p ostmaster@ <domain na me>. | |
| 450 | ## Choose ENABLED as the statu s. | |
| 451 | ## Click A dd | |
| 452 | # Click th e Anchors tab. | |
| 453 | ## Click * Browse...* and brows e to the l ocation of your trus t anchor, and select it. | |
| 454 | ## Check I ncoming an d Outgoing | |
| 455 | ## Choose ENABLED as the statu s. | |
| 456 | ## Click a dd anchor | |
| 457 | # Click Ce rtificate at the top of the sc reen | |
| 458 | ## Click * Browse...* and brows e to the l ocation of you org c ertificate PKCS12 fi le, and se lect it | |
| 459 | ## Choose ENABLED as the statu s. | |
| 460 | ## Click A dd Crtific ate | |
| 461 | ### If you have mult iple certi ficate fil es for sce narios suc h as singl e use cert ificates, repeat the previous 3 steps fo r each cer tificate f ile. | |
| 462 | ||
| 463 | *Note:* Yo u do not h ave to ent er any add itional ag ent settin g in versi on 1.2 and higher of the Bare Metal asse mbly. The agent aut omatically defaults to suffici ent settin g for gene ral intero perability . | |
| 464 | ||
| 465 | Before you r HISP can communica te with ot her HISP, you must i mport anch ors from o ther HISPs to estabi lish trust ed communi cation. Y ou must al so provide your trus t anchor t o the HISP (s) you ar e communic ating with . There a re a few o ptions of HISPs that exist for interop t esting tha t can be e asily acce ssed. Anc hors of th ese HISP c an be foun d and down loaded fro m the Dire ct Project google co de source [page|http ://code.go ogle.com/p /nhin-d/so urce/brows e/certs/an chors/]. | |
| 466 | ||
| 467 | * direct.s ecurehealt hemail.com | |
| 468 | ** Testing HISP runn ing the la test versi on of the Java Bare Metal asse mbly. Con tact gm255 2@cerner.c om to esta blish a tr ust relati onship. | |
| 469 | ** Anchor File Name: Direct Se curehealth email CA.d er | |
| 470 | ||
| 471 | ||
| 472 | h2. Config ure and Ru n James Ma il Server | |
| 473 | ||
| 474 | First, con figure jam es with yo ur domain name. Dep ending on the versio n of James you choos e to use, the config uration wi ll differ slightly. | |
| 475 | ||
| 476 | _Windows_ | |
| 477 | ||
| 478 | *NOTE* You will need ant insta lled to us e the batc h file met hod. | |
| 479 | ||
| 480 | *James 2.3 .2* | |
| 481 | ||
| 482 | To set the domain vi a the batc h file, op en a comma nd prompt, CD to the %DIRECT_H OME%/james -2.3.2 dir ectory and run the f ollowing c ommand: | |
| 483 | ||
| 484 | {code} | |
| 485 | bin/setdo main <your domain na me> | |
| 486 | {code} | |
| 487 | ||
| 488 | If you don 't have An t installe d, manuall y edit the file conf ig.xml und er %DIRECT _HOME%/jam es-2.3.2/a pps/james/ SAR-INF an d change t he followi ng setting s: | |
| 489 | * <postmas ter>postma ster@local host</post master> to <postmast er>postmas ter@<your domain nam e></postma ster> | |
| 490 | * <servern ame>localh ost</serve rname> to <servernam e>your dom ain name</ servername > | |
| 491 | * match="R ecipAndSen derIsNotLo cal=mydoma in.com" to match="Re cipAndSend erIsNotLoc al=your do main name" | |
| 492 | ||
| 493 | *James 3* | |
| 494 | ||
| 495 | To set the domain vi a the batc h file, op en a comma nd prompt, CD to the %DIRECT_H OME%/apach e-james-3. 0-beta4 di rectory an d run the following command: | |
| 496 | ||
| 497 | {code} | |
| 498 | bin/setdo main <your domain na me> | |
| 499 | {code} | |
| 500 | ||
| 501 | Manually e dit the fi le domainl ist.conf u nder %DIRE CT_HOM%E/a pache-jame s-3.0-beta 4/conf and change th e followin g settings under the XML based configura tion (not the JPA co nfiguratio n settings ): | |
| 502 | ||
| 503 | *NOTE:* Ja mes3 has b etter supp ort of mul tiple doma ins hosted in a sing le mail se rver. You may add m ultiple do mains to t his list, but you mu st list on ly one def ault domai n. | |
| 504 | * <domainn ame>localh ost</domai nname> to <domainnam e>your dom ain name</ domainname > | |
| 505 | * <default Domain>loc alhost</de faultDomai n> to <def aultDomain >your doma in name</d efaultDoma in> | |
| 506 | ||
| 507 | Manually e dit the fi le mailetc ontainer.c onf under DIRECT HOM E/apache-j ames-3.0-b eta4/conf and change the follo wing setti ngs: | |
| 508 | * <postmas ter>postma ster@local host</post master> to <postmast er>postmas ter@<your domain nam e></postma ster> | |
| 509 | * match="o rg.nhindir ect.gatewa y.smtp.jam es.matcher .RecipAndS enderIsNot Local=mydo main.com" to match=" org.nhindi rect.gatew ay.smtp.ja mes.matche r.RecipAnd SenderIsNo tLocal=you r domain n ame" | |
| 510 | ||
| 511 | _All Unix/ Linux/Free BSD_ | |
| 512 | ||
| 513 | Run the fo llowing co mmands: | |
| 514 | ||
| 515 | *James 2.3 .2* | |
| 516 | ||
| 517 | {code} | |
| 518 | cd $DIREC T_HOME/jam es-2.3.2 | |
| 519 | sh bin/se tdomain.sh <your dom ain name> | |
| 520 | {code} | |
| 521 | ||
| 522 | *James 3* | |
| 523 | ||
| 524 | {code} | |
| 525 | cd $DIREC T_HOME/apa che-james- 3.0-beta4 | |
| 526 | sh bin/se tdomain.sh <your dom ain name> | |
| 527 | {code} | |
| 528 | ||
| 529 | Now start the Apache James mai l server w ith securi ty and tru st agent w ith the fo llowing co mmands: | |
| 530 | ||
| 531 | _Windows_ | |
| 532 | ||
| 533 | From the D IRECT HOME /james-2.3 .2/bin or DIRECT HOM E/apache-j ames-3.0-b eta4/bin d irectory ( depending on your Ja mes versio n) run: | |
| 534 | ||
| 535 | *James 2.3 .2* | |
| 536 | ||
| 537 | {code} | |
| 538 | run.bat | |
| 539 | {code} | |
| 540 | ||
| 541 | *James 3* | |
| 542 | ||
| 543 | {code} | |
| 544 | james ins tall | |
| 545 | james sta rt | |
| 546 | {code} | |
| 547 | ||
| 548 | _All Unix/ Linux/Free BSD_ | |
| 549 | ||
| 550 | *James 2.3 .2* | |
| 551 | ||
| 552 | {code} | |
| 553 | cd $DIREC T_HOME/jam es-2.3.2 | |
| 554 | sudo -E s h bin/run. sh > james .log 2>&1 & | |
| 555 | {code} | |
| 556 | ||
| 557 | *James 3* | |
| 558 | ||
| 559 | {code} | |
| 560 | cd $DIREC T_HOME/apa che-james- 3.0-beta4/ bin | |
| 561 | sudo jame s startup | |
| 562 | {code} | |
| 563 | ||
| 564 | Now add yo ur first u ser. The differs be tweeen Jam es version s as James 2.3.2 use s a telnet client an d James 3 uses a JMX based com mand line interface. | |
| 565 | ||
| 566 | ||
| 567 | *James 2.3 .2* | |
| 568 | ||
| 569 | *Note For Windows Us ers:* You will need to open a separate command wi ndow from the previo us step. Later vers ions of Wi ndows do n ot come wi th the Tel net client installed . You hav e to manua lly instal l this usi ng the ser ver manage r console. | |
| 570 | ||
| 571 | {code} | |
| 572 | telnet lo calhost 45 55 | |
| 573 | > root | |
| 574 | > root | |
| 575 | > adduser username password | |
| 576 | > quit | |
| 577 | {code} | |
| 578 | ||
| 579 | *Note:* Th e username should no t contain _@domainna me_. This is requir ed for Jam es 3+, but should no t be used for James 2.3.2. | |
| 580 | ||
| 581 | *James 3* | |
| 582 | ||
| 583 | {code} | |
| 584 | cd $DIREC T_HOME/apa che-james- 3.0-beta4/ bin | |
| 585 | ./james-c li.sh -h l ocalhost a dduser use rname pass word | |
| 586 | {code} | |
| 587 | ||
| 588 | *Note:* Th e username *should* contain _@ domainname _. This i s required for James 3+. | |
| 589 | ||
| 590 | h2. DNS Re cords | |
| 591 | ||
| 592 | Now that y our HISP i s running, you need to make it available to the pu blic inter net. If y ou intend to make yo ur HISP's certificat e availabl e via DNS CERT recor ds, you wi ll need to install a nd configu re the Dir ect DNS Se rver. Ins tructions can be fou nd in the DNS Server s users/de ployment [ guide|../. ./../../dn s/1.5/user s-guide/de ploy.html] . This gu ide includ es directi ons on int egrating w ith GoDadd y. | |
| 593 | ||
| 594 | If you are not using DNS to di stribute y our certif icates, yo u may use your regis trar's DNS configura tion tooli ng to setu p MX recor ds for you HISP. | |
| 595 | ||
| 596 | h2. Distri buting Cer tificates | |
| 597 | ||
| 598 | The prefer ed distrib ution mech anism for distributi ng your HI SP's org c ertificate is DNS CE RT records . Instruc tions for setting up the Direc t DNS serv er are fou nd in the DNS server deploymen et [guide| ../../../. ./dns/1.5/ users-guid e/deploy.h tml]. | |
| 599 | ||
| 600 | *NOTE* Som e OS distr ibutions s uch as Ubu ntu may al ready be r unning the ir own DNS server pr ocess. If the OS is already r unning a D NS server bound to t he DNS por ts (TCP an d UDP port s 53), the n you will need to s top these services b efore runn ing the Di rect DNS s erver. Fo r example, to determ ine if Ubu ntu alread y has a DN S running, run the f ollowing c ommand and check for a process listening on port. | |
| 601 | ||
| 602 | {code} | |
| 603 | netstat - anp | grep 53 | |
| 604 | {code} | |
| 605 | ||
| 606 | Another al ternative is LDAP. The defaul t settings in the se curity and trust age nt will at tempt to u se the Dir ect LDAP s pecication if SRV re cords can be found. The LDAP standards can be fou nd on the S&I framew ork's Cert ificate Di scovery fo r Direct P roject wor kgroup [pa ge|https:/ /docs.goog le.com/doc ument/d/1i gDpIizm7CT fV-fUw\_1E nrCUGIljFE gLPRHpgK5i aec/edit]. | |
| 607 | ||
| 608 | A fall bac k alternat ive is man ually dist ributing y our org ce rtificate to the HIS Ps that yo u will com municate. This is a n out of b and proces s that wil l require you to det ermine how to get yo ur certifi cate to th e HISP. L ikewise an other HISP may need to manuall y give you their cer tificate(s ) if they do not sup port DNS o r LDAP dis covery. T o add anot her HISPs certificat e (not anc hor) to yo u HISP, im port the c ertificate file into the Certi ficates se ction of t he configu ration ui tool. | |
| 609 | ||
| 610 | h2. Recomm ended Next Steps | |
| 611 | ||
| 612 | The follow ing are op tional, bu t recommen ded, next steps to s ecure your environme nt. These are only small conf iguration tweaks; ot her config uration op tions that cover spe cific area s are cove red in the deploymen t options [chapter|. /depl-opti ons.html] | |
| 613 | ||
| 614 | h3. Secure Configura tion Servi ce Port (8 081) | |
| 615 | ||
| 616 | To secure the config uration se rvice, it is recomme nded to li mit access to port 8 081 to loc alhost and /or a loca l subnet. | |
| 617 | ||
| 618 | h3. Secure Configura tion Servi ce Passwor d | |
| 619 | ||
| 620 | To further protect t he configu ration ser vice, or i f port 808 1 must rem ain public , it is re commended to change the defaul t password . | |
| 621 | ||
| 622 | _Windows_ | |
| 623 | ||
| 624 | Manuall ed it the con fig-servle t.xml file under DIR ECT HOME/a pache-tomc at-7.0.41/ webapps/co nfig-ui/WE B-INF and change the following setting t o your new password: | |
| 625 | ||
| 626 | {code} | |
| 627 | <security :user name ="admin" p assword="a dm1nD1r3ct " authorit ies="ROLE_ ADMIN"/> | |
| 628 | {code} | |
| 629 | ||
| 630 | Restart th e tomcat s erver by r unning the following commands from the D IRECT HOME /apache-to mcat-7.0.4 1/bin dire ctory. | |
| 631 | ||
| 632 | {code} | |
| 633 | shutdown | |
| 634 | startup | |
| 635 | {code} | |
| 636 | ||
| 637 | _All Unix/ Linux/Free BSD_ | |
| 638 | ||
| 639 | {code} | |
| 640 | cp $DIREC T_HOME/apa che-tomcat -7.07/weba pps/config -ui/WEB-IN F/config-s ervlet.xml $DIRECT_H OME/apache -tomcat-7. 0.41/webap ps/config- ui/WEB-INF /config-se rvlet.xml. orig | |
| 641 | sed -i "s /adm1nD1r3 ct/your_ne w_password /g" $DIREC T_HOME/apa che-tomcat -7.0.41/we bapps/conf ig-ui/WEB- INF/config -servlet.x ml | |
| 642 | sh bin/sh utdown.sh | |
| 643 | sh bin/st artup.sh | |
| 644 | {code} | |
| 645 | ||
| 646 | h3. Add Ow n Server C ertificate to James 3 | |
| 647 | ||
| 648 | If you are using Jam es 3, the default co nfiguratio n enables last mile encryption (SSL and TLS) on th e edge POP 3, SMTP, a nd IMAP pr otocols. This is en abled via configurat ion in the imapserve r.conf, po p3server.c onf, and s mtpserver. conf files . For POP 3 and IMAP 4, all con nections u se the STA RTTLS comm and. For the SMTP p rotocol, t he configu ration ena bles START TLS for lo cal outgoi ng connect ions that must be au thenticate d, but all incoming SMTP excha nges from external s ystems wil l continue to use no n SSL/TLS connection s. | |
| 649 | ||
| 650 | To enable encryption , a server certifica te must be installed along wit h its priv ate key. The James 3 configur ation come s pre-pack aged with a self sig ned certif icate. Mo st email a nd edge cl ients will display a warning t o the user noting th at the cer tificate s hould prob ably not b e trusted. At this point, it is recommn eded that you either install y our own ce rtificate or install a certifi cate from a PKI thir d party. In either case, you will need to create your own k eystore fi le with yo ur own cer tificate a nd deploy it in the James _con f_ directo ry. This should be the same p lace where the defau lt cakeyst ore.jks is located. After dep loying you r own keys tore, you will need to update the SSL co nnection s ection of the imapse rver.conf, pop3serve r.conf, an d smtpserv er.conf fi les with t he locatio n of your own keysto re file an d passphra se for the keystore file. | |
| 651 | ||
| 652 | h3. Tweak Message Mo nitoring S ervice Set tings | |
| 653 | ||
| 654 | The messag e monitori ng service is precon figured wi th common settings, but can be tweaked t o your spe cific requ irements. See the m onitoring deployment [guide|.. /../../../ direct-msg -monitor/1 .1.7/users -guide/dep loyment.ht ml] for mo re details . | |
| 655 | ||
| 656 | h3. Define Policy De finitions | |
| 657 | ||
| 658 | Starting w ith versio n 3.0, an optional m odule is a vailable f or definin g X509 cer tificate p olicies. See the po licy enabl ement modu le (direct -policy) u sers [guid e|../../.. /../direct -policy/1. 0/users-gu ide/index. html] for full detai ls. |
Araxis Merge (but not the data content of this report) is Copyright © 1993-2016 Araxis Ltd (www.araxis.com). All rights reserved.