Page History
...
It is essential that the connections between Controller and Agents and between Director Agents and Subagents are secured. This includes:
- using HTTPS connections which are secured by private keys and certificates,
- using authentication between JS7 products:
- Option 1 (recommended):
- applying TLS mutual authentication between Controller and Agent,
- applying TLS mutual authentication between Director Agent instances and Subagents in an Agent Cluster.
- Option 2:
- applying password authentication between JS7 products should mutual authentication not be in place.
- Option 1 (recommended):
Find examples of private.conf
files for Agent configuration for download:
- Standalone Agent
- Standalone Agents: private.conf-example-standalone-agent
- Agent Cluster
- Primary Director Agent instance: private.conf-example-primary-director-agent
- Secondary Director Agent instance: private.conf-example-secondary-director-agent
- Subagents: private.conf-example-subagent
...
- This setting applies to the use of an Agent with a Standalone Controller or with a Controller Cluster.
- Note that the
Controller
element name is an example that has to be replaced by the Controller ID which is specified with the same value during installation of Controller instances. - The
distinguished-names
element identifies the Controller instance's Client Authentication certificate. The certificate acts as a replacement for a password.- The Agent configuration specifies the distinguished names of the Controller instances that access the Agent by use of a Client Authentication certificate. For a Standalone Controller there is a single distinguished name, for a Controller Cluster each instance's distinguished name is specified.
- Note that the common name (CN) element in the distinguished name has to match the fully qualified domain name (FQDN) of a Controller instance's host.
The following command can be used to read the distinguished name from a certificate file:
Code Block title Example for OpenSSL command to read a certificate's distinguished name # read distinguished name from the pairinga Controller instance's certificate openssl x509 -in centostest-secondary.crt -noout -nameopt RFC2253 -subject # output is returned with a prefix "subject= " or similar that is not part of the distinguished name # subject= DNQ=SOS CA,CN=director-2-0-secondary,OU=IT,O=SOS,L=Berlin,ST=Berlin,C=DE
...
- HTTPS keystore and truststore are used to hold private keys and certificates.
- Keystore and truststore settings accept the path to a file in PKCS12 format or in PEM format.
- The keystore holds the Agent's private key and certificate. This information is used:
- for Server Authentication with JOC Cockpit and
- for Client Authentication with Agents.
- The truststore holds the certificate(s) used to verify:
- Client Authentication certificates presented by a Controller and
- Server Authentication certificates challenged by pairing Controllers.
- Optionally a separate HTTPS client keystore can be used:
- The client keystore is used for HTTPS TLS mutual authentication and holds a private key and certificate created for
Client Auth
extended key usage. - When using HTTPS TLS mutual authentication then:
- a single certificate can be used that is generated for both
Server Auth
andClient Auth
extended key use. In this case do not use the HTTPS client keystore but use the HTTPS keystore to hold the certificate. - separate certificates can be used with the certificate for
Server Auth
key usage being stored with the HTTPS keystore and the certificate forClient Auth
key use being stored with the HTTPS client keystore.
- a single certificate can be used that is generated for both
- For details see
Jira server SOS JIRA columns key,summary,type,created,updated,due,assignee,reporter,priority,status,resolution serverId 6dc67751-9d67-34cd-985b-194a8cdc9602 key JS-1959
- The client keystore is used for HTTPS TLS mutual authentication and holds a private key and certificate created for
- Keystore and Truststore locations are specified. In addition:
- a password for the private keys included in the keystore and a password for access to the keystore can be specified,
- for the truststore a password for access to the truststore can be specified.
- Passwords for keystore and truststore are not intended for security of the configuration, they are used to verify the integrity of certificate stores as the password used for creating and reading the certificate store must be the same.
- The
key-password
is used for access to a private key in a keystore. - The
store-password
setting is used for access to a keystore or to a truststore. - For PKCS12 keystores both settings have to use the same value. The settings can be omitted if no passwords are used.
- The
- The
alias
setting can be used for example with a keystore that holds a number of private keys from which the relevant private key is selected by its alias name.
...
js7.web.server: Authentication Settings
js7 | web | server | |||
---|---|---|---|---|---|
auth | public | <true>true |<false> false |
- This setting specifies public access to an Agent if incoming HTTP connections are to be used. If used with a value
true
then no authentication is applied. - Default:
false
true
js7.job.execution: Job Script Encoding
js7 | job | execution | |||
---|---|---|---|---|---|
encoding | <MIME<MIME-Type > |
- This setting specifies the code page to be used if Agents are operated for Windows. For details see JS7 - Unicode Support.
The following code pages are automatically detected and used, they do not need require the above setting:
Code Block title List of supported codepages collapse true js7.windows.codepages { 37 = "IBM037" # IBM EBCDIC US-Canada 437 = "IBM437" # OEM United States 737 = "x-IBM737" # ibm737 OEM Greek (formerly 437G); Greek (DOS) 775 = "IBM775" # ibm775 OEM Baltic; Baltic (DOS) 850 = "IBM850" # ibm850 OEM Multilingual Latin 1; Western European (DOS) 852 = "IBM852" # ibm852 OEM Latin 2; Central European (DOS) 855 = "IBM855" # OEM Cyrillic (primarily Russian) 857 = "IBM857" # ibm857 OEM Turkish; Turkish (DOS) 858 = "IBM00858" # OEM Multilingual Latin 1 + Euro symbol 860 = "IBM860" # OEM Portuguese; Portuguese (DOS) 861 = "IBM861" # ibm861 OEM Icelandic; Icelandic (DOS) 862 = "IBM862" # DOS-862 OEM Hebrew; Hebrew (DOS) 863 = "IBM863" # OEM French Canadian; French Canadian (DOS) 864 = "IBM864" # OEM Arabic; Arabic (864) 865 = "IBM865" # OEM Nordic; Nordic (DOS) 866 = "IBM866" # cp866 OEM Russian; Cyrillic (DOS) 869 = "IBM869" # ibm869 OEM Modern Greek; Greek, Modern (DOS) 870 = "IBM870" # IBM EBCDIC Multilingual/ROECE (Latin 2); IBM EBCDIC Multilingual Latin 2 874 = "x-IBM874" # windows-874 Thai (Windows) 875 = "x-IBM875" # cp875 IBM EBCDIC Greek Modern 932 = "shift_jis" # shift_jis ANSI/OEM Japanese; Japanese (Shift-JIS) 949 = "x-windows-949" # ks_c_5601-1987 ANSI/OEM Korean (Unified Hangul Code) 950 = "x-windows-950" # big5 ANSI/OEM Traditional Chinese (Taiwan; Hong Kong SAR, PRC); Chinese Traditional (Big5) 1026 = "IBM1026" # IBM EBCDIC Turkish (Latin 5) 1047 = "IBM1047" # IBM EBCDIC Latin 1/Open System 1140 = "IBM01140" # IBM EBCDIC US-Canada (037 + Euro symbol); IBM EBCDIC (US-Canada-Euro) 1141 = "IBM01141" # IBM EBCDIC Germany (20273 + Euro symbol); IBM EBCDIC (Germany-Euro) 1142 = "IBM01142" # IBM EBCDIC Denmark-Norway (20277 + Euro symbol); IBM EBCDIC (Denmark-Norway-Euro) 1143 = "IBM01143" # IBM EBCDIC Finland-Sweden (20278 + Euro symbol); IBM EBCDIC (Finland-Sweden-Euro) 1144 = "IBM01144" # IBM EBCDIC Italy (20280 + Euro symbol); IBM EBCDIC (Italy-Euro) 1145 = "IBM01145" # IBM EBCDIC Latin America-Spain (20284 + Euro symbol); IBM EBCDIC (Spain-Euro) 1146 = "IBM01146" # IBM EBCDIC United Kingdom (20285 + Euro symbol); IBM EBCDIC (UK-Euro) 1147 = "IBM01147" # IBM EBCDIC France (20297 + Euro symbol); IBM EBCDIC (France-Euro) 1148 = "IBM01148" # IBM EBCDIC International (500 + Euro symbol); IBM EBCDIC (International-Euro) 1149 = "IBM01149" # IBM EBCDIC Icelandic (20871 + Euro symbol); IBM EBCDIC (Icelandic-Euro) 1200 = "UTF-16LE" # utf-16 Unicode UTF-16, little endian byte order (BMP of ISO 10646); available only to managed applications 1201 = "UTF-16BE" # unicodeFFFE Unicode UTF-16, big endian byte order; available only to managed applications 1250 = "windows-1250" # windows-1250 ANSI Central European; Central European (Windows) 1251 = "windows-1251" # windows-1251 ANSI Cyrillic; Cyrillic (Windows) 1252 = "windows-1252" # windows-1252 ANSI Latin 1; Western European (Windows) 1253 = "windows-1253" # windows-1253 ANSI Greek; Greek (Windows) 1254 = "windows-1254" # windows-1254 ANSI Turkish; Turkish (Windows) 1255 = "windows-1255" # windows-1255 ANSI Hebrew; Hebrew (Windows) 1256 = "windows-1256" # windows-1256 ANSI Arabic; Arabic (Windows) 1257 = "windows-1257" # windows-1257 ANSI Baltic; Baltic (Windows) 1258 = "windows-1258" # windows-1258 ANSI/OEM Vietnamese; Vietnamese (Windows) 12000 = "UTF-32LE" # utf-32 Unicode UTF-32, little endian byte order; available only to managed applications 12001 = "UTF-32BE" # utf-32BE Unicode UTF-32, big endian byte order; available only to managed applications 20127 = "US-ASCII" # us-ascii US-ASCII (7-bit) 20866 = "KOI8-R" # koi8-r Russian (KOI8-R); Cyrillic (KOI8-R) 20905 = "KOI8-U" # IBM EBCDIC Turkish 20932 = "EUC-JP" # EUC-JP Japanese (JIS 0208-1990 and 0212-1990) 21025 = "x-IBM1025" # cp1025 IBM EBCDIC Cyrillic Serbian-Bulgarian 28591 = "iso-8859-1" # iso-8859-1 ISO 8859-1 Latin 1; Western European (ISO) 28592 = "iso-8859-2" # iso-8859-2 ISO 8859-2 Central European; Central European (ISO) 28593 = "iso-8859-3" # iso-8859-3 ISO 8859-3 Latin 3 28594 = "iso-8859-4" # iso-8859-4 ISO 8859-4 Baltic 28595 = "iso-8859-5" # iso-8859-5 ISO 8859-5 Cyrillic 28596 = "iso-8859-6" # iso-8859-6 ISO 8859-6 Arabic 28597 = "iso-8859-7" # iso-8859-7 ISO 8859-7 Greek 28598 = "iso-8859-8" # iso-8859-8 ISO 8859-8 Hebrew; Hebrew (ISO-Visual) 28599 = "iso-8859-9" # iso-8859-9 ISO 8859-9 Turkish 28603 = "iso-8859-13" # iso-8859-13 ISO 8859-13 Estonian 28605 = "iso-8859-15" # iso-8859-15 ISO 8859-15 Latin 9 50220 = "iso-2022-jp" # iso-2022-jp ISO 2022 Japanese with no halfwidth Katakana; Japanese (JIS) 50222 = "iso-2022-jp" # iso-2022-jp ISO 2022 Japanese JIS X 0201-1989; Japanese (JIS-Allow 1 byte Kana - SO/SI) 50225 = "iso-2022-kr" # iso-2022-kr ISO 2022 Korean 65001 = "UTF-8" # utf-8 Unicode (UTF-8) }
The Agent detects and makes use of the code page used by the Windows OS
- for code pages from the above list,
- for code pages that are prefixed with
cp#
orCP#
with # being the number of the code page.
- Users can enforce use of a supported code page by adding a setting to the Agent's
JS7_AGENT_CONFIG_DIR/agent.conf
configuration file such as:js7.job.execution.encoding = "UTF-8"
- This setting specifies the MIME type not the numeric code page identifier, for example
UTF-8
instead of65001
. - Default: the default code page of the Windows operating system is used, for example, 932 for Japan, 850 for Western Europe.
...
js7 | job | execution | ||
---|---|---|---|---|
signed-script-injection-allowed | <yes>yes|<no>no |
- By default the Agent prevents any commands and scripts from being executed except for scripts located in specific directories. This setting allows any commands and scripts to be executed that the workflow has signed and where the signature has been verified.
...
js7 | configuration | |||
---|---|---|---|---|
trusted-signature-keys | ||||
PGP | <directory> | |||
X509 | <directory> |
- The Agent expects a signature receives signatures for any deployed objects such as workflows. Such signatures are created with a private key and are verified by the Agent according to the available certificates.
- When deploying objects with JOC Cockpit:
- for a low Security Level JOC Cockpit creates the signature from a single private key that is used for any JOC Cockpit user accounts allowed to deploy objects.
- for a medium Security Level JOC Cockpit creates the signature from the private key of the JOC Cockpit user account that deploys objects.
- for a high Security Level the user creates the signature outside of JOC Cockpit and uploads the files holding scheduling objects and signatures.
- The Agent supports PGP public keys and X.509 certificates. This setting expects a directory that holds a number of public key files or certificate files.
trusted-signature-keys
PGP
: specifies the directory from which PGP public keys are used to verify the signature signatures of deployed objects.X509
: specifies specifies the directory from which X.509 certificates are used to verify the signature signatures of deployed objects.
js7.auth: HTTPS Authentication and Authorization
js7 | auth | ||||
---|---|---|---|---|---|
users | Controller | ||||
distinguished-names | <distinguished<distinguished-name>name>[,<distinguished<distinguished-namename>] | ||||
password |
| ||||
<subagent-id> | |||||
distinguished-names | <distinguished<distinguished-name>name>[,<distinguished<distinguished-namename>] | ||||
password |
| ||||
subagents | <subagent-id> | "plain:<password>" |
...
js7 | web | https | |||
---|---|---|---|---|---|
keystore | |||||
file | <path> | ||||
key-password | <text> <password> | ||||
store-password | <text> <password> | ||||
alias <text> | <identifier> | ||||
client-keystore | |||||
file | <path> | ||||
key-password | <text> <password> | ||||
store-password | <text> <password> | ||||
alias | <text> <identifier> | ||||
truststores | |||||
file | <path> | ||||
store-password | <text> <password> | ||||
alias <text> | <identifier> |
- This setting is used to specify the location of a keystore and any truststores used for HTTPS connections.
- Keystore and truststore files are expected in PKCS12 format or in PEM format.
keystore
- The keystore includes the private key for the Agent's incoming HTTPS connections.
- Private key types RSA and ECDSA are supported.
file
: the full path to the location of the keystore file is expected.- Default:
${js7.config-directory}"/private/https-keystore.p12"
- Default:
key-password
: Any keys included with the keystore are protected with a password. The same password has to be used for all private keys in the given keystore.store-password
: The keystore file is protected by a password.alias
: can be used for example with a keystore that holds a number of private keys from which the relevant private key is selected by its alias name.
client-keystore
- Use of this setting is optional. It can be used if separate certificates for Server Authentication and Client Authentication are used.
- The Client Authentication private key and certificate can be added to this keystore.
- Included configuration items correspond to the
keystore
setting.
truststores
- A truststore contains the certificates or public keys for the Agent's incoming HTTPS connections.
- Certificates are signed by a Certificate Authority (CA) - alternatively a self-signed certificate can be used.
- It is recommended that certificates are used instead of public keys.
- Certificates of type X.509 are supported.
file
: the path to the location of the truststore file is expected.- Default:
${js7.config-directory}"/private/https-truststore.p12"
- Default:
store-password
: A truststore file is protected by a password.alias
: can be used for example with a truststore that holds a number of certificates from which the relevant certificate is selected by its alias name.- A number of truststores can be specified by repeating the
file
andstore-password
settings.
- A truststore contains the certificates or public keys for the Agent's incoming HTTPS connections.
...
js7 | web | server | |||
---|---|---|---|---|---|
auth | |||||
https-client-authentication | <onon |off> off |
- This setting is used to specify the authentication type for HTTPS connections to an Agent.
https-client-authentication
- The value
on
(default) specifies that mutual authentication with certificates for Server Authentication and Client Authentication is used. - The value
off
specifies that only HTTP Basic Authentication is used.
- The value
- By default JS7 makes use of mutual authentication including both Server and Client Authentication Certificates. This setting can be switched off to use Server Authentication Certificates only.
...