...

• An Agent makes use of two configuration files:
  • the general configuration file agent.conf is which is available from the following locations:
    • Windows: C:\ProgramData\sos-berlin.com\js7\agent\var\config\agent.conf
    • Unix /var/sos-berlin.com/js7/agent/var/config/agent.conf
  • the security configuration file private.conf which is available from the following locations:
    
    • Windows: C:\ProgramData\sos-berlin.com\js7\agent\var\config\private.conf
    • Unix: /var/sos-berlin.com/js7/agent/var/config/private/private.conf
• The configuration format makes use of Typesafe Config, see JS7 - Configuration Format
• Restart the Agent instance to apply changes to any configuration file.

...

By default the Agent configuration ships with HTTP communication enabled. It is recommended to create that public/private keys and certificates for secure HTTPS communication are created and to disable HTTP Communicationthat HTTP communication is disabled.

# Allow http connections without authentication
js7.web.server.auth.public = true

...

The Agent requires X.509 certificates and/or PGP public keys to be in place that . These are used to verify the signatures of signed workflows. Unsigned workflows are not accepted by an Agent, therefore a minimum of one X.509 certificate file or PGP public key file has to be present with in the directories that are specified with the following configuration item:

...

The default Agent configuration includes to allow allows job scripts to be executed from any location. Without this setting scripts are restricted to be being executed from the config/executables directory only.

...

Secure Configuration

It is essential to secure that the connections between Controller and Agents are secured. This includes:

• to use using HTTPS connections that are secured by private/public key and certificates,
• to apply applying mutual authentication between Controller and Agent.

...

• This setting specifies public access to an Agent should if insecure incoming HTTP connections are to be used. If used with a value true then no authentication appliesis applied.
• Default: false

Security Configuration File: private.conf

...

• By default the Agent prevents any commands and scripts to be from being executed except for scripts located in specific directories. This setting allows to execute any commands and scripts provided to be executed that the workflow is has signed and the signature is has been verified for.

js7.configuration: Trusted Signature Keys

• For The Agent expects a signature for any deployed objects such as workflows the Agent expects a signature. Such signatures are created with a private key and are verified by the Agent based on according to the available certificates. 
• When deploying objects with JOC Cockpit:
  • for a Low Security Level JOC Cockpit creates the signature from a single private key that is used for any JOC Cockpit user accounts allowed to deploy objects.
  • for a Medium Security Level JOC Cockpit creates the signature from the private key of the JOC Cockpit user account that deploy deploys objects.
  • for a High Security Level the user creates the signature outside of JOC Cockpit and uploads the signed objects.
• The Agent supports PGP public keys and X.509 certificates. This setting expects a directory respectively that holds a number of public key files or certificate files.
• trusted-signature-keys
  • PGP: specifies the directory from which PGP public keys are used to verify the signature of deployed objects.
  • X509: specifies the directory from which X.509 certificates are used to verify the signature of deployed objects.

...

• When An additional authentication mechanism is applied when using HTTPS certificates or public keys for incoming connections, see below, then an additional authentication mechanism applies: the client of the incoming connection, i.e. a Controller, is required to provide a Client Authentication Certificate. This includes that two certificates that are in place for a secure HTTPS connection: the Agent's Server Authentication Certificate and the Controller's Client Authentication Certificate. 
  • The fact that a given certificate is to be used for Server Authentication and/or Client Authentication is specified with the key usage when creating and signing the certificate is being created and signed.
  • The distinguished name that is specified with the Agent's configuration has to match the Client Authentication Certificate's subject attribute of a Controller. This attribute specifies the hostname and additional information that is created when the certificate or public key is generated.
• Controller
  • Settings in this section are used for incoming HTTPS connections from Controller instances.
  • distinguished-names: 
    • Specifies the distinguished name as given with the subject of the Client Authentication Certificate for incoming HTTPS connections from a Controller.
    • Any number of distinguished names can be specified allowing a number of incoming HTTPS connections from different Controllers.

...

• This setting is used to specify the location of a keystore and any truststores used for HTTPS connections.
• Keystore and truststore files are expected in PKCS#12 format.
• keystore
  • The keystore includes the private key for the Agent's incoming HTTPS connections.
  • Private key types RSA and ECDSA are supported. 
  • file:  the full path to the location of the keystore file is expected.
    • Default: ${js7.config-directory}"/private/https-keystore.p12"
  • key-password: Any keys included with the keystore are protected with a password. The same password has to be used for all private keys in the given keystore.
  • store-password: The keystore file is protected by a password.
• truststores
  
  • A truststore contains the certificates or public keys for the Agent's incoming HTTPS connections.
    • Certificates are signed by a Certificate Authority (CA) , - alternatively a self-signed certificate can be used.
    • It is recommended to use that certificates are used instead of public keys.
    • Certificates of type X.509 are supported.
  • file:  the full path to the location of the truststore file is expected.
    • Default: ${js7.config-directory}"/private/https-truststore.p12"
  • store-password: A truststore file is protected by a password.
  • A number of truststores can be specified by repeating the file and store-password settings.

...