BMD Web: Setting up web applications

1. Steps for setting up BMD Web applications

This guide is for skilled computer administrators with experience in working with the Internet Information Web Server. On request, our IT support team can set up the web applications for you. To make an appointment, please contact: termin@bmd.at

1.1. IIS must be installed on the web server with the following role services (in addition to the default installations)

1. Dynamic Content Compression

2. ISAPI Extensions

3. HTTP Redirection

4. IIS 6 Management Compatibility

• IIS 6 Metabase Compatibility
• IIS 6 WMI Compatibility

Note:

A web application can process up to 30 concurrent users. For more than 30 concurrent users, you have to set up an appropriate load-balancing solution. To do so, please contact the BMD IT support team: technik@bmd.at

BMD Go does not require a separate application pool. It is sufficient to set up the BMD Web application with an additional entry in BMD.ini.

BMD online application is also part of BMD Web. It is opened via a special parameter: http://.../bmdweb/bmdweb.dll/STARTFUNC/?func=MCS_FRMONLBEWWEB_CREATE

1.3. Create the folder structure on the web server according to the web application in use

1. C:\Inetpub\“web application“

2. Grant the respective user (e.g. bmdcom-sa) permission to “Read, execute” for the folder “bmdcom” and remove the group “User” (NTFS inheritance has to be disabled in the advanced security settings).

3. Create the folder “LOG”.

4. For the folder “LOG”, you have to grant the user (e.g. bmdcom-sa) permission to “Change” and “Write”.

1.5. Create BMD.ini on the web server

1. Create the file “BMD.ini” in the directory of the web application “bmdcom”.

2. Depending on the constellation, there are different templates (please adjust the paths accordingly).

PLEASE NOTE: if the paths contain spaces, enter them without “”!!

The entries “ALIASCONFIG” and “ALIASNAMES” have to match the entries in the global BMD.ini which can be found in the general BMD NTCS directory.

Please also note that entry is case sensitive. Moreover, it must be possible for the web server to resolve the SQL server name (if DNS resolution is not possible, please specify it via the HOST file on the web server). This parameter defines the authentication type.

1.6. Depending on the web application, BMD.ini has to be extended.

1.7. Special constellations

1. In the case of BMD Go, the functionality of BMD Web should be deactivated completely.

2. In the case of BMD online application, the functionality of BMD Web should be deactivated completely.

3. The default timeout of 30 minutes should be adjusted.

1.9. Set up automatic update service

Setting up an automatic update service depends on the constellation (adjust paths accordingly). You have to set up and start the update service. Once it has been completed (entry in the log: update complete), you can test accessing the website.

1.9.1. Special constellations for update service

The application pool running on IIS is automatically restarted at midnight. If you want to define a different time for this, you have to make the following entry:

2. Troubleshooting

• Check if all the required ports from the web server to the application server are reachable—see System requirements: BMD web applications.
• The website displays a “Service unavailable” notification and the application pool is stopped automatically each time:
  • Check whether the correct password has been entered for the user bmdcom-sa on the website as well as in the application pool.
  • Check whether the permissions for the required directories are correct.
  • Check whether the user bmdcom-sa has the permission “Log on as batch processing order” (should be the case by default due to the membership in the group IIS_IUSRS).
• The login window opens but without the background or without text on the buttons:
  • The user bmdcom-sa is required to have read and write permission for the BIN, NSL, and FILES directories defined in BMD.ini, in order to guarantee proper operation.
• A database connection error occurs when logging in:
  • Check the ALIAS entry in BMD.ini
  • Name resolution not possible (especially in the case of a web server in a DMZ)
• Uploading the Databox or sharing documents is not possible:
  • The service BMDNTCSSVC must be actively running and the document archive in BMD NTCS has to operate as “storage via service”.
  • Name resolution not possible (especially in the case of a web server in a DMZ)
• The browser displays a message stating “Possible DoS Attack...”
  • The BMD web applications are equipped with protection against denial-of-service attacks. If more than 20 accesses occur within 5 minutes from one IP address, further accesses are blocked by the web application. You can change this value via a parameter in BMD.ini on the web server. This might be necessary if you are using a load balancer and it is therefore always the same IP which accesses the webserver.
  • To do so, set the following entries in section [BMD\BMDWEB2]:
    • DOS_TIME_RANGE=5                           (time in minutes)
    • DOS_ALLOWEDSESSIONS=100           (number of accesses by one IP address)

3. Security recommendations

• All servers should be running on the latest Windows updates and the patches provided by the manufacturers in order to eliminate various security gaps.
• In general, it is advised to follow the corresponding instructions and recommendations by Microsoft in order to run the operating system and its components as securely as possible. For further information, please see: http://social.technet.microsoft.com/wiki/contents/articles/18931.security-hardening-tips-and-recommendations.aspx

Please also refer to our BMD NTCS hardening guide: BMD NTCS: Hardening guide