Setting up BMD Web applications

1. Steps for setting up BMD Web applications

This guide is for skilled computer administrators with experience in working with the Internet Information Webserver. On request, our BMD Technik team can set up the web applications for you. To make an appointment please contact: termin@bmd.at

1.1. IIS must be installed on the web server with the following role services (in addition to the default installations)

1. Dynamic Content Compression
2. ISAPI Extensions
3. HTTP redirection
4. IIS 6 Management Compatibility
   • IIS 6 Metabase Compatibility
   • IIS 6 WMI Compatibility

A web application can process up to 30 concurrent users. For more than 30 concurrent users, you have to set up an appropriate load-balancing solution. To do so, please contact the BMD Technik team: technik@bmd.at

For BMD Mobile, no separate application pool is required. It is sufficient to set up the BMD Web application with an additional entry in BMD.INI.

BMD Online application is also part of BMD Web. It is opened via a special parameter: http://.... /bmdweb/bmdweb.dll/STARTFUNC/?func=MCS_FRMONLBEWWEB_CREATE

1.2. Create a separate Windows user

The application runs under this user. 

Web server = BMD server

Create user as local user (or as domain user)

Web server ≠ BMD server

Create user as local user (or as domain user) directly on the web server

1. User name: e.g. bmdcom-sa (It is recommended to create a separate user for each web application.)

   Web application	User name
   BMD Com	bmdcom-sa
   BMD Web	bmdweb-sa
   BMD Mobile	bmdweb-sa
   BMD Online application	bmdweb-sa
   BMD Web service	bmdntcsws-sa

2. Password: any complex password
3. The user cannot change the password and it never expires.
4. Group membership
   • User or domain user
   • IIS_IUSRS

The created user must be granted permission to "Debug programs". This either has to be configured in the local security policy or in the group policies.

1. 3. Create the folder structure on the web server according to the web application in use

1. C:\Inetpub\"web application"

   Web application	Folder structure
   BMD Com	C:\Inetpub\bmdcom
   BMD Web	C:\Inetpub\bmdweb
   BMD Mobile	C:\Inetpub\bmdweb
   BMD Online application	C:\Inetpub\bmdweb
   BMD Web service	C:\Inetpub\bmdntcsws

2. For this folder, grant the respective user (e.g. bmdcom-sa) permission to "Read, execute" and remove the group "user" (NTFS inheritance has to be disabled in the advanced security settings).
3. Set up the folder "LOG".
4. For this folder you have to grant the user (e.g. bmdcom-sa) permission to "Change" and "Write".

1.4. Copy the necessary directories and files to the web server

1. Copy \\“BMDSERVER“\BMDNTCS_PGM\BMDWEBCORE2_SubFolder.zip to the previously created folder and unpack it. In terms of the BMD web service, you need to copy and unpack BMDNTCSWS_SubFolder.zip.
2. Copy \BMDSERVER\BMDNTCS_PGM\bmdwebcore2.dll to the previously created folder and rename it according to the web application.
   (Exceptions BMD web service)

CAUTION! Danger of confusion! The files BMDWEBCORE_SubFolder.zip and bmdwebcore.dll are used for legacy BMD Web/Com applications.

Example (BMD Com):

1.5. Create BMD.INI on the web server

1. Create a file called "BMD.INI" in the directory of the web application. 
2. Depending on the constellation, there are different templates (please adjust the paths accordingly).
   PLEASE NOTE: If the paths contain spaces, enter them without ""!!
   The entries "ALIASCONFIG" and "ALIASNAMES" have to match the entries in the global BMD.INI which can be found in the general BMD NTCS program directory. Please also note that entry is case sensitive. Moreover, it must be possible for the web server to resolve the SQL server name (if DNS resolution is not possible, please specify it via the HOST file on the web server). This parameter defines the authentication type.

1.6. Depending on the web application, BMD.INI has to be extended.

1.7. Special constellations

1. In the case of BMD Mobile, the functionality of BMD Web should be deactivated completely.

   Web application	Extensions in BMD.INI
   BMD Mobile	[BMD\BMDWEB2] HANDLEDREQUESTS=MOBILE

2. In the case of BMD Online application, the functionality of BMD Web should be deactivated completely.

   Web application	Extensions in BMD.INI
   BMD Online application	[BMD\BMDWEB2] AUTOSTART_SUBTYPE_MCS=MCS_FRMONLBEWWEB_CREATE

3. The default timeout of 30 minutes should be adjusted.

   Web application	Extensions in BMD.INI
   BMD Com	[BMD\BMDCOM2] TIMEOUT=10
   BMD Web	[BMD\BMDWEB2] TIMEOUT=10

1.8. Setup in IIS

(only different when it comes to the names of individual web applications)

1. Set up an application pool according to the web application.

   Web application	Name of the application pool
   BMD Com	bmdcom
   BMD Web	bmdweb
   BMD Mobile	bmdweb
   BMD Online application	bmdweb
   BMD Web service	bmdntcsws

Example (BMD Com):

2. Edit the advanced settings of the application pool 

• Enable 32-bit applications => TRUE
• Identity => define the user, e.g. bmdcom-sa
• Idle timeout (minutes) => 0
• Ping enabled => TRUE
• Rapid-Fail Protection enabled => FALSE

3. Add a new application (according to the web application) using the context menu of the Default Web Site:

• Specify the application pool.
• "Connect as" => define the respective user, e.g. bmdcom-sa.

Example (BMD Com):

4. Adjust the following settings in the application that you have just created:
 Add default document => the respective .dll of the application

Example (BMD Com):

5. Enable the ISAPI-dll in the "Handler Mappings":

6. The .dll of the web application still needs to be added as an ISAPI in the ISAPI and CGI restrictions (at the level of the web server):

Example (BMD Com):

7. Increase the application’s upload limit to 100 MB (100000000 bytes) in request filtering.

Example for BMD Com:

1.9. Set up automatic update services

Setting up an automatic update service depends on the constellation (adjust paths accordingly). You have to set up and start the update service. Once it is completed (entry in the log: update complete), you can test calling the website.

2. Troubleshooting

• The website displays a "Service unavailable" notification and the application pool is being stopped automatically each time:
  • Check whether the user bmdcom-sa is specified with the correct password on the website as well as in the application pool.
  • Check whether the permissions for the required directories are correct.
  • Check whether the user bmdcom-sa has the permission "Log on as batch processing order" (should be the case by default due to the membership in the group IIS_IUSRS).

• The login mask appears, but without the background or text on the buttons:
  • Check the BIN, NLS and FILES directories in BMD.INI and their permissions for the bmdcom-sa user.
     
• A database connection error occurs when logging in:
  • Check the ALIAS entry in BMD.INI
  • Name resolution not possible (especially in the case of a web server in a DMZ)

• Uploading the Databox or sharing documents is not possible:
  • The service BMDNTCSSVC must be actively running and the document archive in BMD NTCS has to operate as "storage via service".
  • Name resolution not possible (especially in the case of a web server in a DMZ)

• You can test BMD Mobile in a browser:
  • http://localhost/bmdweb/bmdweb.dll/mobile/?info 

• The browser displays a message stating "Possible DoS Attack..."
  • The BMD web applications are equipped with protection against denial-of-service attacks. If more than 20 accesses occur within 5 minutes from one IP address, further accesses are blocked by the web application. This value can be changed via a parameter in BMD.INI on the web server. This might be necessary if you are using a load balancer and it is therefore always the same IP which accesses the webserver.
  • To do so, set the following entries in section [BMD\BMDWEB2]:
    • DOS_TIME_RANGE=5 (time in minutes)
    • DOS_ALLOWEDSESSIONS=100 (number of accesses by one IP address)

3. Security recommendations

• All servers should be running on the latest Windows updates and the patches provided by the manufacturers in order to eliminate various security gaps. 
• In general, it is advised to follow the corresponding instructions and recommendations by Microsoft in order to run the operating system and its components as securely as possible. For further information, please see: http://social.technet.microsoft.com/wiki/contents/articles/18931.security-hardening-tips-and-recommendations.aspx

Please also refer to our BMD NTCS hardening guide:  BMD NTCS Hardening Guide

Dátum:

09.12.2020

Kategória:

Einrichten BMD Webanwendungen