regify Provider Manual

A dedicated hardware machine or VMware virtual machine with the following attributes:

The ISO image can be burned onto CD or USB stick and then installed by booting off that. If the machine is a virtual machine then the virtual CD can be pointed at the ISO itself.

Before installing the system it is helpful to provide a few basic things:

Installation of driver software and programs in the context of virtualisation technologies

regify also provides support for customers who use the regify Provider software appliance or the regigate software appliance on virtual servers (e.g. on VMWare, KVM, VirtualBox or Microsoft Virtual PC) according to the maintenance agreement and in line with commercial practice. As virtualisation technologies emulate functions of physical computers, regify assumes that regify products work in virtual environments as they do in physical environments. Therefore, provisioning of the regify support is based on the assumption that apotential problem or error that is observed in a virtual environment can be replicated in a physical one.

A regify customer may install other software on a regify appliance if such software is critical for the operation of the virtual environment. The existing maintenance agreement between customer and regify also applies for such virtual setups. However, problems or errors that only occur on virtual systems or in combination with software that was installed by the customer are not covered by the maintenance agreement. In such cases, regify reserves the right to charge the customer for time and effort. Moreover, regify does not assume any liability for system failure or loss of data.

Insert the boot medium into the computer and boot off of it. For a legacy BIOS type systems the installation looks like this:

For UEFI installations the installation screen looks like this:

To install simply press enter. This will automatically install the entire system and reboot into the appliance wizard.

If you are installing using a serial connection choose regify Provider Serial Installation and press enter. To use the serial connection insure your client the system to use the following settings.

Login to the appliance as user regify password regify.

While PuTTY is free and generally works well, it can be a little quirky in the initial configuration. This is why it is covered in detail here. I will setup a configuration for the regify user. I will now go through and make the adjustments needed to connect to the appliance provider2.de.regify.com as the user regify. When initially opening PuTTY you get the following screen.

Adding regify as the Auto-login username under Connection  Data saves you from having to type it every time.

Setting the Remote characters set under Window  Translation to UTF-8 is important.

If it’s not set to UTF-8 you’ll get a screen that looks like this.

IMPORTANT:This step is very important and frequently forgotten.

After setting the Host Name, set Saved Sessions and press Save, not Open. This will save these settings for you to use next time.

After pressing Save simply double click the new provider2 entry to open the session.

The first time you connect, you will get a prompt that looks something like this. Simply click Yes (Ja).

Now you are prompted for the password for the regify user that you set earlier in the appliance wizard. Enter it here. It will not echo it back, not even as stars. Press Enter when done.

Now you are logged in as the regify user and can administer the appliance. Hitting Tab twice followed by Enter will exit the session again.

The Network…​  View Settings page gives you a general overview of the network settings. It lists the host name, all configured interfaces and DNS servers.

Since there are many things that can be done incorrectly between DNS entries and server configurations, a diagnostics tool is installed that aims to point out common mis configurations and their remedies. It can be found under Network…​  Run Diagnostics.

In this screenshot everything is correct, except for the fact that this internal machine used for making these screen shots is not accessible from the internet.

Network…​  Add IP allows you to do just that. Interface lists the available network adaptors when there is more than one to choose from. The (on) suffix means it’s plugged in, while (off) means it is not. Simply choose the Interface, specify the IP Number and Netmask and hit Ok. If you are running an 802.1Q VLAN, add the proper VLAN ID, otherwise just leave this field blank. The network will get restarted making the change immediate. This will take a second or 2 to complete.

Network…​  Set Gateway allows you to set the default gateway for the system. Simply type in the IP number of the gateway Tab to Ok and press Enter.

Network…​  Set Hostname & DNS allows you to specify the Hostname and up to 2 DNS servers. The DNS servers can be safely omitted to use the built-in internal DNS server. It is good practise but not mandatory for the given host name to be resolvable by the given DNS entry.

By default SSH root login is disabled and general access is only allowed from the local subnet. This is for security reasons. At Network…​  SSH Settings you may specify one or more space delimited IP numbers or subnets to access the appliance. The following entries are legal and equivalent:

Or:

You may check Allow root login if needed. This is only needed to setup database replication or High Availability.

Network…​  Proxy Settings allows you to specify a proxy server to use when making HTTP or HTTPS calls to for example the update repository or the clearing server. This can be in the format of PROTO://HOST:PORT or simply HOST:PORT.

Network…​  Remove IP allows you to remove an IP number. It is fine to do this over the network since it will not allow you to remove the IP number with which you are logged in as. Use the Arrow keys to select 62.26.97.35 and hit Tab twice to get to the Delete IP button and hit Enter.

Appliance…​  Run appliance wizard can be used to run through the appliance wizard again. There is no harm in running it more than once and it provides a coherent alternative to making changes in the appliance menu.

Use Appliance…​  Time & Locale to set Localisation Settings.

The Appliance…​  Time & Locale  View Settings dialogue shows the state of the Timesync daemon as well as the current time and time zone. Most of these settings are fairly self explanatory.

You can find Stratum documented here http://en.wikipedia.org/wiki/Network_Time_Protocol#Clock_strata

In Appliance…​  Time & Locale  Keyboard Layout you can change the keyboard layout for the console. Use the Arrow keys to choose the layout and press Tab to switch to the Ok button and hit Enter.

The Appliance…​  Time & Locale  Set NTP Servers setting show up when NTP is enabled only. It allows you to specify one or more NTP server host names or IP addresses. Servers may be specified one or more per line. When specifying more than one per line separate them with spaces.

Use Appliance…​  Time & Locale  Select Timezone to select the time zone the system is in. Use the Arrow keys to choose the time zone and press Tab to switch to the Ok button and hit Enter.

Visit Appliance…​  E-mail Settings to set anything relating to sending e-mails.

The Appliance…​  E-mail Settings  Set Administrative E-mail allows you to set the administrative e-mail address. This address may receive occasional e-mail from the system.

In some configurations it is not possible for a given server to send e-mail by itself. To accommodate this situation, you may use Appliance…​  E-mail Settings  Set E-mail Smarthost to tell the server to route all SMTP (e-mail) traffic through the given host.

Appliance…​  E-mail Settings  Set E-mail Hostname dialogue can be used to override the default host name, the appliance MTA (Mail Transfer Agent, aka E-mail Server) claims to be. This is necessary when an appliance is located off limits to the internet.
It is important to insure that this name has the following properties:

When one or more of these requirements are not met, it is likely that e-mail from this machine will be marked as spam or not be delivered at all.

Visit Appliance…​  Other Settings for support diagnostics and other system maintenance work.

This menu allows you to send comprehensive but not sensitive system information to regify support. Should you feel that your system setting are sensitive, you may send this information to yourself and then forward it via regimail to regify support. If even that is insecure, then log onto the console as root and run regifyInfo. Then copy the output and send it via regimail to regify support.

Appliance…​  Drop into shell provides the regify user with a command line shell to perform advanced operations. Unlike normal administrative appliance tasks, these operations do require Linux knowledge and are not recommended, unless you know what you are doing or are directed by regify technical staff to do so. As it already says, you can type exit to return to the appliance menu. Usually pressing Ctrl+d by itself will also return you to the appliance menu.

As you might have guessed, Appliance…​  Reboot the appliance does just that.

Appliance…​  Set root password to change the password for the root account. For security reasons, the old password must be supplied to create the new one. The password must be at least 8 characters long and contain letters and numbers, but no special characters.

Use Appliance…​  Set regify password to change the password for the regify account. For security reasons, the old password must be supplied to create the new one. The password must be at least 8 characters long and contain letters and numbers, but no special characters.

The Database…​  View Database Status dialogue gives you a general idea about the current database status.

The Database…​  Configure Replication page allows you to setup and change replication settings. After making achoice, a mini wizard is started to present you with the relevant dialogues. These are described in detail below.

The Database…​  Database Replication  Master Replication dialogue is used to setup the master of a replication scheme. Every server in a replication scheme needs to have a unique server id. This number should usually be 1 or 2 since there are 2 servers involved in the replication scheme. Both Slave Settings and Master Settings dialogues contain the Unique Server ID to supply this number. The Slave Host IP field is used to set the IP number or subnet of the slave host(s) that will be connecting to this master for replication updates.

The field accepts IP numbers or networks in the form of:

It does not accept:

The Database…​  Database Replication  Slave Replication dialogue is shown when the database acts as a slave. This is the case the when Slave or Cross Master is selected in the Database…​  Configure Replication dialogue.

Every server in a replication scheme needs to have a unique server id. This number should usually be 1 or 2 since that is the number of servers involved in the replication scheme. Both individual Slave Replication and Master Replication dialogues contain the Unique Server ID to supply this number. If you chose Database…​  Database Replication  Cross Master, the slave dialogue will not display the field, because the information was already collected in the Database…​  Database Replication  Master Replication dialogue. The Master Host IP field contains the IP number of the server to pull the replication data from. This may not be a subnet.

Replication Synchronisation is a helpful feature to initially setup, or at a later time restore, broken replication configurations. This option is only available when the system acts as a replication master. This is the case when Configure Replication is set to Master or Cross Master replication. Replication Synchronisation uses SSH to synchronise the two systems. It is necessary to use the root account and password of the other system to accomplish this. This is one scenario where the system root account is actually used. It is necessary for root SSH login to be enabled on the slave system. To enable it, log into the other system as the user regify and go to Network…​  SSH Settings and check the Allow root login option.

The Slave Host IP field takes the IP number of the slave host. Note that this field defaults to the setting specified in Database  Master Settings  Slave Host IP and may be a subnet in the form of 192.168.11.0/24 in which case it needs to be adjusted to point to the actual host. The Root Password field expects the root password of the slave host.

Because this process can take a considerable amount of time, a progress bar is displayed.

The following table describes the settings chosen on two example systems running in a cross master replication scheme. The first system has the IP number 192.168.1.1 and the second is 192.168.1.2.

Deploying this replication scheme is best done using the following steps:

When replication has been set up the Database…​  View Database Status dialogue may look something like this.

To make changes to a given provider or subprovider, you first choose which provider to operate on. The * indicates the main provider.

After choosing you will get one of the following menus.

Let’s encrypt based providers are relieved of their TLS functionality.

The suffix (Needed) only appears if the certificate is self signed, not when it’s expired.

The first step is to choose the provider domain name.

This is followed by the notice about the self signed certificate. Even i n the case of Use automated TLS being checked, the self signed cert is created as a fallback. This screen does not appear when there already is an exisiting certificate.

Provider…​  Backup Options allows you to automatically backup the provider database and configuration file. These backups are important in case data loss has occurred. The Backup Options are organised in a 2 step mini wizard. The first screen obtains and tests the settings for the share where the backups are to be copied to . These settings are validated to insure that writing to the specified share is indeed possible. If an error occurs an e-mail will be sent to the administrative e-mail specified in the appliance wizard or Appliance…​  E-mail Settings  Set Administrative E-mail screen. Tab to the Disable Backups button to turn automatic backups off again.

The second screen collects information regarding scheduling and backup retention. The Interval option sets whether to run backups every 1,6 or 24 hours. The Start Time setting specifies at which minute, and with the 6 and 24 hour intervals, which hour, the backup is to be run. When Interval is set to Every 6 Hours and the Start Time is set to 23:15, backups will be made at 5:15, 11:15, 17:15 and 23:15. The Backup Retention setting can be used to delete backups after a week or month. When it is set to Forever, no backups are ever deleted and the administrator must ensure that adequate disk space is provided.

regibox consists of meta data and file data. While the meta data resides in the database and is replicated over all provider systems behind a load balancer via MySQL replication, the file data must reside on a commonly accessed SMB network share. High availability and redundancy must be managed internally by the network share hoster. This dialogue needs to be completed on each provider node to enable it to offer regibox functionality. While the Windows Domain field is optional, all other fields are mandatory, meaning the share has to require user credentials. The share should exclusively host regibox functionality, to prevent file locks and other potential instabilities. All data on the share is encrypted.

This dialog configures an SMB share for storing RGF file uploads. Using this, recipients can open their regify files directly from the regify provider. Currently, this is only needed if you’re offering regipay plus. High availability and redundancy must be managed internally by the network share hoster. This dialogue needs to be completed on each provider node to enable it to offer uploads functionality. While the Windows Domain field is optional, all other fields are mandatory, meaning the share has to require user credentials. The share should exclusively host the uploads functionality, to prevent file locks and other potential instabilities.

This dialogue makes it possible to restrict access to https://regify.providername.com/admin/ to a limited set of IP numbers or subnets. It is optional, but highly recommended for locking down the administrative section, in order to protect it against potential password attacks. Leaving the field blank will allow access to any IP number. This dialog can also be used to reset the admin password. This is only necessary when the password has been lost somehow.

Provider…​  Stop/Start means if the service is running you get the Provider…​  Stop Web Server option, if it is not you get the Provider…​  Start Web Server option, meaning these options also serve as an indicator of whether something is running or not.

After an update you need to visit the administrative section of your Provider installation, to apply any missing or changed configurations.

The regify Provider Appliance runs a PostFix server as MTA. You can use the following tricks to get a closer look:

To upgrade/renew an existing SSL certificate, follow this guide:

The following steps describe how to add a subprovider. We will assume that the machine is called host1 that the new provider is called provider2.

To activate regibox on your regify Provider, please follow those steps:

If you do not set this flag, new regify users will not have regibox activated by default.

This will set the default size to 5GB. If needed, you can overwrite the default value in the individual users' product settings.