JS7 JobScheduler

Space shortcuts

Page tree

Versions Compared

Old Version 35

changes.mady.by.user Andreas Püschel

Saved on

compared with

New Version 36

changes.mady.by.user Alan Amos

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

  • An Agent makes use of two configuration files:
    • the general configuration file agent.conf that is available from general configuration file which is found in the following locations:
      • Windows: C:\ProgramData\sos-berlin.com\js7\agent\var\config\agent.conf
      • Unix /var/sos-berlin.com/js7/agent/var/config/agent.conf
    • the security configuration file private.conf that is available from  security configuration file which is found in the following locations:
      • Windows: C:\ProgramData\sos-berlin.com\js7\agent\var\config\private.conf
      • Unix: /var/sos-berlin.com/js7/agent/var/config/private/private.conf
    • The configuration format makes use of Typesafe Config, see see the JS7 - Configuration Format article.
    • Restart the Agent instance to apply changes to any configuration filefiles.
  • For HTTPS configuration consider refer to the JS7 - Configuration Templates article.

Default Configuration

General Configuration File: agent.conf

...

The Agent requires X.509 certificates and/or PGP public keys to be in place. These are used to verify the signatures of signed workflows. Unsigned workflows are not accepted by an Agent , and therefore a minimum of one X.509 certificate file or PGP public key file has to be present in the directories that which are specified with in the following configuration item:

...

  • The Agent verifies the signature of deployable objects such as workflows. This can be performed for PGP signatures and for X.509 signatures. 
  • The trusted-signature-keys setting specifies the location of PGP public keys and X.509 certificates.
  • If no PGP public keys are used or if no X.509 certificates are used then the respective this setting should not be used as it expects the indicated directory to be populated with public keys or certificates respectively.

...

The default Agent configuration allows job scripts that which include shell commands to be executed from any location. Without this setting scripts are restricted to being executed from the Agent's config/executables directory only.

...

It is essential that the connections between Controller and Agents are secured. This includes:

  • to use using HTTPS connections that which are secured by private keys and certificates,
  • to apply applying mutual authentication between Controller and Agent.
  • Consider referring to the detailed explanations from in the subsequent chaptersfollowing sections.


Code Block
languagetext
titleSecure configuration example: private.conf
linenumberstrue
collapsetrue
# Security configuration
js7 {
    auth {
        # User accounts for https connections
        users {
            # Controller ID for connections by primary/secondary Controller instance
            Controller {
                distinguished-names=[
                    "DNQ=SOS CA, CN=controller-2-0-primary, OU=IT, O=SOS, L=Berlin, ST=Berlin, C=DE",
                    "DNQ=SOS CA, CN=controller-2-0-secondary, OU=IT, O=SOS, L=Berlin, ST=Berlin, C=DE"
                ]
            }
        }
    }
    configuration {
        # Locations of certificates and public keys used for signature verification
        trusted-signature-keys {
            PGP=${js7.config-directory}"/private/trusted-pgp-keys"
            X509=${js7.config-directory}"/private/trusted-x509-keys"
        }
    }
    job {
        # Enable script execution from signed workflows
        execution {
            signed-script-injection-allowed = yes
        }
    }
    web {
        # Locations of keystore and truststore files for HTTPS connections
        https {
            keystore {
                # Default: ${js7.config-directory}"/private/https-keystore.p12"
                file=${js7.config-directory}"/private/https-keystore.p12"
                key-password=jobscheduler
                store-password=jobscheduler
            }
            truststores=[
                {
                    # Default: ${js7.config-directory}"/private/https-truststore.p12"
                    file=${js7.config-directory}"/private/https-truststore.p12"
                    store-password=jobscheduler
                }
            ]
        }
    }
}

...

Explanation:

  • This setting applies to the use of an Agent with a solo Controller or with a Controller Cluster.
  • Consider Note that the element name  Controller element name is an example that has to be replaced by the Controller ID that which is specified with the same value during installation of both cluster Controller instances in a cluster.
  • This setting specifies the distinguished name indicated with the Controller's Client Authentication certificate. The certificate acts as a replacement for a password.
    • The Agent configuration specifies the distinguished names of any Controllers that access the Agent by use of a Client Authentication certificate.
    • Consider Note that the common name (CN) setting in the distinguished name has to match the fully qualified domain name (FQDN) of a Controller's host.

...

  • HTTPS keystore and truststore are used to hold private keys and certificates.
    • The keystore holds the Agent's private key and certificate. This information is used:
      • for Server Authentication with JOC Cockpit and
      • for Client Authentication with Agents.
    • The truststore holds the certificate(s) used to verify:
      • Client Authentication certificates presented by a Controller and
      • Server Authentication certificates challenged by pairing Controllers.
  • Keystore and Truststore locations are specified. In addition,:
    • for the keystore a password for the private keys included in the keystore and a password for access to the keystore can be specified,
    • for the truststore a password for access to the truststore can be specified.
  • Passwords for keystores and truststores have no tendency do not tend to improve security of the configuration: the passwords have to be specified as plain text and have to be in reach of the Agent. This mechanism is not too different from hiding the key under your doormat. In fact, limiting ownership and access permissions for keystore and truststore files to the JS7 Agent's run-time account are more important than using a password.
    • The key-password is used for access to a private key in keystore.
    • The store-password setting is used for access to a keystore or to a truststore.
    • For PKCS12 (*.p12) keystores both settings have to use the same value. The settings can be omitted if no passwords are used.

...

  • This setting specifies the code page to be used if Agents are operated for Windows. For details see JS7 - Unicode Support.

  • The following code pages are automatically detected and used, they do not need the above setting:

    Code Block
    titleList of supported codepages
    collapsetrue
    js7.windows.codepages {
   37 = "IBM037"          # IBM EBCDIC US-Canada
  437 = "IBM437"          # OEM United States
  737 = "x-IBM737"        # ibm737  OEM Greek (formerly 437G); Greek (DOS)
  775 = "IBM775"          # ibm775  OEM Baltic; Baltic (DOS)
  850 = "IBM850"          # ibm850  OEM Multilingual Latin 1; Western European (DOS)
  852 = "IBM852"          # ibm852  OEM Latin 2; Central European (DOS)
  855 = "IBM855"          # OEM Cyrillic (primarily Russian)
  857 = "IBM857"          # ibm857  OEM Turkish; Turkish (DOS)
  858 = "IBM00858"        # OEM Multilingual Latin 1 + Euro symbol
  860 = "IBM860"          # OEM Portuguese; Portuguese (DOS)
  861 = "IBM861"          # ibm861  OEM Icelandic; Icelandic (DOS)
  862 = "IBM862"          # DOS-862  OEM Hebrew; Hebrew (DOS)
  863 = "IBM863"          # OEM French Canadian; French Canadian (DOS)
  864 = "IBM864"          # OEM Arabic; Arabic (864)
  865 = "IBM865"          # OEM Nordic; Nordic (DOS)
  866 = "IBM866"          # cp866  OEM Russian; Cyrillic (DOS)
  869 = "IBM869"          # ibm869  OEM Modern Greek; Greek, Modern (DOS)
  870 = "IBM870"          # IBM EBCDIC Multilingual/ROECE (Latin 2); IBM EBCDIC Multilingual Latin 2
  874 = "x-IBM874"        # windows-874  Thai (Windows)
  875 = "x-IBM875"        # cp875  IBM EBCDIC Greek Modern
  932 = "shift_jis"       # shift_jis ANSI/OEM Japanese; Japanese (Shift-JIS)
  949 = "x-windows-949"   # ks_c_5601-1987  ANSI/OEM Korean (Unified Hangul Code)
  950 = "x-windows-950"   # big5  ANSI/OEM Traditional Chinese (Taiwan; Hong Kong SAR, PRC); Chinese Traditional (Big5)
  1026 = "IBM1026"        # IBM EBCDIC Turkish (Latin 5)
  1047 = "IBM1047"        # IBM EBCDIC Latin 1/Open System
  1140 = "IBM01140"       # IBM EBCDIC US-Canada (037 + Euro symbol); IBM EBCDIC (US-Canada-Euro)
  1141 = "IBM01141"       # IBM EBCDIC Germany (20273 + Euro symbol); IBM EBCDIC (Germany-Euro)
  1142 = "IBM01142"       # IBM EBCDIC Denmark-Norway (20277 + Euro symbol); IBM EBCDIC (Denmark-Norway-Euro)
  1143 = "IBM01143"       # IBM EBCDIC Finland-Sweden (20278 + Euro symbol); IBM EBCDIC (Finland-Sweden-Euro)
  1144 = "IBM01144"       # IBM EBCDIC Italy (20280 + Euro symbol); IBM EBCDIC (Italy-Euro)
  1145 = "IBM01145"       # IBM EBCDIC Latin America-Spain (20284 + Euro symbol); IBM EBCDIC (Spain-Euro)
  1146 = "IBM01146"       # IBM EBCDIC United Kingdom (20285 + Euro symbol); IBM EBCDIC (UK-Euro)
  1147 = "IBM01147"       # IBM EBCDIC France (20297 + Euro symbol); IBM EBCDIC (France-Euro)
  1148 = "IBM01148"       # IBM EBCDIC International (500 + Euro symbol); IBM EBCDIC (International-Euro)
  1149 = "IBM01149"       # IBM EBCDIC Icelandic (20871 + Euro symbol); IBM EBCDIC (Icelandic-Euro)
  1200 = "UTF-16LE"       # utf-16  Unicode UTF-16, little endian byte order (BMP of ISO 10646); available only to managed applications
  1201 = "UTF-16BE"       # unicodeFFFE  Unicode UTF-16, big endian byte order; available only to managed applications
  1250 = "windows-1250"   # windows-1250  ANSI Central European; Central European (Windows)
  1251 = "windows-1251"   # windows-1251  ANSI Cyrillic; Cyrillic (Windows)
  1252 = "windows-1252"   # windows-1252  ANSI Latin 1; Western European (Windows)
  1253 = "windows-1253"   # windows-1253  ANSI Greek; Greek (Windows)
  1254 = "windows-1254"   # windows-1254  ANSI Turkish; Turkish (Windows)
  1255 = "windows-1255"   # windows-1255  ANSI Hebrew; Hebrew (Windows)
  1256 = "windows-1256"   # windows-1256  ANSI Arabic; Arabic (Windows)
  1257 = "windows-1257"   # windows-1257  ANSI Baltic; Baltic (Windows)
  1258 = "windows-1258"   # windows-1258  ANSI/OEM Vietnamese; Vietnamese (Windows)
  12000 = "UTF-32LE"      # utf-32  Unicode UTF-32, little endian byte order; available only to managed applications
  12001 = "UTF-32BE"      # utf-32BE  Unicode UTF-32, big endian byte order; available only to managed applications
  20127 = "US-ASCII"      # us-ascii  US-ASCII (7-bit)
  20866 = "KOI8-R"        # koi8-r  Russian (KOI8-R); Cyrillic (KOI8-R)
  20905 = "KOI8-U"        # IBM EBCDIC Turkish
  20932 = "EUC-JP"        # EUC-JP  Japanese (JIS 0208-1990 and 0212-1990)
  21025 = "x-IBM1025"     # cp1025  IBM EBCDIC Cyrillic Serbian-Bulgarian
  28591 = "iso-8859-1"    # iso-8859-1  ISO 8859-1 Latin 1; Western European (ISO)
  28592 = "iso-8859-2"    # iso-8859-2  ISO 8859-2 Central European; Central European (ISO)
  28593 = "iso-8859-3"    # iso-8859-3  ISO 8859-3 Latin 3
  28594 = "iso-8859-4"    # iso-8859-4  ISO 8859-4 Baltic
  28595 = "iso-8859-5"    # iso-8859-5  ISO 8859-5 Cyrillic
  28596 = "iso-8859-6"    # iso-8859-6  ISO 8859-6 Arabic
  28597 = "iso-8859-7"    # iso-8859-7  ISO 8859-7 Greek
  28598 = "iso-8859-8"    # iso-8859-8  ISO 8859-8 Hebrew; Hebrew (ISO-Visual)
  28599 = "iso-8859-9"    # iso-8859-9  ISO 8859-9 Turkish
  28603 = "iso-8859-13"   # iso-8859-13  ISO 8859-13 Estonian
  28605 = "iso-8859-15"   # iso-8859-15  ISO 8859-15 Latin 9
  50220 = "iso-2022-jp"   # iso-2022-jp  ISO 2022 Japanese with no halfwidth Katakana; Japanese (JIS)
  50222 = "iso-2022-jp"   # iso-2022-jp  ISO 2022 Japanese JIS X 0201-1989; Japanese (JIS-Allow 1 byte Kana - SO/SI)
  50225 = "iso-2022-kr"   # iso-2022-kr  ISO 2022 Korean
  65001 = "UTF-8"         # utf-8  Unicode (UTF-8)
}

  • The Agent detects and makes use of the code page used by the Windows OS

    • for code pages from the above list,
    • for code pages that are prefixed with cp# or CP# with # being the number of the code page.


  • Users can enforce use of a supported code page by adding a setting to the Agent's JS7_AGENT_CONFIG_DIR/agent.conf configuration file such as:
    • js7.job.execution.encoding = "UTF-8"
  • This setting specifies the MIME type not the numeric code page identifier, for example UTF-8 instead of 65001.
  • Default: The the default code page of the Windows operating system is used, for example, 932 for Japan, 850 for Western Europe.

...

  • By default the Agent prevents any commands and scripts from being executed except for scripts located in specific directories. This setting allows any commands and scripts to be executed that the workflow has signed and where the signature has been verified.

...

  • The Agent can be instructed to terminate running jobs , see - see the JS7 - FAQ - Does JS7 reliably kill running jobs? article.
  • The following settings are in place to terminate running jobs by an Agent operated for a Unix OS:
    • The setting kill-with-sigterm-command specifies the OS command executed by the Agent to forward a SIGTERM signal to the running job.
    • The setting kill-with-sigkill-command specifies the OS command executed by the Agent to forward a SIGKILL signal to the running job.
  • Both settings are specified as an array of arguments, i.e. "/bin/kill", "-KILL", "$pid" translates to the command: /bin/kill -KILL 99, provided that 99 were is the Process ID of the running job.
  • This setting can be applied should if the Agent be is operated for on an OS that makes use of a different syntax for the kill command.

...

  • An additional authentication mechanism is applied when using HTTPS certificates or public keys for incoming connections, see below: the client of the incoming connection, i.e. a Controller, is required to provide a Client Authentication Certificate. This includes two certificates that are in place for a secure HTTPS connection: the Agent's Server Authentication Certificate and the Controller's Client Authentication Certificate. 
    • The fact that a given certificate is to be used for Server Authentication and/or Client Authentication is specified with the key usage when the certificate is being created and signed.
    • The distinguished name that is specified with the Agent's configuration has to match the Client Authentication Certificate's subject attribute of a the Controller. This attribute specifies the hostname and additional information that is created when the certificate or public key is generated.
  • Controller
    • Settings in this section are used for incoming HTTPS connections from Controller instances.
    • distinguished-names: 
      • Specifies the distinguished name as given with the subject of the Client Authentication Certificate for incoming HTTPS connections from a Controller.
      • Any number of distinguished names can be specified allowing a number of incoming HTTPS connections from different Controllers.

...

  • This setting is used to specify the authentication type for HTTPS connections to an Agent.
  • https-client-authentication
    • The value on (default) specifies that mutual authentication with certificates for Server Authentication and Client Authentication is used.
    • The value off specifies that only HTTP Basic Authentication only is used.
  • By default JS7 makes use of mutual authentication including both Server and Client Authentication Certificates. This setting can be switched off to use Server Authentication Certificates only.

...