User manual MACROMEDIA BREEZE 5 - INSTALLATION AND CONFIGURATION GUIDE

Installation and Configuration Guide Trademarks 1 Step RoboPDF, ActiveEdit, ActiveTest, Authorware, Blue Sky Software, Blue Sky, Breeze, Breezo, Captivate, Central, ColdFusion, Contribute, Database Explorer, Director, Dreamweaver, Fireworks, Flash, FlashCast, FlashHelp, Flash Lite, FlashPaper, Flex, Flex Builder, Fontographer, FreeHand, Generator, HomeSite, JRun, MacRecorder, Macromedia, MXML, RoboEngine, RoboHelp, RoboInfo, RoboPDF, Roundtrip, Roundtrip HTML, Shockwave, SoundEdit, Studio MX, UltraDev, and WebHelp are either registered trademarks or trademarks of Macromedia, Inc. and may be registered in the United States or in other jurisdictions including internationally. Other product names, logos, designs, titles, words, or phrases mentioned within this publication may be trademarks, service marks, or trade names of Macromedia, Inc. or other entities and may be registered in certain jurisdictions including internationally. Third-Party Information This guide contains links to third-party websites that are not under the control of Macromedia, and Macromedia is not responsible for the content on any linked site. If you access a third-party website mentioned in this guide, then you do so at your own risk. Macromedia provides these links only as a convenience, and the inclusion of the link does not imply that Macromedia endorses or accepts any responsibility for the content on those third-party sites. The following are trademarks of Microsoft®: Microsoft Windows®, Microsoft PowerPoint® XP, Windows 2000®, Windows Server 2003®, Microsoft SQL ServerTM 2000. Copyright © 2005 Macromedia, Inc. All rights reserved. This manual may not be copied, photocopied, reproduced, translated, or converted to any electronic or machine-readable form in whole or in part without written approval from Macromedia, Inc. Notwithstanding the foregoing, the owner or authorized user of a valid copy of the software with which this manual was provided may print out one copy of this manual from an electronic version of this manual for the sole purpose of such owner or authorized user learning to use such software, provided that no part of this manual may be printed out, reproduced, distributed, resold, or transmitted for any other purposes, including, without limitation, commercial purposes, such as selling copies of this documentation or providing paid-for support services. Part Number ZBP50M200A Acknowledgments Director: Erick Vera Project Management: Stephanie Gowin Writing: John Norton Editing: Evelyn Eldridge, Mary Ferguson, Mary Kraemer, Noreen Maher, Lisa Stanziano Production Management: Adam Barnett Managing Editor: Rosana Francescato Media Design and Production: Paul Benkman, John Francis, Mario Reynoso Third Edition: November 2005 Macromedia, Inc. 601 Townsend St. San Francisco, CA 94103 CONTENTS INTRODUCTION: Breeze Installation Overview . ..........................5 Guide to documentation and additional resources. . . . . . . . . . . . . . . . . . . . . . . . . . 6 Troubleshooting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 CHAPTER 1: Before You Begin . ....................................... 9 Basics of Breeze Server technology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Planning for bandwidth requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Planning for directory services integration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Planning for SSL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Planning for security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Ports used by Breeze . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Available Breeze configurations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Planning for a Breeze Server cluster . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Installation requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Breeze user requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 The Breeze database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 CHAPTER 2: Preparing to Upgrade . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Before you begin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Backing up your Breeze files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Backing up the Breeze database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Preparing for the upgrade . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 CHAPTER 3: Installing and Upgrading Breeze . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 35 36 37 43 53 54 54 55 55 Installation checklist . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Installation and configuration overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Using the Breeze installer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Application Management Console . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Starting and stopping Breeze components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Uninstalling Breeze . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Troubleshooting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Breeze technical support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Macromedia online forums . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 CHAPTER 4: Post-installation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 Deploying Breeze to your organization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 Implementing single sign-on . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 Configuring the Breeze Directory Service Integration . . . . . . . . . . . . . . . . . . . . . . 62 Configuring SSL support for Breeze . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 Configuring FCS for SSL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 Configuring a Breeze Server cluster . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 Maintaining Breeze reliability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 CHAPTER 5: Verifying Your Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 Verifying that the Breeze database and Breeze Server work together . . . . . . . . . . . . 92 Verifying that you can use Breeze Manager and send e-mail notifications . . . . . . . 92 Verifying that you can use Breeze Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94 Verifying that you can use Breeze Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95 Verifying that you can use Breeze Meeting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95 Verifying that you can use the Breeze seminar feature . . . . . . . . . . . . . . . . . . . . . . 96 Verifying that you can use Breeze Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96 INDEX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97 4 Contents INTRODUCTION Breeze Installation Overview Macromedia Breeze consists of Breeze Server and its applications: Macromedia Breeze Meeting, Macromedia Breeze Presenter, Macromedia Breeze Manager, Breeze Events, and Breeze Training. Depending on the configuration purchased and the terms of your license, you may be installing one, two, or all of these applications. Breeze Server Makes it possible to quickly create multimedia presentations that combine audio and video with slides and graphics. Breeze Events Lets users manage the full lifecycle of large- or small-scale events, from registrations, invitations, and reminders, to reporting. Lets you create courses, enroll students, and track and monitor students and Breeze Manager courses. Breeze Meeting Lets you conduct online real-time meetings in which you can show multimedia presentations and broadcast live audio and video to participants. 5 Breeze Presenter Lets you rapidly create e-learning content and high-quality multimedia presentations. Breeze Presenter is a plug-in for Microsoft PowerPoint. Finished presentations are in Macromedia Flash (SWF file) format and are SCORM and AICC compliant. Lets you build e-learning systems, with surveys, tracking, analysis, and course Breeze Training management. Guide to documentation and additional resources Macromedia Breeze contains a variety of media to help you quickly learn how to use the Breeze applications. This section describes the variety of resources available to ensure the successful deployment of the Breeze applications within your organization. About the electronic manuals and online help In addition to this manual, the following electronic manuals and online help systems are available: · Breeze Manager User Guide describes how to use the administration, presentation, and meeting applications of Breeze. You can access Breeze Manager User Guide from the Breeze Manager Home page, and from the Help link in Breeze Manager. · Breeze Presenter User Guide describes how to create Breeze presentations from PowerPoint and publish them to Breeze. You can access this document from the Breeze Manager Home page, and from the Breeze menu in PowerPoint by selecting Breeze > Help. · Breeze Meeting User Guide for Hosts and Presenters includes information about using the Breeze web application to host online real-time meetings. The documentation includes procedures that demonstrate the simplicity of adding slides, Flash SWF files, images, and live audio and video to your presentation. You can access Breeze Meeting User Guide from the Breeze Manager Home page, and from the Help menu within a Breeze meeting room (when you enter as a Presenter) by selecting Meeting > Help. · Breeze Meeting User Guide for Participants includes information relevant to users participating in an online real-time meeting. Breeze Meeting offers meeting participants a variety of options to make their experience truly participatory, including the ability to send messages and questions to Presenters and to each other, and the ability to participate through live video and audio. You can access Breeze Meeting User Guide from the Breeze Manager Home page, and from the Help menu within a Breeze meeting room (when you enter as a Participant) by selecting Meeting > Help. · Breeze Integration Guide includes information necessary to make application programming interface (API) calls on the Breeze server from your external system, such as a web application. It also explains how to interpret the XML results that Breeze returns. In addition, the documentation contains reference material about each API and its parameters. Note: The relevance of these guides to users depends on the Breeze Server applications that you are authorized to use, the type of user (such as meeting content manager, information technology engineer, or course presenter), and the user's Breeze account permissions. 6 Introduction: Breeze Installation Overview To help you determine what documentation is relevant to your needs, see the following table: Breeze user type Information technology (IT) engineer Recommended reading · Breeze Installation and Configuration Guide · Review the system requirements in all other user guides · Breeze Manager User Guide · Breeze Meeting User Guide for Hosts and Presenters Content managers in charge of overall content within Breeze, and administrators who may add users and permissions Content authors and instructional designers who · Breeze Manager User Guide create presentations and training with Breeze · Breeze Presenter User Guide Meeting · Breeze Meeting User Guide for Hosts and Presenters Meeting administrators who create and manage Breeze meetings End users who attend Breeze meetings · Breeze Manager User Guide · Breeze Meeting User Guide for Hosts and Presenters · Breeze Meeting User Guide for Participants Information about specialized topics This manual primarily provides information for a basic installation of Breeze applications in which no more than one instance of each application is installed on a computer. It also covers the installation of Breeze applications on multiple networked computers, which is called a cluster. For information about specialized topics not discussed in this installation manual, visit the Macromedia Breeze Licensed Support website at www.macromedia.com/go/ breeze_licensed_support. To access the licensed support website, you will need to have available the Breeze License Certificate from Macromedia. The following are among the topics that the website covers: · · · · · · Installing and configuring Breeze Edge Servers Upgrading from an release earlier than Breeze 4.0 Port numbers used by Breeze Using and managing the embedded database engine Integrating Breeze with a learning management system (LMS) Troubleshooting Additional resources Additional documentation, white papers, and articles are available at the following websites: Breeze Resource Center This site, at www.macromedia.com/resources/breeze, is updated regularly with tutorials, simulations, best-practices information, and links to procedures. Guide to documentation and additional resources 7 Breeze Documentation Center This site, at www.macromedia.com/go/ breeze_documentation, contains documentation for all Breeze products, answers to frequently asked questions, articles about specialized topics, and Breeze presentations. Breeze Support Center This site, at www.macromedia.com/support/breeze, contains current support information, including technical notes, helpful Breeze presentations, and support program details. Troubleshooting If you encounter unexpected results after installing Breeze on a single server or on a cluster of servers, consult the following helpful resources: · TechNotes on the Breeze Support Center website at www.macromedia.com/support/breeze · Macromedia Support You will need to provide your Macromedia license number to the representative. · Macromedia Online Forums at www.macromedia.com/support/forums. 8 Introduction: Breeze Installation Overview CHAPTER 1 Before You Begin For a successful installation of Macromedia Breeze, read the information provided in this chapter. It contains the following sections: · · · · · · · · · · · · "Basics of Breeze Server technology" on page 9 "Planning for bandwidth requirements" on page 11 "Planning for directory services integration" on page 13 "Planning for SSL" on page 14 "Planning for security" on page 15 "Ports used by Breeze" on page 22 "Available Breeze configurations" on page 23 "Planning for a Breeze Server cluster" on page 24 "Installation requirements" on page 25 "Additional software requirements" on page 27 "Breeze user requirements" on page 27 "The Breeze database" on page 29 Before you start the installation, you should plan how Breeze is to be configured. When you run the Breeze installer, you will see only those Breeze applications and options purchased by your organization. Basics of Breeze Server technology Breeze Server includes a suite of applications that interact to form a total solution. End users log in, enroll in courses, view reports, and complete additional basic functions using a web-based application that runs in a browser. Breeze users can also participate in meetings using any supported browser. For a list of supported browsers, see "Breeze user requirements" on page 27. 9 The web browser interacts primarily with the Breeze Server applications. When a user starts a meeting, Flash Player interacts primarily with Breeze Meeting, although there is still some interaction with Breeze Presenter. The following figure illustrates how the server hosting Breeze interacts with the user's computer, sometimes called the client. Breeze Server Domain Name/IP Address Port:80 Domain Name/IP Address Port: 1935 (or 443) Web Browser Login Flash Player Live Meetings Breeze User's Computer For two computers to communicate over the Internet, the client computer must have the URL of the server (computer) where Breeze is installed. Typically, the client uses a domain name such as www.mycompany.com, and a name server translates the IP address of the server. To send information to a specific application running on a server, the client must also know the port number for that application. For example, most web servers listen on port 80. Servers typically run a few applications, such as a web server, a mail server, and an FTP server, and each application owns or listens on a specific port. 10 Chapter 1: Before You Begin Starting a meeting Tracing the sequence in which Breeze applications execute when users start a meeting can help you understand the primary system applications. The following list explains the typical order in which Breeze calls upon applications to place users successfully in a meeting: 1. The web browser collects the login credentials and communicates the credentials to Breeze Server. 2. Breeze Server accepts the login credentials and validates the user. 3. Breeze Server creates a session and sends the home page information to the browser. (Some users might not see the home page if they received a Breeze Meeting invitation directly.) 4. In the web browser, the user sees Breeze Meeting on the home page, clicks the link and presses the Meeting button to start the meeting. 5. Flash Player initiates communication with both Breeze Server and Breeze Meeting to participate in the meeting. 6. Breeze Meeting handles most of the requests from Flash Player to display media, such as video and audio, and to conduct screen sharing. 7. Breeze Server interacts with Flash Player to provide meeting services, such as content display and views into the Content library. Planning for bandwidth requirements There are many network factors that can affect the Breeze Meeting experience. This section contains information and suggestions that will help you understand bandwidth requirements so the system can provide sufficient resources for a successful Breeze Meeting experience. A Presenter can configure the room bandwidth setting in a Breeze Meeting by accessing the Meeting menu and navigating to Meeting > Optimized Room Bandwidth. The default setting is for LAN connections. When you use a LAN connection, Breeze applications send high-quality audio, video and screen-shared images. Use the LAN setting only if all the users are on a highspeed network and Presenters are using high-end systems (2Ghz and faster desktop computers). Note: The LAN setting not only increases bandwidth consumption but also increases CPU usage on the host's system. If CPU usage goes beyond 80%, latency will increase, resulting in choppy audio and video. The users' primary method of access determines the appropriate setting. · Change the setting for the bandwidth option to DSL for users on LAN and broadband connections. · Change the setting to Modem if most of the users are using a modem connection. Planning for bandwidth requirements 11 Calculating bandwidth usage Here are some bandwidth calculations based on a meeting with audio, video, and slides. Calculations are based on 1024x768 full screen. · Room bandwidth: Modem setting One Presenter can generate about 26 Kbits/sec of data. Viewers need about 29 Kbits/sec of downstream bandwidth to have a good experience. Having more than one Presenter on a modem room setting is not recommended. Screen sharing is not recommended for use with the Modem bandwidth setting. If screen sharing is added to Modem, the total bandwidth required is about 49 Kbits/sec. This is close to saturating a modem connection. Any bottleneck in the network can cause latency or an undelivered message. One Presenter generates close to 125 Kbits/sec of data. Each viewer requires about 128 Kbits/sec to consume all the data generated. Adding screen sharing requires 184 Kbits/sec. To have a good Breeze Meeting experience with the DSL setting, make sure viewers have available at least 200 Kbits/sec downstream bandwidth and Presenters have a 200 Kbits/sec upstream bandwidth. One Presenter generates close to 250 Kbits/sec of data. Each viewer requires about 255 Kbits/sec to consume all the data generated. Adding screen sharing requires about 300 Kbits/sec. To have a good Breeze Meeting experience with the LAN setting, make sure viewers have available at least 400 Kbits/sec downstream bandwidth and Presenters have a 400 Kbits/sec upstream bandwidth. · Room bandwidth: DSL setting · Room bandwidth: LAN setting Note: The bandwidth requirements for screen sharing can vary according to the content being shared and the screen resolution. These numbers are a general guideline--actual capacity varies in each network environment. 12 Chapter 1: Before You Begin Planning for directory services integration Directory services integration lets the Breeze administrator synchronize the Breeze internal directory of users and groups with an external source such as an organization's LDAP (Lightweight Directory Access Protocol) server. The Breeze administrator can synchronize the internal and external directories on demand or at scheduled intervals. Directory services integration allows those external users and groups that originate in a corporate database to continue to coexist with the internal users and groups created with Breeze. A directory service is like a database, but tends to contain more descriptive, attribute-based information. The information in a directory is generally read much more often than it is written. Only complete directory service updates are allowed. No partial updates are permitted. They replicate information widely in order to increase availability and reliability, while reducing response time. Directory services integration lets Breeze incorporate the information about an organization's users and groups. Breeze administrators do not need to perform manually the arduous processes of recreating users and groups. Breeze uses LDAP to access the organization's information directories. LDAP is an industry-standard access method to directory services. The LDAP protocol is supported by Microsoft Active Directory along with most other user directories. With the LDAP protocol, Breeze acquires its user data directly from an organization's user directory, including basic information such as email addresses, names, phone numbers, and the users' groups and departments. After the Breeze internal directory has been synchronized through the LDAP (or SLDAP) protocol to the organization's directory for authentication, Breeze identifies the external users and groups as Breeze users and groups. Directory services integration allows organizations to continue using their existing network user names, email lists and other attributes in Breeze while retaining the ability to create Breezespecific users and groups. After the directory service and the Breeze directory are integrated, users may keep their existing network passwords and login to Breeze. The degree of integration is determined by the organization's information technology (IT) policies and executed by the Breeze administrator. Synchronization of directories The general approach to integrating Breeze users and accounts with external directories such as an organization's human resources databases is to synchronize the Breeze internal directory of users and groups with some or all of the directory service. Synchronization copies the information from the organization's directory to the Breeze directory. The Breeze administrator schedules the synchronizations, and defines the level of integration with Breeze on the Application Management Console screens. Planning for directory services integration 13 Directory services integration In an LDAP schema, all directory entries are arranged in a hierarchical tree-like structure that reflects the organization's political, geographic, or administrative regions. For example, the IT administrator at a company with multiple worksites wants to let everybody in the organization use Breeze. In this scenario, the company's directory structure consists of multiple organizational units, and these are represented by four directory branches: San Francisco, Boston, Singapore, and Paris. Everyone in the organization has a Windows domain account listed in the Microsoft Active Directory. The IT administrator would like to offer Windows users a single sign-on, or at a minimum, the ability to use their domain login to access Breeze. The administrator synchronizes the organization's directory with Active Directory using the four branches to perform an initial synchronization. The administrator may in the future employ a solution accelerator to integrate the Breeze login screen with Windows authentication, and configure the Windows NT LAN Manager (NTLM) authentication to allow users to skip the Breeze login screen. The NTLM protocol is the default protocol for network authentication in many different versions of Windows. NTLM uses a challenge-response mechanism for authentication, in which clients are able to prove their identities without sending a password to the server. This procedure retrieves the user's Windows credentials to validate the user's access to Breeze. The IT group schedules synchronization to begin every day at 2:00 A.M. when the demand on system resources is low and to incorporate any changes since the previous synchronization. The administrator routinely checks the synchronization logs to monitor the status of the scheduled synchronization. Planning for SSL SSL, or Secure Socket Layer, is a technology that allows web browsers and web servers to communicate over a secured connection. This means that the data being sent is encrypted by one side, transmitted, and then decrypted by the other side before processing. This is a two-way process, meaning that both the server and the client's browser encrypt all traffic before sending out the data. An important aspect of the SSL protocol is authentication. During your initial attempt to communicate with a web server over a secure connection, that server will present your web browser with a set of credentials in the form of a certificate as proof the site is who and what it claims to be. In certain cases, the server may also request a certificate from your web browser, asking for proof that you are who you claim to be. This procedure is known as client authentication. Breeze can be configured to use SSL, a secure protocol for transmitting private documents over the Internet. SSL does not provide any inherent encryption capabilities, but instead performs the appropriate URL and data mapping to allow HTTPS URLs to access Breeze and the desired content. 14 Chapter 1: Before You Begin Implementing SSL for Breeze There are two options available for implementing SSL-based authentication with Breeze: · Using the native support in Flash Communication Server's (FCS) for SSL. Use this option if you want to secure only Breeze and not the web application. You will need 2 IP addresses (2 DNS entries for the IP addresses) and 1 SSL certificate. You will need to modify SSL tags in the Flash Adaptor.xml and Server.xml files configuration files. · Adding an external hardware SSL accelerator Use this option if you want to secure both FCS and the Breeze application. You will need 2 IP addresses - 2 DNS entries for the IP addresses -- and 2 SSL certificates. You need to purchase the accelerator separately. When you use Breeze with an SSL hardware accelerator, all logins to Breeze are sent over the secured protocol HTTPS. Port number for SSL The Internet uses well-known ports for unencrypted HTTP-based web traffic and encrypted HTTPS-based web traffic. Unencrypted traffic generally goes to port 80, and encrypted traffic generally goes to port 443. SSL hardware accelerators work by intercepting traffic on port 443, decrypting the information, and sending it back to the Breeze server through port 80. There is no indication to the Breeze server that the original data was encrypted. Without SSL, all logins are conducted over HTTP connections. After you are connected to the Breeze server, all presentations and meetings are delivered over standard unencrypted HTTP and RMTP connections. Planning for security Breeze is a server-based web application integrated with a database to provide a powerful solution for online training and conferencing. By hosting Breeze Server and its applications on your intranet or the Internet, you are providing users the flexibility to access information anywhere at any time. Any application run over a network, especially the Internet, has security risks associated with it. Macromedia Breeze is no different. However, these security threats can be minimized if you give careful consideration to implementing a security plan for Macromedia Breeze. There are three levels of security that should be considered for Macromedia Breeze: · Application-level security · Physical security · Infrastructure security Breeze provides application-level security, which provides an ACL (Access Control List)-based security model for controlling which users have access to which features in the Breeze applications. Physical security means placing the actual Breeze server in a physically-secure location. The third level, infrastructure security, which deals with securing the server and the network, is the most important, yet most overlooked aspect of securing Breeze. Planning for security 15 The discussion on security is divided into the following sections: · · · · Security levels Solutions for a secure infrastructure Best practices Additional references Security levels When planning a security strategy, it is important to consider the various layers in a deployed server environment, and devise a security plan for each layer. Typically, a comprehensive security strategy incorporates the following elements: · Infrastructure security · Application-level security · Physical security Infrastructure security Infrastructure security is by far the most important, but most overlooked, aspect of securing Breeze. It is up to your IT department or administrator to provide a secure infrastructure for Breeze. There are three parts to providing a secure infrastructure for Breeze: · Network security · Breeze web server · Database server security The following sections describe a secure infrastructure. The security measures you implement depend on whether your Breeze system consists of a single server running in the DMZ (demilitarized zone) or an elaborate multiserver system running with different trusted zones. Network security Breeze relies on several private TCP/IP services for its communications. These services open several ports and channels for private communication. These ports must be protected from outside users. Breeze's design requires the environment to provide security for these communications. Sensitive ports should be placed behind a firewall that separates them from non-trusted computers. If you intend to have users access Breeze on your intranet, you should place the Breeze servers and the Breeze database in a separate subnet, separated by a firewall. This configuration of the firewall should take into consideration all Breeze ports and whether they are configured for inbound or outbound traffic. If you intend to have users access Breeze on the Internet, it is extremely important that you separate the Breeze servers from the Internet with a firewall. If you do not take the necessary steps to secure the Breeze servers, you are leaving your valuable information available for anyone to steal. For more information, see "Security resources and references" on page 22. 16 Chapter 1: Before You Begin Breeze web server Breeze comes with its own built-in, high-performance, secure web server. This web server is based in part on Macromedia JRun Enterprise Server and has been designed specifically to serve dynamic content for Breeze, including Breeze Meetings, Breeze Presentations, Breeze Seminars, and other rich media content. Because of Breeze's special requirements, no other web servers (such as Apache) can be used with Breeze. Database server security Whether or not you are hosting your database on the same server as Breeze, you must make sure that your database is secure. Computers hosting a database should be in a physically secure location. Additional precautions include the following: · Install the database in the secure zone of your organization's intranet. · Never connect the database directly to the Internet. · Back up all data regularly and store copies in a secure off-site location. The Microsoft security website contains information that applies to both securing SQL Server 2000 and the embedded database engine: www.microsoft.com/sql/techinfo/ administration/2000/security/. The following link provides a good starting point to making sure that your database is secure: www.microsoft.com/sql/techinfo/administration/2000/security/securingsqlserver.asp. Note: Macromedia Breeze supports SQL authentication only. You must install SQL Server with mixed-mode authentication. Breeze does not support Windows Authentication Mode. If you are running the embedded database engine, the database uses breeze as the password by default. You should change this password after you install Breeze and verify that all its applications are functioning. To change the password, type the following at the command line: osql -E -Q "sp_password @new = 'new_password', @loginame = 'sa'" where {new_password} is a strong password. Solutions for a secure infrastructure Most Breeze configurations fall into one of two configurations: · A single-server configuration · A multiple-server configuration (a cluster) This section discusses both configurations and provides examples on how to secure these environments. Planning for security 17 Single-server configuration The easiest solution for a dedicated, single-server Breeze system is to block all ports on the server except 80, 1935, and 443 for SSL-enabled traffic. An external hardware firewall appliance provides a layer of protection against gaps in the operating system. Some organization configure layers of hardware-based firewalls to form DMZs. If the server is carefully updated by your IT department with the latest Microsoft security patches, a software-based firewall can be configured to enable additional security. The following procedure assumes that you are setting up Breeze Server on a single computer. The database is to be installed on this computer, too. It is also assumed that you want users to be able to access Breeze on the Internet. To secure Breeze on a single server: 1. Install a firewall. Since you are allowing users to access Breeze through the Internet, the server is open to an attack by hackers. By using a firewall, you can block access to the server and control the communications that occur between the Internet and the server. 2. Configure a firewall. After installing your firewall, configure it as follows: Inbound ports (from the Internet): 80, 443, 1935 Outbound ports (to the mail server): 25 Use the TCP/IP protocol only Since the database is located on the same server as Breeze, you do not need to open up port 1433 on the firewall. 3. Install Breeze. For more information, see Chapter 3, "Installing and Upgrading Breeze," on page 35. 4. Verify that the Breeze applications are working. After installing Breeze, you should verify that Breeze is working properly both from the Internet and from your local network. For more information, see Chapter 5, "Verifying Your Installation," on page 91. 5. Test the firewall. After you have installed and configured the firewall, you should verify that your firewall is working correctly. Test the firewall by attempting to use the blocked ports. Multiserver solutions Multiserver (cluster) solutions are inherently more complex. A Breeze cluster can be located with a data center or geographically distributed across multiple Network Operation Centers. If you choose to, you can install and configure servers hosting Breeze in multiple locations and synchronize them through database replication. Note that SQL Server is required for any multiserver solution. 18 Chapter 1: Before You Begin It is very important that you understand how to secure a multiserver installation. The following are suggestions for securing multiserver solutions. · Private networks The simplest solution for multiserver solutions in a single location is to create an extra subnet for the Breeze system. This solution offers a high level of security, but it can be expensive. · Local software firewalls For the Breeze s that are located in a cluster but share a public network with other customer servers, a software firewall may be appropriate on each individual server. · VPN systems In multiserver installations where there are multiple Breeze servers in different physical locations, customers may want to consider using an encrypted channel to communicate with the remote servers. Many software and hardware vendors offer VPN technology to secure the communications to remote servers. Breeze relies on this external security if data traffic must be encrypted. Application-level security Breeze has a built-in ACL (Access Control List)-based security model that lets you assign users different permissions to access Breeze's features. For example, you can control which users have permissions to publish presentations by adding them to the Account Authors group. You can also control which folders individual users can publish to. Breeze has seven primary groups that grant users access to specific features in the Breeze system. By adding users to these groups, you can control the kind of the role a user has in your Breeze account. These groups are as follows: · Administrators Members of the Administrators group have access to all functions in the Breeze account. They can create and manage users, manage content, create and manage courses and create and manage meetings. A member of the Administrators group also needs to be a member of the relevant groups in order to: publish content organize events create meetings present seminars create courses enroll users send notifications Planning for security 19 · Authors Members of the Account Authors group have access to publishing features. They can publish content to the Breeze system. · Events Administrators This group includes anyone who organizes events. An event can be any meeting, presentation, course, curriculum, or seminar that requires registration and generates reports with participant tracking information. · Learners This group includes anyone who attends any meeting, presentation, course, curriculum, or seminar. · Meeting Hosts Members of the Meeting Hosts group can perform all functions associated with creating meetings, including setting up a meeting, inviting participants, sending invitations and viewing reports. · Seminar Administrators This group includes those who present seminars. A seminar is a special kind of meeting with its own attributes and licensing structure. · Training Managers Members of the Training Managers group manage the Meeting library, including creating courses, incorporating course content from Authors, enrolling users, sending enrollee notifications, and setting up course reminders. They can also view content and course reports. In addition to adding users to groups to grant them rights to use features in the Breeze system, you can also grant them permissions to access specific folders, content, courses and meetings. For example, you can control whether or not a certain Author has permissions to publish to a specific folder. For more information on using Breeze's application-level security features, refer to the Breeze Manager User Guide. Physical security Customers who store sensitive information on their servers should be aware of the physical security of their systems. Breeze relies on the safety of the host system against intruders. Servers should be kept secured when private and confidential data is at risk. Breeze is designed to take advantage of native environmental features like file system encryption when available and if configured by the user. 20 Chapter 1: Before You Begin