| Panel | |
|---|---|
|
Requirements
- Linux x64 (kernel 3.10 and later, glibc 2.17-78 and later)
- NGINX web server (1.20 and later)
- PostgreSQL database (13 and later)
- UDMG distribution files for the different modules:
- UDMG Admin UI
- UDMG Authentication Proxy
- UDMG Server (Waarp Gateway)
- UDMG Agent Proxy
| Panel | |
|---|---|
|
Requirements
System Requirements
Linux x64 (kernel 3.10 and later, glibc 2.17-78 and later), x86_64 based or Debian based
NGINX web server (1.20 and later)
PostgreSQL database (13 and later)
UDMG distribution files for the different modules:
UDMG Admin UI
UDMG Authentication Proxy
UDMG Server (Waarp Gateway)
UDMG Agent Proxy, this module is optional
- An account with administrative privileges for the installation.
- Network connectivity via TCP/IP.
- Approximately 100 megabytes of disk space for the installation. More disk space is required for log files.
- A dedicated account for the execution of the UDMG components, with write access to the storage location for the files that will be managed by UDMG.
Database Space Requirements
Following the initialization of the Universal Data Mover Gateway database, the initial table space size will be approximately 10MB.
Based on calculations using data from all transfer types, each file transfer consumes approximately 2KB of database space. You should estimate space requirements for your data based on your expected number of file transfers per day and the duration for retaining history and activity data before purging.
Installing and Configuring the Components
PostgreSQL Database
Create a blank database on the server. An already existing database can be used, but this is not recommended.
Add a user that will be used as the owner of the related tables but also to authenticate with the server.
In order to install or perform upgrades, this database user will require DDL (Data Definition Language) permission in the database during the installation or the upgrade.
Once the install or upgrade has been completed successfully, the configured database user requires only DML (Data Manipulation Language) permissions.
Here is how to configure the database for a local installation where the database server is on the same host. For multi-node installation please refer to your database administrator.Note:
| Note |
|---|
The following steps require root privilege, be sure that you have the correct access before |
...
to continue. |
Install a PostgreSQL database server.
Once the installation is complete, initialize the PostgreSQL database.
Start the PostgreSQL Server:
| Panel |
|---|
|
...
|
...
|
- Create a user for UDMG Waarp Gateway
Login as PostgreSQL administrative user, start the PostgreSQL Console (psql) and create the database user for UDMG:
...
| Panel |
|---|
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
- Finally change the
pg_hba.conf, to allow database connection with password. For example, for a system where the database server is on the same host as the UDMG server, by changing this line from:
| Panel |
|---|
|
...
|
...
|
...
|
...
|
to:
| Panel |
|---|
|
...
|
...
|
...
|
...
|
The exact configuration depends on the OS and database version, on the preferred security settings, and on the system architecture.
| Note | title | Note
|---|
| Panel |
|
NGINX Server
| Note |
|---|
...
The following steps require root privilege, be sure that you have the correct access before to continue. |
- Install a NGINX Server (Linux packages).
Run the following command to check the main NGINX configuration file:
| Panel |
|---|
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
If the NGINX configuration file supports include directives, there will be a line like this:
| Panel |
|---|
|
...
|
- Create a configuration file
mft.confunder this directory (normally/etc/nginx/conf.d): This will create 2 location ‘/' for the UDMG Admin UI and'/service'for the internal authentication mechanism.
| Panel |
|---|
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
...
|
...
|
...
|
- Validate that the configuration is correct with the following command:
| Panel |
|---|
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
- Create the Root directory:
| Panel |
|---|
|
...
|
...
|
...
|
- Start the NGINX service using the Init system.
| Panel |
|---|
|
...
|
...
|
...
|
- Check that the HTTP server was started and is running, for example with the
curlcommand command:
| Panel |
|---|
|
...
|
...
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
This error (403) is excepted, since we don't have any asset deployed.Note: for
| Note |
|---|
For configuring HTTPS and HTTP redirection, please refer to the web server documentation. |
UDMG Admin UI
...
| Note |
|---|
The following steps require root privilege, be sure that you have the correct access before to continue. |
Extract the distribution file for UDMG Admin UI, under the directory web server root directory, see the NGINX Service configuration above.
| Panel |
|---|
|
...
|
...
|
...
|
...
|
...
|
- Validate that the service is working properly:
| Panel |
|---|
|
...
|
...
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
UDMG User setup
Create a dedicated user for running the UDMG modules and to be the owner of the files that will be transferred by UDMG.
| Panel |
|---|
|
...
|
...
|
UDMG Server
Create the configuration file
/etc/mft/waarp_gateway/server.iniwith the following parameters:
| Panel |
|---|
|
...
|
...
|
...
|
...
|
...
|
...
|
| Panel |
|---|
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
- Install the binaries under
/usr/local/bin:
# install -m 755 waarp-gatewayd /usr/local/bin
# install -m 755 waarp-gateway /usr/local/binUDMG Authentication Proxy
- Create a directory under
/etc/mft/:
# mkdir -p /etc/mft/auth_proxy- Create a configuration file for the service:
# vi /etc/mft/auth_proxy/config.toml...
|
- Install the binaries under
/usr/local/bin:
| Panel |
|---|
|
UDMG Authentication Proxy
Create a directory under
/etc/mft/:
| Panel |
|---|
|
- Create a configuration file for the service:
| Panel |
|---|
|
| Panel |
|---|
|
- Install the binary under
/usr/local/bin:
| Panel |
|---|
|
...
|
...
|
...
|
...
|
...
|
Configuration for LDAP Authentication
The UDMG Authentication Proxy is capable to use a LDAP Service to authenticate users for UDMG Admin UI:
# vi /etc/mft/auth_proxy/config.toml...
:
| Panel |
|---|
|
| Panel |
|---|
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
...
|
...
|
...
|
...
|
...
|
...
|
...
| Note | |
|---|---|
| title | Note
The LDAP replication requires a user with permission for creating and updating users. For example to create the 'ldap_sync' user with the command line interface:
| Panel |
|---|
|
In case of successful authentication on the LDAP, the user is created with default read permission in the internal UDMG database if it does not exist. Otherwise the credentials are updated in the database to allow for authentication on the REST and CLI interfaces.
UDMG Agent Proxy
Create a directory under
/etc/mft:
| Panel |
|---|
|
...
|
...
|
...
|
- Install the binaries under
/usr/local/bin:
| Panel |
|---|
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
Agent Configuration
Generate a SSH Key for the service:
| Panel |
|---|
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
- Change the agent key permissions:
| Panel |
|---|
|
...
|
...
|
...
|
...
|
- Create a configuration file as
/etc/mft/agent_proxy/agent.toml:
| Panel |
|---|
|
...
|
...
|
...
| Panel |
|---|
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
The password key will be used for the client authentication.
Client Configuration
Create a configuration file as
/etc/mft/agent_proxy/client.toml:
| Panel |
|---|
|
...
|
...
|
| Panel |
|---|
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
The password key will be used for the client authentication.
Setup the Systemd Services
UDMG Server
Create a new service definition:
| Panel |
|---|
|
...
|
...
|
...
| Panel |
|---|
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
- Enable the new service::
| Panel |
|---|
# |
...
systemctl |
...
enable |
...
mft_waarp_gateway.service |
...
|
...
symlink |
...
/etc/systemd/system/multi-user.target.wants/mft_waarp_gateway.service |
...
→ |
...
/etc/systemd/system/mft_waarp_gateway.service. |
- Start the service and check the status:
| Panel |
|---|
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
Be sure that the listen port and network interface is reachable by UDMG Authentication Proxy and UDMG Agent Client.
UDMG Authentication Proxy
Create a new service definition:
| Panel |
|---|
|
...
|
...
|
...
| Panel |
|---|
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
- Enable the new service:
| Panel |
|---|
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
- Start the service and check the status:
| Panel |
|---|
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
Be sure that the listen port and network interface is reachable by NGINX Server.
UDMG Agent Proxy
Agent Proxy Server Service
Create a new service definition:
| Panel |
|---|
|
...
|
...
|
...
| Panel |
|---|
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
- Enable the new service:
| Panel |
|---|
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
- Start the service and check the status:
| Panel |
|---|
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
Be sure that the listen port and network interface is reachable by UDMG Agent Client .
Agent Proxy Client Service
Create a new service definition:
| Panel |
|---|
|
...
|
...
|
...
| Panel |
|---|
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
- Enable the new service:
| Panel |
|---|
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
- Start the service and check the status:
| Panel |
|---|
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
Component Ports
Make sure that all the ports needed are open under your firewall configuration.
Using UDMG with SELinux
- Modify the file label so that NGINX (as a process labeled with the
httpd_tcontext) can access the configuration file
| Panel |
|---|
|
...
|
...
|
- Modify the file label so that NGINX (as a process labeled with the
httpd_tcontext) can access the asset files
| Panel |
|---|
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
- Allow NGINX to reverse proxy through the authentication proxy by setting the httpdthe
httpd_can_network_connectboolean
| Panel |
|---|
|
...
|
...
|
...
|
...
|
References
This document references the following documents.
Name | Location | ||
|---|---|---|---|
Systemd | https://www.linux.com/training-tutorials/understanding-and-using-systemd/ | NGINX with SELinux | https://www.nginx.com/blog/using-nginx-plus-with-selinux/|
NGINX with SELinux | |||
PostgreSQL Client Authentication | https://www.postgresql.org/docs/current/auth-pg-hba-conf.html|||
PostgreSQL Password Authentication | https://www.postgresql.org/docs/current/auth-password.html
