UDMG for Windows Installation
For the UDMG Web Transfer Client, please refer to UDMG Web Transfer Client for Windows Installation.
Upgrading Universal Data Mover Gateway
Upgrading UDMG refers to the increase of a currently installed pre-2.0.x Version, Release, or Modification level of UDMG (1.5.x, 1.4.x, 1.3.x) to UDMG 2.0.x.
As a precautionary measure, it is highly recommended that you back up the UDMG database prior to upgrading.
Upgrading from a pre 2.0 UDMG release
If you are upgrading an installation of UDMG from any release before 2.0.0.0, the following changes must be reviewed carefully.
License Key
Starting with UDMG version 2.0, a license key must be provided to enable file transfers.
Contact your Stonebranch representative or Customer Support to receive the license key before upgrading to version 2.0 or later.
Shared Account
(1) Local Accounts are converted to Shared Accounts
Before this change, a local account was only defined for a given local server and not allowed to have the same account for multiple protocols. For instance, to allow a partner to transfer files over SFTP and FTP, it was required to have both an SFTP and FTP local server, each with their own local account. Each account was then maintained independently, which created additional overhead in configuration and maintenance (password or key updates). A shared Account is created once and can be assigned to several Local Servers, sharing the same login, password, and authentication records.
A migrated account has the following characteristics:
Linked to the Local Server that owned the Local Account. The new Shared Account can later be assigned to other servers.
Member of the same Business Services as the Local Server. The Shared Account membership to Business Services can be modified later but must retain compatibility between Server memberships and Shared Account memberships
Account name is composed of the original server name and the login: <local_server name>-<local_account login>,for example, if the local account has a login of "common" and belongs to the local server "sftp", the new account name is "common-sftpr". The Share Account name can be edited later, it is only for internal use and does not affect the login that is used for authentication.
UDMG 1.5 local account
UDMG 2.0 migrated shared account
Enabled by default.
(2) New permission for Shared Account management
A new User and User Group permission, "sharedAccount", is created for the management of Shared Accounts.
The UDMG users and user groups are assigned these permissions by copying the existing server permissions. The refinement of server and sharedAccount permissions for the Users and User Groups can be done after the migration.
For example, if a UDMG user has server read and write permission, it is allowed to manage servers and local accounts. With the migration, it obtains also the sharedAccount read and write permissions to continue the management of accounts.
Start parameters
The start parameters for several services have changed.
Please review the start scripts, the following modules now require a 'start' command to begin in server mode.
udmg-auth-proxy.exe start -f configuration_file
udmg-agent-client.exe start -f configuration_file
udmg-agent-server.exe start -f configuration_file
Without it, they will only display the command line usage information.
In addition, a 'test' command allows the syntax of the configuration file to be verified without starting the server.
New configuration parameter with UDMG 2.0.0.0
Configuration Parameters
UDMG Server
Adds new database timeout option
[database]
; Threshold before warning for long-running queries, the default is 10 seconds
WarningTimeout=10sAdds a parameter to disable the implicit assignment of Transfer Rules. Before this change, a Transfer Rule was allowed for all servers, partners, and accounts right after creation. It was only restricted after an explicit assignment (whitelisting) to at least one server, partner, or account. The prior functionality created confusion and allowed unauthorized access to files and folders for third-party accounts during the time between the rule creation and its explicit assignment. The change allows the functionality to be disabled with the new UDMG Server configuration parameter
ExplicitRuleAssignment. When set to true, a Transfer Rule is only effective when it is explicitly linked with the intended target (local server, remote partner, remote or local account).
[rule]
; Disables global rules, requiring rules to be explicitly allowed to be used.
; ExplicitRuleAssignment = falseUDMG Admin UI
The recommended security setting for NGINX have been modified, with the inclusion of the following header directives. Please review the sample configuration on Installing NGINX Server page.
# Server Banner
server_tokens off;
# DEPRECATED Security Headers
add_header X-XSS-Protection "0";
add_header X-Frame-Options "SAMEORIGIN";
# Security Headers
add_header Content-Security-Policy "frame-ancestors 'self'";
add_header X-Content-Type-Options nosniff;
add_header Referrer-Policy "strict-origin";
add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains; preload';
add_header Permissions-Policy "geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self),payment=()";
add_header X-Permitted-Cross-Domain-Policies none;
location /service/ {
proxy_pass http://udmg_auth_proxy/;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
Agent Proxy Client
The section for the configuration of the target UDMG Server is renamed from
[gateway]to[server].New
secureoption to support HTTPS for the connection to the UDMG Server API
[server]
# UDMG Server Hostname or IP, and port
hostname = "localhost"
port = "8080"
# UDMG API protocol, set to true to select https, default is false for http
secure = false
# UDMG Server Username/Password
username = "admin"
password = "admin_password"