Setting up an mSign server - Revision history

John Powers at 18:58, 29 June 2023

2023-06-29T18:58:00Z

← Older revision		Revision as of 14:58, 29 June 2023
Line 17:		Line 17:
	sudo dpkg -i scriptel-msign-X.X.X-all.deb		sudo dpkg -i scriptel-msign-X.X.X-all.deb

	6. Edit the /usr/lib/scriptel-msign/config.js file. hostName must be set to the fully qualified domain name for SSL to work. webappLocation must be set to the front-end server. Everything else should work by default.		6. Edit the /usr/lib/scriptel-msign/config.js file.
			# hostName must be set to the fully qualified domain name for SSL to work.
			# webappLocation must be set to the URL of the front-end server.
			# publicHttpsPort is the port that the front end should connect to. Change this to 443.
			# Everything else should work by default.

	7. Restart the service to pick up the changes by stopping and starting it. restart does not work.		7. Restart the service to pick up the changes by stopping and starting it. restart does not work.
Line 26:		Line 30:
	sudo service scriptel-msign status		sudo service scriptel-msign status

	At this point, your mSign Desktop and mSign Mobile applications should be able to connect to the server on port 8443. For example, if your IP address were 54.291.191.59 you would put this into the applications as https://54.291.191.59:8443. You can try this using a browser for mSign Mobile as long as it will allow you to get to it as an unsafe site. Chrome will allow this, for example, but you will not be able to use the mSign mobile app for Android until there is a certificate.		At this point, your mSign Desktop and mSign Mobile applications should be able to connect to the server on port 8443. For example, if your IP address were 54.291.191.59 you would put this into the applications as https://54.291.191.59:8443. You can try this using a browser for mSign Mobile as long as it will allow you to get to it as an unsafe site. Chrome will allow this, for example, but you will not be able to use the mSign mobile app for Android until there is an SSL certificate.

	===Reassign the ports===		===Reassign the ports===
Line 39:		Line 43:
	sudo /etc/init.d/netfilter-persistent save		sudo /etc/init.d/netfilter-persistent save

	===~~Install a certificate~~===		===Certificate types===

			There are two certificates. One is for SSL between the server and the browser and the server and the desktop. The other is for the mobile application (front end).

			===SSL Key===

	To avoid security warnings you need to install a certificate. You can buy one and install it. Or you can self-certify, but if you do, you will have to set yourself up as a root authority on each mobile device you use. Or you can use [https://letsencrypt.org/ Let's Encrypt], which is free, but requires that the server be public on the internet so that it can validate ownership of the domain.		To avoid security warnings you need to install a certificate. You can buy one and install it. Or you can self-certify, but if you do, you will have to set yourself up as a root authority on each mobile device you use. Or you can use [https://letsencrypt.org/ Let's Encrypt], which is free, but requires that the server be public on the internet so that it can validate ownership of the domain.
Line 56:		Line 64:
	sudo apt install certbot		sudo apt install certbot
	sudo certbot certonly --webroot -w /usr/lib/scriptel-msign/www -d domain.example.com		sudo certbot certonly --webroot -w /usr/lib/scriptel-msign/www -d domain.example.com

			===Mobile certificate===

			This is the certficate pointed to in config.js. When the installer is run, a self-signed certificate is generated but it does not chain up to a root authority. In order to avoid security warnings on the mobile device, a certficate for the front end server's domain must be obtained. This can be done through Amazon's certificate manager, for example.

John Powers at 19:20, 28 June 2023

2023-06-28T19:20:55Z

← Older revision		Revision as of 15:20, 28 June 2023
Line 19:		Line 19:
	6. Edit the /usr/lib/scriptel-msign/config.js file. hostName must be set to the fully qualified domain name for SSL to work. webappLocation must be set to the front-end server. Everything else should work by default.		6. Edit the /usr/lib/scriptel-msign/config.js file. hostName must be set to the fully qualified domain name for SSL to work. webappLocation must be set to the front-end server. Everything else should work by default.

	7. check to see if the service is started the service		7. Restart the service to pick up the changes by stopping and starting it. restart does not work.
			sudo service scriptel-msign stop
			sudo service scriptel-msign start

			8. check to see if the service is started the service
	sudo service scriptel-msign status		sudo service scriptel-msign status

John Powers: Added config details; stumbling blocks that I ran into.

2023-06-28T19:19:12Z

Added config details; stumbling blocks that I ran into.

← Older revision		Revision as of 15:19, 28 June 2023
Line 17:		Line 17:
	sudo dpkg -i scriptel-msign-X.X.X-all.deb		sudo dpkg -i scriptel-msign-X.X.X-all.deb

	6. check to see if the service is started the service		6. Edit the /usr/lib/scriptel-msign/config.js file. hostName must be set to the fully qualified domain name for SSL to work. webappLocation must be set to the front-end server. Everything else should work by default.

			7. check to see if the service is started the service
	sudo service scriptel-msign status		sudo service scriptel-msign status

Line 25:		Line 27:

	This section is optional. mSign Server runs natively on ports 8080 and 8443. You might want to use the standard http and https ports 80 and 443. You have to do this if you use Letsencrypt for a certificate in the next section.		This section is optional. mSign Server runs natively on ports 8080 and 8443. You might want to use the standard http and https ports 80 and 443. You have to do this if you use Letsencrypt for a certificate in the next section.

			Note that eth0 may or may not be the name of your ethernet adaptor. For example, on AWS T4g instances it is ens5.

	sudo apt install iptables-persistent		sudo apt install iptables-persistent

John Powers: reduced the steps necessary to install certbot since it's installer does these things for you now.

2023-06-28T14:36:51Z

reduced the steps necessary to install certbot since it's installer does these things for you now.

@@ Line 41: / Line 41: @@
 . Give your server a DNS name with your DNS provider and wait for it to propogate. This can be a subdomain of one you already own.
-. Type the following, substituting your domain for domain.example.com:
+. Create the directory /usr/lib/scriptel-msign/www and change the owner to scriptel-msign
-    sudo apt install software-properties-common
+   sudo mkdir /usr/lib/scriptel-msign/www
-    sudo add-apt-repository ppa:certbot/certbot
+   sudo chown scriptel-msign /usr/lib/scriptel-msign/www
      sudo apt install certbot
      sudo certbot certonly --webroot -w /usr/lib/scriptel-msign/www -d domain.example.com

John Powers: Took out steps that are no longer necessary, like setting up a postgres server and steps that the installer now handles automaticaly.

2023-06-27T19:29:09Z

Took out steps that are no longer necessary, like setting up a postgres server and steps that the installer now handles automaticaly.

← Older revision		Revision as of 15:29, 27 June 2023
Line 1:		Line 1:
	This guide is for administrators in organizations who have purchased an mSign server license. Scriptel provides a public server for public use free of charge at msign.scriptel.com. However, this requires internet connectivity and is shared. Organizations may wish to use their own server behind their firewall. A 90-day trial license is available upon request.		This guide is for administrators in organizations who have purchased an mSign server license. Scriptel provides a public server for public use free of charge at msign.scriptel.com. However, this requires internet connectivity and is shared. Organizations may wish to use their own server behind their firewall. A 90-day trial license is available upon request.

	mSign Sever is designed to run on an Ubuntu 16.04 server. It is written node.js, so technically it is possible to make it run on any platform that supports node. However, all of the scripts for installing are written for Ubuntu and that is all we are currently supporting.		mSign Sever is designed to run on an Ubuntu 20.04 server and up. It is written node.js, so technically it is possible to make it run on any platform that supports node. However, all of the scripts for installing are written for Ubuntu and that is all we are currently supporting.

	~~mSign Server requires connection to a PostgreSQL database. This can live on the local machine or elsewhere. These instructions will assume it lives on the local system~~.

	===Set up the service:===		===Set up the service:===

	1. Obtain the scriptel-msign-x.x.xx-all.deb package ~~and license file from Scriptel~~		1. Obtain the scriptel-msign-x.x.xx-all.deb package.

	2. Obtain a server with Ubuntu 20.04 on it.		2. Obtain a server with Ubuntu 20.04 (or higher) on it.

	3. Change the host name		3. Change the host name
Line 16:		Line 14:
	4. Point your DNS to the new server.		4. Point your DNS to the new server.

	5~~. Install PostgreSQL and nodejs~~		5. Start the install of mSign server
	~~sudo apt update~~		sudo dpkg -i scriptel-msign-X.X.X-all.deb
	~~sudo apt install postgresql postgresql-contrib nodejs~~

	~~6. Start command line PostgreSQL~~
	~~sudo -u postgres psql~~

	~~7. Type, (changing the password ''secret'' to a reasonable password):~~
	~~CREATE USER "scriptel-msign" WITH PASSWORD 'secret';~~
	~~CREATE DATABASE "scriptel-msign" WITH OWNER "scriptel-msign";~~
	\q

	8. Start the install of mSign server
	sudo ~~apt install~~ -~~f ./~~scriptel-msign-*-all.deb

	~~9. Take the default answers, except password. Make the password the same as in step 7.~~

	~~10. Create the user~~
	~~cd /usr/lib/scriptel-msign~~
	~~sudo -u scriptel-msign node msign-util.js --create-user=guy@email.com:guysPassword~~

	~~11. Create an organization~~
	~~sudo -u scriptel-msign node msign-util.js -o organization~~

	~~12. Assign the user to the organization~~
	~~sudo -u scriptel-msign node msign-util.js -a guy@email.com:organization~~

	~~13. If the directory /usr/lib/scriptel-msign/licenses does not exist, create it.~~
	~~sudo -u scriptel-msign mkdir licenses~~

	~~14. License the server. This assumes that Scriptel has granted you a license. If not, this step will fail. This is the portal username and password, which may be different than one created earlier.~~
	~~sudo -u scriptel-msign node msign-util.js --download-licenses guy@email.com:guysPassword~~

	~~15. Start the service~~
	~~sudo service scriptel-msign start~~

	16. ~~Make~~ the service ~~automatically start when~~ the ~~system is rebooted~~		6. check to see if the service is started the service
	sudo ~~systemctl enable~~ scriptel-msign~~.service~~		sudo service scriptel-msign status

	At this point, your mSign Desktop and mSign Mobile applications should be able to connect to the server on port 8443. For example, if your IP address were 54.291.191.59 you would put this into the applications as https://54.291.191.59:8443. You can try this using a browser for mSign Mobile as long as it will allow you to get to it as an unsafe site. Chrome will allow this, for example, but you will not be able to use the mSign mobile app for Android until there is a certificate.		At this point, your mSign Desktop and mSign Mobile applications should be able to connect to the server on port 8443. For example, if your IP address were 54.291.191.59 you would put this into the applications as https://54.291.191.59:8443. You can try this using a browser for mSign Mobile as long as it will allow you to get to it as an unsafe site. Chrome will allow this, for example, but you will not be able to use the mSign mobile app for Android until there is a certificate.

John Powers at 17:49, 4 November 2021

2021-11-04T17:49:16Z

← Older revision		Revision as of 13:49, 4 November 2021
Line 31:		Line 31:
	sudo apt install -f ./scriptel-msign-*-all.deb		sudo apt install -f ./scriptel-msign-*-all.deb

	9. Take the default answers, except password. Make the password the same as in step 5.		9. Take the default answers, except password. Make the password the same as in step 7.

	10. Create the user		10. Create the user

John Powers at 14:29, 4 November 2021

2021-11-04T14:29:27Z

← Older revision		Revision as of 10:29, 4 November 2021
Line 9:		Line 9:
	1. Obtain the scriptel-msign-x.x.xx-all.deb package and license file from Scriptel		1. Obtain the scriptel-msign-x.x.xx-all.deb package and license file from Scriptel

	2. Obtain a server with Ubuntu 16.04 on it.		2. Obtain a server with Ubuntu 20.04 on it.

	3. Change the host name		3. Change the host name
Line 16:		Line 16:
	4. Point your DNS to the new server.		4. Point your DNS to the new server.

	5. Install PostgreSQL		5. Install PostgreSQL and nodejs
	sudo apt~~-get~~ update		sudo apt update
	sudo apt~~-get~~ install postgresql postgresql-contrib		sudo apt install postgresql postgresql-contrib nodejs

	6. Start command line PostgreSQL		6. Start command line PostgreSQL
Line 29:		Line 29:

	8. Start the install of mSign server		8. Start the install of mSign server
	sudo apt~~-get~~ install -f ./scriptel-msign-*-all.deb		sudo apt install -f ./scriptel-msign-*-all.deb

	9. Take the default answers, except password. Make the password the same as in step 5.		9. Take the default answers, except password. Make the password the same as in step 5.
Line 61:		Line 61:
	This section is optional. mSign Server runs natively on ports 8080 and 8443. You might want to use the standard http and https ports 80 and 443. You have to do this if you use Letsencrypt for a certificate in the next section.		This section is optional. mSign Server runs natively on ports 8080 and 8443. You might want to use the standard http and https ports 80 and 443. You have to do this if you use Letsencrypt for a certificate in the next section.

	sudo apt~~-get~~ install iptables-persistent		sudo apt install iptables-persistent
	sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080		sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080
	sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 8443		sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 8443
Line 77:		Line 77:

	3. Type the following, substituting your domain for domain.example.com:		3. Type the following, substituting your domain for domain.example.com:
	sudo apt~~-get~~ install software-properties-common		sudo apt install software-properties-common
	sudo add-apt-repository ppa:certbot/certbot		sudo add-apt-repository ppa:certbot/certbot
	sudo apt~~-get~~ install certbot		sudo apt install certbot
	sudo certbot certonly --webroot -w /usr/lib/scriptel-msign/www -d domain.example.com		sudo certbot certonly --webroot -w /usr/lib/scriptel-msign/www -d domain.example.com

Samuel Lovetro: /* Set up the service: */

2018-01-16T21:46:00Z

Set up the service:

← Older revision		Revision as of 17:46, 16 January 2018
Line 23:		Line 23:
	sudo -u postgres psql		sudo -u postgres psql

	7. Type, (changing the password 'secret' to a reasonable password):		7. Type, (changing the password ''secret'' to a reasonable password):
	CREATE USER "scriptel-msign" WITH PASSWORD 'secret';		CREATE USER "scriptel-msign" WITH PASSWORD 'secret';
	CREATE DATABASE "scriptel-msign" WITH OWNER "scriptel-msign";		CREATE DATABASE "scriptel-msign" WITH OWNER "scriptel-msign";

Samuel Lovetro: /* Set up the service: */

2018-01-16T21:44:35Z

Set up the service:

← Older revision		Revision as of 17:44, 16 January 2018
Line 23:		Line 23:
	sudo -u postgres psql		sudo -u postgres psql

	7. ~~type~~, changing the password 'secret' to a reasonable password.		7. Type, (changing the password 'secret' to a reasonable password):
	CREATE USER "scriptel-msign" WITH PASSWORD 'secret';		CREATE USER "scriptel-msign" WITH PASSWORD 'secret';
	CREATE DATABASE "scriptel-msign" WITH OWNER "scriptel-msign";		CREATE DATABASE "scriptel-msign" WITH OWNER "scriptel-msign";

John Powers at 15:40, 21 August 2017

2017-08-21T15:40:21Z

← Older revision		Revision as of 11:40, 21 August 2017
Line 12:		Line 12:

	3. Change the host name		3. Change the host name
	hostnamectl set-hostname new-hostname		sudo hostnamectl set-hostname new-hostname

	4. Point your DNS to the new server.		4. Point your DNS to the new server.