Installation Manual Linux V-5.1.0

Overview

true-Broker enables UBS customers to automatically exchange data with B2B applications of UBS over the Internet. true-Broker Web is responsible to establish a secure communication with the UBS Web-Portal. The communication is secured using 128bit SSL/TLS with mutual certificate based authentication.

true-Broker Web is a Web application running on an Apache Tomcat server.

true-Broker Web is multi-client capable. true-Broker Web Administration may be used to manage the client instances of true-Broker Web. For each client a specific true-Broker Web application instance is deployed on Apache Tomcat which separates it from the other clients.

The configuration of each true-Broker Web client instance is held in an internal data base.

true-Broker Web additionally offers a Web service interface for real time message exchange. The supported operations of the Web service interface are:

• Check the connection to the target system
• Transfer message from the client system to the target system
• Check the status of a sent message
• Receive a message from the target system

System Requirements

Operating systems

• RPM Based Linux Systems

Software

• true-Broker Web 5.0.x or newer
• Softtoken
  • OpenDNSSEC - Softhsm2
• nss-tools
• compat-openssl11

Hardware

• 20 GB free hard disk
• 8 GB RAM

Other

• root rights
• https access to the Internet (proxy configuration parameters if required)
• Unbound local port 8645/8646
• Firewall allowing connections to http://localhost:8645 and/or https://localhost:8646

Packages

The packages can be downloaded under:

https://products.sits.services/books/true-broker/chapter/releases

Installing true-Broker Web

Install SoftHsm2

Install the SoftHsm2 software as follows.

rpm –i softhsm-2.6.0-3.module.x86_64.rpm

User/Group

Create a new group account keyon. Create a new user account keyon. The third line ensures that the keyon account has write access to the directory /var/lib/softhsm/tokens.

groupadd keyon useradd -g keyon keyon usermod -a -G ods keyon

Installing true-Broker Web Software

All software components are delivered as Linux packages. Follow the steps below to install the software packages:

rpm –i KEYON-TBW-JRE.adm64.rpm --force

rpm -i KEYON-TBW-SRV.adm64.rpm --force

rpm -i KEYON-TBW-DB.adm64.rpm --force

rpm -i KEYON-TBW-APP.adm64.rpm --force

Configure true-Broker

SSL Certificate Configuration

True-Broker is a web application based on tomcat. Therefore, it’s good practice to encrypt the communication with SSL. To do so, an SSL Certificate needs to be created matching your hostname, or at least “localhost” if you do not intend to access true-broker from remote.

The certificate can potentially be issued using your internal PKI system. Otherwise, a self-signed certificate can be issued using OpenSSL. Please refer to the OpenSSL manual for more details.

The certificate needs to be configured in below file.

/opt/keyon/trueBroker/server/conf/server.xml

Adjust the certificate tag within the connector port 8646 to your certificate. Paste the path to your certificate into the certificateKeystoreFile parameter and the password into the certificateKeystorePassword parameter

<Connector 
    port="8646" 
    maxHttpHeaderSize="8192"
    maxThreads="100"
    minSpareThreads="25"
    maxSpareThreads="75"
    enableLookups="false"
    disableUploadTimeout="true"
    Server =" "
    acceptCount="100" SSLEnabled="true">  
    <SSLHostConfig
        honorCipherOrder="true"
        protocols="TLSv1.2,TLSv1.3"
        ciphers="ECDHE-ECDSA-AES256-GCM…GCM-SHA256">   
        <Certificate 
            certificateKeystoreFile="______conf/ssl/keystore\_localhost.pfx_____"   certificateKeystorePassword="_____password______"   certificateKeystoreType="PKCS12" /> 
    </SSLHostConfig>
</Connector>

The default path to store the certificate is:

/opt/keyon/trueBroker/server/conf/ssl/keystore_localhost.pfx

Add certificate to trust store

Add the newly created certificate or if available the certificate of its issuing CA to the true-Store used by true-broker

cd /opt/keyon/trueBroker/jre/lib/security

/opt/keyon/trueBroker/jre/lib/security>../../bin/keytool -importcert -file <pathToCertificate> -keystore cacerts -alias “trueBrokerCaCert”

The default password of the JRE trust store is: changeit

Afterwards please restart the service. See chapter 4.

Allow HTTP access

In case you do not want to issue a certificate, you can allow the plain HTTP connection to true-Broker. To do so, remove the below file:

rm -f /opt/keyon/trueBroker/server/conf/web.xml

And rename the file “web_UNENCRYPTED.xml” to “web.xml”

cd /opt/keyon/trueBroker/server/conf/

/opt/keyon/trueBroker/server/conf/>mv web\_UNENCRYPTED.xml web.xml

Start/stop true-Broker Web

Start true-Broker Web using the following script:

systemctl start trueBroker

Stop true-Broker Web using the following script:

systemctl stop trueBroker

Access true-Broker

The URL to access true-Broker Web Administration is:

http://localhost:8645/TrueBrokerWebAdmin

Please consult the true-Broker Web – User Manual to configure true-Broker Web.