dohertj2/lmxopcua
1
0
Fork 0
Code Issues 4 Pull Requests Actions 1 Packages Projects Releases Wiki Activity

docs(#891): QA box-wide worker denies + deploy-backup lockdown applied on vq03/vq04
v2-ci / unit-tests (push) Waiting to run
Details

Browse Source 
Claude-Session: https://claude.ai/code/session_01GT67ACmpMR7b9LGRPLijMi
This commit is contained in:
Joseph Doherty
2026-11-12 19:26:16 -05:00
parent a17ffb721a
commit f47891ff50
2 changed files with 32 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/deploy/qa-upgrade-b8b4c18f-to-fea7de0a.md
+31
View File
@@ -318,3 +318,34 @@ already passed on docker-dev (§12.4).
- **Rollback of this run:** remove the canary by deleting its rows in the AdminUI and deploying (or restore
`OtOpcUaConfig_pre-fea7de0a_20261112.bak`). The isolation rollback is unchanged: `… -ConfigureHostService -Uninstall`
removes the four recorded denies.
## Box-wide worker denies and backup lockdown (lmxopcua#891, 2026-11-12, owner-approved)
**Owner approval:** the owner approved locking down the registry exports and adding the denies for the other apps' folders. Done on both vq03 and vq04 with the `f75ee7d0` installer staged at `E:\psrem-stage\otopcua-890-f75ee7d0\install`. Order: one `-WhatIf` run, then the apply, then a re-apply that reported all items `unchanged`. No service was restarted.
**1. Registry exports locked down.** These six deploy-backup `.reg` files per box now have a protected DACL allowing only `SYSTEM` and `BUILTIN\Administrators` (FullControl); every other ACE was removed:
- `hg-d8d890c\backup\HistorianGateway-svc-*.reg`
- `mxgw-4f931e4\backup\MxAccessGw-servicekey-*.reg` (2 files)
- `otopcua-b8b4c18f\backup\OtOpcUaHost-service*.reg` (2 files)
- `otopcua-fea7de0a\backup\OtOpcUaHost-pre-fea7de0a.reg`
The files themselves were not deleted, so they still serve as rollback copies.
**2. Box-wide denies.** `-DenyPaths` now lists:
- `E:\ApiInstall\OtOpcUa`, `\pki`, `\data`, and `C:\ProgramData\ZB\kek` (all from before);
- `E:\ApiInstall\ScadaBridge`, `HistorianGateway`, `MxAccessGateway`, `Overview` and `btdbmanager`;
- `E:\psrem-stage` and `E:\psrem`.
`icacls` shows `NT SERVICE\OtOpcUaScriptWorker:(OI)(CI)(DENY)(W,D,WDAC,WO,RD,DC)` on each of these folders, and `reg query` shows the 11 recorded paths. The deny names only the worker identity, so the other apps' service accounts are not affected.
**3. Installer warnings, all checked.**
- The six locked `.reg` files have protected DACLs on purpose.
- On vq04, `C:\ProgramData\ZB\kek\historiangw.kek` and `mxgateway.kek` have protected DACLs that allow only `SYSTEM` and `Administrators`.
None of these grants anything to `Everyone`, `BUILTIN\Users` or `RESTRICTED`. A restricted worker token fails the restricting-SID check on all of them, so they need no deny of their own.
**4. After the change.** `/health/ready` returns 200 on both nodes for OtOpcUa `:9000`, Overview `:5320`, ScadaBridge `:8085` and mxgw `:5130`.
**Deploy procedure from now on.** Write registry exports and appsettings backups into a backup folder that you create with a protected ACL (SYSTEM + Administrators only), and run the installer with the box-wide `-DenyPaths` list above. Any new app folder under `E:\ApiInstall` must be added to the list when it is installed.
**Rollback:** re-run the installer with the previous four-path list to remove the new denies, or use `-Uninstall`. To restore the `.reg` ACLs, run `icacls <file> /reset`.