Changes

Template:Networking rutos manual administration (view source)

Revision as of 12:45, 6 October 2021

14,206 bytes added ,  12:45, 6 October 2021
no edit summary
Line 1: Line 1:  +
<!--- {{{series}}}, {{{name}}} --->
 +
{{Template: Networking_rutos_manual_fw_disclosure
 +
| fw_version = {{{series}}}{{#ifeq:{{{name}}}|RUT241|M|}}_R_00.07.01
 +
| series    = {{{series}}}
 +
}}
 +
{{#ifeq: {{{series}}} | RUT9 |<br><i><b>Note</b>: <b>[[{{{name}}} Administration (legacy WebUI)|click here]]</b> for the old style WebUI (FW version RUT9XX_R_00.06.08.5 and earlier) user manual page.</i>|}}
 +
{{#ifeq: {{{series}}} | RUT2 |
 +
{{#switch: {{{name}}}
 +
  | RUT241 =
 +
  | #default =
 +
<br><i><b>Note</b>: <b>[[{{{name}}} Administration (legacy WebUI)|click here]]</b> for the old style WebUI (FW version RUT2XX_R_00.01.14.4 and earlier) user manual page.</i>}}
 +
|}}
 
==Summary==
 
==Summary==
 +
 
This page is an overview of the <b>Administration</b> section of {{{name}}} devices.
 
This page is an overview of the <b>Administration</b> section of {{{name}}} devices.
−
  −
{{Template:Networking_rutos_manual_fw_disclosure
  −
| fw_version = {{{series}}}_R_00.02.03
  −
| series = {{{series}}}
  −
}}
      
==General==
 
==General==
Line 11: Line 19:  
The <b>General</b> section is used to set up some of device managerial parameters, such as changing device name. For more information on the General section, refer to figure and table below.
 
The <b>General</b> section is used to set up some of device managerial parameters, such as changing device name. For more information on the General section, refer to figure and table below.
   −
[[File:Networking_rutx_manual_administration_general_v1.png|border|class=tlt-border]]
+
{{#ifeq:{{{series}}}|RUTX|[[File:Networking_{{lc:{{{name}}}}}_manual_administration_general_v2.png|border|class=tlt-border]]
 +
|[[File:Networking_{{lc:{{{name}}}}}_manual_administration_general.png|border|class=tlt-border]]}}
    
<table class="nd-mantable">
 
<table class="nd-mantable">
Line 28: Line 37:  
       <td>string; default: <b>Teltonika-{{{name}}}.com</b></td>
 
       <td>string; default: <b>Teltonika-{{{name}}}.com</b></td>
 
       <td>Device hostname. This can be used for communication with other LAN hosts.</td>
 
       <td>Device hostname. This can be used for communication with other LAN hosts.</td>
 +
    </tr>
 +
    <tr>
 +
      <td>Mode</td>
 +
      <td>Basic {{!}} Advanced; default: <b>Basic</b></td>
 +
      <td>Mode determines what options and configurations are shown. In Basic mode only the essential configurations are shown. In Advanced mode there is greater freedom to configure and access more options.</td>
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
Line 38: Line 52:  
         <td>integer [1..60]; default: <b>none</b></td>
 
         <td>integer [1..60]; default: <b>none</b></td>
 
         <td>Maximum time (in seconds) the button can be held to perform an action, after which no action will be performed.</td>
 
         <td>Maximum time (in seconds) the button can be held to perform an action, after which no action will be performed.</td>
 +
    </tr>
 +
</table>
 +
 +
==Access Control==
 +
===General===
 +
----
 +
The <b>Access Control</b> page is used to manage remote and local access to device.
 +
 +
<b>Important</b>: turning on remote access leaves your device vulnerable to external attackers. Make sure you use a strong password.
 +
<br><br>
 +
<b>SSH</b>
 +
----
 +
[[File:Networking_rutos_manual_administration_access_control_general_ssh.png|border|class=tlt-border]]
 +
 +
<table class="nd-mantable">
 +
    <tr>
 +
        <th>Field</th>
 +
      <th>Value</th>
 +
      <th>Description</th>
 +
    </tr>
 +
    <tr>
 +
        <td>Enable SSH access</td>
 +
        <td>off | on; default: <b>on</b></td>
 +
        <td>Turns SSH access from the local network (LAN) on or off.</td>
 +
    </tr>
 +
    <tr>
 +
        <td>Remote SSH access</td>
 +
        <td>off | on; default: <b>off</b></td>
 +
        <td>Turns SSH access from remote networks (WAN) on or off.</td>
 +
    </tr>
 +
    <tr>
 +
        <td>Port</td>
 +
        <td>integer [0..65535]; default: <b>22</b></td>
 +
        <td>Selects which port to use for SSH access.</td>
 +
    </tr>
 +
</table>
 +
<br>
 +
<b>WebUI</b>
 +
----
 +
[[File:Networking_rutos_manual_administration_access_control_general_webui.png|border|class=tlt-border]]
 +
 +
<table class="nd-mantable">
 +
    <tr>
 +
        <th>Field</th>
 +
      <th>Value</th>
 +
      <th>Description</th>
 +
    </tr>
 +
    <tr>
 +
        <td>Enable HTTP access</td>
 +
        <td>off | on; default: <b>on</b></td>
 +
        <td>Turns HTTP access from the local network (LAN) to the device WebUI on or off.</td>
 +
    </tr><tr><td>Enable HTTPS access
 +
</td><td>off | on; default: <b>on</b></td><td>Turns HTTPS access from the local network (LAN) to the device WebUI on or off.</td></tr><tr>
 +
        <td>Redirect to HTTPS</td>
 +
        <td>off | on; default: <b>off</b></td>
 +
        <td>Redirects connection attempts from HTTP to HTTPS.</td>
 +
    </tr>
 +
    <tr>
 +
        <td>Enable remote HTTP access</td>
 +
        <td>off | on; default: <b>off</b></td>
 +
        <td>Turns HTTP access from remote networks (WAN) to the device WebUI on or off.</td>
 +
    </tr>
 +
    <tr>
 +
        <td>Port</td>
 +
        <td>integer [0..65535]; default: <b>80</b></td>
 +
        <td>Selects which port to use for HTTP access.</td>
 +
    </tr>
 +
    <tr>
 +
        <td>Enable remote HTTPS access</td>
 +
        <td>off | on; default: <b>off</b></td>
 +
        <td>Turns HTTPS access from remote networks (WAN) to the device WebUI on or off.</td>
 +
    </tr>
 +
    <tr>
 +
        <td>Port</td>
 +
        <td>integer [0..65535]; default: <b>443</b></td>
 +
        <td>Selects which port to use for HTTPS access.</td>
 +
    </tr>
 +
</table>
 +
<br>
 +
<b>CLI</b>
 +
----
 +
[[File:Networking_rutos_manual_administration_access_control_general_cli.png|border|class=tlt-border]]
 +
 +
<table class="nd-mantable">
 +
    <tr>
 +
        <th>Field</th>
 +
      <th>Value</th>
 +
      <th>Description</th>
 +
    </tr>
 +
    <tr>
 +
        <td>Enable CLI</td>
 +
        <td>off | on; default: <b>on</b></td>
 +
        <td>Turns CLI access from the local network (LAN) on or off.</td>
 +
    </tr>
 +
    <tr>
 +
        <td>Enable remote CLI</td>
 +
        <td>off | on; default: <b>off</b></td>
 +
        <td>Turns CLI access from remote networks (WAN) on or off.</td>
 +
    </tr>
 +
    <tr>
 +
        <td>Port range</td>
 +
        <td>range of integers [0..65534]-[1..65535]; default: <b>4200-4220</b></td>
 +
        <td>Selects which ports to use for CLI access.</td>
 +
    </tr>
 +
    <tr>
 +
        <td>Shell limit</td>
 +
        <td>integer [1..10]; default: <b>5</b></td>
 +
        <td>Maximum number of active CLI connections.</td>
 +
    </tr>
 +
</table>
 +
<br>
 +
<b>Telnet</b>
 +
----
 +
[[File:Networking_rutos_manual_administration_access_control_general_telnet.png|border|class=tlt-border]]
 +
 +
<table class="nd-mantable">
 +
    <tr>
 +
        <th>Field</th>
 +
      <th>Value</th>
 +
      <th>Description</th>
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
−
  <td>Restore to factory defaults</td>
+
        <td>Enable Telnet access</td>
−
         <td>-(interactive button)</td>
+
        <td>off | on; default: <b>on</b></td>
−
         <td>Restores device to manufacturer's default settings.</td>
+
         <td>Turns Telnet access from the local network (LAN) on or off.</td>
 +
    </tr>
 +
    <tr>
 +
        <td>Enable remote Telnet access</td>
 +
         <td>off | on; default: <b>off</b></td>
 +
        <td>Turns Telnet access from remote networks (WAN) on or off.</td>
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
−
  <td>Restore to user's defaults</td>
+
        <td>Port range</td>
−
         <td>-(interactive button)</td>
+
         <td>integer [0..65535]; default: <b>23</b></td>
−
         <td>Restores device to custom configuration set by the user.</td>
+
         <td>Selects which port to use for Telnet access.</td>
 
     </tr>
 
     </tr>
 
</table>
 
</table>
   −
==Users & recipients==
+
===Security===
 +
----
 +
[[File:Networking_rutos_manual_administration_access_control_security.png|border|class=tlt-border]]
   −
The <b>Users & recipients</b> section is used to configure phone groups and email users.  
+
<table class="nd-mantable">
 +
    <tr>
 +
        <th>Field</th>
 +
      <th>Value</th>
 +
      <th>Description</th>
 +
    </tr>
 +
    <tr>
 +
        <td>Fail count</td>
 +
        <td>integer; default: <b>10</b></td>
 +
        <td>An amount of times IP address can try to access SSH or WebUI before being blocked.</td>
 +
    </tr>
 +
    <tr>
 +
        <td>Blocked address</td>
 +
        <td>ip</td>
 +
        <td>IP address which was blocked due to reaching fail count limit.</td>
 +
    </tr>
 +
    <tr>
 +
        <td>Failed attempts</td>
 +
        <td>integer</td>
 +
        <td>Amount of times IP address tried to access SSH or WebUI after getting blocked.</td>
 +
    </tr>
 +
</table>
   −
===Phone groups===
+
===Root CA===
 
----
 
----
−
The <b>Phone groups</b> section is used to manage groups of phone numbers.
+
The <b>Root CA</b> section is used to add a root CA certificate file to the device. There is a default file already preloaded on the device which will be overwritten by any uploaded file. The certificates must be in .pem format, maximum file size is 300 KB. These certificates are only needed if you want to use HTTPS for your services and the default file should be sufficient in most cases.
   −
Refer to the figure below for information on device Phone groups page.
+
[[File:Networking_rutos_manual_administration_access_control_root_ca.png|border|class=tlt-border]]
   −
[[File:Networking_rutx_manual_administration_phone_groups_v1.png]]
+
==Recipients==
   −
You can create a group by writing its name and clicking <b>Add</b> button. To configure group, choose group you want to configure from the list and click [[File:Networking rutx manual edit button v1.png]] <b>Edit</b> button, located at the right side of it.
+
The <b>Recipients</b> section is used to configure{{#ifeq:{{{mobile}}}|0|&nbsp;|&nbsp;phone groups and&nbsp;}}email
 +
users, which can later be used along with{{#ifeq:{{{mobile}}}|0|&nbsp;|&nbsp;SMS or&nbsp;}}email related
 +
services{{#ifeq:{{{events_reporting}}}|0|.|, such as [[{{{name}}} Events Reporting|Events Reporting]].}}
   −
===Modify phone group===
+
{{#ifeq:{{{mobile}}}|0||
 +
 
 +
===Phone Groups===
 
----
 
----
 +
A <b>Phone Group</b> is a collection of phone numbers that can be used as the recipient in SMS & call related services instead of specifying every number individually. The phone group list is empty by default thus, you must first add at least one new group before you can add phone numbers to it. To create and begin editing a phone group, follow these steps:
   −
[[File:Networking_rutx_manual_administration_phone_groups_setup_v1.png]]
+
<ol>
 +
    <li>Enter a custom name for the phone group into the 'Name' field.</li>
 +
    <li>Click the 'Add' button.</li>
 +
    <li>Click the 'Edit' button next to the newly added phone group.</li>
 +
</ol>
 +
 
 +
[[File:Networking_rutos_manual_administration_recipients_phone_groups_add_button_edit_button.png|border|class=tlt-border]]
 +
 
 +
After clicking 'Edit' you should be redirected to that phone group's configuration page where you can start adding phone numbers to it.
 +
 
 +
[[File:Networking_rutos_manual_administration_recipients_phone_groups_modify_phone_group.png|border|class=tlt-border]]
    
<table class="nd-mantable">
 
<table class="nd-mantable">
Line 84: Line 261:  
       <td>Phone number</td>
 
       <td>Phone number</td>
 
       <td>string; default: <b>none</b></td>
 
       <td>string; default: <b>none</b></td>
−
       <td>A phone number entry for this group. A phone number containing 0-9*+# characters is accepted.</td>
+
       <td>A phone number entry for this group. Numbers that consist of <i>0-9*+#</i> characters are accepted. Click the plus symbol to add more entries.</td>
 
     </tr>
 
     </tr>
 
</table>
 
</table>
 +
}}
   −
===Email users===
+
===Email Accounts===
 
----
 
----
−
The <b>Email users</b> section is used to manage email configurations.
+
When email related services{{#ifeq:{{{events_reporting}}}|0|&nbsp;|&nbsp;(such as [[{{{name}}} Events Reporting|Events Reporting]])&nbsp;}}are used, the device logs in to the specified email account and reads the inbox (e.g., Email to SMS) or sends out a message (e.g., SMS to Email) depending on the configured service. In this context, an <b>Email Account</b> is an configuration instance that contains the necessary data required in order to log into an email account.
   −
Refer to the figure below for information on device Email users page.
+
The email accounts list is empty by default thus, you must first add at least one new account before you can configure it. To create and begin editing an email account, follow these steps:
   −
[[File:Networking_rutx_manual_administration_email_users_v1.png]]
+
<ol>
 +
    <li>Enter a custom name for the email account into the 'Name' field.</li>
 +
    <li>Click the 'Add' button.</li>
 +
    <li>Click the 'Edit' button next to the newly added email account.</li>
 +
</ol>
   −
You can create user by writing its name and clicking <b>Add</b> button. To configure email user, choose user you want to configure from the list and click [[File:Networking rutx manual edit button v1.png]] <b>Edit</b> button, located at the right side of it.
+
[[File:Networking_rutos_manual_administration_recipients_email_accounts_groups_add_button_edit_button.png|border|class=tlt-border]]
   −
===Modify email user===
+
After clicking 'Edit' you should be redirected to that email account's settings page where you can start configuring the account.
−
----
     −
[[File:Networking_rutx_manual_administration_email_users_setup_v1.png]]
+
[[File:Networking_rutos_manual_administration_recipients_email_accounts_modify_email_account.png|border|class=tlt-border]]
    
<table class="nd-mantable">
 
<table class="nd-mantable">
Line 117: Line 298:  
       <td>SMTP server</td>
 
       <td>SMTP server</td>
 
       <td>string; default: <b>none</b></td>
 
       <td>string; default: <b>none</b></td>
−
       <td>SMTP server name.</td>
+
       <td>Name of the email service provider's SMTP server.</td>
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
 
       <td>SMTP server port</td>
 
       <td>SMTP server port</td>
 
       <td>integer [0..65535]; default: <b>none</b></td>
 
       <td>integer [0..65535]; default: <b>none</b></td>
−
       <td>SMTP server port.</td>
+
       <td>Port of the email service provider's SMTP server.</td>
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
 
       <td>User name</td>
 
       <td>User name</td>
 
       <td>string; default: <b>none</b></td>
 
       <td>string; default: <b>none</b></td>
−
       <td>Username used in authentication to SMTP server.</td>
+
       <td>Username used to authenticate to the email service.</td>
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
 
       <td>Password</td>
 
       <td>Password</td>
 
       <td>string; default: <b>none</b></td>
 
       <td>string; default: <b>none</b></td>
−
       <td>Password used in authentication to SMTP server.</td>
+
       <td>Password used to authenticate to the email service..</td>
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
 
       <td>Sender's email address</td>
 
       <td>Sender's email address</td>
 
       <td>string; default: <b>none</b></td>
 
       <td>string; default: <b>none</b></td>
−
       <td>Configured SMTP server's user's email address.</td>
+
       <td>Configured SMTP server user's email address.</td>
 
     </tr>
 
     </tr>
 
</table>
 
</table>
   −
==Access Control==
+
==Certificates==
−
===General===
+
 
 +
The <b>Certificates</b> page is used for convenient TLS certificate and key generation and management. Generated files can be exported and used on other machines or locally on this device with functions that use TLS/SSL, such as {{#ifeq:{{{mqtt}}}|0||[[{{{name}}} MQTT|MQTT]],&nbsp;}}[[{{{name}}} VPN#OpenVPN|OpenVPN]], [[{{{name}}} VPN#IPsec|IPsec]] and others.
 +
 
 +
===Certificate Generation===
 +
----
 +
The <b>Certificate Generation</b> tab provides the possibility to generate TLS certificates required for secure authentication and communication encryption used by some of the devices services.
 +
 
 +
There are five distinct generation methods (denoted by the selected 'File Type').
   −
The <b>Access Control</b> page is used to manage remote and local access to the router.
+
<ol>
 +
    <li><b>Simple</b> - generates and signs a set of 2048 bit certificate and key files that include:
 +
        <ul>
 +
            <li>Certificate Authority (CA)</li>
 +
            <li>Server certificate & key</li>
 +
            <li>Client certificate & key</li>
 +
            <li>DH Parameters</li>
 +
        </ul>The CA file generated with this option automatically signs the certificates. In short, this option is used for convenience as it doesn't let the user set any additional parameters for the certificate files. Therefore, it should be used only when no other specific requirements are expected.
 +
    </li>
 +
    <li><b>CA</b> - generates a Certificate Authority (CA) file. A CA is a type of certificate file that certifies the ownership of a public key by the named subject of the certificate. In other words, it assures clients that they are connecting to a trusted server and vice versa.</li>
 +
    <li><b>Server</b> - generates a server certificate and key. A server certificate validates a server's identity to connecting clients, while a key is responsible for encryption.</li>
 +
    <li><b>Client</b> - generates a client certificate and key. A client certificate validates a client's identity to the server that it's connecting to, while a key is responsible for encryption.</li>
 +
    <li><b>DH Parameters</b> - generates a Diffie-Hellman (DH) parameters file. DH parameters are used in symmetric encryption to protect and define how OpenSSL key exchange is performed.</li>
 +
</ol>
   −
<b>Important</b>: turning on remote access leaves the router vulnerable to external attackers. Make sure you use a strong password.
+
====Generation Parameters====
−
<br><br>
+
----
−
<b>SSH</b>
+
Generating each type of file (excluding 'Simple') requires setting some parameters. This section provides an overview for parameters used in TLS certificate generation.
 
----
 
----
−
[[File:Networking_rutx_manual_administration_access_control_general_ssh_v1.png]]
+
<b>Core parameters</b> or simply parameters that apply to each file type are the size and common name of the generated file(s).
 +
 
 +
[[File:Networking_rutos_manual_administartion_certificates_certificates_generation_core_parameters_v1.png|border|class=tlt-border]]
    
<table class="nd-mantable">
 
<table class="nd-mantable">
Line 159: Line 362:  
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
−
        <td>Enable SSH access</td>
+
      <td>Key Size</td>
−
        <td>off | on; default: <b>on</b></td>
+
      <td>integer; default: <b>2048</b></td>
−
        <td>Turns SSH access from the local network (LAN) on or off.</td>
+
      <td>Generated key size in bits. Larger keys provide more security but take longer to generate. A 2048 bit is the preferred option.</td>
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
−
        <td>Remote SSH access</td>
+
      <td>Name (CN)</td>
−
        <td>off | on; default: <b>off</b></td>
+
      <td>string; default: <b>cert</b></td>
−
        <td>Turns SSH access from remote networks (WAN) on or off.</td>
+
      <td>Common Name (CN), aka Fully Qualified Domain Name (FQDN) is a parameter that defines the name of the certificate. It should be chosen with care as it is not only used for easier management. For example, the Common Name should typically hostname of the server. It may also be used to differentiate clients in order to apply client-specific settings.</td>
−
    </tr>
  −
    <tr>
  −
        <td>Port</td>
  −
        <td>integer [0..65535]; default: <b>22</b></td>
  −
        <td>Selects which port to use for SSH access.</td>
   
     </tr>
 
     </tr>
 
</table>
 
</table>
−
<br>
  −
<b>WebUI</b>
   
----
 
----
−
[[File:Networking_rutx_manual_administration_access_control_general_webui_v2.png|border|class=tlt-border]]
+
<b>Subject information</b> is not mandatory but can be used as user-friendly way to identify the ownership of certificate files by including such information as the owner's location and company name.
 +
 
 +
[[File:Networking_rutos_manual_administartion_certificates_certificates_generation_subject_information_v1.png|border|class=tlt-border]]
 +
----
 +
The <b>Sign the certificate</b> slider control whether the certificate will be signed automatically or manually after the generation is complete.
 +
 
 +
[[File:Networking_rutos_manual_administartion_certificates_certificates_generation_sign_the_certificate_v1.png|border|class=tlt-border]]
    
<table class="nd-mantable">
 
<table class="nd-mantable">
Line 186: Line 388:  
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
−
        <td>Enable HTTP access</td>
+
      <td>Days Valid</td>
−
        <td>off | on; default: <b>on</b></td>
+
      <td>integer; default: <b>3650</b></td>
−
        <td>Turns HTTP access from the local network (LAN) to the router's WebUI on or off.</td>
+
      <td>Length of the signature's validity.</td>
−
    </tr><tr><td>Enable HTTPS access
  −
</td><td>off | on; default: <b>on</b></td><td>Turns HTTPS access from the local network (LAN) to the router's WebUI on or off.</td></tr><tr>
  −
        <td>Redirect to HTTPS</td>
  −
        <td>off | on; default: <b>off</b></td>
  −
        <td>Redirects connection attempts from HTTP to HTTPS.</td>
   
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
−
        <td>Enable remote HTTP access</td>
+
      <td>CA File Name</td>
−
        <td>off | on; default: <b>off</b></td>
+
      <td>filename; default: <b>none</b></td>
−
        <td>Turns HTTP access from remote networks (WAN) to the router's WebUI on or off.</td>
+
      <td>Selects which CA file will be used to sign the generated certificate.</td>
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
−
        <td>Port</td>
+
      <td>CA key</td>
−
        <td>integer [0..65535]; default: <b>80</b></td>
+
      <td>filename; default: <b>none</b></td>
−
        <td>Selects which port to use for HTTP access.</td>
+
      <td>Selects which CA key file will be used to sign the generated certificate.</td>
−
    </tr>
  −
    <tr>
  −
        <td>Enable remote HTTPS access</td>
  −
        <td>off | on; default: <b>off</b></td>
  −
        <td>Turns HTTPS access from remote networks (WAN) to the router's WebUI on or off.</td>
   
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
−
        <td>Port</td>
+
      <td>Delete Signing Request</td>
−
        <td>integer [0..65535]; default: <b>443</b></td>
+
      <td>off | on; default: <b>off</b></td>
−
        <td>Selects which port to use for HTTPS access.</td>
+
      <td>Generation creates additional 'signing request' files (which appear under the [[#Certificate_Manager|Certificate Manager]] tab) that are later used to sign the generated certificates. When this option is set to 'on', the device deletes the signing request files after the signing process is complete.</td>
 
     </tr>
 
     </tr>
 
</table>
 
</table>
−
<br>
  −
<b>CLI</b>
   
----
 
----
−
[[File:Networking_rutx_manual_administration_access_control_general_cli_v1.png]]
+
A <b>Private Key Decryption Password</b> is a parameter used to decrypt private keys protected by a password.
 +
 
 +
[[File:Networking_rutos_manual_administartion_certificates_certificates_generation_private_key_decryption_password_v1.png|border|class=tlt-border]]
 +
 
 +
===Certificate Signing===
 +
----
 +
The <b>Certificate Signing</b> section is used to validate (sign) unsigned certificates.
 +
 
 +
[[File:Networking_rutos_manual_administartion_certificates_certificates_generation_certificate_signing_v1.png|border|class=tlt-border]]
    
<table class="nd-mantable">
 
<table class="nd-mantable">
Line 228: Line 426:  
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
−
        <td>Enable CLI</td>
+
      <td>Signed Certificate Name</td>
−
        <td>off | on; default: <b>on</b></td>
+
      <td>string; default: <b>cert</b></td>
−
        <td>Turns CLI access from the local network (LAN) on or off.</td>
+
      <td>Name of the signed certificate.</td>
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
−
        <td>Enable remote CLI</td>
+
      <td>Type of Certificate to Sign</td>
−
        <td>off | on; default: <b>off</b></td>
+
      <td>Certificate Authority | Client Certificate | Server Certificate; default: <b>Certificate Authority</b></td>
−
        <td>Turns CLI access from remote networks (WAN) on or off.</td>
+
      <td>Specifies what type of file will be signed.</td>
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
−
        <td>Port range</td>
+
      <td>Certificate Request File</td>
−
        <td>range of integers [0..65534]-[1..65535]; default: <b>4200-4220</b></td>
+
      <td>file; default: <b>none</b></td>
−
        <td>Selects which ports to use for CLI access.</td>
+
      <td>Specifies the signing request file linked to the certificate.</td>
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
−
        <td>Shell limit</td>
+
      <td>Days Valid</td>
−
        <td>integer [1..10]; default: <b>5</b></td>
+
      <td>integer; default: <b>3650</b></td>
−
        <td>Maximum number of active CLI connections.</td>
+
      <td>Length of the signature's validity.</td>
 
     </tr>
 
     </tr>
−
</table>
  −
  −
===Security===
  −
----
  −
[[File:Networking_rutx_manual_administration_access_control_security_v1.png]]
  −
  −
<table class="nd-mantable">
   
     <tr>
 
     <tr>
−
        <th>Field</th>
+
      <td>Certificate Authority File</td>
−
       <th>Value</th>
+
       <td>filename; default: <b>none</b></td>
−
       <th>Description</th>
+
       <td>Selects which CA file will be used to sign the generated certificate.</td>
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
−
        <td>Fail count</td>
+
      <td>Certificate Authority Key</td>
−
        <td>integer; default: <b>10</b></td>
+
      <td>filename; default: <b>none</b></td>
−
        <td>An amount of times IP address can try to access SSH or WebUI before being blocked.</td>
+
      <td>Selects which CA key file will be used to sign the generated certificate.</td>
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
−
        <td>Blocked address</td>
+
      <td>Delete Signing Request</td>
−
        <td>ip</td>
+
      <td>off | on; default: <b>off</b></td>
−
        <td>IP address which was blocked due to reaching fail count limit.</td>
+
      <td>Generation creates additional 'signing request' files (which appear under the [[#Certificate_Manager|Certificate Manager]] tab) that are later used to sign the generated certificates. When this option is set to 'on', the device deletes the signing request files after the signing process is complete.</td>
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
−
        <td>Failed attempts</td>
+
      <td>Sign</td>
−
        <td>integer</td>
+
      <td>- (interactive button)</td>
−
        <td>Amount of times IP address tried to access SSH or WebUI after getting blocked.</td>
+
      <td>Signs the certificate on click.</td>
 
     </tr>
 
     </tr>
 
</table>
 
</table>
   −
==Diagnostics==
+
===Certificate Manager===
 +
----
 +
The <b>Certificate Manager</b> page displays information on all certificate and key files stored on the device and provides the possibility export these files for use on another machine or import files generated elsewhere.
 +
 
 +
====Certificate Import====
 +
----
 +
The <b>Certificate Import</b> section provides the possibility to import certificates and files generated on another machine. To upload such a file simply click 'Browse' and locate the file on your computer, it should then start uploading automatically.
 +
 
 +
[[File:Networking_rutos_manual_administartion_certificates_certificates_manager_certificate_import_v1.png|border|class=tlt-border]]
   −
The <b>Diagnostics</b> section is used to execute simple network diagnostic tests, including <i>ping</i>, <i>traceroute</i> and <i>nslookup</i>.
+
====Certificates, Keys & Requests====
 +
----
 +
The <b>Certificates</b>, <b>Keys</b> and </b>Requests</b> section display files generated on or imported to the device along with the most important information related to them.
 +
 
 +
By default, the lists are empty. A set certificates generated using 'Simple' file type would look something like this:
 +
 
 +
[[File:Networking_rutos_manual_administartion_certificates_certificates_manager_certificate_list_v1.png|border|class=tlt-border]]
 +
 
 +
The 'Export' buttons are used to download the files from the device onto your local machine. The 'X' buttons located to the right of each entry are used to delete related files.
 +
 
 +
==Troubleshoot==
 +
 
 +
===Logging Settings===
 +
----
 +
The <b>Logging Settings</b> section is used to configure how and where the device stores system log data. The system log is a file that contains information on various system related events and is useful to engineers for troubleshooting the device.
   −
[[File:{{{file_diagnostics}}}]]
+
[[File:Networking_rutos_manual_administration_troubleshoot_logging_settings.png|border|class=tlt-border]]
    
<table class="nd-mantable">
 
<table class="nd-mantable">
Line 289: Line 502:  
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
−
       <td>Method</td>
+
       <td>System log buffer size</td>
−
       <td>Ping | Traceroute | Nslookup; default: <b>Ping</b></td>
+
       <td>integer; default: <b>128</b></td>
−
       <td>Selects diagnostic method.
+
       <td>System log buffer size in kibibytes (KiB).</td>
−
            <ul>
+
    </tr>
−
                <li><b>Ping</b> - sends ICMP requests to the specified address.</li>
+
    <tr>
−
                <li><b>Traceroute</b> - displays the path that packets have to take in order to reach the specified address.</li>
+
      <td>External system log server</td>
−
                <li><b>Nslookup</b> - obtains domain name address and IP address mapping information.</li>
+
      <td>ip; default: <b>none</b></td>
−
            </ul>
+
      <td>IP address of an external server that will be used to store device logs.</td>
−
        </td>
+
    </tr>
 +
    <tr>
 +
      <td>External system log server port</td>
 +
      <td>integer [0..65535]; default: <b>none</b></td>
 +
      <td>TCP/UDP port number of the external log server.</td>
 +
    </tr>
 +
    <tr>
 +
      <td>External system log server protocol</td>
 +
      <td>UDP | TCP; default: <b>UDP</b></td>
 +
      <td>Communication protocol used by the external log server.</td>
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
−
       <td>Protocol</td>
+
       <td>Save log in</td>
−
       <td>IPv4 | IPv6; default: <b>IPv4</b></td>
+
       <td>RAM memory | Flash memory; default: <b>RAM memory</b></td>
−
       <td>Selects IP address family for diagnostic test.</td>
+
       <td>Specifies which type of memory to use for storing system logs.</td>
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
−
       <td>Address</td>
+
       <td>Show hostname</td>
−
       <td>ip | host; default: <b>none</b></td>
+
       <td>off | on; default: <b>off</b></td>
−
       <td>IP address or hostname on which the diagnostic test will be performed.</td>
+
       <td>Show hostname instead of IP address in syslog.</td>
 
     </tr>
 
     </tr>
 
</table>
 
</table>
   −
==Troubleshoot==
+
===Troubleshoot===
 +
----
 +
The <b>Troubleshoot</b> section is used to download various files that contain information used for troubleshooting the device. Refer to the figure and table below for information on the Troubleshoot page.
   −
The <b>Troubleshoot</b> section is used to download various files that contain information used for troubleshooting the router. Refer to the figure and table below for information on the Troubleshoot page.
+
[[File:Networking_rutos_manual_administration_troubleshoot_troubleshoot.png|border|class=tlt-border]]
−
 
  −
[[File:{{{file_troubleshoot}}}]]
      
<table class="nd-mantable">
 
<table class="nd-mantable">
Line 326: Line 548:  
         <td>System log</td>
 
         <td>System log</td>
 
         <td>- (interactive button)</td>
 
         <td>- (interactive button)</td>
−
         <td>Displays the contents of the router's system log file. The system log contains records of various system related events, such as starts/stops of various services, errors, reboots, etc.</td>
+
         <td>Displays the contents of the device system log file. The system log contains records of various system related events, such as starts/stops of various services, errors, reboots, etc.</td>
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
 
         <td>Kernel log</td>
 
         <td>Kernel log</td>
 
         <td>- (interactive button)</td>
 
         <td>- (interactive button)</td>
−
         <td>Displays the contents of the router's kernel log file. The kernel log contains records of various events related to the processes of the operating system (OS).</td>
+
         <td>Displays the contents of the device kernel log file. The kernel log contains records of various events related to the processes of the operating system (OS).</td>
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
 
         <td>Troubleshoot file</td>
 
         <td>Troubleshoot file</td>
 
         <td>- (interactive button)</td>
 
         <td>- (interactive button)</td>
−
         <td>Downloads the router's Troubleshoot file. It contains the router's configuration information, logs and some other files. When requesting support, it is recommended to always provide the router's Troubleshoot file to Teltonika engineers for analysis.</td>
+
         <td>Downloads the device Troubleshoot file. It contains the device configuration information, logs and some other files. When requesting support, it is recommended to always provide the device Troubleshoot file to Teltonika engineers for analysis.</td>
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
−
         <td>TCP dump file</td>
+
         <td>TCP dump file<span class="asterisk">*</span></td>
 
         <td>- (interactive button)</td>
 
         <td>- (interactive button)</td>
−
         <td>Downloads the router's TCP dump file. TCP dump is a program used to capture packets moving through network interfaces. By default, the router does not store TCP dump information. You must enable TCP dump and save the changes before you can download the file.</td>
+
         <td>Downloads the device TCP dump file. TCP dump is a program used to capture packets moving through network interfaces. By default, the device does not store TCP dump information. You must enable TCP dump and save the changes before you can download the file.</td>
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
Line 350: Line 572:  
</table>
 
</table>
   −
<font size="-1"><span class="asterisk">*</span> More on TCP dump in the [[#TCP_dump|next section]].</font>
+
<font size="-1"><span class="asterisk">*</span> As of {{{series}}}_R_00.07.00, TCPdump is not part of core functionality anymore. To see these options, the TCPdump package must be downloaded from [[{{{name}}}_Package_Manager|Package Manager]].</font>
   −
===TCP dump===
+
====TCP dump====
 
----
 
----
−
<b>TCP dump</b> is a program used to capture packets moving through network interfaces. By default, the router does not store TCP dump information. You must enable TCP dump and save the changes before you can download the file.  
+
<b>TCP dump</b> is an <i>optional</i> downloadable functionality<span class="asterisk">*</span> used to capture packets moving through network interfaces. By default, the device does not store TCP dump information. You must enable TCP dump and save the changes before you can download the file.  
    
If you enable TCP dump, you will notice additional configuration fields appear. Refer to the figure and table below for realted information.
 
If you enable TCP dump, you will notice additional configuration fields appear. Refer to the figure and table below for realted information.
   −
[[File:{{{file_tcpdump}}}]]
+
<font size="-1"><span class="asterisk">*</span> You can download the TCPdump package from [[{{{name}}}_Package_Manager|Package Manager]].</font>
 +
 
 +
[[File:Networking_rutos_manual_administration_troubleshoot_tcp_dump.png|border|class=tlt-border]]
    
<table class="nd-mantable">
 
<table class="nd-mantable">
Line 378: Line 602:  
     <tr>
 
     <tr>
 
         <td>Select protocol filter</td>
 
         <td>Select protocol filter</td>
−
         <td>all | icmp | tcp | udp | arp; default: <b>All</b></td>
+
         <td>All | ICMP | TCP | UDP | ARP; default: <b>All</b></td>
 
         <td>Only captures packets that match the specified protocol.</td>
 
         <td>Only captures packets that match the specified protocol.</td>
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
 
         <td>Select packets direction</td>
 
         <td>Select packets direction</td>
−
         <td>IN/OUT | Incoming | Outgoing; default: <b>IN/OUT</b></td>
+
         <td>Incoming/Outgoing | Incoming | Outgoing; default: <b>Incoming/Outgoing</b></td>
 
         <td>Only captures packets coming from the specified direction.</td>
 
         <td>Only captures packets coming from the specified direction.</td>
 
     </tr>
 
     </tr>
Line 398: Line 622:  
     <tr>
 
     <tr>
 
         <td>Select storage</td>
 
         <td>Select storage</td>
−
         <td>Internal storage | / ; default: <b>Internal storage</b></td>
+
         <td>RAM memory; default: <b>RAM memory</b></td>
 
         <td>Specifies where the TCP dump file will be stored.</td>
 
         <td>Specifies where the TCP dump file will be stored.</td>
 
     </tr>
 
     </tr>
 
</table>
 
</table>
    +
===Diagnostics===
 +
----
 +
The <b>Diagnostics</b> section is used to execute simple network diagnostic tests, including <i>ping</i>, <i>traceroute</i> and <i>nslookup</i>.
    +
[[File:Networking_rutos_manual_administration_troubleshoot_diagnostics.png|border|class=tlt-border]]
   −
==Root CA==
+
<table class="nd-mantable">
−
 
+
    <tr>
−
The <b>Root CA</b> section is used to add a root CA certificate file to the router. There is a default file already preloaded on the device which will be overwritten by any uploaded file. The certificates must be in .pem format, maximum file size is 300 KB. These certificates are only needed if you want to use HTTPS for your services and the default file should be sufficient in most cases.
+
        <th>Field</th>
−
 
+
      <th>Value</th>
−
[[File:{{{file_root_ca}}}]]
+
      <th>Description</th>
 +
    </tr>
 +
    <tr>
 +
      <td>Method</td>
 +
      <td>Ping | Traceroute | Nslookup; default: <b>Ping</b></td>
 +
      <td>Selects diagnostic method.
 +
            <ul>
 +
                <li><b>Ping</b> - sends ICMP requests to the specified address.</li>
 +
                <li><b>Traceroute</b> - displays the path that packets have to take in order to reach the specified address.</li>
 +
                <li><b>Nslookup</b> - obtains domain name address and IP address mapping information.</li>
 +
            </ul>
 +
        </td>
 +
    </tr>
 +
    <tr>
 +
      <td>Protocol</td>
 +
      <td>IPv4 | IPv6; default: <b>IPv4</b></td>
 +
      <td>Selects IP address family for diagnostic test.</td>
 +
    </tr>
 +
    <tr>
 +
      <td>Address</td>
 +
      <td>ip | host; default: <b>none</b></td>
 +
      <td>IP address or hostname on which the diagnostic test will be performed.</td>
 +
    </tr>
 +
    <tr>
 +
        <td>Perform</td>
 +
      <td>-(interactive button)</td>
 +
      <td>Performs diagnostic test when clicked.</td>
 +
    </tr>
 +
</table>
    
[[Category:{{{name}}} System section]]
 
[[Category:{{{name}}} System section]]
Retrieved from "https://wiki.teltonika-networks.com/view/Special:MobileDiff/60702...84764"

Navigation menu