3.3 Post-installation steps

When LiveCycle is installed, a single default user account is configured for user Super Administrator/ login-id Administrator with a default password of password. You should immediately change this password using the Configuration Manager.

1. Type the following URL in a web browser:

   http://[host name]:[port]/adminui

   The default port number is one of these:

   JBoss: 8080

   WebLogic Server: 7001

   WebSphere: 9080.

2. In the User Name field, type administrator and, in the Password field, type password.

3. Click Settings > User Management > Users and Groups.

4. Type administrator in the Find field, and click Find.

5. Click Super Administrator from the list of users.

6. Click Change Password on the Edit User page.

7. Specify the new password and click Save.

In addition, it is recommended to change the default password for CRX Administrator by performing the following steps:

1. Log into http://[host name]:[port]/lc/libs/granite/security/content/admin.html using the default username/password.

2. Type Administrator in the search field and click Go.

3. Select Administrator from the search result and click the Edit icon at the bottom-right of the user interface.

4. Specify the new password in the New Password field and the old password in the Your Password field.

5. Click the Save icon at the bottom-right of the user interface.

Web Service Definition Language (WSDL) generation should be enabled only for development environments, where WSDL generation is used by developers to build their client applications. You may choose to disable WSDL generation in a production environment to avoid exposing a service’s internal details.

1. Type the following URL in a web browser:

   http://[host name]:[port]/adminui

2. Click Settings > Core System Settings > Configurations.

3. Uncheck Enable WSDL and click OK.

By default, Content Services does not restrict on the amount of data a user can check in to the server at any one time. Large amounts of data are potentially threatening to the system as they leave the system without the resources to perform other operations. This situation can cause a denial of service to other incoming processes. Use JVM arguments to enable quota management in Content Services.

1. Modify [JBOSS_HOME]\server\all\deploy\adobe-ds.xml to add integratedSecurity=true to the connection URL, as shown in this example:

   jdbc:sqlserver://<serverhost>:<port>;databaseName=<dbname>;integratedSecurity=true

2. Add the sqljdbc_auth.dll file to the Windows systems path on the computer that is running the application server. The sqljdbc_auth.dll file is located with the Microsoft SQL JDBC 1.2 driver installation (the default is [InstallDir]/sqljdbc_1.2/enu/auth/x86).

3. Modify JBoss Windows service (JBoss for LiveCycle) property for Log On As from Local System to a login account that has LiveCycle database and a minimum set of privileges. If you are running JBoss from the command line instead of as a Windows service, you do not need to perform this step.

4. Set Security for SQL Server from Mixed mode to Windows Authentication only.

1. Start the WebLogic Server Administration Console by typing the following URL in the URL line of a web browser:

   http://[host name]:7001/console

2. Under Change Center, click Lock & Edit.

3. Under Domain Structure, click [base_domain]> Services > JDBC > Data Sources and, in the right pane, click IDP_DS.

4. On the next screen, on the Configuration tab, click the ConnectionPool tab and, in the Properties box, type integratedSecurity=true.

5. Under Domain Structure, click [base_domain] > Services > JDBC > Data Sources and, in the right pane, click RM_DS.

6. On the next screen, on the Configuration tab, click the Connection Pool tab and, in the Properties box, type integratedSecurity=true.

7. Add the sqljdbc_auth.dll file to the Windows systems path on the computer that is running the application server. The sqljdbc_auth.dll file is located with the Microsoft SQL JDBC 1.2 driver installation (the default is [InstallDir]/sqljdbc_1.2/enu/auth/x86).

8. Set Security for SQL Server from Mixed mode to Windows Authentication only.

On WebSphere, you can configure integrated security only when you use an external SQL Server JDBC driver, not the SQL Server JDBC driver that is embedded with WebSphere.

1. Log in to the WebSphere Administrative Console.

2. In the navigation tree, click Resources > JDBC > Data Sources and, in the right pane, click IDP_DS.

3. In the right pane, under Additional Properties, click Custom Properties, and then click New.

4. In the Name box, type integratedSecurity and, in the Value box, type true.

5. In the navigation tree, click Resources > JDBC > Data Sources and, in the right pane, click RM_DS.

6. In the right pane, under Additional Properties, click Custom Properties, and then click New.

7. In the Name box, type integratedSecurity and, in the Value box, type true.

8. On the computer where WebSphere is installed, add the sqljdbc_auth.dll file to the Windows systems path (C:\Windows). The sqljdbc_auth.dll file is in the same location as the Microsoft SQL JDBC 1.2 driver installation (default is [InstallDir]/sqljdbc_1.2/enu/auth/x86).

9. Select Start > Control Panel > Services, right-click the Windows service for WebSphere (IBM WebSphere Application Server <version> - <node>) and select Properties.

10. In the Properties dialog box, click the Log On tab.

11. Select This Account and provide the information required to set the login account you want to use.

12. Set Security on SQL Server from Mixed mode to Windows Authentication only.

A common attack using LDAP involves an attacker deliberately failing to authenticate multiple times. This forces the LDAP Directory Server to lock out a user from all LDAP-reliant services.

You can set the number of failure attempts and subsequent lock-out time that LiveCycle implements when a user repeatedly fails to authenticate to LiveCycle. In Administration Console, choose low values. When selecting the number of failure attempts, it is important to understand that after all attempts are made, LiveCycle locks out the user before the LDAP Directory Server does.

1. Log in to Administration Console.

2. Click Settings > User Management > Domain Management.

3. Under Automatic Account Locking Settings, set Maximum Consecutive Authentication Failures to a low number, such as 3.

4. Click Save.

The Convert PDF service that is part of LiveCycle requires the following minimum system libraries:

/lib/ 
    libdl.so.2 (0x00964000) 
    ld-linux.so.2 (0x007f6000) 
/lib/tls/ 
    libc.so.6 (0x00813000)     
    libm.so.6 (0x0093f000) 
    libpthread.so.0 (0x00a5d000) 
/usr/lib/libz.so.1 (0x0096a000) 
/gcc410/lib/ 
    libgcc_s.so.1 (0x00fc0000) 
    libstdc++.so.6 (0x00111000)

/usr/platform/SUNW,Sun-Fire-V210/lib/libc_psr.so.1 
/usr/lib/ 
    libc.so.1 
    libdl.so.1 
    libintl.so.1 
    libm.so.1 
    libmp.so.2 
    libnsl.so.1 
    libpthread.so.1 
    libsocket.so.1 
    libstdc++.so.6  
    libthread.so.1

/usr/lib/ 
    libpthread.a(shr_comm.o) 
    libpthread.a(shr_xpg5.o) 
    libc.a(shr.o) 
    librtl.a(shr.o) 
    libpthreads.a(shr_comm.o) 
    libcrypt.a(shr.o) 
/aix5.2/lib/gcc/powerpc-ibm-aix5.2.0.0/4.1.0/libstdc++.a(libstdc++.so.6) 
/aix5.2/lib/gcc/powerpc-ibm-aix5.2.0.0/4.1.0/libgcc_s.a(shr.o)

XMLForms requires the following minimum system libraries:

/lib/ 
    libdl.so.2 
    libpthread.so.0 
    libm.so.6 
    libgcc_s.so.1 
    libc.so.6 
    librt.so.1 
    ld-linux.so.2 
/usr/X11R6/lib/ 
    libX11.so.6

/usr/lib/ 
    libdl.so.1 
    libpthread.so.1 
    libintl.so.1 
    libsocket.so.1 
    libnsl.so.1 
    libm.so.1 
    libc.so.1 
    librt.so.1 
    libX11.so.4 
    libmp.so.2 
    libmd5.so.1 
    libscf.so.1 
    libaio.so.1 
    libXext.so.0 
    libdoor.so.1 
    libuutil.so.1 
    libm.so.2 
usr/platform/SUNW,Sun-Fire-V210/lib/libc_psr.so.1 
usr/platform/SUNW,Sun-Fire-V210/lib/libmd5_psr.so.1

/usr/lib/ 
    libpthread.a(shr_comm.o) 
    libpthread.a(shr_xpg5.o) 
    libc.a(shr.o) 
    librtl.a(shr.o) 
    libdl.a(shr.o) 
    libX11.a(shr4.o) 
    libiconv.a(shr4.o) 
    libpthreads.a(shr_comm.o) 
/unix 
    /usr/lib/libcrypt.a(shr.o) 
    /usr/lib/libIM.a(shr.o) 
    /usr/lib/libpthreads.a(shr_xpg5.o)