0% found this document useful (0 votes)

7 views59 pages

Server Installation Linux

The ARIS 10 Server Installation Guide for Linux provides detailed instructions for installing and configuring the ARIS server on Linux systems, including prerequisites and setup scenarios. It covers remote installation processes, database configurations, and security recommendations. The document emphasizes the importance of following specific procedures and accessing necessary resources from the ARIS Download Center and Documentation website.

Uploaded by

kairadzai

We take content rights seriously. If you suspect this is your content, claim it here.

Available Formats

Download as PDF, TXT or read online on Scribd

0% found this document useful (0 votes)

7 views59 pages

Server Installation Linux

Uploaded by

kairadzai

We take content rights seriously. If you suspect this is your content, claim it here.

Available Formats

Download as PDF, TXT or read online on Scribd

ARIS 10

SERVER INSTALLATION
GUIDE - LINUX

OCTOBER 2025
This document applies to ARIS Version 10 and to all subsequent releases.
Specifications contained herein are subject to change and these changes will be reported in
subsequent release notes or new editions.
Copyright © 2010-2025 SAG ARIS GmbH, Saarbrücken, Germany and/or its subsidiaries and/or
its affiliates and/or their licensors.
The name Software AG and all SAG ARIS GmbH product names are either trademarks or
registered trademarks of Software GmbH and/or SAG ARIS GmbH and/or its subsidiaries
and/or its affiliates and/or their licensors. Other company and product names mentioned
herein may be trademarks of their respective owners.
This software may include portions of third-party products. For third-party copyright notices,
license terms, additional rights or restrictions, please refer to "License Texts, Copyright
Notices and Disclaimers of Third Party Products". For certain specific third-party license
restrictions, please refer to section E of the Legal Notices available under "License Terms and
Conditions for Use of Software GmbH Products / Copyright and Trademark Notices of
Software GmbH Products". These documents are part of the product documentation, located
at [Link] and/or in the root installation directory of the licensed
product(s).
Use, reproduction, transfer, publication or disclosure is prohibited except as specifically
provided for in your License Agreement with SAG ARIS GmbH.
SERVER INSTALLATION GUIDE - LINUX

Contents
Contents ........................................................................................................................................................... I
1 Installation................................................................................................................................................ 1

General prerequisites ................................................................................................................................... 3

2 Setup scenarios ..................................................................................................................................... 5

2.1 Change default installation directory or default user ...................................................... 8
2.2 Installing ARIS server using the standard database ......................................................... 8
2.3 Installing ARIS server using a Microsoft SQL Server....................................................... 13
2.4 Installing ARIS server using an Oracle database ............................................................. 19
2.5 How to start ARIS Cloud Controller (ACC) ......................................................................... 26
3 Configure ARIS server ........................................................................................................................28
3.1 Security advice ........................................................................................................................ 31
3.1.1 Make TLS certificate available for ARIS server ...................................................... 31
3.1.2 Safety recommendation: Block AJP ports.............................................................. 32
3.1.3 Check open AJP ports (Ghostcat vulnerability) .................................................... 32
3.2 Database connection ............................................................................................................. 35
3.2.1 Configure the database connection for additional schemes ............................. 35
3.2.2 Update external service (database clusters) ......................................................... 36
3.2.3 Encrypt passwords ......................................................................................................38
3.3 Elasticsearch............................................................................................................................ 39
3.3.1 Check user name and password (Elasticsearch)................................................... 39
3.3.2 Change user name and password (Elasticsearch) ............................................... 40
3.3.3 Disable authentication for Elasticsearch ................................................................ 41
3.4 How to check the virtual memory setting ......................................................................... 41
3.5 Mailing ....................................................................................................................................... 42
3.5.1 Configure ARIS agent mail server connection ....................................................... 42
3.5.2 Configure SMTP mail server connection .................................................................44
3.6 Make fonts available ...............................................................................................................46
3.6.1 Manage fonts in ARIS.................................................................................................. 48
3.6.2 Add fonts in ARIS Architect ...................................................................................... 48
3.7 Make online help available (optional).................................................................................. 49
3.8 Redirect ports ..........................................................................................................................50
3.9 Redirect HTTPS port............................................................................................................... 52
3.10 Use external load balancer ................................................................................................... 53
4 Support and legal information .......................................................................................................... 55
4.1 Documentation scope............................................................................................................ 55
4.2 Support ..................................................................................................................................... 55

I
SERVER INSTALLATION GUIDE - LINUX

1 Installation
This chapter describes the single node installation of an ARIS server using the Windows setup
program. For further information, read the relevant documents on the ARIS Documentation
website ([Link] or download them from ARIS Download Center
([Link]
To install ARIS server on Linux systems, the ARIS agent must be provided (page 5) first. The
required files are available in the installation folder
<ARIS_Installation_and_Documentation-<version>>\Linux setup that you can download
from the ARIS Download Center (login required). After you have copied and installed the files,
you must start the remote installation from a Windows system. If you do not want to run the
setup remotely from a Windows machine, you must execute all required steps manually using
ARIS Cloud Controller. For more information on manual setup, refer to the ARIS Distributed
Installation Cookbook. The necessary knowledge can only be acquired by attending the
ARIS Server Installation training course, which is available at ARIS Academy.
If you run an ARIS server Windows setup remotely, the following components are installed:
 ARIS Cloud Controller (ACC)
 ARIS agent
 ARIS server*
 Viewer*
 Designer*: The functionalities workflows‚ Share model, Change request and Approve
model are available using an ARIS server license. For full ARIS Process Governance
functionality, you need to purchase and import an ARIS Process Governance license.
 ARIS download client: Authorized users can start ARIS download clients within their
browsers. All necessary files are downloaded from the ARIS server to a local directory.
Users do not need a local ARIS client installation.
 The default tenant for all user data.
 The master infrastructure tenant.
 ARIS Risk and Compliance (optionally): The installation procedure is described in the
ARIS Risk and Compliance Installation Guide (see ARIS installation package).
 Dashboards (optionally)*
*The functional range depends on the server license that you have purchased (see ARIS
Product Feature Matrix). Read the documents on the ARIS Documentation website
([Link] or download them from the ARIS Download Center
([Link]
You can install ARIS server along with ARIS Risk and Compliance on one machine. The ARIS
Risk and Compliance installation procedure is described in the ARIS Risk and Compliance
Installation Guide. For advanced installations, it is strongly recommended that you request
an installation service from ARIS Professional Services. This is of particular importance when

1
SERVER INSTALLATION GUIDE - LINUX

you intend to install ARIS across several computers/VMs (distributed installation). A scenario
this specific requires in-depth knowledge of the technical infrastructure and environment.
This information cannot be included in the product documentation. The necessary knowledge
can only be acquired by attending the ARIS Server Installation training course, which is
available at ARIS Academy.
Setup activities are logged in the files %temp%\ARIS_install_log and
%temp%\aris_install_full.log.

REMOTE INSTALLATION
To install ARIS server on Linux systems, the ARIS agent must be provided (page 5) first. The
required files are available in the installation folder
<ARIS_Installation_and_Documentation-<version>>\Linux setup that you can download
from the ARIS Download Center (login required). After you have copied and installed the files,
you must start the remote installation from a Windows system. If you do not want to run the
setup remotely from a Windows machine, you must execute all required steps manually using
ARIS Cloud Controller. For more information on manual setup, refer to the ARIS Distributed
Installation Cookbook. The necessary knowledge can only be acquired by attending the
ARIS Server Installation training course, which is available at ARIS Academy.

2
SERVER INSTALLATION GUIDE - LINUX

General prerequisites
For each setup procedure described in this document, the following general prerequisites
must be met. Additional prerequisites are listed in related procedure descriptions.

Prerequisites
 You have downloaded the ARIS installation package to access the *.rpm files (see: Linux
setups\Linux_<system>\ARIS_Agent, as well as Linux setups\Linux\ARIS_Admin
and ARIS_Scriptrunner) included in
<ARIS_Installation_and_Documentation-<version>>.
To download the package, you need access to the ARIS Download Center
([Link] where a login is
required.
 Make sure that the hard and software requirements are met. For information about
hardware and software requirements, please refer to the ARIS system requirements
(../../yay-system-requirements-guide/en/[Link]). Read the
documents on the ARIS Documentation website ([Link] or download
them from the ARIS Download Center
([Link]
 In the Linux operating system port 14000 must be open.
 In the Windows operating system ports 13131-13140 must be open to give access to the
setup repository server.
 Ensure that the virtual memory available on your Linux operating system is set to 262144
(page 41).
 Make sure that the FONTCONFIG Linux package is installed on the Linux operating
system together with all required fonts. Otherwise, fonts are not visible in ARIS and
unreadable text is displayed.
 It is a good idea to read the ARIS Release [Link] for last-minute information which
could not be included in this document anymore.

3
SERVER INSTALLATION GUIDE - LINUX

 If virus scanners are active on application servers used by ARIS, the performance of
Java-based ARIS software is seriously reduced by on-access scanning. By automatically
removing suspicious files mandatory for ARIS operations, quarantining can lead to
malfunctions or a complete failure of ARIS. We therefore strongly recommend that you
exclude the ARIS installation directory from on-access scanning to prevent performance
impact. Scan the directory on a regular basis using a schedule. The scan should run
outside of typical working hours. As some virus scanners detect false-positives, we
recommend that you limit the scan to executable files only, for example, *.exe and *.jar.
Known cases of false-positives are, for example, Windows Defender Antivirus blocking
*.pos files (elastic runnable) or McAfeeTM slowing down report execution and failing ARIS
setups. Make sure that the overnight scan does not quarantine suspicious files
immediately so that further inspection can be performed by ARIS Global Support. If you
scan network traffic, this can also result in performance problems with ARIS. To prevent
this, exclude the IP addresses of the ARIS server nodes or the ARIS processes from these
network scans.
 If you want to import the ARIS license file during the setup procedure, make sure to have
the zip file saved on this computer. Otherwise, you must import licenses after the
installation (see Manage licenses).
 If you use SELinux, make sure that the defined security settings are met. If the setup fails,
modify the SELinux settings or turn it off. Please follow the instructions in the SELinux
User's and Administrator's Guide
([Link]
linux_users_and_administrators_guide/index), as well as the documentation provided
by the manufacturer.

4
SERVER INSTALLATION GUIDE - LINUX

2 Setup scenarios
This chapter describes the installation processes of ARIS products using different database
management systems on Linux operating systems (page 5). By default, these installations will
create an unprivileged and locked user aris10 which uses /home/ARIS10 to install ARIS
itself. If you want to use different settings, make sure to change them before installing the
first rpm file (page 8).
From ARIS [Link], ARIS Risk and Compliance and ARIS server use the same external
database management system if configured. When you update your ARIS server, ARIS Risk
and Compliance still uses the database connection as configured for ARIS Risk and
Compliance. If you want ARIS server and ARIS Risk and Compliance to use the same
connection, you must first update ARIS server. Then configure the database connection
manually, as described in the ARIS Risk and Compliance Installation Guide.
If you currently run ARIS in version 10.0.18 or lower, you must update to version 10.0.21 first
and then update to ARIS in the current version. The direct update to the current version is
blocked in server setup, the agent setup, and via ACC update command. The ARIS Risk and
Compliance installation procedure is described in the ARIS Risk and Compliance Installation
and Upgrade Help. Documents are available in the Documents folder. Read the documents
on the ARIS Documentation website ([Link] or download them from the ARIS
Download Center ([Link]
Before installing an ARIS server on a Linux operating system, you must provide the ARIS
agent to your Linux Red Hat or SUSE system. To allow customizing activities additionally
provide the command-line tools ARIS Server Administrator and ARIS Scriptrunner. Use the
*.rpm files for Red Hat or SUSE systems.
After you have copied and installed the files, you must start the remote installation from a
Windows system. If you do not want to run the setup remotely from a Windows machine, you
must execute all required steps manually using ARIS Cloud Controller. For more information
on manual setup, refer to the ARIS Distributed Installation Cookbook. The necessary
knowledge can only be acquired by attending the ARIS Server Installation training course,
which is available at ARIS Academy.
All required rpm files are available in the downloaded
<ARIS_Installation_and_Documentation-<version>>\Linux setup folder. You find all setup
programs within the Windows setups\ARIS_Server folder. Copy the whole content to a
directory of your choice. This will make available all documents needed to setup ARIS as well
as the database scripts. These scripts are needed to setup your external database
management system for the use of ARIS. If you only copy a single ARIS setup, make sure to
copy the content of the folder containing the [Link] file as well as the Setup_Data
folder.

5
SERVER INSTALLATION GUIDE - LINUX

<ARIS_INSTALLATION_AND_DOCUMENTATION-<VERSION>>
Get an overview of the content of the downloaded installation directory:

Folder Content
Add-ons Required files needed to connect third-party tools, for
example, Microsoft SQL server, Oracle databases or SAP tools.

Content The Content folder contains ARIS databases, method filters

and templates, the system database and queries, report
scripts and macros that can be imported.

Documents The Documents folder contains all required documents and

guides (pdf) in different languages. Legal information
documents are available in English. Read the documents on
the ARIS Documentation website ([Link] or
download them from the ARIS Download Center
([Link]
ps).

Linux setups Contains all required files to be executed on a Linux operating

system.

Linux <system> Required files to install the ARIS agent and several tools for
administration on SUSE and RedHat Linux systems.

ARIS_Admin Provides ARIS Server Administrator on a Linux system (see

ARIS Server Administrator Command-line [Link]).

ARIS_Agent Provides the ARIS agent. After the ARIS agent is provided,
you can install an ARIS server remotely (page 5) from a
Windows machine.

ARIS_Scriptrunner Provides ARIS Scriptrunner on a Linux system (see ARIS

Architect online help).

Windows setups All required setup programs to be run on Windows machines.

Files required for Linux installations are available in the Linux
setups folder.

6
SERVER INSTALLATION GUIDE - LINUX

Folder Content
ARIS_Agent Installs the ARIS agent. The ARIS agent will be installed on all
Windows machines that will have an ARIS server. It provides
basic components, for example, ARIS Cloud Controller (ACC)
and handles internal communication processes.
If you are about to install an ARIS server remotely, please
make sure to first install the ARIS agent locally on that
machine.

ARIS_Client Installs an ARIS client.

ARIS_Server Installs ARIS.

This setup will install ARIS agent, ARIS server comprises of
100% of ARIS, standard database system (optional), ARIS
Viewer, ARIS Designer and ARIS download clients. It
provides the default tenant for all user data. The
functionalities ARIS workflows‚ Share model, Change
request and Approve model are available using an ARIS
server license. For full ARIS Process Governance
functionality, you need to purchase and import an ARIS
Process Governance license.
ARIS Risk and Compliance server can be installed optionally.
The ARIS Risk and Compliance server installation procedure is
described in the ARIS Risk and Compliance Installation Guide
(see installation package).
You can optionally install ARIS Aware. ARIS Aware provides
dashboards.
This setup can be run on Windows operating systems using
the standard database system, your Microsoft SQL Server or
your Oracle database. You can also install it on a Linux
operating system.

Setup_Data Folder content is needed for all setups.

If you only copy one ARIS server setup, please make sure to
copy the content of the folder containing the [Link] file
as well as the Setup_Data folder.

7
SERVER INSTALLATION GUIDE - LINUX

INSTALLING ARIS SERVER

 Using the standard database
 Using a Microsoft SQL Server® (mixed mode)
 Using a Microsoft SQL Server® (Windows authentication)
 Using an Oracle® database

2.1 Change default installation directory or default user

By default, the executed rpm files will create an unprivileged and locked user aris10 which
uses /home/ARIS10 to install ARIS itself. If you want to use different settings, make sure to
change them before installing the first rpm file.
To change the directory, you must set the environment variable TARGETDIR to the desired
directory, for example:
export TARGETDIR=/mnt/largedisk
To change the user under which ARIS will run, you must set the environment variable user
(lower case is mandatory), for example:
export user=TheOtherUser
Ensure to set the environment variables in the same user context as the package manager
call that uses the environment variables.

CODE EXAMPLE
sudo -s
export TARGETDIR=/mnt/largedisk
export user=TheOtherUser
rpm install aris10-cloud-agent-<number>-1.x86_64.rpm

2.2 Installing ARIS server using the standard database

8
SERVER INSTALLATION GUIDE - LINUX

on manual setup, refer to the ARIS Distributed Installation Cookbook. The necessary
knowledge can only be acquired by attending the ARIS Server Installation training course,
which is available at ARIS Academy.
In RedHat and SUSE systems *.rpm files will perform these actions automatically:
 /etc/[Link]
[Link]:
if "[Link] < 629145600" then "[Link] = 629145600"
max_file_max:
if "max_file_max < 200000” then "[Link]-max = 200000"

 /etc/security/limits.d/[Link]
$max_file_max = "ulimit –n"
If "$max_file_max > 2^20" then max_file_max = 2^20
aris10 soft nofile $max_file_max
aris10 hard nofile $max_file_max
aris10 soft nproc 12204
aris10 hard nproc 12204

 /etc/pam.d/su
session required pam_limits.so
Prerequisites
Make sure that the general prerequisites are met (page 3).

9
SERVER INSTALLATION GUIDE - LINUX

These commands optionally install the administrator tools ARIS Server Administrator
and ARIS Scriptrunner.
4. Perform the ARIS server installation from a machine running a Microsoft Windows
operating system (see ARIS installation package\Windows setups\ARIS_Server).
5. Start the [Link] file as an administrator.
6. Select the Perform installation on a remote server option and enter the name of your
Linux system.
7. Select ARIS server to be installed.
8. Select Use dashboards to make dashboards available. This will activate the
dashboarding runnable. If you do not select this option, the runnable will be installed but
not activated.
9. Select ARIS Risk and Compliance if you want to install this program as well. The ARIS Risk
and Compliance installation procedure is described in the ARIS Risk and Compliance
Installation and Upgrade Help. Documents are available in the Documents folder. Read
the documents on the ARIS Documentation website ([Link] or download
them from the ARIS Download Center
([Link]
10. Select the installation directory if required.
11. Only if you need to specify an external proxy server IP address for incoming requests
enter the proxy server computer name or IP.
12. Change the ARIS agent user credentials to prevent unauthorized access to your ARIS
system. Make sure to store the credentials in a save place. If you forget the credentials,
you can no longer update the system or modify the configuration.
13. If you change the credentials, you will be further on prompted to enter that password
you've chosen whenever you start/stop the ARIS server or access your ARIS installation
using ARIS Cloud Controller.
14. If the ports 1080 or 1443 are already in use, specify the port numbers to be used. If you
change the default port numbers users must add :<this port number> to the URL (see
below).
15. To force secure connections (HTTPS), uncheck HTTP port. If you do so, make sure to
make a valid TLS server certificate (page 31) available.
16. Select the suitable system settings option. You need to take the RAM required and the
number of users who will be accessing the ARIS server into account. For a productive
system it is recommended to select the Medium or Large option.
The Demo scenario option is recommended for demonstration purposes (laptop) only.
Warning
If the hardware does not fit the system requirements, a warning is prompted. In this case
do not proceed the setup. Otherwise, ARIS might not work reliably.

10
SERVER INSTALLATION GUIDE - LINUX

17. To import the ARIS license file, enable Import now, click Select file..., and navigate to the
license archive file. Otherwise, licenses must be imported after the installation.
Make sure this file contains the required ARIS server license. The functional range
depends on the server license that you have purchased (see ARIS Product Feature
Matrix). Read the documents on the ARIS Documentation website
([Link] or download them from the ARIS Download Center
([Link]
18. Select the Standard database system.
19. Enter the SMTP mail processing parameters of an existing account.
Warning
If you don't, ARIS will not send any notifications, due to the missing mailing functionality.
But you can configure SMTP mail processing (page 44) at any later point of time. Some
parameters can also be managed using the ARIS Administration of this server. Please
refer to the online help of ARIS Administration.
20. Activate Use TLS/SSL encryption to prevent password sniffing.
21. Only if your mail server requires SMTP authentication, select the option SMTP
authentication and enter the user credentials.
Warning
If you enter these parameters but your mail server does not require SMTP authentication,
the connection will be rejected.
22. If you are about to use a proxy server, enter all proxy processing parameters. You can also
enter them later, using the ARIS Administration of this server. Please refer to the online
help of ARIS Administration.
You can specify a URL to be used for validating the proxy server settings.
23. Select the start option:
Select Start automatically if you want to have the server started up with every restart
of your operating system.
Select Start manually if you want to start/stop the server on the active computer
manually.
24. Start the installation process. If you have changed the ARIS agent's default user
credentials during this procedure, you will be prompted for that password you have
chosen.
The installation process takes some time. You can change settings entered during the setup
process. Use the reconfigure ACC command to change settings, such as ports. After the
ARIS server installation has completed, you must check the installation and configure the
system (page 28).

11
SERVER INSTALLATION GUIDE - LINUX

To ensure optimum performance when you are using ARIS with the standard database
system, we recommend that you regularly shrink the database. This prevents that the used
disk space constantly increases. To do so, execute the [Link] file (<ARIS installation
directory>\server\bin\agentLocalRepo\.unpacked\<build
number>_PostgreSQL-run-prod-<ARIS version>-[Link]\postgresql\bin).
For detailed information, read the instructions provided by the manufacturer
([Link]
To uninstall ARIS from a Red Hat or a SUSE system enter, for example, rpm –e
aris10-cloud-agent.

12
SERVER INSTALLATION GUIDE - LINUX

2.3 Installing ARIS server using a Microsoft SQL Server

Before installing an ARIS server on a Linux operating system, you must provide the ARIS
agent to your Linux Red Hat or SUSE system. To allow customizing activities additionally
provide the command-line tools ARIS Server Administrator and ARIS Scriptrunner. Use the
*.rpm files for Red Hat or SUSE systems.
After you have copied and installed the files, you must start the remote installation from a
Windows system. If you do not want to run the setup remotely from a Windows machine, you
must execute all required steps manually using ARIS Cloud Controller. For more information
on manual setup, refer to the ARIS Distributed Installation Cookbook. The necessary
knowledge can only be acquired by attending the ARIS Server Installation training course,
which is available at ARIS Academy.
In RedHat and SUSE systems *.rpm files will perform these actions automatically:
 /etc/[Link]
[Link]:
if "[Link] < 629145600" then "[Link] = 629145600"
max_file_max:
if "max_file_max < 200000” then "[Link]-max = 200000"

 /etc/pam.d/su
session required pam_limits.so
Prerequisites
 Make sure that the general prerequisites are met (page 3).
 An operating Microsoft SQL Server database. If you have not yet installed the Microsoft
SQL Server, follow the instructions in the Microsoft installation program, as well as the
documentation provided by the manufacturer. The external database management
system is not included in this package. If you need help in setting up ARIS using your
external database system, please contact ARIS ([Link] Note that this service
is not subject to the standard software maintenance agreement and that these changes
can only be performed if you requested and agreed on them.
 Ensure that Latin1_General_CI_AI sorting is selected for the COLLATE statement.
 The SQL Server and Windows authentication mode (mixed mode) option is selected
(Microsoft SQL Console > Security tab).

13
SERVER INSTALLATION GUIDE - LINUX

 You must know the port number, the database name of the new database instance if it
was not configured as a default instance, and also the user name and the password of the
application user.
 You have downloaded the latest supported version (see ARIS System Requirements) of
the Microsoft SQL Server JDBC driver from the Microsoft Download Center to a directory
of your choice.
 SQL scripts and all additional files. All scripts and files are located on the installation
medium (Add-ons\DatabaseScripts\Design&ConnectServer\mssql) or they can be
downloaded from the ARIS Download Center
([Link]

Procedure
1. Copy the file aris10-cloud-agent-<number>-1.x86_64.rpm or
aris10-cloud-agent-SLES-<number>-1.x86_64.rpm from the ARIS installation
package to the hard drive of your Linux system.
This file provides the ARIS agent. The ARIS agent is needed to perform a remote server
installation.
2. Optionally copy the files for installing ARIS Server Administrator and ARIS Scriptrunner.
These files are not mandatory for ARIS server to be installed.
3. Depending on the files you have copied and the type of the Linux system enter the
relevant command to install the files. By default, these installations will create an
unprivileged and locked user aris10 which uses /home/ARIS10 to install ARIS itself. If
you want to use different settings, make sure to change them before installing the first
rpm file (page 8).
rpm –i aris10-cloud-agent-<number>-1.x86_64.rpm
This command installs the ARIS agent to your Red Hat system.
rpm –i aris10-cloud-agent-SLES-<number>-1.x86_64.rpm
This command installs the ARIS agent to your SUSE system.
rpm –i aris10adm-<number>-1.x86_64 and rpm –i
aris10-scriptrunner-<number>-1.x86_64
These commands optionally install the administrator tools ARIS Server Administrator
and ARIS Scriptrunner.
4. Your database administrator must adjust the settings that are used by all database
scripts. These scripts must be executed by the database administrator to set up the
database as required.
Edit the [Link] file to specify the connection data of the Microsoft SQL server
instance. It's a good idea to write down the credentials. They must be entered later during
the ARIS setup process.

14
SERVER INSTALLATION GUIDE - LINUX

To specify the connection data of the Microsoft SQL instance, modify the highlighted
parameters and refer to the comments:
REM
REM You may edit this section for customizing purposes.
REM
REM This script is intended to be executed on the Microsoft SQL server
machine, therefore the default value is 'localhost'
REM If the MSSQL_SAG_FILEGROUP_FILE_DIR directory exists on the Microsoft
SQL server machine, you can run the script remotely. When executed locally,
the script creates this mandatory directory.
REM If you use a default instance, an instance name is not required.
REM If you use named instances, enter a backslash ‘\’ followed by the instance
name.
SET MSSQL_SAG_MSSQL_SERVER_NAME=localhost
REM This script is configured for the use of Windows authentication by
default.
REM Windows authentication uses the user account running this script and
does not require user credentials to be specified in this script.
REM If you want to use user/password authentication instead, uncomment
the following lines and modify the settings for use by the SQL Server command
line tool (sqlcmd).
REM SET SQLCMDUSER=sa
REM SET SQLCMDPASSWORD=manager
REM name of database that will be created by the script.
SET MSSQL_SAG_DATABASE_NAME=ARIS10DB
REM folder in which the database files should be stored.
SET MSSQL_SAG_FILEGROUP_FILE_DIR=F:\msqldata\ARIS10DB
REM credentials of the login that is used by the application.
SET MSSQL_SAG_APP_USER=ARIS10
REM If using % character in your password: Write %% to yield a single %
character.
SET MSSQL_SAG_APP_PWD=*ARIS!1dm9n#
REM schema names for the default and master tenants
SET MSSQL_SAG_TENANT_DEFAULT=ARIS_DEFAULT
SET MSSQL_SAG_TENANT_MASTER=ARIS_MASTER
REM
REM The rest of the script must not be modified.
....
5. Execute the [Link] file. This will create the database including the two mandatory
tenants and the application user. The application user (APP_USER) is the Microsoft SQL
user connecting ARIS and the Microsoft SQL database. The default user name is ARIS10.
But you may have changed that name in the [Link] earlier. Two schemes are
mandatory. One for the master tenant and one for the default tenant. Write down the
tenant names. These names must be entered later during the ARIS server setup process.
6. If you need additional tenants, you must create additional schemes for each new tenant.
If you are going to create additional tenants for ARIS10 to migrate data from ARIS 9.8.7 or
later, make sure to use identical names in both ARIS versions.
Run the script create_schema_for_tenant.bat and pass the schema name as
parameter, for example:
create_schema_for_tenant.bat <schema name for additional tenant>

15
SERVER INSTALLATION GUIDE - LINUX

If the schema already exists it will be dropped and recreated automatically. If you do not
use the scripts, you can also set up the database and create an empty schema for each
tenant manually.
If you use an external database management system and you have created empty
schemes for additional tenants, you must assign additional tenants (page 35) to these
schemes after the ARIS server setup is completed. The default tenant and the master
tenant were assigned automatically.
7. Perform the ARIS server installation from a machine running a Microsoft Windows
operating system (see ARIS installation package\Windows setups\ARIS_Server).
8. Start the [Link] file as an administrator.
9. Select the Perform installation on a remote server option and enter the name of your
Linux system.
10. Select ARIS server to be installed.
11. Select Use dashboards to make dashboards available. This will activate the
dashboarding runnable. If you do not select this option, the runnable will be installed but
not activated.
12. Select ARIS Risk and Compliance if you want to install this program as well. The ARIS Risk
and Compliance installation procedure is described in the ARIS Risk and Compliance
Installation and Upgrade Help. Documents are available in the Documents folder. Read
the documents on the ARIS Documentation website ([Link] or download
them from the ARIS Download Center
([Link]
13. Select the installation directory if required.
14. Only if you need to specify an external proxy server IP address for incoming requests
enter the proxy server computer name or IP.
15. Change the ARIS agent user credentials to prevent unauthorized access to your ARIS
system. Make sure to store the credentials in a save place. If you forget the credentials,
you can no longer update the system or modify the configuration.
If you change the credentials, you will be further on prompted to enter that password
you've chosen whenever you start/stop the ARIS server or access your ARIS installation
using ARIS Cloud Controller.
16. If the ports 1080 or 1443 are already in use, specify the port numbers to be used. If you
change the default port numbers users must add :<this port number> to the URL (see
below).
17. To force secure connections (HTTPS), uncheck HTTP port. If you do so, make sure to
make a valid TLS server certificate (page 31) available.
18. Select the suitable system settings option. You need to take the RAM required and the
number of users who will be accessing the ARIS server into account. For a productive
system it is recommended to select the Medium or Large option.

16
SERVER INSTALLATION GUIDE - LINUX

The Demo scenario option is recommended for demonstration purposes (laptop) only.
Warning
If the hardware does not fit the system requirements, a warning is prompted. In this case
do not proceed the setup. Otherwise, ARIS might not work reliably.
19. To import the ARIS license file, enable Import now, click Select file..., and navigate to the
license archive file. Otherwise, licenses must be imported after the installation.
Make sure this file contains the required ARIS server license. The functional range
depends on the server license that you have purchased (see ARIS Product Feature
Matrix). Read the documents on the ARIS Documentation website
([Link] or download them from the ARIS Download Center
([Link]
20. Select MSSQL.
21. Select the required JDBC driver for the Microsoft SQL database management system.
22. Enter the connection parameters used in the [Link] file and exactly the values used
by the Microsoft SQL server.
The values shown are the default values used in the [Link] file and the default
parameters used when setting up the Microsoft SQL server.
 Server: Fully qualified name or IP address of the Microsoft SQL server. The default
parameter used in the [Link] file is localhost. The default name works only if
you run that script from the machine were the Microsoft SQL server is installed.
 Port: Port addressing the SQL server instance running over TCP. The default port
number used in the [Link] file is 1433.
 Database name: Name of the database that was created by the [Link] script.
The default value is ARIS10DB.
 Application user: Login user name that is used by the application. The default value
used in the from [Link] file is ARIS10.
 Password: The application user's password. The default value used in the from
[Link] file is *ARIS!1dm9n#.
 Default schema: Schema name for the default tenant and user name for that
schema's owner. The default value used in the from [Link] file is
ARIS_DEFAULT.
 Master scheme: Schema name for the master tenant and user name for that
schema's owner. The default value used in the from [Link] file is
ARIS_MASTER.
23. Enter the SMTP mail processing parameters of an existing account.
Warning
If you don't, ARIS will not send any notifications, due to the missing mailing functionality.

17
SERVER INSTALLATION GUIDE - LINUX

But you can configure SMTP mail processing (page 44) at any later point of time. Some
parameters can also be managed using the ARIS Administration of this server. Please
refer to the online help of ARIS Administration.
24. Activate Use TLS/SSL encryption to prevent password sniffing.
25. Only if your mail server requires SMTP authentication, select the option SMTP
authentication and enter the user credentials.
Warning
If you enter these parameters but your mail server does not require SMTP authentication,
the connection will be rejected.
26. If you are about to use a proxy server, enter all proxy processing parameters. You can also
enter them later, using the ARIS Administration of this server. Please refer to the online
help of ARIS Administration.
You can specify a URL to be used for validating the proxy server settings.
27. Select the start option:
Select Start automatically if you want to have the server started up with every restart
of your operating system.
Select Start manually if you want to start/stop the server on the active computer
manually.
28. Start the installation process. If you have changed the ARIS agent's default user
credentials during this procedure, you will be prompted for that password you have
chosen.
The installation process takes some time. You can change settings entered during the setup
process. Use the reconfigure ACC command to change settings, such as ports. After the
ARIS server installation has completed, you must check the installation and configure the
system (page 28).
To uninstall ARIS from a Red Hat or a SUSE system enter, for example, rpm –e
aris10-cloud-agent.

18
SERVER INSTALLATION GUIDE - LINUX

2.4 Installing ARIS server using an Oracle database

 /etc/pam.d/su
session required pam_limits.so
Prerequisites
 Make sure that the general prerequisites are met (page 3).
 An operating Oracle database management system. If you have not yet installed the
Oracle database management system, please follow the instructions in the Oracle
installation program, as well as the documentation provided by the manufacturer. The
external database management system is not included in this package. If you need help in
setting up ARIS using your external database system, please contact ARIS
([Link] Note that this service is not subject to the standard software
maintenance agreement and that these changes can only be performed if you requested
and agreed on them.
 Ensure that SQL*PLUS is available. Therefore, an ORACLE client or an ORACL server must
be installed on the machine where the scripts are run.
 Use of the database character set AL32UTF8 is mandatory.

19
SERVER INSTALLATION GUIDE - LINUX

 You must know the port number, the database/service name of the new database
instance and also the credentials, for example, the user name and the password of the
application user.
 You have downloaded the latest supported version (see ARIS System Requirements) of
the Oracle JDBC driver from the Oracle website to a directory of your choice.
 SQL scripts and all additional files. All scripts and files are located on the installation
medium (Add-ons\DatabaseScripts\Design&ConnectServer\oracle) or they can be
downloaded from the ARIS Download Center
([Link]

Procedure
1. Copy the file aris10-cloud-agent-<number>-1.x86_64.rpm or
aris10-cloud-agent-SLES-<number>-1.x86_64.rpm from the ARIS installation
package to the hard drive of your Linux system.
This file provides the ARIS agent. The ARIS agent is needed to perform a remote server
installation.
2. Optionally copy the files for installing ARIS Server Administrator and ARIS Scriptrunner.
These files are not mandatory for ARIS server to be installed.
3. Depending on the files you have copied and the type of the Linux system enter the
relevant command to install the files. By default, these installations will create an
unprivileged and locked user aris10 which uses /home/ARIS10 to install ARIS itself. If
you want to use different settings, make sure to change them before installing the first
rpm file (page 8).
rpm –i aris10-cloud-agent-<number>-1.x86_64.rpm
This command installs the ARIS agent to your Red Hat system.
rpm –i aris10-cloud-agent-SLES-<number>-1.x86_64.rpm
This command installs the ARIS agent to your SUSE system.
rpm –i aris10adm-<number>-1.x86_64 and rpm –i
aris10-scriptrunner-<number>-1.x86_64
These commands optionally install the administrator tools ARIS Server Administrator
and ARIS Scriptrunner.
4. Your database administrator must adjust the settings that are used by all database
scripts. These scripts must be executed by the database administrator to set up the
database as required.
Edit the file [Link] to specify the connection data of the Oracle instance. It's a good
idea to write down values and credentials. They must be entered later during the ARIS
server setup process.
5. Edit the [Link] file and adjust the following lines replacing the highlighted
parameters with the settings appropriate for your environment:

20
SERVER INSTALLATION GUIDE - LINUX

REM The path to where [Link] can be found.

SET CIP_ORA_BIN_PATH=<enter the path>
REM hostname, port and service name
SET TARGET_HOST=localhost
SET TARGET_PORT=1521
SET TARGET_SERVICE_NAME=ARIS
6. Edit the following lines to change the highlighted credentials of the application user:
REM credentials of the user that is used by the application.
SET CIP_APP_USER=ARIS10
SET CIP_APP_PWD=*ARIS!1dm9n#
REM password of the tenant schemas.
SET CIP_TENANT_SCHEMA_PWD=*ARIS!1dm9n#yy
7. With the next two lines you specify the DBA user you intend to use to create the
application user and this DBA user’s password:
REM credentials of the Oracle user that will be used to create the application schema.
REM Note that this user must be endowed with DBA privileges such as user SYSTEM.
SET CIP_INSTALL_USER=system
SET CIP_INSTALL_PWD=manager
8. If your data tablespace name is different from ARISDATA respectively TEMP for temp
tablespace, you will also need to modify these highlighted parameters accordingly:
REM tablespace name of the tablespace in which the data of the application schema
should be stored.
SET CIP_TS_DATA=ARISDATA
REM name of the temporary tablespace.
SET CIP_TS_TEMP=TEMP
9. Save the [Link] file. So you can use it for future update setups again.
10. Run the script cip_create_app_user.bat.
This will create the application user. The application user (CIP_APP_USER) is the Oracle
user connecting ARIS and the Oracle database. The default user name is ARIS10. But you
may have changed that name in the [Link] earlier.
11. Create an empty schema for each tenant. Two schemes are mandatory. One for the
master tenant and one for the default tenant. The names, for example, aris_master and
aris_default can be modified. Write down the tenant names. These names must be
entered later during the ARIS server setup process. If you need additional tenants, you
must create additional schemes.

21
SERVER INSTALLATION GUIDE - LINUX

To create the schema objects, run these commands for each schema name aris_master,
aris_default and additional tenants.
Run the script cip_create_schema_for_tenant.bat and pass the schema name as
parameter, for example:
cip_create_schema_for_tenant.bat aris_master (mandatory)
cip_create_schema_for_tenant.bat aris_default (mandatory)
cip_create_schema_for_tenant.bat <oracle schema name for additional tenant>
(optional)
If you are going to create additional tenants for ARIS10 to migrate data from ARIS 9.8.7 or
later, make sure to use identical names in both ARIS versions. If the schema already exists
it will be dropped and recreated.
If you use an external database management system and you have created empty
schemes for additional tenants, you must assign additional tenants (page 35) to these
schemes after the ARIS server setup is completed. The default tenant and the master
tenant were assigned automatically.
12. Perform the ARIS server installation from a machine running a Microsoft Windows
operating system (see ARIS installation package\Windows setups\ARIS_Server).
13. Start the [Link] file as an administrator.
14. Select the Perform installation on a remote server option and enter the name of your
Linux system.
15. Select ARIS server to be installed.
16. Select Use dashboards to make dashboards available. This will activate the
dashboarding runnable. If you do not select this option, the runnable will be installed but
not activated.
17. Select ARIS Risk and Compliance if you want to install this program as well. The ARIS Risk
and Compliance installation procedure is described in the ARIS Risk and Compliance
Installation and Upgrade Help. Documents are available in the Documents folder. Read
the documents on the ARIS Documentation website ([Link] or download
them from the ARIS Download Center
([Link]
18. Select the installation directory if required.
19. Only if you need to specify an external proxy server IP address for incoming requests
enter the proxy server computer name or IP.
20. Change the ARIS agent user credentials to prevent unauthorized access to your ARIS
system. Make sure to store the credentials in a save place. If you forget the credentials,
you can no longer update the system or modify the configuration.

22
SERVER INSTALLATION GUIDE - LINUX

If you change the credentials, you will be further on prompted to enter that password
you've chosen whenever you start/stop the ARIS server or access your ARIS installation
using ARIS Cloud Controller.
21. If the ports 1080 or 1443 are already in use, specify the port numbers to be used. If you
change the default port numbers users must add :<this port number> to the URL (see
below).
22. To force secure connections (HTTPS), uncheck HTTP port. If you do so, make sure to
make a valid TLS server certificate (page 31) available.
23. Select the suitable system settings option. You need to take the RAM required and the
number of users who will be accessing the ARIS server into account. For a productive
system it is recommended to select the Medium or Large option.
The Demo scenario option is recommended for demonstration purposes (laptop) only.
Warning
If the hardware does not fit the system requirements, a warning is prompted. In this case
do not proceed the setup. Otherwise, ARIS might not work reliably.
24. To import the ARIS license file, enable Import now, click Select file..., and navigate to the
license archive file. Otherwise, licenses must be imported after the installation.
Make sure this file contains the required ARIS server license. The functional range
depends on the server license that you have purchased (see ARIS Product Feature
Matrix). Read the documents on the ARIS Documentation website
([Link] or download them from the ARIS Download Center
([Link]
25. Select Oracle.
26. Select the required JDBC driver for the Oracle database management system.
27. Enter the connection parameters used in the [Link] file and exactly the values used
by the Oracle server.
The values shown are the default values used in the [Link] file and the default
parameters used when setting up the Oracle server.
Enter exactly the values used by the Oracle server, for example, database name. Use the
default schema's name and the master schema's name that have been created earlier.
 Server: Fully qualified name or IP address of the Oracle server.
 Port: Specify the port number addressing the Oracle server instance running over
TCP. The corresponding line in the [Link] file is SET TARGET_PORT=1521.
 Database/Service name: Specify the Oracle SID or Oracle service name. The
corresponding line in the [Link] file is SET TARGET_SERVICE_NAME=ARIS.
 Application user: Login user name that is used by the application. The
corresponding line in the [Link] file is SET CIP_APP_USER=ARIS10.

23
SERVER INSTALLATION GUIDE - LINUX

 Password: The application user's password. The corresponding line in the

[Link] file is SET CIP_APP_PWD=*ARIS!1dm9n#. Enter the schema names
exactly in the way they have been created earlier.
 Master schema: Schema name for the master tenant and user name for that
schema's owner. Enter exactly the name used when you have created the schema,
for example, aris_master (see step Create an empty schema for each tenant).
 Default schema: Schema name for the default tenant and user name for that
schema's owner. Enter exactly the name used when you have created the schema,
for example, aris_default (see step Create an empty schema for each tenant).
If you want to use an Oracle cluster you must change the connection URL as
required: syntax:
jdbc:oracle:thin:@<ORACLE_SERVER>:<ORACLE_PORT>:<ORACLE_SID>. After
the setup process is completed you need to update the external service (page 36).
28. Enter the SMTP mail processing parameters of an existing account.
Warning
If you don't, ARIS will not send any notifications, due to the missing mailing functionality.
But you can configure SMTP mail processing (page 44) at any later point of time. Some
parameters can also be managed using the ARIS Administration of this server. Please
refer to the online help of ARIS Administration.
29. Activate Use TLS/SSL encryption to prevent password sniffing.
30. Only if your mail server requires SMTP authentication, select the option SMTP
authentication and enter the user credentials.
Warning
If you enter these parameters but your mail server does not require SMTP authentication,
the connection will be rejected.
31. If you are about to use a proxy server, enter all proxy processing parameters. You can also
enter them later, using the ARIS Administration of this server. Please refer to the online
help of ARIS Administration.
You can specify a URL to be used for validating the proxy server settings.
32. Select the start option:
Select Start automatically if you want to have the server started up with every restart
of your operating system.
Select Start manually if you want to start/stop the server on the active computer
manually.
33. Start the installation process. If you have changed the ARIS agent's default user
credentials during this procedure, you will be prompted for that password you have
chosen.

24
SERVER INSTALLATION GUIDE - LINUX

The installation process takes some time. You can change settings entered during the setup
process. Use the reconfigure ACC command to change settings, such as ports. After the
ARIS server installation has completed, you must check the installation and configure the
system (page 28).
To ensure optimum performance when you are using ARIS with an Oracle database, we
recommend that you recalculate the database statistics regularly
([Link]
To uninstall ARIS from a Red Hat or a SUSE system enter, for example, rpm –e
aris10-cloud-agent.
Update installations are available. Components will be stopped. After the system has been
updated all components will be started automatically.

25
SERVER INSTALLATION GUIDE - LINUX

2.5 How to start ARIS Cloud Controller (ACC)

ACC is a command-line tool for administrating and configuring an ARIS installation. ACC
communicates with the ARIS agents on all nodes. You can use ACC in multiple modes (see
Technical Help: ARIS Cloud Controller Command-Line Tool). Read the documents on the ARIS
Documentation website ([Link] or download them from the ARIS Download
Center ([Link]

Warning
ACC commands will majorly impact your system. They require profound knowledge of the
technical ARIS infrastructure and environment. This knowledge can be acquired only by
attending related training courses. These are provided by ARIS Academy. According to the
standard software maintenance agreement, we cannot guarantee proper functioning if you
use ACC commands without this knowledge or without our services.
ARIS Cloud Controller (ACC) can be used in three modes:

INTERACTIVE MODE (DEFAULT)

ACC runs with an interactive shell, allowing you to manually issue commands.

BATCH MODE
Batch mode is activated by specifying a command file with the -f command line parameter
(see ACC command line parameters below). ACC will execute the commands in the file in the
given sequence and exit after execution or if one of the commands fails.
A command file line starting with # will be interpreted as a comment line and ignored by ACC.

COMMAND MODE
You can directly pass a single command to ACC as a command line parameter. The command
will be executed and ACC will exit.
When passing commands directly as a command line parameter, you must be careful when
escaping strings in your command, for example, double-quote-delimited parameters. The
operating system command shell will eliminate the double quotes, leaving your string
parameter un-escaped. Therefore, make sure to escape the quote characters and special
characters.
Examples
If you issue the command in command mode, for example:
set [Link]="[Link]
you must enter:
[Link] -h localhost -u <user name> -pwd <remoteAccessPassword> set
[Link]=\"[Link]
If you enter:

26
SERVER INSTALLATION GUIDE - LINUX

[Link] -h localhost -u <user name> -pwd <remoteAccessPassword> set

[Link]="[Link]
ACC will return an error message, for example:
line 1:52 mismatched character '<EOF>' expecting '\n'
Invalid or erroneous command "set
[Link]=[Link] ": line 1:30 extraneous
input ':' expecting EOF
Use "help" to display a list of available commands.
This also affects passwords and names containing special characters. If you try to back up
your tenants with the following command, make sure to escape the quote characters and the
special character & used in the password User&12345.
If your user name or password includes any special character, add a backslash (\) before the
character for ACC to process the special character as a string. If your password contains an
ampersand (&), add a backslash before the ampersand.
./[Link] -h localhost -u Clous -pwd g3h31m -p 18011 -c
../[Link] backup tenant default username=\"admin\"
password=\"User\&12345\"

To obtain information about the usage of ACC commands, enter help or help <command>.

WINDOWS OPERATING SYSTEM

To start ACC under a Windows operating system, click Start > All Programs > ARIS >
Administration > Start ARIS Cloud Controller. If you changed agent user credentials you
must enter the user name and/or the password.

LINUX OPERATING SYSTEM

To start ACC under a Linux operating system, execute the [Link] shell script. To do so,
enter: su -c [Link] aris10. After the ARIS server installation was completed on a Linux
operating system, the aris10 user is locked and has no password. Command-line tools (sh
files), such as ARIS server Administrator or ARIS Cloud Controller can only be started by
the aris10 user related to the ARIS agent.
 To unlock the aris10 user, enter: passwd -u aris10
 To interactively enter a password, enter: passwd aris10
 To start the command-line tools, enter: su -c [Link] aris10 or su -c [Link] aris10
 To execute these command-line tools as an ARIS user without root privileges, you must
enter the password of the aris10 user.
 To copy files manually into the ARIS directory, as the aris10 user enter the commands:
su aris10 and sudo aris10
As an ARIS user without root privileges, you must make sure that the files have the
correct ownership (aris10).
 To lock the aris10 user again enter: passwd -l aris10

27
SERVER INSTALLATION GUIDE - LINUX

3 Configure ARIS server

After the ARIS server installation was completed on a Linux operating system, the aris10 user
is locked and has no password. Command-line tools (sh files), such as ARIS server
Administrator or ARIS Cloud Controller can only be started by the aris10 user related to
the ARIS agent.
 To unlock the aris10 user, enter: passwd -u aris10
 To interactively enter a password, enter: passwd aris10
 To start the command-line tools, enter: su -c [Link] aris10 or su -c [Link] aris10
 To execute these command-line tools as an ARIS user without root privileges, you must
enter the password of the aris10 user.
 To copy files manually into the ARIS directory, as the aris10 user enter the commands:
su aris10 and sudo aris10
As an ARIS user without root privileges, you must make sure that the files have the
correct ownership (aris10).
 To lock the aris10 user again enter: passwd -l aris10
After installation please check the system. To prevent unauthorized access, you must change
initial passwords and optionally define security settings for passwords. Depending on the
features you want to use in ARIS additional modifications are required.

Procedure
1. Due to the current Tomcat (Ghostcat) vulnerability, block (page 32) all ports except the
load balancer HTTPS port.
2. If you use an external database management system and you have created empty
schemes for additional tenants, you must assign additional tenants (page 35) to these
schemes after the ARIS server setup is completed. The default tenant and the master
tenant were assigned automatically.
3. If you use an external load balancer (LB), you must reconfigure ARIS LB (page 53) to
prevent system failure caused by ARIS brute-force protection.
4. Make sure that all fonts are available (page 46).
5. To check the installation, start ARIS server.
To do so, start ARIS Cloud Controller (su -c [Link] aris10). If you have changed the
ARIS agent's default user credentials during this procedure, you will be prompted for that
password you have chosen.
As the internal ARIS user running all runnables has no root privileges all privileged ports
(<1024) cannot be used. To run ARIS under a privileged port you need to redirect the ports
(page 50).
6. Enter startall. This process will take a while.
7. Enter list to monitor the status of all runnables.

28
SERVER INSTALLATION GUIDE - LINUX

The state of all runnables represented by their instance IDs is listed. Possible states are:
 UNKNOWN
The runnable state is not yet known. This state is shown directly after the ARIS agent
was started.
 STARTING
The runnable is starting, but this process is not complete yet.
 STARTED
The runnable is running.
 DEACTIVATED
The runnable is not in use. It has been deactivated manually and can be activated if
necessary.
This runnable is deactivated if ARIS server was installed without ARIS Aware.
 DOWN
This runnable started and crashed. The ARIS agent will attempt to automatically
restart the runnable momentarily.
 FAILED
This runnable has crashed. The ARIS agent has given up trying to restart the
runnable.
If you want more detailed information on health checks, please refer to the ARIS System
Monitoring guide. If a runnable does not start properly, read the Basic Troubleshooting.
8. After all runnables have started, open your browser and enter localhost or [Link]
address or fully-qualified host name>:<load balancer port>/#<tenant
name>/adminSettings. You must enter the port number only if you have changed or
redirected the standard port. The login dialog opens.
9. Enter the user name superuser and the password superuser. This user only has access
to the ARIS Administration of the tenant.
10. Click OK. ARIS Administration opens.
11. Click Licenses and check whether the licenses were properly imported during setup.
If you have not imported licenses during setup, do so now. For detailed information on
license and user management and security settings refer to the Manage ARIS online help
chapter.
12. Click User management. The list of users is displayed. It contains all default users.
13. Make sure to assign all required license privileges to the system user, such as ARIS
Architect. Otherwise, the system user cannot perform administrative actions, such as
running scheduled reports. For detailed information on license and user management and
security settings refer to the Manage ARIS online help chapter.

29
SERVER INSTALLATION GUIDE - LINUX

14. Change all default passwords and customize the password policy (see Configure user
management).
Warning
To prevent unauthorized access to the ARIS system, after installation or data migration,
always change the default passwords of all users that are automatically created
(arisservice user, guest user, system user, superuser user) on all operational tenants,
as well as on the infrastructure tenant (master). It is mandatory to provide administrator
permissions to different users and/or make sure to not lose the superuser's password.
Otherwise, the system will not allow administrator access. If you did not change the ARIS
agent user's credentials during the setup process, please at least change the ARIS agent
user's password manually.
By default, the elastic_<s, m, or l> runnable (Elasticsearch) uses generic user credentials
required for communication with other ARIS runnables. You can check (page 39) and
change (page 40) the user name and the password if required.
15. Create users or import LDAP users and assign privileges and licenses for the default
tenant. For detailed information on user management and security settings refer to the
Manage ARIS online help chapter.
If you have created additional tenants, users and licenses must be managed for each
additional tenant.
16. Create additional system users and superusers for each tenant holding all required
administrator permissions. This will allow access to the ARIS system in case of password
loss.
17. Optionally customize the password policy. You can define passwords to expire after a
period of time, define length or strength of a password or you can force users to change
their passwords before first login.
18. If you use functionalities and extension packs as listed, you must customize ARIS
accordingly.
 If you are going to use ARIS for SAP® Solutions, additional requirements must be
met. For details, see Technical Help: Connect SAP® systems and Required SAP
systems.
 To make dashboards available, refer to the online help.
19. Click Logout.
20. Send the URL [Link] address or fully-qualified host name>:<load balancer
port>/#<tenant name>/home to all users.
ARIS server is installed and running.
You can stop ARIS server using the Stop ARIS server link in the Windows start menu or enter
stopall in the ARIS Cloud Controller (see ARIS Cloud Controller (ACC) Command-line
Tool).

30
SERVER INSTALLATION GUIDE - LINUX

3.1 Security advice

Due to the Tomcat (Ghostcat) vulnerability, you are recommended to block (page 32) access
to all AJP ports if you use an ARIS version prior to [Link].

3.1.1 Make TLS certificate available for ARIS server

By default, the loadbalancer runnable is set to allow both unencrypted HTTP (port 80) and
encrypted HTTPS (port 443) access. To use TLS (former SSL), the certificate must fit the load
balancer's host name. Otherwise, client connections, in particular web browser connections,
will fail due to an invalid certificate.

OBTAINING A VALID CERTIFICATE

If you want to use TLS, you need a valid certificate for the server on which the load balancer is
running. This certificate must be signed by a certificate authority (CA). Please make sure that
the certificate is compatible with the Java version of each ARIS client.
 You can buy a certificate from an official CA. Most clients, in particular browsers, will trust
certificates signed by such a CA.
 If your company uses own CA, use a certificate from this CA and add this CA to the trust
store of all clients.

ADDING A VALID CERTIFICATE TO THE LOAD BALANCER

Your certificate must contain two parts:
 The private key used to encrypt information sent back to the client (file extension .key).
 The server certificate (file extension .crt).
1. Put the *.key file and the *.crt file into a ZIP archive.
2. Copy this ZIP file to a local directory that can be accessed by ARIS Cloud Controller (ACC).
3. Start ARIS Cloud Controller (ACC) (page 26) and establish a connection.
4. Stop the loadbalancer runnable. Enter, for example: stop loadbalancer_m
5. Enter the ACC command enhance loadbalancer_<s, m, or l> with sslCertificate local
file "<path to the ZIP file>"
Example: enhance loadbalancer_m with sslCertificate local file
"c:\\temp\\[Link]".
If you have blanks or special characters in the path, you must put it in quotes and use a
double backslash instead of a single slash. Alternatively, use single forward slashes, for
example: "c:/temp/[Link]".
6. Start the loadbalancer runnable again. Enter, for example: start loadbalancer_m
The SSL certificate is available.

31
SERVER INSTALLATION GUIDE - LINUX

If an ARIS client cannot perform connections to servers using TLS certification, you need to
provide an additional certificate (see: Basic Troubleshooting Guide).

3.1.2 Safety recommendation: Block AJP ports

The Apache JServ Protocol (AJP) is a binary protocol that can proxy incoming requests
from a web server to an application server behind the web server. AJP is a highly trusted
protocol. It must not be made available to untrusted clients because they could gain access to
confidential information or execute code on the application server.
ARIS uses AJP for communication between the loadbalancer runnable that bases on Apache
HTTPD and ARIS applications that base on Apache Tomcat. The vulnerable Tomcat AJP
connector is mandatory and must stay active for ARIS applications.
If you have installed ARIS server according to our recommendations, you can block access to
the ports of all runnables except the HTTP and HTTPS ports used by the loadbalancer
runnable by setting appropriate firewall rules. By default these HTTP and HTTPS ports are 80
and 443 on Windows operating systems and 1080 and 1443 on Linux operating systems.
To prevent unauthorized access, check that the AJP ports of your ARIS installations are only
accessible from networks from which users access ARIS (page 32). The show node ACC
command gives an overview of open AJP ports. It lists all ports used by ARIS runnables. The
[Link] parameter (in former ARIS versions called CATALINA_AJP_PORT)
identifies AJP ports. If any of these ports are accessible from an external network, you must
block access immediately by your firewall.
Important: If your ARIS system is a multiple node installation, the AJP ports must remain open
for data transfer between multiple nodes. These open AJP ports do not represent a security
gap, because distributed ARIS installations must always be protected by a firewall.

3.1.3 Check open AJP ports (Ghostcat vulnerability)

To prevent unauthorized access, check that the AJP ports of your ARIS installations are only
accessible from networks from which users access ARIS (page 32).

Procedure
1. Start ARIS Cloud Controller (ACC) (page 26) and establish a connection.
2. To check ports used by runnables, enter: show node
The list is displayed. Navigate to the Known used ports section.
Port Runnable Port Parameter
443 loadbalancer_m [Link] Set
explicitly

32
SERVER INSTALLATION GUIDE - LINUX

33
SERVER INSTALLATION GUIDE - LINUX

34
SERVER INSTALLATION GUIDE - LINUX

3.2 Database connection

This chapter provides information on configuring the ARIS server in order to use an external
database management system.

3.2.1 Configure the database connection for additional

schemes

ASSIGN TENANT TO DATABASE SCHEMA

During the setup process you have created an empty Oracle or Microsoft SQL schema for an
additional tenant (see Technical Help: ARIS server Installation - Windows or ARIS server
Installation Linux). Read the documents on the ARIS Documentation website
([Link] or download them from the ARIS Download Center
([Link] Additionally created tenants
must be assigned to the database schema. Replace values in angle brackets, such as <tenant
name> with your own values, such as new tenant1.
1. Start ARIS Cloud Controller (ACC) (page 26) and establish a connection.
2. To discover the database service ID (<dbserviceID>, such as db000000000), enter:
list external services
assign tenant <tenant name> to service <dbserviceID> [Link] =<schema
name>
For tenant names please only use up to 25 lowercase ASCII characters and numbers. The
name must begin with a character. Special characters, such as _ and characters, for
example, in Chinese, Cyrillic or Arabic cannot be used.
3. To create a new tenant, enter:
create tenant <tenant name>
The new tenant is available on ARIS server.

ADDITIONAL SETTINGS
To enable validationQuery for external database connections (Oracle & Microsoft SQL) use
the correct validation query for the DBMS.
For Oracle use:
validationQuery="select 1 from dual" and testOnBorrow=true
For Microsoft SQL use:
validationQuery="select 1" and testOnBorrow=true
For better readability, the parameters of the command are shown with line-wraps. For
execution you must enter a single-line command.

35
SERVER INSTALLATION GUIDE - LINUX

During registration of external service add parameters, for example, for Oracle:
register external service db
url="jdbc:oracle:thin:@<target_host>:<target_port>:<oracle_sid>"
driverClassName="[Link]"
username="<cip_app_user>
password="<cip_app_pwd>"
maxIdle=15
maxActive=100
maxWait=10000
removeAbandoned=false
removeAbandonedTimeout=600
defaultAutoCommit=false
rollbackOnReturn=true
host=<target_host>
port=<target_port>
jmxEnabled=true
validationQuery="select 1 from dual"
testOnBorrow="true"
After the external service was already registered, for example, for Oracle:
update external service <dbserviceID>
url="jdbc:oracle:thin:@<target_host>:<target_port>:<oracle_sid>"
driverClassName="[Link]"
username="<cip_app_user>"
password="<cip_app_pwd>"
maxIdle=15
maxActive=100
maxWait=10000
removeAbandoned=false
removeAbandonedTimeout=600
defaultAutoCommit=false
rollbackOnReturn=true
host=<target_host>
jmxEnabled=true
validationQuery="select 1 from dual"
testOnBorrow="true"

ENABLE VALIDATIONQUERY FOR EXTERNAL POSTGRESQL CONNECTION

1. Enter: stopall
2. Enter: reconfigure <postgres_runnable> [Link]="select 1"
[Link]=true
3. Enter: startall
The database connection is configured.

3.2.2 Update external service (database clusters)

If you have performed an installation using an Oracle or Microsoft SQL database cluster you
need to reconfigure the external service after the installation process.
This procedure shows an example for an Oracle database.

36
SERVER INSTALLATION GUIDE - LINUX

Procedure
1. Start ARIS Cloud Controller (ACC) (page 26) and establish a connection.
2. To connect to an Oracle cluster using a JDBC URL you may use this example:
update external service <dbserviceID>
url="jdbc:oracle:thin:@(DESCRIPTION=ADDRESS_LIST=(ADDRESS=(PROTOCOL=TCP
) (HOST=<virtual-ip-oracle-cluster>)(PORT = <target
port>)))(CONNECT_DATA=(SERVICE_NAME=cluster-database-name)))"
driverClassName="[Link]" username="<cip_app_user>"
password="<new_cip_app_pwd>" maxIdle=15 maxActive=100 maxWait=10000
removeAbandoned=false removeAbandonedTimeout=600 logAbandoned=true
defaultAutoCommit=false rollbackOnReturn=true host=<target_host>
jmxEnabled=true validationQuery="select 1 from dual" testOnBorrow=true
ARIS server can be started using the Oracle cluster.

37
SERVER INSTALLATION GUIDE - LINUX

3.2.3 Encrypt passwords

You can encrypt passwords, such as the superuser password. The command line tool ARIS
Server Administrator is available if you have installed ARIS server or the ARIS Administrator
Tools (see Technical Help: ARIS client Installation Guide. Read the documents on the ARIS
Documentation website ([Link] or download them from the ARIS Download
Center ([Link]
If you have installed ARIS server, navigate to <ARIS installation
path>\server\bin\work\work_abs_<s, m, or l>\tools\arisadm and run the batch file.

Procedure
1. Start ARIS Server Administrator. This command line tool is available, if you have
installed ARIS server, or the ARIS Administrator Tools (see Technical Help: ARIS client
Installation Guide. Read the documents on the ARIS Documentation website
([Link] or download them from the ARIS Download Center
([Link]
If you have installed ARIS server, navigate to <ARIS installation
path>\server\bin\work\work_abs_<s, m, or l>\tools\arisadm and run the batch file.
Under a Linux operating system, execute the [Link] shell script instead. The
command prompt opens and ARIS Server Administrator is launched in interactive mode.
If you accepted the program group suggested by the installation program, click Start >
Programs > ARIS > Administration > ARIS Server Administrator 10.
2. Establish a connection to the server using the server command:
syntax: server <server name>:<port number> <tenant> <user name> <password>
example: server localhost:80 default system manager
3. Enter command: encrypt <pwd_to_be_encrypted>
Example:
encrypt databaseuser
encrypted password:{crypted}123456789abcdefg
4. Copy the encrypted password, such as {crypted}123456789abcdefg to a text editor
file.
You can paste the encrypted password to related fields.

38
SERVER INSTALLATION GUIDE - LINUX

3.3 Elasticsearch
The Document index (Elasticsearch) is a basic component that contains the full-text search
index for documents and collaboration data. It also stores users, user groups, licenses, and
privileges. By default, the elastic_<s, m, or l> runnable (Elasticsearch) uses generic user
credentials required for communication with other ARIS runnables.

3.3.1 Check user name and password (Elasticsearch)

By default, the elastic_<s, m, or l> runnable (Elasticsearch) uses generic user credentials
required for communication with other ARIS runnables. You can check the user name and
password in use.

Procedure
1. Navigate to <ARIS installation path>\server\bin\work\work_elastic_m, for example,
C:\ARIS10.0\server\bin\work\work_elastic_m.
2. Open the [Link] file with a text editor.
3. Copy the instance ID, for example:
elasticsearch0000000000
4. Start ARIS Cloud Controller (ACC) (page 26) and establish a connection.
5. Once ACC is initialized, enter show service elastisearch<ID>, for example:
show service elasticsearch0000000000
User name and password are displayed.

You can change (page 40) the user name and the password if required.

39
SERVER INSTALLATION GUIDE - LINUX

3.3.2 Change user name and password (Elasticsearch)

By default, the elastic_<s, m, or l> runnable (Elasticsearch) uses generic user credentials
required for communication with other ARIS runnables. You can check (page 39) and change
the user name and the password if required.

Procedure
1. Start ARIS Cloud Controller (ACC) (page 26) and establish a connection.
2. Once ACC is initialized, enter:
reconfigure elastic_<s, m, or l> +[Link]="<new user
name" +[Link]="<new password>"
for example:
reconfigure elastic_m +[Link]="administrator"
+[Link]="Thssmynwpsswrd"
3. Stop the Collaboration runnable ecp_<s, m, or l>. Enter, for example:
stop ecp_m
4. Restart the Collaboration runnable. Enter, for example:
5. start ecp_m
You have changed the user credentials required for the Elasticsearch.

40
SERVER INSTALLATION GUIDE - LINUX

3.3.3 Disable authentication for Elasticsearch

You can switch off the authentication for the Elasticsearch.

Warning
Disabling authentication is not recommended and must be considered carefully. It bears a
potentially risk to data security.

Procedure
1. Start ARIS Cloud Controller (ACC) (page 26) and establish a connection.
2. Once ACC is initialized, enter: reconfigure elastic_<s, m, or l>
+[Link]="true"
for example: reconfigure elastic_m
+[Link]="true"
You have disabled the authentication for the Elasticsearch.

3.4 How to check the virtual memory setting

From ARIS 10 SR4, the elastic runnable (elastic search) requires more virtual memory on your
Linux operating system in order to prevent indices from causing out-of-memory exceptions.
On the machine where the elastic runnable is installed, check which value the
vm.max_map_count system parameter is currently set to.
For this, use the sysctl vm.max_map_count command. If the value is lower than 262144,
change it to 262144.
To change the value for this session only, use the following command (root access
permissions required):
sudo sysctl -w vm.max_map_count=262144
This command changes the value for the current session only. After a reboot, this change is
undone.
To change the value persistently, add this line to the [Link] configuration file that is
available in the ARIS installation directory on your machine:
vm.max_map_count=262144

41
SERVER INSTALLATION GUIDE - LINUX

3.5 Mailing
This chapter provides information on configuring automatic mailing.

3.5.1 Configure ARIS agent mail server connection

If only the ARIS agent is installed but no ARIS server you can activate automatic mailing in
order to receive technical information from the ARIS agent. This will inform administrators, for
example, about performance problems concerning the ARIS agent.
1. Start ARIS Cloud Controller (ACC) (page 26) on the machine where the ARIS agent is
installed.
2. Enter the following lines one after the other.
Example:
set [Link]=true
set [Link]=[Link]
set [Link]=25
set [Link]=<user name>
set [Link]=<password>
set [Link]=aris.administrator1@[Link]
set [Link]=aris.administrator2@[Link]
set [Link]=<COMPUTERNAME>@[Link]
The ARIS agent mail server connection is set.
Mail notification can be configured by the following parameters:

Parameter Description
[Link] true enables automatic mailing.
d
(default: false)

[Link] Qualified hostname or IP of the mail server.

[Link] Port of the mail server.

(common: 25)

[Link] User name on the mail server. If this parameter is set, the
applications will implicitly enable SMTP authentication. There
is NO dedicated parameter to explicitly enable SMTP
authentication.

[Link] Mail server password for the specified user.

42
SERVER INSTALLATION GUIDE - LINUX

Parameter Description
[Link] Sender's e-mail address.

[Link] Sender's name.

[Link] Recipient's e-mail address.

This parameter is multivalued, specify several recipients
separated with commas, for example:
set [Link] = "a@[Link]","b@[Link]"

[Link] Recipient's e-mail address (Carbon Copy(CC)).

This parameter is multivalued (see [Link])

[Link] Defining events triggering e-mail notification if a runnable is in

(default: FAILED) the state FAILED.

[Link] Defining events triggering e-mail notification.

[Link] This parameter is multivalued (see [Link]).
Possible values:
 RUNNABLE_MONITORING_HIGH_THRESHOLD_EXCEEDE
D
 RUNNABLE_MONITORING_LOW_THRESHOLD_EXCEEDED

43
SERVER INSTALLATION GUIDE - LINUX

3.5.2 Configure SMTP mail server connection

If you did not enter the SMTP server connection parameters during the setup process of a
previous ARIS version you need to register your SMTP server manually.
1. Start ARIS Cloud Controller (ACC) (page 26) and establish a connection.
2. Enter, for example:
register external service smtp host="YourMailServerAddressWithDomain" port=25
3. Check that setting entering:
list external services
SMTP mail server configuration is set.
You can modify SMTP configuration parameters using the update external service
command.

Default
Parameter Type Description
value
Host String Qualified hostname or IP of the SMTP server.
host

Port Integer 25 Port of the SMTP server.

port

User name String User name on the SMTP server. If this

username parameter is set, the applications will
implicitly enable SMTP authentication. There
is NO dedicated parameter to explicitly enable
SMTP authentication.

Password String Password for the user on the SMTP server.

password

Sender address String Sender's e-mail address.

[Link]

TLS Boolean false Specifies if SMTP server is TLS enabled.

[Link]

44
SERVER INSTALLATION GUIDE - LINUX

Default
Parameter Type Description
value
TLS mode String STARTTL Specifies the method used to secure the
[Link] S connection. Accepted values are STARTTLS
and SSL. STARTTLS upgrades an initially
non-secure connection to an encrypted one
without requiring a dedicated port for secure
communication, whereas SSL immediately
establishes a secured connection on a
dedicated port.

45
SERVER INSTALLATION GUIDE - LINUX

3.6 Make fonts available

Fonts define how text attribute values are displayed, such as names or descriptions in
models, tables, output files, print outs and PDF outputs. These fonts are related to languages
used in ARIS. The fonts used are taken from different sources, such as the operating system
(OS), the JRE used and the system database of the tenant.
Since ARIS version 10.0.6, Azul Zulu JRE is used as an internally used JRE. This JRE provides
no fonts anymore.
Make sure that all the fonts needed are available on the operating system of the machine
were by ARIS server is installed or in the related tenant.
 To make fonts available server wide, use the tools and procedures related to the
operating system in use.
If you add fonts to the operating system or delete fonts, you must restart ARIS server so
that the changes take effect.
 To make fonts available tenant wide, you must add the missing fonts to the system
database of each tenant. You can add fonts using ARIS Architect or ARIS.
If you have the Admin license and Configuration administration function privilege, you can
manage the fonts that are available for data evaluation and model graphic generation on this
tenant.
You must add any missing fonts that you use in scripts and models, but that are not provided
by the operating system of ARIS server. If the used fonts are missing, unreadable content
might be displayed. The missing fonts are not rendered correctly in output files, or when you
paste a copied model to another application. This can occur, for example, in Japanese, if the
default attribute font MS UI Gothic is missing. In this case, add at least the [Link] font
file.
If ARIS server is installed on a Linux operating system, usually no Windows® standard fonts
are available. To prevent unreadable content or incorrect line breaks, make sure to add all
used fonts from your Windows® operating system.
To manage the fonts used by evaluation scripts, click Application launcher >
Administration > Configuration > Evaluation and select Fonts. You can do the
following:
Import fonts
Delete fonts
Fonts define how text attribute values are displayed, such as names or descriptions in
models, tables, output files, print outs and PDF outputs. These fonts are related to languages
used in ARIS. The fonts used are taken from different sources, such as the operating system
(OS), the JRE used and the system database of the tenant.

46
SERVER INSTALLATION GUIDE - LINUX

When ARIS server is installed on a Windows® operating system, all fonts saved in the Fonts
folder of the operating system are available for report and model graphic generation. Linux
operating systems usually provide a smaller set of fonts.
If you use additional fonts in report scripts or in models, you must add the missing fonts to
the system database of this tenant. If a used font is missing, unreadable content appears in
report output files or incorrect line breaks show up in model graphics. This can occur, for
example, in Japanese, if the default attribute font MS UI Gothic is missing. In this case, add at
least the [Link] font file.

Warning
If ARIS server is installed on a Linux operating system, usually no Windows® standard fonts
are available. To prevent unreadable content or incorrect line breaks, make sure to add all
used fonts from your Windows® operating system to the system database of the tenant.

Prerequisite
 You are the script administrator for this tenant.
 You have access to the required font file (*.ttf or *.ttc).

Procedure
1. In ARIS Architect, click ARIS > Administration.
2. Click Navigation in the bar panel if the Navigation bar is not activated yet.
3. In the navigation tree, click the folder Evaluations > Fonts. All additional fonts
available in the system database of this tenant are listed. If no fonts are displayed, only
the fonts of the Windows® operating system are in use. These fonts are not displayed
here.
4. Click Add font. The dialog for file selection opens.
5. Navigate to the required ttf or ttc file.
If you want to add fonts, such as the [Link] font file from your Windows/Fonts
folder, you must first copy them to a different folder. The Windows/Fonts folder cannot
be used as source folder because the Windows® operating system does not allow direct
access.
6. Select the font files and click Open.
The fonts are added to the system database of this tenant. They are available for reports and
model graphic generation.
If you want to delete a font, move the mouse pointer to the required font, right-click, and click
Delete.
Adding fonts to the system database has the advantages that font sets are update-prove
and there is no need restarting ARIS server to make changes available.

47
SERVER INSTALLATION GUIDE - LINUX

3.6.1 Manage fonts in ARIS

If you have the Admin license and Configuration administration function privilege, you can
manage the fonts that are available for data evaluation and model graphic generation on this
tenant.
You must add any missing fonts that you use in scripts and models, but that are not provided
by the operating system of ARIS server. If the used fonts are missing, unreadable content
might be displayed. The missing fonts are not rendered correctly in output files, or when you
paste a copied model to another application. This can occur, for example, in Japanese, if the
default attribute font MS UI Gothic is missing. In this case, add at least the [Link] font
file.
If ARIS server is installed on a Linux operating system, usually no Windows® standard fonts
are available. To prevent unreadable content or incorrect line breaks, make sure to add all
used fonts from your Windows® operating system.
To manage the fonts used by evaluation scripts, click Application launcher >
Administration > Configuration > Evaluation and select Fonts. You can do the
following:
Import fonts
Delete fonts

3.6.2 Add fonts in ARIS Architect

48
SERVER INSTALLATION GUIDE - LINUX

Prerequisite
 You are the script administrator for this tenant.
 You have access to the required font file (*.ttf or *.ttc).

3.7 Make online help available (optional)

From Service Release 28 and higher, documents and online help are no longer installed. If
your company does not allow access to the ARIS Documentation Website
([Link] you can provide this content using an internal Web server with SSL
configuration and redirecting ARIS.

Prerequisites
 You have access to a Web server with SSL configuration.
 You have downloaded the zipped help file from the ARIS Download Center
([Link] for example
ARIS_Installation_and_Documentation_<version>.zip, and unzipped it to the Root
directory of your Web server.

Procedure
1. Start ARIS Cloud Controller (ACC) (page 26) and establish a connection.

49
SERVER INSTALLATION GUIDE - LINUX

2. Enter the path to your internal Web server on which the documents and the online help
are provided:
[Link]="<URL to your Web server>"
Syntax: "[Link] number>"
The default path is: [Link]="[Link]
3. To reconfigure the abs, copernicus, and arcm runnables using the [Link] of your Web
server, enter the following on all nodes:
reconfigure abs_<s, m, or l> [Link]="<URL to your Web server>"
reconfigure copernicus_<s, m, or l> [Link]="<URL to your Web server>"
reconfigure arcm_<s, m, or l> [Link]="<URL to your Web server>"
4. To specify the version of the content to be used, enter the following for each runnable on
all nodes:
reconfigure <runnable> [Link]="10.2025.10.0"
Example
reconfigure abs [Link]="10.2025.10"
The help is redirected to your internal Web server.
After an update setup, the help on your internal Web server will keep the current version until
you have downloaded the corresponding zipped help file from the ARIS Download Center and
updated your Web server.

3.8 Redirect ports

When installing ARIS on a Linux operating system, for security reasons, all ARIS components
(runnables) are running under a user account that has no root privileges. Such NON-root
users, cannot use privileged ports. Privileged ports are all ports <1024. This restriction in
particular affects the loadbalancer runnable, through which each ARIS client accesses the
application through HTTP and HTTPS protocol. The standard ports for these two protocols
are 80 and 443, respectively, but due to the restriction, the loadbalancer runnable will by
default use ports 1080 and 1443, respectively.
To allow users to access ARIS through the default ports of the respective protocol, a port
redirect can be performed.

Procedure
1. To redirect ports, use the basic syntax of the iptables command:
iptables -t nat -A PREROUTING -i <network interface> -p tcp --dport <port number
to redirect> -j REDIRECT --to-ports <port number>

50
SERVER INSTALLATION GUIDE - LINUX

Replace <network interface> with the name of the network interface through which
each ARIS client accesses the ARIS server. You can use the ip addr command to get an
overview of all network interfaces and their associated IP addresses.
Replace <port number to redirect> with the port on which ARIS should be made
accessible to clients. Usually this is the default port of the respective protocol: port 80 for
HTTP and port 443 for HTTPS.
Replace <port number> with the physical port used by the loadbalancer runnable, that
is: port 1080 for HTTP and port 1443 for HTTPS, unless the load balancer port
configuration was changed.
This example redirects port 80 to port 1080 to allow HTTP access over the standard port
for the network interface enp0s8:
iptables -t nat -A PREROUTING -i enp0s8 -p tcp --dport 80 -j REDIRECT --to-ports
1080
This example redirects port 443 to port 1443 to allow HTTPS access over the standard
port, here for a network interface named eth0:
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-ports
1443
Start ARIS Cloud Controller (ACC) (page 26) and establish a connection.
2. Run a reconfigure command on the loadbalancer runnable.
To make the loadbalancer runnable know through which ports users are now accessing
it, you need to run an ACC reconfigure command with the following syntax:
reconfigure loadbalancer_<SIZING>
[Link]=<externalHttpPort>
[Link]=<externalHttpsPort>
Replace <SIZING> with the sizing you used to install ARIS server, such as s, m, or l.
Replace <externalHttpPort> with the port from which you redirect to the physical HTTP
port of the loadbalancer runnable (usually port 80).
Replace <externalHttpsPort> with the port from which you redirect to the physical
HTTPS port of the loadbalancer runnable (usually port 443).
This example tells the loadbalancer runnable in an m size installation that users are now
accessing through the redirected ports 80 and 443:
reconfigure loadbalancer_m [Link]=80
[Link]=443
ARIS users access ARIS using the redirected ports.
If runnables do not start up properly, resolve possible port conflicts.

51
SERVER INSTALLATION GUIDE - LINUX

3.9 Redirect HTTPS port

To make ARIS accessible under a privileged port on a Linux system, a user with root privileges
has redirect the ports (page 50), for example, the HTTP port 80 or the HTTPS port 443.
If you have forced the loadbalancer runnable to use HTTPS using an ACC command, such as:
reconfigure loadbalancer_m +[Link]="true"
connections cannot be established. This is because users are forwarded to [Link]
name>:1443/ instead of [Link] name>.
You must redirect the HTTPS port to 443.

Procedure
1. Start ARIS Cloud Controller (ACC) (page 26) and establish a connection.
2. Enter:
reconfigure loadbalancer_m [Link]=":443"
You must enter a colon followed by the port number.
Users are forwarded correctly.

52
SERVER INSTALLATION GUIDE - LINUX

3.10 Use external load balancer

If you use an external load balancer (LB), you must reconfigure ARIS LB (page 53) to prevent
system failure caused by ARIS brute-force protection.
When you put an HTTP-based application server behind an external load balancer (LB), the
HTTP application will only see the IP address of the LB as apparent client IP. Likewise, when
TLS is terminated at the external LB, the HTTP server will see that it is accessed via HTTP, as
it has no way of knowing that the actual clients had been using HTTPS up to the external LB.
For various reasons listed below, it is important for the HTTP application to know the true
clients' IP addresses, the true protocol used from the client's perspective, and the TCP port
used:
 If the ARIS LB does not know the true client IP, it cannot log it in its access log - the
access log will only show the IP of the external LB all the time. This might not be a
problem until you try to find out which client did a bad request.
 ARIS has a mechanism to limit the number of failed logon attempts, so that an attacker
cannot brute-force passwords. This mechanism logs the number of attempts individually
for each client IP. If the attacker at [Link] tries to brute force his way into the system he
will be slowed down after a few failed attempts. This will not affect other users accessing
the system from other IPs. But if the application only sees the IP of the external LB, failed
logon attempts all seem to come from the same IP. This makes the brute-force protection
become active much earlier because all failed attempts, even if it is not an attack but just
a typo, are counted for the same IP - that of the external LB.
 in some situations ARIS server needs to create a link to itself and send that to the client.
For example, when Process Governance processes are sending notification mails that
contain links to a certain resource in the application, these links should use the host
name, protocol and port that the actual end users are using to access the application. Not
the host name, protocol and port that the external LB is using to communicate with ARIS.
A similar mechanism is going on with the download client download mechanism.
Because of this, it is necessary that ARIS in some way gets information about:
 The true IP address of the client.
 The protocol the client originally used to access the application.
 The port used.
 The host name used.
With an external LB in front and without additional mechanisms, all this information would be
lost if you did not use the X-Forwarded-* header mechanism. Slightly simplified it work like
this:
 X-Forwarded-For contains the original client IP address.
 X-Forwarded-Port contains the port that the client originally used.

53
SERVER INSTALLATION GUIDE - LINUX

 X-Forwarded-Proto contains the protocol (HTTPS or HTTP) that the client originally
used.
 X-Forwarded-Host contains the original host name that the client used.
There is also a more recent header specified (Forwarded header), which puts all this
information into a single header, but the concept is the same.
To make all the functionality above work properly, an external LB has to add the
X-Forwarded-* headers or the Forwarded header to the request, putting in the true client
information.
However, if ARIS would simply accept these headers from anywhere, an attacker could create
requests that already contain these headers. For example, using the X-Forwarded-For
header, he could circumvent the login attempt limitation. He could use a physical IP address,
but change the IP in the X-Forwarded-For header for each attempt. For this and similar
reasons, ARIS LB will by default not accept any of the X-Forwared-* headers from anyone.
They will simply be removed from the request before passing it on to the actual application
micro services.
Using the [Link] parameter, you can specify a
regular expression. Any client IP that matches this regex will be considered trustworthy, and
only from those the ARIS LB will accept the X-Forwarded-* headers.
Note that while this parameter name suggests that it is only relevant for the X-Forwarded-For
it is now used for all of these headers - we merely decided to keep the parameter name for
compatibility.
Therefore, in any scenario where clients do not directly access ARIS LB, but go through
external LBs, you must declare the IPs of your external LBs as trustworthy to ARIS LBs.
Therefore, reconfigure each ARIS LB. And if your external LB is using more than one IP
address to access ARIS, you must change the regex so that all of these IP addresses match.
The regex syntax used is that of the perl-compatible regular expressions library (PCRE)
[Link] The only caveat is that if you need to use a backslash in your regex
(like to escape the "." in the above proposal), it has to be replaced by four backslashes.

Example
If the IP of your external LB is [Link] and you are using two ARIS LBs, enter the
following ARIS Cloud Controller (ACC) commands:
on n1 reconfigure loadbalancer_l
[Link]="198\\\\.20\\\\.212\\\\.156"
on n2 reconfigure loadbalancer_l
[Link]="198\\\\.20\\\\.212\\\\.156"

54
SERVER INSTALLATION GUIDE - LINUX

4 Support and legal information

This section provides you with some general information regarding product support and legal
aspects.

4.1 Documentation scope

The information provided describes the settings and features as they were at the time of
publishing. Since documentation and software are subject to different production cycles, the
description of settings and features may differ from actual settings and features. Information
about discrepancies is provided in the Release Notes that accompany the product. Please
read the Release Notes and take the information into account when installing, setting up, and
using the product.
If you want to install technical and/or business system functions without using the
consulting services provided by SAG ARIS GmbH, you require extensive knowledge of the
system to be installed, its intended purpose, the target systems, and their various
dependencies. Due to the number of platforms and interdependent hardware and software
configurations, we can describe only specific installations. It is not possible to document all
settings and dependencies.
When you combine various technologies, please observe the manufacturers' instructions,
particularly announcements concerning releases on their Internet pages. We cannot
guarantee proper functioning and installation of approved third-party systems and do not
support them. Always follow the instructions provided in the installation manuals of the
relevant manufacturers. If you experience difficulties, please contact the relevant
manufacturer.
If you need help installing third-party systems, contact your local ARIS sales organization
([Link] Please note that this type of manufacturer-specific or customer-specific
customization is not covered by the standard ARIS software maintenance agreement and can
be performed only on special request and agreement.

4.2 Support

PRODUCT SUPPORT
We provide support for ARIS products to all customers with a valid support contract.
Contact our Global Support services at ARIS Community to raise and update support incidents
([Link] or post ideas and feature requests
([Link]

55
SERVER INSTALLATION GUIDE - LINUX

COMMUNITY
Register with ARIS Community to download products, updates and fixes, find expert
information, and interact with other users.

DOCUMENTATION
For information on how to use and activate products and for other technical support
questions, visit the ARIS Documentation website ([Link]
If you want to give feedback on any documentation topic, write to documentation@[Link].

ARIS Server Installation and Administration Guide - 0 PDF
No ratings yet
ARIS Server Installation and Administration Guide - 0 PDF
167 pages
ARIS Server Installation and Administration Guide
0% (2)
ARIS Server Installation and Administration Guide
354 pages
ARIS Client Installation Guide
No ratings yet
ARIS Client Installation Guide
23 pages
Installation Administration Guide S
No ratings yet
Installation Administration Guide S
476 pages
ARIS Client Installation Guide
No ratings yet
ARIS Client Installation Guide
22 pages
Installation Guide Aris S
100% (2)
Installation Guide Aris S
57 pages
ARIS Administration Guide
No ratings yet
ARIS Administration Guide
125 pages
ARIS 10-0sr1 Distributed Installation Cookbook
No ratings yet
ARIS 10-0sr1 Distributed Installation Cookbook
112 pages
ARIS Aware Guide for Version 10.0
No ratings yet
ARIS Aware Guide for Version 10.0
26 pages
Aras Innovator 9.3 - Installation Guide
No ratings yet
Aras Innovator 9.3 - Installation Guide
66 pages
BMC Remedy AR System 7.0 Installation Guide
No ratings yet
BMC Remedy AR System 7.0 Installation Guide
186 pages
ARIS Update Cookbook
No ratings yet
ARIS Update Cookbook
51 pages
ARCM - Administration Guide
No ratings yet
ARCM - Administration Guide
26 pages
ARM 9-2 Installation Guide
No ratings yet
ARM 9-2 Installation Guide
14 pages
Aras Innovator 9.2 - Installation Guide
No ratings yet
Aras Innovator 9.2 - Installation Guide
61 pages
Aras Innovator 10.0 - Installation Guide
No ratings yet
Aras Innovator 10.0 - Installation Guide
63 pages
ARIS-CentraSite-webMethods Setup Guide
No ratings yet
ARIS-CentraSite-webMethods Setup Guide
65 pages
ACI Issuer 4.10 - Product Installation Guide For UNIX
No ratings yet
ACI Issuer 4.10 - Product Installation Guide For UNIX
17 pages
OracleAS Infrastructure Installation Guide
No ratings yet
OracleAS Infrastructure Installation Guide
30 pages
Tidal Workload Automation Guide 6.2.2
No ratings yet
Tidal Workload Automation Guide 6.2.2
232 pages
Installing Asterisk on CentOS 7
No ratings yet
Installing Asterisk on CentOS 7
60 pages
Aras Innovator 11.0 - Installation Guide
No ratings yet
Aras Innovator 11.0 - Installation Guide
73 pages
Siemens FMX 3
100% (2)
Siemens FMX 3
90 pages
Linux Server Installation Guide
No ratings yet
Linux Server Installation Guide
9 pages
Asterisk and Vicidial Installation Guide
No ratings yet
Asterisk and Vicidial Installation Guide
68 pages
Aginet ACS Installation Guide
No ratings yet
Aginet ACS Installation Guide
17 pages
Acr Win Install
No ratings yet
Acr Win Install
46 pages
Arcserver D2D Linux
No ratings yet
Arcserver D2D Linux
182 pages
Understanding the NMA Acronym in RPM
No ratings yet
Understanding the NMA Acronym in RPM
12 pages
Dell Proxm PRNTG User's Guide en Us
No ratings yet
Dell Proxm PRNTG User's Guide en Us
40 pages
RAIS+ Installation Manual Guide
No ratings yet
RAIS+ Installation Manual Guide
53 pages
Configuring Apache on Red Hat 6
No ratings yet
Configuring Apache on Red Hat 6
33 pages
Nagios Installation Guide on VirtualBox
No ratings yet
Nagios Installation Guide on VirtualBox
26 pages
IRAF Installation Guide for Ubuntu
No ratings yet
IRAF Installation Guide for Ubuntu
3 pages
Aras Innovator 120 Installation Guide
No ratings yet
Aras Innovator 120 Installation Guide
74 pages
Avrdude 72
No ratings yet
Avrdude 72
66 pages
Apache Web Server Training Guide
No ratings yet
Apache Web Server Training Guide
20 pages
QAD Enterprise Edition Installation Guide
No ratings yet
QAD Enterprise Edition Installation Guide
66 pages
Understanding Autoyast in SUSE
No ratings yet
Understanding Autoyast in SUSE
164 pages
Aginet ACS Installation Guide
No ratings yet
Aginet ACS Installation Guide
35 pages
FP HW&SW&VA Installation
No ratings yet
FP HW&SW&VA Installation
21 pages
QAD Enterprise Edition Installation Guide
No ratings yet
QAD Enterprise Edition Installation Guide
52 pages
Apache Server Installation Guide
No ratings yet
Apache Server Installation Guide
53 pages
Kaspersky Security Center Installation Guide
No ratings yet
Kaspersky Security Center Installation Guide
6 pages
What Is Arch Linux?
No ratings yet
What Is Arch Linux?
19 pages
Install Apache on Ubuntu 18.04
No ratings yet
Install Apache on Ubuntu 18.04
1 page
Oracle® Auto Service Request: Quick Installation Guide Release 5.5
No ratings yet
Oracle® Auto Service Request: Quick Installation Guide Release 5.5
8 pages
Installing Apache on Linux Guide
No ratings yet
Installing Apache on Linux Guide
10 pages
Apache Web Server Setup Guide
No ratings yet
Apache Web Server Setup Guide
15 pages
Arbor APS STT Unit 02 Deployment 25 Jan2018
No ratings yet
Arbor APS STT Unit 02 Deployment 25 Jan2018
50 pages
Elevate CSUS Installation Guide 2.0
No ratings yet
Elevate CSUS Installation Guide 2.0
19 pages
ACI Issuer 4.10 - Product Installation Guide
No ratings yet
ACI Issuer 4.10 - Product Installation Guide
20 pages
AventX Oracle Connector Resource Guide
No ratings yet
AventX Oracle Connector Resource Guide
590 pages
Oracle9i Installation Guide for UNIX
No ratings yet
Oracle9i Installation Guide for UNIX
252 pages
Installing Red Hat Linux VM Guide
No ratings yet
Installing Red Hat Linux VM Guide
15 pages
4leaps - ESM - Installation GuideV11
No ratings yet
4leaps - ESM - Installation GuideV11
38 pages
CTD Installation Guide for ClarotyOS 5.0.12
No ratings yet
CTD Installation Guide for ClarotyOS 5.0.12
36 pages
T Nav Dispatcher Administration Guide English
No ratings yet
T Nav Dispatcher Administration Guide English
23 pages
New Server Setup Checklist for Windows 2008
No ratings yet
New Server Setup Checklist for Windows 2008
2 pages
Creating Purchase Orders in Excel
No ratings yet
Creating Purchase Orders in Excel
19 pages
CCSupervision Installation Guide R10.9.92.0
No ratings yet
CCSupervision Installation Guide R10.9.92.0
58 pages
Roku Streaming Player Component Guide
No ratings yet
Roku Streaming Player Component Guide
148 pages
BioRad CFX96 10021337
No ratings yet
BioRad CFX96 10021337
178 pages
Introduction to Digital Forensics
No ratings yet
Introduction to Digital Forensics
34 pages
Nectas Configuration Guide 1641-1651
No ratings yet
Nectas Configuration Guide 1641-1651
8 pages
Teradata SQL Assistant and Java Edition
No ratings yet
Teradata SQL Assistant and Java Edition
22 pages
SWEDU-FundamentalsSWE SV 0
No ratings yet
SWEDU-FundamentalsSWE SV 0
42 pages
Scripting Language Transition in MPV
No ratings yet
Scripting Language Transition in MPV
283 pages
DelPhi Manual v8.0 Overview
No ratings yet
DelPhi Manual v8.0 Overview
33 pages
Grade 10 Computer System Servicing Plan
No ratings yet
Grade 10 Computer System Servicing Plan
5 pages
SPIC-300 Spectral Irradiance Colorimeter User'S Manual
No ratings yet
SPIC-300 Spectral Irradiance Colorimeter User'S Manual
51 pages
MFM-CMS Installation Guide
No ratings yet
MFM-CMS Installation Guide
29 pages
BIM Worksharing in Revit
No ratings yet
BIM Worksharing in Revit
14 pages
Overview of Linux Operating System
No ratings yet
Overview of Linux Operating System
24 pages
Managing ZIP Files in EPPS
No ratings yet
Managing ZIP Files in EPPS
6 pages
Siemens Drive Fault Codes Overview
No ratings yet
Siemens Drive Fault Codes Overview
238 pages
MSC/Nastran Troubleshooting Guide
No ratings yet
MSC/Nastran Troubleshooting Guide
12 pages
RNR USB Motion Control Card Guide
100% (1)
RNR USB Motion Control Card Guide
38 pages
Wifi Hacking Guide - Step by Step
No ratings yet
Wifi Hacking Guide - Step by Step
2 pages
2ND Term SS2 DP Note
No ratings yet
2ND Term SS2 DP Note
20 pages
Network Design Assignment for Red Organization
No ratings yet
Network Design Assignment for Red Organization
4 pages
Spooky2 User's Guide 01042015
50% (2)
Spooky2 User's Guide 01042015
224 pages
Christian Spiritual Growth Journal
No ratings yet
Christian Spiritual Growth Journal
12 pages
IBP Demand Planning Activation Issues in HANA
No ratings yet
IBP Demand Planning Activation Issues in HANA
61 pages
pyRevit 4.8 Documentation Guide
No ratings yet
pyRevit 4.8 Documentation Guide
134 pages
Oracle ASM & RAID Storage Solutions
No ratings yet
Oracle ASM & RAID Storage Solutions
11 pages
Philips HDD6320 HDD6330 Service Manual
No ratings yet
Philips HDD6320 HDD6330 Service Manual
26 pages
The ABS's of Parameters and Thresholds PDF
No ratings yet
The ABS's of Parameters and Thresholds PDF
40 pages
WebCTRL v5 5 User Manual PDF
No ratings yet
WebCTRL v5 5 User Manual PDF
208 pages

Server Installation Linux

Uploaded by

Server Installation Linux

Uploaded by

ARIS 10

General prerequisites ................................................................................................................................... 3

2 Setup scenarios ..................................................................................................................................... 5

Content The Content folder contains ARIS databases, method filters

Documents The Documents folder contains all required documents and

Linux setups Contains all required files to be executed on a Linux operating

ARIS_Admin Provides ARIS Server Administrator on a Linux system (see

ARIS_Scriptrunner Provides ARIS Scriptrunner on a Linux system (see ARIS

Windows setups All required setup programs to be run on Windows machines.

ARIS_Client Installs an ARIS client.

ARIS_Server Installs ARIS.

Setup_Data Folder content is needed for all setups.

INSTALLING ARIS SERVER

2.1 Change default installation directory or default user

2.2 Installing ARIS server using the standard database

2.3 Installing ARIS server using a Microsoft SQL Server

2.4 Installing ARIS server using an Oracle database

REM The path to where [Link] can be found.

 Password: The application user's password. The corresponding line in the

2.5 How to start ARIS Cloud Controller (ACC)

INTERACTIVE MODE (DEFAULT)

[Link] -h localhost -u <user name> -pwd <remoteAccessPassword> set

WINDOWS OPERATING SYSTEM

LINUX OPERATING SYSTEM

3 Configure ARIS server

3.1 Security advice

3.1.1 Make TLS certificate available for ARIS server

OBTAINING A VALID CERTIFICATE

ADDING A VALID CERTIFICATE TO THE LOAD BALANCER

3.1.2 Safety recommendation: Block AJP ports

3.1.3 Check open AJP ports (Ghostcat vulnerability)

1080 loadbalancer_m [Link] Set

14450 hds_m [Link] Set

3.2 Database connection

3.2.1 Configure the database connection for additional

ASSIGN TENANT TO DATABASE SCHEMA

ENABLE VALIDATIONQUERY FOR EXTERNAL POSTGRESQL CONNECTION

3.2.2 Update external service (database clusters)

3.2.3 Encrypt passwords

3.3.1 Check user name and password (Elasticsearch)

3.3.2 Change user name and password (Elasticsearch)

3.3.3 Disable authentication for Elasticsearch

3.4 How to check the virtual memory setting

3.5.1 Configure ARIS agent mail server connection

[Link] Qualified hostname or IP of the mail server.

[Link] Port of the mail server.

[Link] Mail server password for the specified user.

[Link] Sender's name.

[Link] Recipient's e-mail address.

[Link] Recipient's e-mail address (Carbon Copy(CC)).

[Link] Defining events triggering e-mail notification.

[Link] Defining events triggering e-mail notification if a runnable is in

[Link] Defining events triggering e-mail notification.

3.5.2 Configure SMTP mail server connection

Port Integer 25 Port of the SMTP server.

User name String User name on the SMTP server. If this

Password String Password for the user on the SMTP server.

Sender address String Sender's e-mail address.

TLS Boolean false Specifies if SMTP server is TLS enabled.

3.6 Make fonts available

3.6.1 Manage fonts in ARIS

3.6.2 Add fonts in ARIS Architect

3.7 Make online help available (optional)

3.8 Redirect ports

3.9 Redirect HTTPS port

3.10 Use external load balancer

4 Support and legal information

4.1 Documentation scope

You might also like