OpenDeploy FTP Adapter - not allowed deployment path

This is our environment:
- TeamSite 6.7.1 SP1
- OpenDeploy 6.2.0

TeamSite server is in protected network (behind the firewall). The Web server environment where content gets deployed is in the public domain.

Due to the firewall setting we are not able to use OpenDeploy. Instead, we have decided to explore the OpenDeploy FTP Adapter route.

I have attached the OD FTP Adapter config file (used to connect to the FTP server) with login information that work (login parameters were tested via command line FTP command - DOS environment).

As we tested ability to connect to FTP server, we confirmed that our firewall settings seem to be atypical - our FTP connect request had to be issued against firewall IP address with special username and FTP server information (see attached OD FTP adapter config file).

Once the ability to connect to FTP server was confirmed (from within DOS), we decided to test OpenDeploy FTP Adapter. However, we are not successful.

These are lines from our OD deployment file used to specify source and destination folders:

This is the error we get when OpenDeploy request is triggered:
Receiver-ERROR: ERROR: [\admmat_web_site\temp] is not an allowed deployment path.

The 'not allowed deployment path' quite often requires that allowed destinations are listed in odreceiver.xml and/or odbase.xml files.

However, our case (OD FTP adapter) is not a typical one (where OD base connects to the OD receiver). What is that we would need to specify in our case?
- Firewall IP address and FTP server destination folder?
- or something else

TIA.

Find more posts tagged with

Comments

sniv

Hey

See primary purpose of the FTP adapter is to enable deployment to platforms that do not support the OpenDeploy Receiver software.

There is common mis-understandings about the the OpenDeploy FTP adapter allowing for content to be FTP’d to target servers DIRECTLY.

Which is NOT the case.

Process is as follows:

OD Base Server deploys the content using the OpenDeploy protocol to a Receiver Server (this could be to the same Base Server too if u dont have any other server or don't have reciver/base s/w on it).

The FTP adapter takes the file from same server/ or from any other second server and then using the Active or Passive mode FTP protocol it transfer the file to the third target server. (Which don't have OD installation).

Hope this help u.

Vinayak

boskovuk

Hey

See primary purpose of the FTP adapter is to enable deployment to platforms that do not support the OpenDeploy Receiver software.

There is common mis-understandings about the the OpenDeploy FTP adapter allowing for content to be FTP’d to target servers DIRECTLY.

Which is NOT the case.

Process is as follows:

OD Base Server deploys the content using the OpenDeploy protocol to a Receiver Server (this could be to the same Base Server too if u dont have any other server or don't have reciver/base s/w on it).

The FTP adapter takes the file from same server/ or from any other second server and then using the Active or Passive mode FTP protocol it transfer the file to the third target server. (Which don't have OD installation).

Hope this help u.

Vinayak

This is definitely helpful. I had impression that FTP Adapter would work collaborately with OD Base/Sender and deploy content directly to the destination FTP server environment. Your feedback puts more light on this topic.

I have attached our OpenDeploy deployment file.

Can you help me understand some of these paths (source, destination, FTP server, etc)?

This is what I know now:
- FTP Adapter config file is located on the same server as OD Base component
- as per our OD deployment file, these are source and destination folders:
sourceFilesystem area="Y:\default\main\development\dev_workflow\STAGING\htdocs\CSS"
targetFilesystem area="E:\Inetpub\wwwroot\admmat_web_site\temp

What is the FTP server (destination environment for the FTP Adapter) folder where deployed files will be FTP-ed?
Would this destination be identical to the targetFilesystem area/folder?

Adam Stoller

This is our environment:
- TeamSite 6.7.1 SP1
- OpenDeploy 6.2.0

TeamSite server is in protected network (behind the firewall). The Web server environment where content gets deployed is in the public domain.

Due to the firewall setting we are not able to use OpenDeploy. Instead, we have decided to explore the OpenDeploy FTP Adapter route.
...

Just because there's a firewall doesn't mean you cannot use OpenDeploy - OpenDeploy has been installed at countless customer sites where there's a firewall between the TS server and the Web server.

You need to read the OD manual more thoroughly / carefully to understand what's involved - but essentially you need to open at least one port (by default 20014, but you can use something different), and it only needs to be opened for outbound traffic (from TS -> Web). If your firewall performs NAT you need to configure the receivers to accept deployments from the NAT'd address of the TS server and/or for the sender to know about NAT'd addresses of the receivers (I think it's only the former, but I can't remember, and it may depend on whether the NAT is performed in both directions or only one) - No adapters needed.

sniv

This is definitely helpful. I had impression that FTP Adapter would work collaborately with OD Base/Sender and deploy content directly to the destination FTP server environment. Your feedback puts more light on this topic.

I have attached our OpenDeploy deployment file.

Can you help me understand some of these paths (source, destination, FTP server, etc)?

This is what I know now:
- FTP Adapter config file is located on the same server as OD Base component
- as per our OD deployment file, these are source and destination folders:
sourceFilesystem area="Y:\default\main\development\dev_workflow\STAGING\htdocs\CSS"
targetFilesystem area="E:\Inetpub\wwwroot\admmat_web_site\temp

What is the FTP server (destination environment for the FTP Adapter) folder where deployed files will be FTP-ed?
Would this destination be identical to the targetFilesystem area/folder?

Can you please upload the odbase.xml file....

Check whether you have an entry present for below path inside the allowed hosts section inside odbase.xml.

E:\Inetpub\wwwroot\admmat_web_site\temp

If not provide same ....and DO RESTART the services once.

As I see the error is : Receiver-ERROR: ERROR: [\admmat_web_site\temp] is not an allowed deployment path....where as there is no path provided into conf as "\admmat_web_site\temp"...

Vinayak

boskovuk

Just because there's a firewall doesn't mean you cannot use OpenDeploy - OpenDeploy has been installed at countless customer sites where there's a firewall between the TS server and the Web server.

You need to read the OD manual more thoroughly / carefully to understand what's involved - but essentially you need to open at least one port (by default 20014, but you can use something different), and it only needs to be opened for outbound traffic (from TS -> Web). If your firewall performs NAT you need to configure the receivers to accept deployments from the NAT'd address of the TS server and/or for the sender to know about NAT'd addresses of the receivers (I think it's only the former, but I can't remember, and it may depend on whether the NAT is performed in both directions or only one) - No adapters needed.

The business decision of this organization (my current client) that no firewall ports (except 80 and 21) can be opened!

The TeamSite server is running within protected network. The destination environment/server is outside (within public unprotected domain). The company firewall is in between (21 and 80 are the only opened ports).

It is impossible to make OpenDeploy architecture work within described limitations, am I right?

That is why we decided to explore OD FTP Adapter route.

ghoti,
I am trying to understand this advice:

...it only needs to be opened for outbound traffic (from TS -> Web).

This outgoing communication would be happening, as you proposed, either through the default port (20014) or through some other.

You are not suggesting that this outbound traffic could be somehow configured to work with either one, port 21 or 80 (and some of TCP/IP tricks/forwarding/etc) to make it happen. Am I missing something here?

boskovuk

Can you please upload the odbase.xml file....

Check whether you have an entry present for below path inside the allowed hosts section inside odbase.xml.

E:\Inetpub\wwwroot\admmat_web_site\temp

If not provide same ....and DO RESTART the services once.

As I see the error is : Receiver-ERROR: ERROR: [\admmat_web_site\temp] is not an allowed deployment path....where as there is no path provided into conf as "\admmat_web_site\temp"...

Vinayak

Vinayak,
Thanks for your suggestions and advices. You helped us to correct initially envisioned OD FTP Adapter architecture.

We are still failing on the last step (FTP client connecting to the FTP server). However, all of the following has been confirmed to be correct:
- OD deployment file (Base/Sender side) needs to be extended to indicate that FTP Adapter will be used
- OD FTP Adapter config file is located on the OD Receiver side (!!!) and not on the OD Base server (as we iniitally assumed)
- FTP client (sitting on the OD Receiver side) will connect to the FTP server and FTP files that were deployed via OpenDeploy framework

All of the above seems to be working. This is the outcome of many test cases we executed in our environment.

I have attached the FTP log file (collected on the OD Receiver side) that is created by OD FTP Adapter. It connects, however, files are not getting deployed. Or, they could be there, however, I am not able to find them.

Could you have a look at the end of this log file (test case that started 09:00:18) - we tried to deploy these two files:
- desktop.ini
- desktopxxx.ini

Please, let me know if you see anything interesting here?

Adam Stoller

The business decision of this organization (my current client) that no firewall ports (except 80 and 21) can be opened!

The TeamSite server is running within protected network. The destination environment/server is outside (within public unprotected domain). The company firewall is in between (21 and 80 are the only opened ports).

It is impossible to make OpenDeploy architecture work within described limitations, am I right?

That is why we decided to explore OD FTP Adapter route.

ghoti,
I am trying to understand this advice:

This outgoing communication would be happening, as you proposed, either through the default port (20014) or through some other.

You are not suggesting that this outbound traffic could be somehow configured to work with either one, port 21 or 80 (and some of TCP/IP tricks/forwarding/etc) to make it happen. Am I missing something here?

Well, if the business wants to be so utterly constricted you could probably hire someone to read the content on the TeamSite server and re-type it word-for-word on the web server ;-)

The opening of one additional port in the firewall (20014 by default) for outbound traffic only (TS -> Web) means that you are not putting any of your protected servers at risk by doing so. I.e.: Nobody out in the big-bad-world would be able to connect back into the protected area by trying to send packets through port 20014 on the firewall because it only allows the communication to be established in the out-bound direction, not the in-bound direction. If the business doesn't understand this - then you should try to arrange a meeting between them, your network security folks, and Autonomy Interwoven Sales Engineers (not Sales Reps - Sales Engineers).

A number of us have been involved with such setups at financial institutions (banks, brokerage companies, etc.) - and I've yet to hear about any of those companies getting attacked through their OpenDeploy firewall ports.

nipper

The business decision of this organization (my current client) that no firewall ports (except 80 and 21) can be opened!

That is an incredibly stupid decision. OD is much more secure than FTP. Someone who actually knows these products needs to talk with the people who make this decision and see if it can be changed.

boskovuk

After going through various test cases and making required changes along the way, I believe the problem is outlined below (see lines extracted from FTP Adapter log file).

I am trying to deploy (via FTP Adapter) this file:
encoding-VisualPreview.jpg

SourceArea, TargetArea and absPath seem to have good values.

However, FtpHelper_put() method fails to put this file into FTP Server environment. I wonder who throws the exception - it looks like firewall, right?

Note that I am able to put files into this folder:
e:\inetpub\wwwroot\admmat\temp\
by using both:
DOS FTP commands and
by using WS_FTP95 FTP client

ADAPTER: 2009-08-11 10:31:05 EDT GMT-04:00 Printing out the Manifest item details
ADAPTER: 2009-08-11 10:31:05 EDT GMT-04:00 Path = encoding-VisualPreview.jpg
ADAPTER: 2009-08-11 10:31:05 EDT GMT-04:00 Type = FILE
ADAPTER: 2009-08-11 10:31:05 EDT GMT-04:00 Action = NEW
ADAPTER: 2009-08-11 10:31:05 EDT GMT-04:00 Reason = NEW
ADAPTER: 2009-08-11 10:31:05 EDT GMT-04:00 Status = COMPLETED
ADAPTER: 2009-08-11 10:31:05 EDT GMT-04:00 Target Area = e:\inetpub\wwwroot\admmat\temp
ADAPTER: 2009-08-11 10:31:05 EDT GMT-04:00 Source Area = Y:\default\main\development\Dev_Evan\STAGING\htdocs\bvck
ADAPTER: 2009-08-11 10:31:05 EDT GMT-04:00 absPath = e:\inetpub\wwwroot\admmat\temp\encoding-VisualPreview.jpg
ADAPTER: 2009-08-11 10:31:05 EDT GMT-04:00 In FtpHelper_put()
ADAPTER: 2009-08-11 10:31:05 EDT GMT-04:00 Caught exception: if.mil.ca
ADAPTER: 2009-08-11 10:31:05 EDT GMT-04:00 UNSUCCESSFUL in establishing ftp Connection

boskovuk

Well, if the business wants to be so utterly constricted you could probably hire someone to read the content on the TeamSite server and re-type it word-for-word on the web server ;-)

The opening of one additional port in the firewall (20014 by default) for outbound traffic only (TS -> Web) means that you are not putting any of your protected servers at risk by doing so. I.e.: Nobody out in the big-bad-world would be able to connect back into the protected area by trying to send packets through port 20014 on the firewall because it only allows the communication to be established in the out-bound direction, not the in-bound direction. If the business doesn't understand this - then you should try to arrange a meeting between them, your network security folks, and Autonomy Interwoven Sales Engineers (not Sales Reps - Sales Engineers).

A number of us have been involved with such setups at financial institutions (banks, brokerage companies, etc.) - and I've yet to hear about any of those companies getting attacked through their OpenDeploy firewall ports.

ghoti,
I agree with you and nipper, this business/technical/security decision is complete nonsense. I tried to change their position, unfortunately they did not want to listen (I would not want to elaborate further Smiley Sad