__Include: License Management Overview Charon-PAR for Linux
Please refer to the other sections of the Charon Licensing Handbook and your product documentation for any topics not covered in this overview guide and for more detailed information on the topics discussed here.
This page provides an overview of the basic steps to set up the HASP licensing environment on a system running Charon-PAR for Linux.
General Description
A Charon emulator product will not run without a valid license. For Sentinel HASP licenses (the topic of this chapter) this license can be provided on a USB hardware dongle (a Sentinel HASP key) or as a software license bound to the hardware of the host system or the network license server. A loss or defect of a license will cause the emulator to stop.
For extra protection, Stromasys recommends the use of a backup license key (purchased separately) that can replace the main license key for a limited period of time. It is possible to specify the backup license in the Charon configuration file to prevent the emulator from stopping in case its main license is no longer accessible.
To check the validity of a license, Charon performs the following steps:
The Charon emulator checks the license to determine if there is a product definition that will allowed it to run.
Then Charon checks the feature definition associated with the product to see if the feature definition is valid - that is, it is not expired, the available runtime hours are not exhausted, and if there are still some instance-slots available to run the emulator.
If there is no matching product definition or if the feature is not valid, Charon reports the problem in the log and shuts down.
Charon License Checks
Charon products check the availability of a valid license at different points in time:
1. At startup:
If no valid license is found, an error message will be written to the emulator log file and the emulator will not start.
2. At regular intervals during the runtime of the emulator (the default license check period of 1 hour can be changed by Stromasys using the appropriate license parameters):
If the previously used valid license has been removed, has disappeared, is defect, or has become invalid, the emulator will report the loss of the license in the log file and continue operation for a limited amount of time as described below.
If there is another valid license, for example a backup license defined in the configuration file, it will be used.
Starting with Charon-PAR 1.10: Charon allows for a grace period of 12 hours during which the software checks for the presence of a valid license every 10 minutes until a valid license is found. If no valid license is found after the grace period has expired, the emulator will stop.
Earlier versions of the above products and other emulator products: should there still be no valid license at the next regular license check (this default interval may be changed by individual Charon products), the emulator will stop.
If a time-restricted license is used and it expires, the Charon instance tries to find its replacement automatically and, if found, proceeds using the replacement license.
Important note for Windows installations: any running emulators will be stopped if the license service is forced to stop despite existing service dependencies (i.e., running emulators). So any running guest systems must be cleanly shutdown before restarting the license service in order to avoid data loss. This is the behavior at the time of writing. It may change in future versions.
Charon License Updates
Under certain circumstances existing licenses must be updated. License updates are required, for example, in the following cases:
Charon product version upgrade
Product change
License validity (time) extension
License updates, for example a new expiration date or a new execution counter, can be performed without interrupting operation, that is, without shutting down active Charon instances, provided that the resulting license is valid for the running Charon instance. If any parameters of the updated license are not valid for the running Charon instance (for example, the wrong model or version), the Charon instance will stop running.
Licenses are backwards compatible to some extent. A license update to a more recent version will allow some previous Charon versions to run as well. The details depend on the Charon product.
The license check for Charon-PAR will pass if the version on the license is higher than the one of the running Charon instance, as long as the major version (e.g., the 2 in 2.00) is the same. Please note that license are not compatible between product versions 1.x, 2.x, and 3.x.
License Content
License Type Overview
Depending on customer requirements, Stromasys can provide several different license types.
Local Hardware License
Local hardware licenses are USB dongles and work on the system they are physically connected to. For Windows systems supporting AnywereUSB®, hardware licenses can also be connected over the network. They can easily be moved to a different system, if required. The content of the dongle can be updated if a change to the license or an extension of a time-based license is required. The necessary steps will be described later in this document.
Please note:
Hardware dongles require the Sentinel HASP run-time (driver) installation before the dongle can be connected to and used by the system.
Hardware dongles, apart from HL-MAX dongles, are equipped with a battery and a clock, which makes them independent of the host clock. The battery is not rechargeable. However, the dongle can use the power provided by the host system while it is plugged in. By doing this, the depletion of the battery can be slowed down. Check the dongle at regular intervals if it is not permanently connected to a system. If the battery becomes completely depleted, the dongle will be permanently unusable and must be replaced. See also: How long does the license USB dongle battery last upon a full charge.
Software License
A software license is a "virtual" key with functionality very similar to a HASP network-enabled hardware dongle.
A software license does not require any special hardware but it still requires installation of the Sentinel runtime environment.
Please note:
To avoid unexpected problems, do not use any Sentinel runtime software that was not provided by Stromasys without being advised to do so by your Stromasys representative.
Software licenses are best suited for stable environments, because their correct function depends on certain characteristics of the host system. Changing any of these characteristics will invalidate the license.
If the Charon host runs on real hardware, software licenses are by default tightly bound to the hardware for which they were issued. If major hardware characteristics of the system are changed, the license will be disabled.
If the Charon host runs in a virtual environment (e.g., VMware), software licenses are normally bound to the virtual machine ID and a set of additional characteristics of the virtual machine. If any of these parameters are changed, the license will be disabled.
Software licenses are very sensitive to even small changes on the host system. Therefore, it is especially important to provide for a backup license that will ensure continued operation should there be a problem with the software license. See Handling Multiple License Keys and Product Licenses for details.
For a more detailed description of the restrictions, please refer to HASP Software Licensing restrictions or contact your Stromasys representative.
Network License
The network Sentinel HASP key (red USB dongle) can be shared between several hosts running a Charon emulator product (including the host on which the network license is installed).
All software licenses are also network licenses.
If the Charon emulator product is installed on the host where the network license is connected, no additional steps are required. The Sentinel driver is installed as part of the Charon product installation. If the host does not have a Charon emulator product installed, the host can still distribute the connected network license to emulator instances running on other hosts.
The Sentinel HASP runtime software must be installed on such a "license server" and on the client system. For details regarding the installation, please refer to the software installation section in this document. Once both the Sentinel runtime software and the network license are installed, the Charon emulator product can be started on any appropriate client host on the LAN, provided access to the license is enabled.
The network license will be visible to all hosts that can access the license server over IP. Access to the license server must be possible on port 1947 via UDP (discovery process) and TCP (actual access to license). Further information (e.g., use of additional UDP ports) can be found in the section Firewall Considerations.
The license server and the client must both allow access to the network license using the appropriate management tools.
The maximum number of concurrently active Charon instances is determined by the parameters of the license.
If you need to install a standalone license server, please refer to the installation section of the Licensing Handbook.
Overview of Initial License Installation Steps
Each Charon emulator product requires a valid license to run. To access the license, the emulator needs the Sentinel runtime software. This software is part of the Charon-PAR for Linux installation kits. Refer to the software installation section of the Charon product user's guide for software installation instructions.
After the installation of this software, the license can be installed on the system. The following steps will be described in more detail below:
Add a password for the Sentinel Admin Control Center (ACC).
If you purchased a hardware license, you can simply plug the dongle into a free USB port on the system.
If you purchased a software license, you need to create a fingerprint file in C2V (customer-to-vendor) format containing the system characteristics. Use this file to request a license for your Charon product from Stromasys.
If your license is a network license served by a license server, make sure that the access of the client system to the license server is not blocked by the configuration or a firewall.
Optionally, define how multiple licenses will be used (selecting primary/backup license, defining license priorities).
If you have an existing license that needs to be updated, you need to create a customer-to-vendor (C2V) file and use this file to request a license update from Stromasys.
Overview of License Management Tools
The following list shows the main tools used to manage licenses on Linux:
Sentinel Admin Control Center (ACC): A web-based interface providing important configuration options with respect to licenses.
The hasp_srm_view program: A command-line tool to display the detailed license contents and generate C2V and fingerprint files. Cannot be used over a remote connection when using local hardware licenses.
The hasp_update program: A command-line tool to install new and update existing licenses.
Accessing the License Management Tools
The command-line tools are installed under /opt/charon/bin/. If this directory is not part of your PATH variable, you have to specify the full path to access the command.
To run the commands, use the following syntax for hasp_srm_view and hasp_update respectively.
and
|
The relevant options will be specified with the tasks described below, as needed.
The Sentinel ACC on the local system is accessed by starting a web-browser and pointing it to the URL: http://localhost:1947.
Sentinel Admin Control Center (ACC) Security Settings
Stromasys strongly recommends performing the steps described below to reduce the risk of unauthorized access to the Sentinel ACC.
Define a Password for the Sentinel ACC
By default, anyone on the local system with access to port 1947 can access the GUI. If remote access is enabled, users on the network with access to port 1947 can also access the GUI. To protect access to the GUI with a password, perform the following steps:
Step | Description |
|---|---|
1 | Open a web browser and navigate to http://localhost:1947/. |
2 | Click on the left-hand menu item labeled Configuration. |
3 | Click on the Basic Settings tab. |
4 | Under the entry labeled Password Protection, click the Change Password button. |
5 | At the Change Password window:
|
6 | Back at the Basic Settings tab:
|
7 | Optional: to allow remote access to the Sentinel HASP GUI:
Additional information: For remote access to the Sentinel HASP GUI,
If required, remote access can also be enabled on Linux by editing the file /etc/hasplm/hasplm.ini |
Please note: With these settings, when you connect to the HASP GUI from a remote system, you may be prompted for a username and password. It is enough to just enter the configured password and leave the username field empty.
Setting Linux File Protections
To prevent unprivileged access and modifications to the Sentinel HASP configuration file on Linux, enter the following commands:
|
Viewing Existing Licenses
It is important to know which licenses are visible on a system. For example, the user can
determine if the correct license is installed,
identify the expiration date on time-based licenses,
identify the remaining hours of run-time on backup licenses,
identify the license ID of primary and backup license which are needed for the emulator configuration file,
identify licenses that conflict with the currently used product and therefore may need to be removed.
Licenses can be viewed using two tools:
Sentinel ACC: shows important information, but not the product specific license parameters.
Command-line tool hasp_srm_view: shows all product details contained on the license. Can only be run from a local connection for local hardware licenses.
Viewing a License with Sentinel ACC
To view available licenses using Sentinel ACC, start the web interface as described above.
To get to the Sentinel Keys screen, click on the corresponding menu item or access the URL http://localhost:1947/_int_/devices.html directly. A screen similar to the following opens and displays the available license keys:
For Sentinel drivers version 7.60 and above, this screen looks similar to the following:
This page displays important information about the available licenses, including
Location: Shows whether the license is local or remote. If the license is a network license, the hostname of the remote system is specified. You can access the remote license manager by clicking on the hostname, provided that access is permitted.
Key ID: The unique identification of the license.
Key Type: Hardware keys are marked by the abbreviation HL (hardware license) and a picture of the license dongle. Software licenses are marked by the abbreviation SL (software license).
Sessions: Shows the number of active sessions opened for the specific key.
The buttons on the right-hand side can be used to retrieve more information about the license or to extract the C2V file for a license update. The Browse button shown for network licenses will connect to the remote license manager to show the license features.
A C2V file can only be extracted if the license in question is local to the current license manager, i.e., the license manager to which the web browser is connected. In the example above, the network license on a different host does not have the option to create a C2V file. You can connect to the remote license manager clicking on the hostname in the Location column (if connections are allowed).
Please note:
The option to create a C2V file is not available in older versions of the Charon emulator software.
Starting with ACC version 7.60, the option to create C2V files for USB dongles is only available if it has been enabled in the basic configuration section (under the Configuration menu item).
The menu options Products, Features and Sessions on the left-hand side provide the same information as the buttons. However, they show the information for all licenses.
Viewing a License with hasp_srm_view
On Linux, the license content is displayed using the hasp_srm_view command. For displaying the license, the following parameters are relevant:
Display the default license: run the command without options or with
-lDisplay all licenses: run the command with the option
-allDisplay a license with a specific ID: run the command with the option
-key
Please note: Local hardware licenses can only be displayed from a local connection to the system, for example via the console. If you are connected via a remote connection, for example via ssh, the hasp_srm_view command will return an error. Network licenses do not have this problem. A workaround is described below.
Workaround when logged in via a remote connection:
When connected to the system via a remote connection, the command to display a local hardware license will return an error. As a workaround, you can display the license contents with the following command (adapt the path of the command if your installation location is different):
$ ssh localhost /opt/charon/bin/hasp_srm_view
Please note: Starting with Charon-PAR 1.10, the hasp_srm_view utility on Linux does not follow the settings in the Sentinel ACC with respect to querying remote license servers and network visibility. The utility performs a broadcast search for network licenses even if this has been disabled in the Sentinel ACC. If this behavior has to be prevented for specific reasons, the network access of the system must be temporarily restricted or disabled, for example by blocking the relevant traffic with a firewall. Alternatively, access to the network license at the license server side can be blocked. Note that such methods can negatively impact other functions of the system or, in case of blocking access to a network license on the server, even the functions on other client host systems.
The following shows sample output of the hasp_srm_view command on Linux (to display all available licenses, use the -all parameter):
--- output truncated -- |
Starting with license driver versions >= 7.60, for example, in Charon-PAR version 2.00, there are some small changes in the output of hasp_srm_view. The parameters are described in the License Content section of the Licensing Handbook. The following sample shows the most important changes (in blue):
< Parameters Maximum Build and Minimum Build are no longer shown>
---output truncated---
|
Installing the License
This section provides a short overview of the initial license installation. For more in-depth information, please refer to the licensing handbook.
Preparation
Before a license can be installed, some preparatory steps are required.
Ensure that the correct Sentinel Runtime software is installed. Please refer to the installation section of your Charon emulator user's guide for details.
If a conflicting or obsolete license is available on the system it may be necessary to (temporarily) remove or disable it. If you need to remove a hardware license, simply unplug it. If you need to remove a software license or disable access to a network license, please refer to the relevant chapter in the licensing handbook. Before removing a license or disabling access to it ensure that it is not required by another currently active product.
Installing a Local Hardware License
A local hardware license (USB dongle) is installed by inserting the USB license key into a free USB port of the host system.
After this step, verify that the license is visible to the system by following the steps for viewing a license as described above. Please bear in mind that a local hardware license cannot be read when connected to the system via a remote connection (for example, ssh).
Installing a Software License
To install a new software license, perform the following steps:
Step 1: Create a fingerprint file using the hasp_srm_view command:
Execute the following command to create the fingerprint file:
|
The fingerprint will be written to the filename specified.
Please note:
Charon-PAR before 1.10: the above command will terminate with the error message "
Can not retrieve the C2V (host fingerprint mode) data"or with "Can not retrieve the C2V (host fingerprint mode) data"if a network-wide software license is visible to the system. Access to such a license needs to be temporarily disabled before creating the fingerprint file.Charon-PAR versions 1.10 and higher can create a fingerprint file even in the presence of a network-wide software license.
Step 2: Send the resulting fingerprint file to Stromasys orders administration using the email address that Stromasys will provide to you.
Step 3: After receiving the V2C file from Stromasys, copy the file to the system where the license needs to be installed and install the new license:
In addition to the Sentinel ACC, the command hasp_update can be used on Linux to apply V2C files.
The following example shows the use of the hasp_update command:
|
This section describes the installation of a new software license. However, the commands to install a V2C file are identical when updating a hardware license.
Important caveat:
When updating a hardware license you will in most cases receive two V2C files, a *_fmt.v2c file and a *.v2c file. The *_fmt.v2c file formats the dongle and the *.v2c file contains the updated license data. In such cases the *_fmt.v2c file must be applied first.
Installing a Network License
For a network license to be provided to a client host on the network, a license server must have been set up either with a network-enabled hardware license (red dongle) or a software license (software licenses are always network enabled).
If the license server also runs a Charon emulator product, follow the steps in the user's guide to install the software. To set up a standalone license server, please refer to the licensing handbook.
For the client to access a license on a license server the following steps are required:
Any firewall between license server and client must permit the necessary communication.
The license server must be configured to allow access from the client.
The client must be configured to allow access to the license server.
Firewall Considerations
The following ports are used for the communication between license server and client hosts:
On the server side (where network license has been installed), port 1947 must be open for incoming TCP and UDP traffic to allow client access to the license.
On the client side, traffic is initiated using ports 30000 through 65535 as the source ports and port 1947 as the target port. If broadcast search for remote licenses is to be used, the client must also permit UDP traffic initiated from port 1947 of the license server to ports 30000 through 65535 of the client.
If a host on the network cannot find the license server even though the server is operational, you can temporarily disable the firewall to determine whether it blocks the traffic.
For details on how to configure the firewall in your network, please consult your operating system documentation and make sure to adhere to your company's security policies.
Allowing Client Access on the License Server
The Sentinel license manager on the license server can be configured to allow or disallow access from remote clients to the network licenses installed on the license server. To access this configuration option, perform the following steps on the license server:
1. Open a web-browser and go to the URL http://localhost:1947/_int_/config_from.html (option: Configuration / Access from Remote Clients).
2. This will open a configuration page similar to the following. Please note: newer Charon emulator products (e.g., Charon-AXP/VAX version 4.9 and Charon-PAR 1.10 and higher) have newer versions of the Sentinel license drivers. The Sentinel ACC pages of these versions look different, but the functionality remains mostly the same.
Old ACC version:
New ACC version:
Or for versions starting with 8.x:
3. Possible actions:
To allow access from remote clients, activate the check-box next to the field Allow Access from Remote Clients and press Submit at the bottom of the page.Please note: to allow access from remote clients, network visibility on the "Network" tab must be set to All Network Adapters.