AVEVA™ InTouch Access Anywhere 2020 R2 SP1b Readme

Last revision: 12/15/2021

About This Readme

This Readme provides information about AVEVA InTouch Access Anywhere 2020 R2 SP1b, Version 20.1.100.

Security Updates

This release includes security improvements addressing a directory traversal issue and upgrading out of date libraries.

AVEVA™ InTouch Access Anywhere Overview

AVEVA™ InTouch Access Anywhere provides remote access to InTouch applications with an HTML5 Web browser running on a desktop computer or a mobile device. Any Web browser that supports HTML5 can be used as the client to view InTouch applications running on a remote desktop server. InTouch Access Anywhere enables you to select an InTouch application from a list and view it running in WindowViewer.

The InTouch Access Anywhere installation media provides the following:

• AVEVA InTouch Access Anywhere Server: Enables you to view remote InTouch applications hosted on Terminal Servers with an HTML5-compliant web browser running on mobile devices or a desktop.
• AVEVA InTouch Access Anywhere Secure Gateway: Optional server that provides secure remote connections from clients running on unsecured networks to internal network resources. The Secure Gateway provides authentication and authorization services as well as data encryption.

Requirements, Browsers, and Mobile Devices

This section summarizes InTouch Access Anywhere installation requirements, supported browsers, and considerations for viewing InTouch applications on mobile devices. For more detailed information, see the InTouch Access Anywhere Documentation

Installation Requirements

The following list describes the prerequisites to install the InTouch Access Anywhere Server or Secure Gateway.

Note: System Platform 2020 R2 SP1 is not supported on any 32-bit Windows operating system. Windows 10, Version 1909 (64-bit), is the earliest version of Windows 10 that supports System Platform 2020 R2 SP1. For the complete list of supported Windows operating systems and SQL Server versions, see the AVEVA GCS Technology Matrix.

• InTouch Access Anywhere Server cannot be updated by installing System Platform 2020 R2 SP1 on a computer currently hosting an earlier version.

  Important: All existing instances of InTouch Access Anywhere components must be removed from the computer before installing System Platform 2020 R2 SP1. Earlier versions of InTouch Access Anywhere Servers cannot be modified or repaired using System Platform 2020 R2 SP1.

• The computer that will host the InTouch Access Anywhere Server must be running one of the following 64-bit versions of Windows Server:
  • Windows 2012 Data Center
  • Windows 2012 R2 Data Center and Standard
  • Windows 2016 Data Center and Standard
  • Windows Server 2019 LTSC Data Center - Desktop Experience, IoT - Desktop Experience, Standard - Desktop Experience
• You must install InTouch Access Anywhere Secure Gateway on a computer running one of the following versions of Windows:
  • Windows 10 Professional or Enterprise (Version 1909 or later)
  • Windows 8.1 Enterprise, Professional
  • Windows 2012 Data Center (Not Standard Edition)
  • Windows 2012 R2 Standard and Data Center
  • Windows 2016 Standard and Data Center
  • Windows Server 2019 LTSC Data Center - Desktop Experience, IoT - Desktop Experience, Standard - Desktop Experience
• .NET Framework 4.6.2 Full Installation or later must be installed on the host computer if you are completing a stand-alone installation of InTouch Access Anywhere.

  Note: If you are installing InTouch Access Anywhere from System Platform 2020 R2 SP1, the installer verifies the current, installed versions of .NET on the computer. When only earlier versions of .NET are detected, the installer automatically updates the computer to .NET 4.8.

• You must have an InTouch 2012 R2 TSE (RDS) or newer license activated. When InTouch is launched by InTouch Access Anywhere, this RDS license will be acquired per browser session. The license is released when the InTouch application running within the RDS session is closed.
• InTouch Access Anywhere Server and InTouch HMI must be installed on the same Windows Server computer where the RDS Server Role is enabled. For detailed instructions, refer to the InTouch Access Anywhere Server Administrator Manual.

  Per-Device RDS licenses are not supported.

Important Security Requirement: Securely Deploying InTouch Access Anywhere

Direct access to the InTouch Access Anywhere Secure Gateway over the Internet is not supported. Accessing the Secure Gateway by means of a VPN tunnel for all remote connections is recommended.

Browsers

InTouch Access Anywhere can be accessed from smart phones, tablets, and laptop computers that provide an HTML5-compliant web browser.

Browsers Tested with InTouch Access Anywhere

Browsers verified to work with InTouch Access Anywhere include the following:

• Microsoft Edge
• Microsoft Internet Explorer 11
• Firefox version 38 and later
• Safari version 5 and later
• Chrome version 12 and later
• Opera version 11 and later

  Important: Only the browser versions listed above have been tested on the specified hardware platforms (PCs, tablets and Smart Phones). No testing has been done on HTML5 browsers running on other devices not included in the list shown above (SmartTVs, eBook Readers, or game consoles).

Functionally Compatible Browsers

Certain versions of the browsers listed above, such as:

• Microsoft Internet Explorer 10
• Firefox versions less than 6
• Safari versions less than 5
• Chrome versions less than 12
• Opera versions less than 11

are in theory functionally compatible with InTouch Access Anywhere. While you may be able to use these versions of the web browsers with InTouch Access Anywhere, specific behaviors are unknown because no formal testing has been conducted.

Browsers: Important Notes

Although InTouch Access Anywhere supports the listed browsers, you should review the Known Issues and Behaviors section of this Readme for issues specific to each browser.

Mobile Devices

Run-time interactions with InTouch applications can be different on mobile devices than on traditional desktop computers. For example:

• Touch gestures perform some of the tasks on a desktop or laptop done by a mouse, but not all mouse events have an equivalent touch gesture.
• Many mobile devices have built-in software keyboards instead of physical keyboards, which do not have keys such as F1-F12, CTRL, and ALT.

When using InTouch Access Anywhere to remotely view and interact with your applications, it is important to be aware of the behavioral differences among devices, operating systems, and browsers. For the best user experience, you should become familiar with the touch interfaces in the devices you will use, and factor these differences into the design of your InTouch applications. For example:

• Input animations do not need to invoke the InTouch or Windows operating system keyboards as mobile devices typically have their own.
• Existing InTouch applications that make use of mouse events and keys or key combinations without a supported equivalent in a touch environment may require you to modify your application to use alternate supported methods.

Installing AVEVA InTouch Access Anywhere

Use the following procedures to install InTouch Access Anywhere.

• Installing the AVEVA InTouch Access Anywhere Server
• Installing InTouch Access Anywhere Secure Gateway

Installing the AVEVA InTouch Access Anywhere Server

If you are upgrading to a newer version of InTouch Access Anywhere Server, complete the following tasks before starting the upgrade:

• Back up any customizations to your InTouch Access Anywhere Server installation.
• Uninstall InTouch Access Anywhere Server by using the Programs and Features component of the Windows Control Panel.
• Become familiar with the new installation configurations available with InTouch Access Anywhere Server. For more information, refer to the InTouch Access Anywhere Server Administrator Manual.

To install InTouch Access Anywhere Server

1. Run setup.exe from the root folder of the InTouch Access Anywhere installation media.
2. After briefly displaying a splash screen, the options selection window appears. Select InTouch Access Anywhere Server, and click Next.
3. Click Next to accept the default installation settings, or select the Customize Installation option to change the installation destination, and then:
   1. Click Next.
   2. Click the Browse button to provide an installation path.
   3. Click Next.
4. Accept the license agreement by selecting the I have read and accept the terms of the license agreement(s) option, and then clicking Agree.
5. The Ready to Install the Application screen appears. Review the installation details and click Install.
6. Click Finish when you see that the Installation has completed successfully.

Installing InTouch Access Anywhere Secure Gateway

Refer to the InTouch Access Anywhere Secure Gateway Administrator Manual for detailed instructions on installing InTouch Access Anywhere Secure Gateway.

Important: If you are upgrading to a newer version of InTouch Access Anywhere Secure Gateway, note any manual changes that have been made to EricomSecureGateway.exe.Config because those changes will need to be applied across two (2) separate configuration files after installing this new version: EricomSecureGateway.Config and EricomSecureGateway.exe.Config. Review the InTouch Access Anywhere Secure Gateway Administrator Manual for details of which configuration items reside in each configuration file.

See the InTouch Access Anywhere Secure Gateway Administrator Manual for detailed information about installing a Secure Gateway.

• The Secure Gateway can be installed on a computer running Windows 10 Professional or Enterprise (Version 1607 or later).
• The Secure Gateway and the Authentication server can be installed together on a single computer or on separate computers by selecting options from the installation wizard.
• The Secure Gateway can be installed with the Access Anywhere server on a single computer running a supported version of Windows Server.

Secure Gateway: Important Notes

The InTouch Access Anywhere Secure Gateway does not provide two factor authentication. This can be a security concern when you directly access the InTouch Access Anywhere Server through the Internet. InTouch Access Anywhere Secure Gateway security is not designed to be directly connected to the internet. We recommend that you use a VPN as the first level of authentication when accessing the InTouch Access Anywhere Server through the Secure Gateway.

To access InTouch applications beyond a firewall you must install the Secure Gateway on a separate computer located in a DMZ.

After installing the InTouch Access Anywhere Secure Gateway, your InTouch applications will not be available in the Application Name: list box when running InTouch Access Anywhere through the gateway. To access a list of your applications, see the Secure Gateway post-installation instructions in the InTouch Access Anywhere Secure Gateway Administrator Manual.

InTouch Access Anywhere Secure Gateway Security Settings

InTouch Access Anywhere Secure Gateway is now configured to be secured by default and requires further configuration after the product is installed. You can also configure the security settings back to the same levels as in previous releases (not recommended).

The security settings are described in InTouch Access Anywhere Secure Gateway Administrator Manual (ITAA_Gateway_AdminManual.pdf), in the following sections:

• Whitelist Security
• Configure Session Cookie Timeout
• Configuring the Origin Header Parameter for Whitelist Security
• Manually Configure a Trusted Certificate
• Configure the Secured Port and SSL Certificate

TargetHostWhitelistAllowedIPv4Addresses and certificate trust must be configured before using the InTouch Access Anywhere Secure Gateway. If you do not configure TargetHostWhitelistAllowedIPv4Addresses with the white listed systems, connections to the InTouch Access Anywhere Server through the InTouch Access Anywhere Secure Gateway will fail. You will get the following error message:

"Gateway: Target Host access is not allowed for address <IP Address>."

If you do not configure the certificate trust, you will be prompted with a certificate error if the Access Anywhere Server's certificate is not recognized on the Gateway node.

InTouch Access Anywhere Documentation

InTouch Access Anywhere product documentation is provided as a set of Portable Document Files (PDF), which are located at the root of CD installation disc.

You need Adobe Reader installed on your computer to view InTouch documentation. You can download the latest version of Adobe Reader from the Adobe Corporation web site: https://get2.adobe.com/reader/.

After installing Adobe Reader, double-click a PDF file with your pointing device to view the book with Adobe Reader. You can also open a PDF with the Adobe Reader Open command from the File menu.