Administering and maintaining the
K2 system
This chapter contains the following topics:
Enabling and disabling the USB ports
Synchronizing system clocks
If you are using a K2 Media Client with internal storage, then synchronizing system clocks is not required. However, if you are using a K2 Media Client with external storage or as part of a larger network, the system clocks on the devices of the K2 system must be kept synchronized. The main purpose for this time synchronization is so that entries in the various logs on the K2 system devices can be correlated. The following procedure describes a mechanism by which clocks are synchronized. If your facility has other mechanisms by which you synchronize system clocks, you can use your own methods, as long as it accomplishes the goal of keeping the system clocks synchronized.
To synchronize system clocks, do the following:
Licensing
For SD-only models, a codec upgrade license is available that adds D10 and DV50 compression and increases available MPEG-2 compression data rate up to 50Mbs, 4:2:2. Contact your Grass Valley representative to purchase the license. Instructions are provided when you receive the upgrade kit.
Security considerations
To provide a basic level of security, the K2 Media Client ships from the factory with four different security levels. The following table shows the different types of K2 user and their privileges. The password is case sensitive.
Windows administrator K2 administrator K2 user Unknown user Login Administrator K2admin K2user N/A1 Password adminK2 K2admin K2user N/A AppCenter Configuration Manager Full access Full access Can view Can’t access AppCenter Full access Full access Full access; requires an account on the K2 Media Client(s) Can view channel suites, channel status, on-line help and System Status pane. Can export logs. Storage Utility Full accessb. Full access Can’t access Can’t access K2 Config Full access2 Full access Can’t access Can’t access PC on which K2 Media Client or Control Point software is run Full access Limited access (based on Windows login privileges) Limited access (based on Windows login privileges) Limited access (based on Windows login privileges)
1The unknown user, like all others who access the K2 system, must have a valid Windows login for the K2 Media Client or the control point PC through which the K2 system is being accessed.2For more information about Storage Utility or K2 Config security, see the K2 Storage System Instruction Manual.Grass Valley recommends that you implement security with unique usernames and passwords for these user levels. In addition, bear in mind the following:
- To access any of the applications, you need to log on.
- All users except for the unknown user must have a valid password.
- Users must have the same local accounts on all control point PCs, K2 servers, K2 storage systems, and K2 Media Clients that they need to access. For example, to perform Windows administrator tasks from a control point PC, you need Windows administrator rights on the control point PC as well on the K2 Media Clients and K2 Media Servers that you need to access.
K2 and NetCentral security considerations
When using K2 with NetCentral, bear in mind that NetCentral has its own levels of security. Grass Valley recommends mapping the NetCentral administrator with the K2 administrator level. You need Windows administrator privileges to add or modify a user’s privileges.
Mapping a NetCentral administrator to the K2 administrator level
The following procedure uses K2admin as an example of a user name. You may want to modify the administrator accounts to bring them in line with your site’s security policies.
A user who belongs to a group has all the rights and permissions granted to that group. To be able to use NetCentral and K2, you need to create a local K2admin user account and add it to the NCAdministrator group on the NetCentral Server PC. (This could also be the control point PC.)
- Create the user named K2admin:
- Open Computer Management.
- In the console tree, right-click on the Users folder.
- Select New User.
- In the New User dialog box, enter the user name K2admin and the password K2admin.
- Select or clear the check boxes, as desired, for:
- User must change password at next logon
- User cannot change password
- Password never expires
- Account is disabled
- Click Create, and then click Close.
- Add the NCAdministrator group to the K2admin user:
For more information on NetCentral security, see the NetCentral on-line Help.
Virus scanning and protection policies
The K2 system is based on a standard Windows PC platform. It is important to defend this system against virus or SpyWare attacks. Grass Valley supports the scanning of the K2 system drives (the disk drives or drive partition used to house the operating system and installed application software) from a PC that is running the scanning program while the K2 is being used to record or play video to air. The anti-virus package executing on the PC can be scheduled to scan the system drives of multiple K2 Systems.
The following strategies are recommended for virus scanning:
- Run the scanning software on a dedicated PC that connects to the K2 system via a network mount. Do not run scanning software locally on the K2 Media Client.
- Connect to the K2 Media Client via 100BaseT network. This constrains the bandwidth and system resources consumed, so as to not interfere with media operations. Do not connect and scan via Gigabit Ethernet.
- Grass Valley does not support the running of anti-virus programs on a K2 System itself at the same time the system is being used to record or play video to air.
With these recommended strategies, you should be able to scan the K2 Media Client without interrupting media access.
In addition, the following protection policies are recommended:
- Where possible, the K2 system should be run in a closed and protected environment without network access to the corporate IS environment or the outside world.
- If the K2 system must operate in a larger network, Grass Valley recommends that access be through a gateway or firewall to provide anti-virus protection. The firewall should allow incoming HTTP (TCP ports 80 and 280) connections for client and configuration connections to the K2 system inside the private network. Additionally, ports should allow incoming packets so requests to the Proxy NAS can be properly processed. The port that needs to be open is port 445 for TCP and UDP for Windows and SAMBA shares. If your site’s policies require that these port numbers change, contact Grass Valley support for assistance.
- Access to the K2 system should be controlled in order to limit the likelihood of malicious or unintended introduction of viruses.
- The front and rear USB ports of the K2 system should normally be disabled; they should only be used by Windows administrators. (Be careful not to disable the RS-422 USB.) For more information, see Enabling and disabling the USB ports.
Enabling and disabling the USB ports
Grass Valley recommends that the front and rear USB ports be disabled. This protects the K2 Media Client from exposure to unauthorized files. Do not disable the RS-422 USB. The following illustration shows which USB ports should be disabled in Windows Device Manager.
Only the Windows administrator, working locally, can enable or disable USB ports. To enable a USB port, right-click on the USB device in Windows Device Manager and select Enable. You cannot enable the K2 Media Client USB port via a control point PC.
To transfer to or from a USB drive on an internal storage K2 Media Client, the Windows administrator should first enable the USB port. When the transfer is complete, the Windows administrator should then disable the USB port to prevent unauthorized use. Transferring to and from a USB drive is supported on a local internal storage K2 Media Client only. USB drive transfers on external storage K2 Media Clients, K2 Media Servers, or control point PCs are not supported. Assets must be exported to a USB drive one at a time. Attempts to export more than one asset at the same time will result in the transfer aborting.
Copyright Thomson Broadcast and Media Solutions, Inc. http://www.thomsongrassvalley.com |