EcoStruxure IT Data Center Expert 8.0 release notes

[EcoStruxureIT]

You must have a valid software support contract to receive the Data Center Expert 8.0.0 update file on the EcoStruxure IT Entitlements portal.

Log in and then click Software Updates. More information...

If the DCE update files are not available in EcoStruxure IT Entitlements, contact your local technical support to verify your support contract and get access to the update file(s) you need.

Part Numbers Affected

• AP9465
• AP9470
• AP9475
• AP94VMTRL

See the list of the server appliances (AP9465, AP9470, and AP9475) supported by DCE 7.9.x and newer: See Data Center Expert 7.9.x and newer - server hardware requirements 

Minimum System Requirements

The DCE console is a stand-alone Java application that runs on systems that meet the following requirements:

• A PC with a 1-GHz or better AMD/Intel processor running a 64-bit operating system:
  Microsoft® Windows® Server 2016 and 2019, Windows 10 and 11

• At least 2 GB of RAM and 20 GB disk space

• Screen resolution should be set to at least 1024 x 768

• Supported browsers: Edge; Mozilla® Firefox®; Google Chrome™
  See Known issues in DCE for details about support for Internet Explorer and Edge.

New features

The Data Center Expert 8.0 release updates the product brand to EcoStruxure™ IT Data Center Expert.

This release contains improvements including:

• Device discovery for NetBotz Appliances
  The device discovery types in the Device >Add devices option are more descriptive and include guidance for NetBotz Appliance models.

• Device Launch Settings
  The Device Launch Settings option now defaults to HTTPS and port 443.

• DDF retrieval
  Data Center Expert now attempts to retrieve Device Definition Files (DDFs) from APC NMC devices using HTTP/HTTPS in addition to FTP/SCP attempts.

• HTTP Strict Transport Security (HSTS) support
  To enhance security, an HSTS entry was added to HTTP response headers to automatically redirect HTTP connections to HTTPS.

  A new setting on the Web Server tab in the System > Administration Settings > Server Access option allows you to Enable HTTP Strict Transport Security. 

  Note: If you select HTTP, it is recommended that you enable HSTS unless it prevents older NetBotz Appliances from posting successfully.

  Learn more about HSTS.

• Compressed backups
  The Compress Backup option was removed from the backup share configuration.

• The Modify certificate button was updated to Change certificate, and can be used to replace any existing certificate. The Delete signed certificate button was removed. 

• Updated Modbus communication terminology
  Modbus.org announced it is expunging all occurrences of inappropriate language of the query and response paradigm of Modbus communications.
  The organization is using client-server instead of master-slave to describe Modbus communications. More...

Server operating system

Server OS: Proprietary Rocky Linux 8.7 (RHEL derivative)

Java version: OpenJDK-headless-1.8.0.372.b07

Windows desktop client

Java version: Adoptium 8u372b07

Software vulnerabilities fixed in DCE 8.0

• The directory listing was removed from web server.

• Unused Apache HTTPD modules were removed.

• DCE will no longer use well-known Apache Diffie-Hellman key exchange parameters.
  A new question was added to the console menu, asking whether to generate a new set of Apache DH parameters.
  A new unique set of parameters will be generated on software update.

• Addressed path traversal vulnerability.

• Addressed insecure output encoding from JSON endpoints (XSS).

• Addressed potential SQL injection in endpoints.

• Removed outdated Linux client.

HTTPD

• CVE-2020-11984 – Apache HTTP
• CVE-2020-35452 – Apache HTTP

OpenSSL

• CVE-2022-4203 – Read buffer overrun
• CVE-2022-4304 – Timing based side channel
• CVE-2022-4450 – PEM_read
• CVE-2023-0215 – Public API BIO_new_NDEF function
• CVE-2023-0216 – Invalid pointer dereference on read
• CVE-2023-0217 – Invalid pointer dereference on read
• CVE-2023-0286 – Type confusion
• CVE-2023-0401 – Null pointer dereference

See Data Center Expert Security for more information.

Issues Fixed

• Synchronized backups now append new data to an existing Synchronized backup as expected.
• The desktop client now consistently utilizes the server hostname provided in the login field.

• The Change server option relaunches the desktop client as expected.

• Modifications to camera motion mask and sensitivity settings are applied as expected.

• Increased NFS mount timeout and retry options.

• Email notifications now identify the DCE version correctly.

• The server now displays a reboot confirmation when changes are made in the Time Settings option.

• The Apply button is enabled as expected when No is selected in the Security Policy confirmation window.

• Graphs are now included in email notifications. 

• Multiple emails are no longer set for a single alarm.

• The DCE web client dashboard no longer times out when the Remain Active option is selected.

• The View live feed only permission now allows surveillance access as expected.

• The Threshold Alarm Configurations tab now displays a large list without error.

Known Issues

• Multiple versions of DCE 8.0.0

  The current version of Data Center Expert is 8.0.0.154. Some customers received DCE 8.0.0.151, 8.0.0.149, or 8.0.0.148.

  DCE 8.0.0.154 addresses the following issue in 8.0.0.151:

  • Synchronized backups created a Full backup and a new Full backup file.
    Synchronized backups now append new data to an existing Synchronized backup as expected.

  DCE 8.0.0.151 addresses the following issue in 8.0.0.149:

  • Self-signed certificates cannot be removed in the System > Server Administration Settings > Server Access > Web Server display.
  • Customers who updated their DCE server to 8.0.0.149 can download the 8.0.0.151 desktop client to mitigate this issue.  

  DCE 8.0.0.149 addresses the following issue in the DCE 8.0.0.148 release:

  • When the Subdirectory field in the System > Server Administration Settings > Server Backup/Restore >  Backup Share Settings display contains a backslash ( \ ), the backup fails and DCE incorrectly indicates that the backup was successful.
    Replace the backslashes in the Subdirectory field with forward slashes (/) to mitigate this issue.

  To update DCE 8.0.0.148, 149, or 151 to 8.0.0.154:

  1. Back up the DCE 8.0.0.148, 149, or 151 server. Make sure to back up to a path that does not include a backslash.
  2. Download DCE 8.0.0.154 at the link previously provided, deploy a new server, and restore from backup.

  There is no upgrade option between DCE 8.0.0 versions.

• The DCE server update progress is not accurately displayed in the web client during the update from DCE 7.9.3 to version 8.0. The server update completes successfully.
  This will be addressed in the next release. More...

• When the DCE Security Policy is changed from Future (most restrictive) to any other policy, the DCE server must be rebooted to maintain communication with devices that use SSL.

Complete list of DCE known issues

Software update procedure

The following steps are necessary to update DCE 7.9.3 to DCE 8.0.

DCE must be at a minimum of 7.9.3 to update to DCE 8.0 If you are downloading DCE 8.0, you will need access to the Internet. 

You must have a valid software support contract to receive the DCE 8.0 update.  If you do not, then you will need to purchase one to receive the update.

The DCE software update files are available in the EcoStruxure IT Entitlements portal.Log in and then click Software Updates. More information...

If the DCE update files are not available in EcoStruxure IT Entitlements, contact your local technical support to verify your support contract and get access to the update file(s) you need.

IMPORTANT: Do not reboot the server during the update.

The DCE 8.0 update performs a data migration that takes under an hour for most systems. The data migration can take longer if the system has thousands of devices and years of history, and varies based on several factors:

• Number of devices

• Number of sensors connected to those devices

• Polling interval

• Frequency at which sensor values change. For example, input voltage to UPSs can fluctuate throughout the day vs. temperature sensors in a strictly controlled environment that almost always report the same value.

You can see the status of the update on the Data Center Expert web client Home page.

NOTICE: Before beginning an update, remember to run a full backup on your DCE by going to System > Server Administration Settings > Server Backup/Restore, create a backup entry and then click Start.

1. Download the upgrade.zip file, or contact Technical Support for assistance.
   Note: The restore.iso file may be needed for later use if a re-installation is required. See Restoring using ISO Format for instructions for restoring your data from a restore.iso file from the ISO format.

2. Log in to your DCE 7.9.3 server with full server access. Select Updates > Apply Server Update.

3. Click Import to import the upgrade.zip file.
   Note: DCE 8.0 and newer only accept the zipped upgrade file.

4. The Upgrade/New Packages table will update indicating there is an update available for the DCE server. Check the "Install/Upgrade" option for the package(s) you want to upgrade. Click the Install Selected button to start the upgrade for the selected package(s). You will be prompted to confirm you want to proceed with the update. Click Install Update to start the update process. Do not reboot the server during the update process.

5. When the file transfer completes, DCE will restart and disconnect your console connection. You can point a web browser to the DCE server for status. Note: Progress is not accurately displayed in the web client for the 7.9.3 to 8.0 update. More...

6. When the update is complete, point a web browser to the DCE server, and select Download Client.

Restoring Data Center Expert using ISO Format

Warning: Only perform the steps in this section if directed to do so by a Technical Support technician.

Before You Restore:  A system restore will erase all data and restore the DCE hardware server to its factory default settings. Make sure you have a copy of all installed license keys and network settings prior to restore.

1. Download the restore.iso file to create a bootable USB key, or contact Technical Support for assistance.

   For a USB Key, follow the instructions provided in Creating a bootable USB key (Windows or Linux machine).

2. Place the USB key in the USB port of your DCE appliance.

3. Reboot DCE.

4. When the appliance restarts the system restore process begins automatically. This process takes approximately 10 minutes for the 1U DCE Basic, 15 minutes for 1U DCE Standard or 25 minutes for 2U DCE Enterprise.
   When the restore is complete, you will be prompted to remove the USB key and hit enter to reboot the server.
   Note: If the system boots into the existing DCE version, reboot the server and access the BIOS settings. Adjust the boot sequence to boot from USB first.

5. Once DCE has restarted, configure the DCE network settings.

Migrating a Data Center Expert hardware server to a virtual appliance

Before You Migrate: To migrate a DCE hardware server to a virtual appliance, you must purchase and apply an activation key.  Additionally, you must contact APC Support for new node license keys and application license keys for the virtual appliance.

1. Perform a back up of the DCE hardware server, using the Server Backup/Restore option, accessed from the Server Administration Settings option in the System menu.

2. Deploy the demo version OVA, and configure it using the hardware equivalents for the DCE Basic, Standard, or Enterprise server from which you are migrating. The available disk space for the virtual appliance must be greater than the disk space used by the hardware server. You cannot restore to a virtual appliance with fewer CPU, fewer network adapters, less RAM, or less available disk space than the hardware server. See help for Deploying and configuring a DCE virtual appliance, and DCE virtual appliance equivalent configurations.

3. Perform a restore on the virtual appliance, using the Server Backup/Restore option, accessed from the Server Administration Settings option in the System menu. You cannot restore to a virtual machine other than the DCE virtual appliance.

4. Apply the activation key to the virtual appliance.

5. Log in to the DCE client. In the "License Keys" display, accessed from the Server Administration Settings option in the System menu, apply the new node license keys and application license keys you received from APC Support.

Creating a bootable USB Key (Windows or Linux machine)

Instructions for a Windows machine

1. InsertUSBkey (no larger than 4GB) into your system.

2. Extract the following file to a temporary directory:
   DCExpertUsbFlashRestore_Win_8.0.0_b.zip

3. Open a command prompt to the temporary directory and run mkDCExpertRestoreUsbKey.bat <iso image filename>. For example: mkDCExpertRestoreUsbKey.bat c:\tmp\restore.iso

4. Answer the prompts as appropriate.

Instructions for a Linux machine

1. Insert a 2GB (or larger) USB key into your system.

2. Extract the following file to a temporary directory: 
   DCExpertUsbFlashRestore_Linux_8.0.0_b.tar.gz

3. Open a command prompt to the temporary directory and run mkDCExpertRestoreUsbKey.sh <iso image filename>. For example: mkDCExpertRestoreUsbKey.sh /tmp/restore.iso

4. Answer the prompts as appropriate.

Third-party USB key scripts

The scripts used to create USB keys use the following software:

Software	URL	Windows	Linux
Syslinux	http://syslinux.zytor.com/	X	X
7-zip	http://www.7-zip.org	X
GNU sed	http://unxutils.sourceforge.net	X

You can now choose to compress a backup. The compressed backup is a single tar.gz file with a .dce file extension for easier filename filtering. More..