Hide navigation sidebar
Hide table of contents sidebar
Skip to content
Quickstart Official documentation Setuphelpers Changelog FAQ
Back to top
View this page
Toggle table of contents sidebar

# 1. Checking WAPT Installation requirements

## 1.1. Installation requirements

### 1.1.1. Naming conventions

You have to take into consideration a few security points in order to extract all possible benefits from WAPT:

- If you are familiar with Linux, we advise you to install WAPT Server directly on Debian or a RedHat based distribution following the security recommendations of French ANSSI or the recommendations of your state cyberdefense agency.

- Although the WAPT Server is not designed to be a sensitive asset, we recommend it to be installed on a dedicated host (physical or virtual).

Attention

In all steps of the documentation, you will not use any accent or special characters for:

- user logins;

- path to the private key and the certificate bundle;

- the CN;

- the installation path for WAPT;

- group names;

- the name of hosts or the the name of the server;

- the path to the folder `C:\waptdev`.

### 1.1.2. Network recommendations

The WAPT Server is using client SSL authentication to authenticate the client WAPT Agents. Thus it is required for the WAPT Server to do the TLS termination itself. The use of WAF or reverse proxy that do TLS interception and terminaison is thus not supported.

It is possible to use a reverse proxy in “stream” mode if supported, like in Nginx stream module or HAProxy TLS Passthrough module. Please refer to the corresponding documentation for details.

### 1.1.3. Hardware recommendations

The WAPT Server can be installed either on a virtual server or a physical server.

Optimal RAM and CPU recommendations for the WAPT Server
Size of the network | CPU | RAM | BDD Size | Server optimization to apply
--- | --- | --- | --- | ---
From 0 to 300 WAPT Agents | 2 CPU | 2048 Mio | 5 Go | No
From 300 to 1000 WAPT Agents | 4 CPU | 4096 Mio | 7 Go | Yes
From 1000 to 3000 WAPT Agents | 4 CPU | 8192 Mio | 10 Go | Yes
From 3000 WAPT Agents onward | 8 CPU | 16384 Mio | 15 Go | Yes

- Server optimization if needed

- A minimum of 10GB of free space is necessary for the system, the database and log files. if you use several audit packages, you will need to monitor the database, which can quickly grow in size.

- For better performance, Tranquil IT recommends the database to be stored on fast storage, such as SSD drives or PCIe-based solid-state drives.

- The overall disk requirement will depend on the number and size of your WAPT packages (software) that you will store on your main repository, 30GB is a good start. It is not strictly required to store WAPT packages on fast drives.

- Finally, we have knowledge of users with WAPT Servers equipped with multiple 10Gbps networking interfaces deploying at full speed massive Catia, National Instruments and Solidworks update packages on their LAN.

### 1.1.4. Software recommendations

#### 1.1.4.1. Operating system

The WAPT Server is available on Linux and Windows only with 64-bit based systems:

Attention

- The WAPT Server will only run on 64-bit based systems.

- Install the Server without the graphical user interface in GNU/Linux.

- Systemd must be enabled.

List of Linux systems available.
OS systems | Versions
--- | ---
Debian | 11, 12, 13
Redhat and derivatives | 8, 9
Ubuntu server LTS | 22.04, 24.04

Attention

- The WAPT Server will only run on 64-bit based systems.

List of Windows versions available.
OS systems | Versions
--- | ---
Windows | 2012r2
Windows | 2016
Windows | 2019
Windows | 10
Windows | 11 Professionnal/Enterprise

#### 1.1.4.2. Open Ports

Data-flow diagram for WAPT

Only ports 80 and 443 MUST be opened to incoming connections as the WAPT framework works with websockets initiated by the WAPT Agents.

##### 1.1.4.2.1. Inbound

Inbound ports to open for WAPT to work
Protocol | Port number | Source | Destination | Description
--- | --- | --- | --- | ---
TCP | 80 | All WAPT Agents | WAPT Server | Websocket connection (unsecured) for downloading packages and KB.
TCP | 443 | All WAPT Agents | WAPT Server | Websocket connection for downloading packages and KB.
UDP | 69 Note: tftp uses ephemeral / dynamic ports for data transport. If you have a firewall between the WAPT Server and the fleet of computers, be sure to enable support for tftp conntrack. | All computers using WADS deployment TFTP method. | WAPT Server | To download the first stage of OS boot files before HTTP becomes available.

##### 1.1.4.2.2. Outbound

Outbound ports to open for WAPT to work
Protocol | Port number | Source | Destination | Description
--- | --- | --- | --- | ---
TCP | 80 | WAPT Server | Internet | For downloading `wsusscn2.cab` and KB.
TCP | 80 | WAPT Server | Linux repository (for Linux server) and Tranquil IT repositories ([1]) | Uploading of WAPT packages using (unsecured) HTTP.
TCP | 443 | WAPT Server | Linux repository (for Linux server) and Tranquil IT repositories ([1]) | Uploading of WAPT packages using (secured) HTTPS.
TCP | 53 | WAPT Server | Domain controller or DNS server | Domain name resolution.
TCP | 389 | WAPT Server | Domain controller or LDAP server | LDAP authentication to authenticate users with the WAPT Console or the WAPT Self-service.
TCP | 636 | WAPT Server | Domain controller or LDAP server | LDAP authentication.
UDP | 123 | WAPT Server | Domain Controller or NTP server | NTP to keep time synchronized and kerberos working properly.
UDP (optional) | 88 | WAPT Server | Domain controller or LDAP server | Kerberos allows you to register your machine without requiring the administrator’s login and password.
UDP or TCP (optional) | 464 | WAPT Server | Domain controller or LDAP server | Port 464 is dedicated to making password change requests within Kerberos.

Footnotes

[1] (1,2)

The following DNS names are the Tranquil IT repositories to authorize:

- https://wapt.tranquil.it

## 1.2. Tips before installing

### 1.2.1. Configuring the Organization’s DNS for WAPT

Note

DNS configuration is not strictly required, but it is very strongly recommended.

In order to make your WAPT setup easier to manage, it is strongly recommended to configure the DNS server to include `A` field or `CNAME` field as below:

- srvwapt.mydomain.lan.

- wapt.mydomain.lan.

Replace mydomain.lan with your network’s DNS suffix.

### 1.2.2. Configuring DNS entries in Microsoft RSAT.

- The `A` field MUST point to the WAPT Server IP address.

You can now install the WAPT Server on your favorite operating system:

- Install the WAPT Server on GNU / Linux Debian.

- Install the WAPT Server on a RedHat based distribution.

- Install the WAPT Server on Windows (not recommended for large production networks).