Currently, only A and B scenarios are supported. There will be more scenarios in the future.

Scenario A (typical)

Terminals connect to the server via the CAS application's built-in OpenVPN secure channel.

• This is the default implementation for Operators.

• No dedicated VPN routers required/deployed for network attached BATMs.

• The OpenVPN software is configured via batm-manage.

  • See: https://generalbytes.atlassian.net/wiki/x/fQCQO

Scenario B (dedicated hardware)

Terminals connect to the server via a VPN provided by additional hardware, such as a router.

• The VPN configuration is not distributed by CAS.

• This scenario is considered more secure than Scenario A.

Scenario “B” Requirements

1. Set the variable batm.vpn-skip to true in the file /batm/config/gate.properties

   1. This change disables VPN distribution via the Gate service.

   2. See: https://generalbytes.atlassian.net/wiki/x/CYBtz

2. Connect your BATMs to the hardware VPN.

3. Connect your hardware VPN to your CAS server (or server-side VPN).

The BATMs must be able to communicate with

• the Gate service on the port 7741, and

• the Master service on the port 7741.

• The Gate and Master services use their specific IP addresses, and

• the Gate service must be able to communicate with the Master service (via port 7747).

Notes

Gate service

The Gate service listens for your terminals' pairing requests. After a successful pairing, the Gate service sends the terminal the VPN configuration, including information on how to connect to the Master service.

• Prior to pairing, the terminal's VPN configuration must (normally) already have been generated.

  • See: https://generalbytes.atlassian.net/wiki/spaces/ESD/pages/948961405/batm-manage+the+CAS+CLI+Toolkit#vpn-generate-serialno1-serialno2

The Gate service uses the batmgate unix user, which is a member of the batm group. The Gate service listens on port 7741. The Master service uses the same port - but on a different interface.

The Gate service configuration file is fully described here: https://generalbytes.atlassian.net/wiki/x/CYBtz

Master service

The Master service communicates with your BATMs. It replies only to BATMs/terminals that are coming from trusted ( paired ) terminals.

• The Master service uses batmmaster unix user, which is a member of the batm group.

• The Master service listens on port 7741.

  • Please note that the same port uses Gate service but on a different interface.

Admin service

The Admin service listens for users' browser requests. It enables CAS users to configure ATMs remotely and inspect processed transactions.

• The Admin service uses batmadmin unix user, which is a member of the batm group.

• The Admin service listens on port 7777.

Extensions

A very powerful way for extending the existing functionality of the server.

More about extensions:

• https://generalbytes.atlassian.net/wiki/x/G4D6qw

• General Bytes on Github