How Do I Configure a Strong Site Security Password for Pharos API and MobilePrint?

Overview:

Before you start:

1. Confirm the Pharos API version on every server.

2. Apply the required Print Center and Pharos API updates to all Pharos API servers.

3. If MobilePrint is installed, confirm that it meets the required version.

4. Identify:

   - The first Pharos API server where the password will be generated.

   - All additional Pharos API servers.

   - Any separate MobilePrint servers.

5. Schedule a maintenance window if you are rotating an existing password.

6. If Blueprint Cloud Bridge is enabled, review the Cloud Bridge impact before running the utility. A new Site Security key can prevent Blueprint from decrypting existing Cloud Bridge settings.

7. Open an elevated Command Prompt on each server.

8. Copy SiteSecurityUtility.exe from the supported Pharos API installation or update package to each applicable server.

Steps:

1. On the first Pharos API server, run the utility without parameters:

   ```cmd

SiteSecurityUtility.exe

```

2. Record the generated password and verification hash.

3. Store the generated password in an approved secure secret store.

4. On every additional Pharos API server and separate MobilePrint server, run the utility with the generated password:

   ```cmd

SiteSecurityUtility.exe <generated-password>

```

5. Compare the verification hash from each server with the verification hash from the first server.

6. Confirm that all verification hashes match.

7. If a hash does not match, do not continue deployment. Re-run the utility on the affected server using the exact password generated on the first server.

8. If you are rotating an existing password:

   1. Run the utility on the first server without parameters to generate a new password.

   2. Apply the new password to every remaining Pharos API and MobilePrint server.

   3. Restart IIS or recycle the Pharos API application pool on every affected API server.

   4. Restart MobilePrint services where applicable.

9. If Blueprint Cloud Bridge is enabled:

   1. Open Blueprint Administrator.

   2. Use Load configuration from file to reload the Cloud Bridge API card.

   3. Re-enter the proxy password if proxy settings are configured.

   4. Save the configuration so Cloud Bridge settings are encrypted with the current Site Security key.

10. Test server-to-server communication and MobilePrint after the update.

Validation:

1. Confirm that the verification hash matches on every server.

2. Confirm that the Pharos API services are running.

3. Confirm that Print Center opens and can communicate with the API.

4. If MobilePrint is installed, submit and retrieve a test MobilePrint job.

5. If Blueprint Cloud Bridge is enabled, confirm that Cloud Bridge communication succeeds.

6. Review the relevant application and service logs for authentication or decryption errors.

7. Confirm that no generated password appears in command history, email, case notes, or unprotected files.

Notes:

• The first Site Security Utility run on a server is automatically detected by the Pharos API and does not require a restart.

• Running the utility again on an existing server requires an IIS restart, application-pool recycle, or MobilePrint service restart.

• Unpatched MobilePrint installations may continue functioning until MobilePrint or IIS is restarted.

• Do not compare registry values between servers. The password is hashed differently on each server. Compare the verification hashes instead.

• Do not run the utility after enabling Cloud Bridge without planning to reload and re-encrypt the Cloud Bridge configuration.

• If the generated password is exposed, rotate it and update every affected server.