Administering and maintaining the
K2 system


This chapter contains the following topics:

Synchronizing system clocks

Licensing

Security considerations

Enabling and disabling the USB ports

Synchronizing system clocks

If you are using a K2 Media Client with internal storage, then synchronizing system clocks is not required. However, if you are using a K2 Media Client with external storage or as part of a larger network, the system clocks on the devices of the K2 system must be kept synchronized. The main purpose for this time synchronization is so that entries in the various logs on the K2 system devices can be correlated. The following procedure describes a mechanism by which clocks are synchronized. If your facility has other mechanisms by which you synchronize system clocks, you can use your own methods, as long as it accomplishes the goal of keeping the system clocks synchronized.

To synchronize system clocks, do the following:

  1. Designate a K2 Media Server as the time server.
  2. On each K2 Media Client, iSCSI client, and any additional K2 Media Servers, in the Windows Control Panel open Date and Time.
  3. On the Internet Time tab, enter the K2 Media Server that is the time server.

Licensing

For SD-only models, a codec upgrade license is available that adds D10 and DV50 compression and increases available MPEG-2 compression data rate up to 50Mbs, 4:2:2. Contact your Grass Valley representative to purchase the license. Instructions are provided when you receive the upgrade kit.

Security considerations

To provide a basic level of security, the K2 Media Client ships from the factory with four different security levels. The following table shows the different types of K2 user and their privileges. The password is case sensitive.

Windows administrator
K2 administrator
K2 user
Unknown user
Login
Administrator
K2admin
K2user
N/A1
Password
adminK2
K2admin
K2user
N/A
AppCenter Configuration Manager
Full access
Full access
Can view
Can’t access
AppCenter
Full access
Full access
Full access; requires an account on the K2 Media Client(s)
Can view channel suites, channel status, on-line help and System Status pane. Can export logs.
Storage Utility
Full accessb.
Full access
Can’t access
Can’t access
K2 Config
Full access2
Full access
Can’t access
Can’t access
PC on which K2 Media Client or Control Point software is run
Full access
Limited access (based on Windows login privileges)
Limited access (based on Windows login privileges)
Limited access (based on Windows login privileges)
1The unknown user, like all others who access the K2 system, must have a valid Windows login for the K2 Media Client or the control point PC through which the K2 system is being accessed.
2For more information about Storage Utility or K2 Config security, see the K2 Storage System Instruction Manual.

Grass Valley recommends that you implement security with unique usernames and passwords for these user levels. In addition, bear in mind the following:

K2 and NetCentral security considerations

When using K2 with NetCentral, bear in mind that NetCentral has its own levels of security. Grass Valley recommends mapping the NetCentral administrator with the K2 administrator level. You need Windows administrator privileges to add or modify a user’s privileges.

Mapping a NetCentral administrator to the K2 administrator level

The following procedure uses K2admin as an example of a user name. You may want to modify the administrator accounts to bring them in line with your site’s security policies.

A user who belongs to a group has all the rights and permissions granted to that group. To be able to use NetCentral and K2, you need to create a local K2admin user account and add it to the NCAdministrator group on the NetCentral Server PC. (This could also be the control point PC.)

  1. Create the user named K2admin:
    1. Open Computer Management.
    2. In the console tree, right-click on the Users folder.
    3. Select New User.
    4. In the New User dialog box, enter the user name K2admin and the password K2admin.
    5. Select or clear the check boxes, as desired, for:
    6. User must change password at next logon
    7. User cannot change password
    8. Password never expires
    9. Account is disabled
    10. Click Create, and then click Close.
  2. Add the NCAdministrator group to the K2admin user:
    1. Open Computer Management.
    2. In the console tree, click Users.
    3. Right-click the K2admin user and select Properties.
    4. Select the Member Of tab and click Add.
    5. Enter the group name NCAdministrator and click OK.


For more information on NetCentral security, see the NetCentral on-line Help.

Virus scanning and protection policies

The K2 system is based on a standard Windows PC platform. It is important to defend this system against virus or SpyWare attacks. Grass Valley supports the scanning of the K2 system drives (the disk drives or drive partition used to house the operating system and installed application software) from a PC that is running the scanning program while the K2 is being used to record or play video to air. The anti-virus package executing on the PC can be scheduled to scan the system drives of multiple K2 Systems.

The following strategies are recommended for virus scanning:

With these recommended strategies, you should be able to scan the K2 Media Client without interrupting media access.

In addition, the following protection policies are recommended:

Enabling and disabling the USB ports

Grass Valley recommends that the front and rear USB ports be disabled. This protects the K2 Media Client from exposure to unauthorized files. Do not disable the RS-422 USB. The following illustration shows which USB ports should be disabled in Windows Device Manager.

Only the Windows administrator, working locally, can enable or disable USB ports. To enable a USB port, right-click on the USB device in Windows Device Manager and select Enable. You cannot enable the K2 Media Client USB port via a control point PC.

To transfer to or from a USB drive on an internal storage K2 Media Client, the Windows administrator should first enable the USB port. When the transfer is complete, the Windows administrator should then disable the USB port to prevent unauthorized use. Transferring to and from a USB drive is supported on a local internal storage K2 Media Client only. USB drive transfers on external storage K2 Media Clients, K2 Media Servers, or control point PCs are not supported. Assets must be exported to a USB drive one at a time. Attempts to export more than one asset at the same time will result in the transfer aborting.


Copyright Thomson Broadcast and Media Solutions, Inc.
http://www.thomsongrassvalley.com