New RPM 7 is now available — see what’s new →

Managing RPM 7 from Another Computer

The RPM Remote Print Manager® 7 user interface can manage an RPM server from another computer on your network, as if you were sitting at the server. Remote management is turned off on a new installation. This page walks through turning it on, connecting securely, and what to check when the connection does not work.

How a remote connection works

The user interface makes two connections to the server:

Anyone who has a server’s management key has full control of RPM on that server. Treat it like an administrator password. The certificate fingerprint is not secret.

Before you start

Step 1: Open the RPC port to your computer (on the server)

  1. In the RPM user interface on the server, choose Ports from the Settings menu.
  2. Select the RPC port and click Modify Port.
  3. Clear Block remote connections. It is selected on a new installation, so that the port listens only on the server itself.
  4. Under Authorized Hosts, click Add and enter the IP address or host name of the computer you will manage from. A * matches any part of a name or address, so 10.0.5.* allows a whole subnet.
  5. Click OK, then restart the RPM service.

Remote Permissions on the same dialog grey out commands in a remote user interface. They are a convenience, not a security boundary: the user interface logs in with the management key, which has full control. They do limit programs that connect with their own application key.

Step 2: Open the database to your computer (on the server)

A new installation lets only the server itself reach the Firebird database.

  1. Choose Security, then Remote Firebird Access, from the Settings menu.
  2. Click Allow remote access and confirm.
  3. Restart the Firebird service, or restart the server. The setting takes effect only then.

This setting applies to every database on that Firebird server, not just RPM’s.

Step 3: Check the firewall (on the server)

RPM setup adds a Windows Firewall exception for the RPM service, which covers the RPC port. Firebird’s port is not covered. If the user interface reaches the server but cannot open the database, allow TCP port 3050 in, preferably from your computer’s address only. For example, from an administrator command prompt on the server:

netsh advfirewall firewall add rule name="Firebird for RPM user interface" dir=in action=allow protocol=TCP localport=3050 remoteip=192.0.2.25

Replace 192.0.2.25 with your computer’s IP address. If a network firewall sits between the two computers, it needs to allow TCP 9198 and 3050 as well.

Step 4: Get the management key and fingerprint (on the server)

Open a command prompt as administrator on the server and run:

"C:\Program Files\Brooks Internet Software\RPM\rpmgui.exe" --show-management-key

(Use the folder RPM is installed in, if it is not the default.) A window shows the server’s management key and its certificate fingerprint, with a button to copy each one to the clipboard. Get both to the other computer by a route you trust; do not email the key.

Step 5: Add the server (on your computer)

  1. Start the RPM user interface and choose Add Server from the Servers menu.
  2. Enter the server’s host name or IP address, and the RPC port (9198 unless you changed it). Click OK.
  3. The user interface offers to import the server’s encryption key, rpm.key. It needs it to save passwords against that server, such as an action’s credentials, FTP or email passwords. Copy rpm.key from the server’s settings folder (normally C:\ProgramData\Brooks Internet Software\RPM) to your computer and select it. Keep the copy as safe as the key itself, and delete it once imported. If you skip this, connect to the server later and choose Import Server Key (rpm.key) from the Servers menu.
  4. When asked, enter the management key and the certificate fingerprint from step 4. The user interface keeps them for your Windows account only, encrypted.
  5. Select the server from the Servers menu to connect.

The user interface asks for the key and fingerprint again if the server rejects the key, for example because the server was reinstalled.

What changes when you are remote

Some commands only make sense on the server itself, and are greyed out while you are connected to a remote server: the Security and database maintenance commands, opening or viewing a job’s files on disk, cleaning the spool folders, and dropping files from your computer onto a queue. Make those changes at the server.

If it does not connect

“The server’s certificate fingerprint … is not the one entered for it.” The server presented a different certificate. If its certificate has been replaced (see below), run step 4 again on the server and enter the new fingerprint. If nobody changed it, someone may be intercepting the connection; do not enter the management key, and check the network path.

“Connections from other computers must use TLS.” Something connected without encryption. RPM 7’s user interface always uses TLS for a remote server, so this is an older user interface, or another program. See Programs that use the RPC interface.

The connection is refused or times out. Check that Block remote connections is cleared and the RPM service has been restarted since (step 1), that your computer is in Authorized Hosts, and that no firewall blocks TCP 9198. Connect failed: 10060 means the connection timed out with no answer, 10061 that it was refused. Running netstat -ano | findstr :9198 on the server shows where the port listens: 127.0.0.1:9198 means it still accepts only local connections, 0.0.0.0:9198 that it accepts remote ones. The server’s Events list records a refused connection with the address it came from, which helps when a computer’s address is not what you expect.

The user interface connects but the lists stay empty, or a database error appears. The database is not reachable: check step 2 (including the Firebird restart) and the firewall in step 3.

“This server’s encryption key does not match the server.” The rpm.key imported for the server is not the one it uses, for example because it was copied from another server. Copy the right one and choose Import Server Key (rpm.key) from the Servers menu while connected to the server.

The management key is not accepted. Run step 4 again and re-enter it. A reinstall that recreated the server’s settings folder creates a new key.

Using your own certificate

On installation RPM creates a self-signed certificate for its RPC port, kept in the server’s Local Machine Personal certificate store, and keeps it through upgrades. The user interface does not check it against a certificate authority, only against the fingerprint, so a self-signed certificate is fully secure for this purpose.

If your organization prefers a certificate issued by its own certificate authority, import it with its private key into the Local Machine Personal store on the server, then run this on the server (it asks for administrator rights if it needs them):

"C:\Program Files\Brooks Internet Software\RPM\rpmgui.exe" --rpc-certificate <thumbprint>

using the thumbprint from the certificate’s details (in quotes, if you copy it with its spaces). To replace the self-signed certificate with a new one instead, use --rpc-certificate new. Either way, a window then shows the new fingerprint, with buttons to restart the RPM service and to copy the fingerprint. Once the service has restarted, every user interface that manages the server remotely asks for the new fingerprint when it next connects: enter the one shown.

Programs that use the RPC interface

Programs that drive RPM through its RPC interface follow the same rule. On the RPM server itself they may connect without encryption, as before. From another computer they must connect with TLS, and should check the server’s certificate fingerprint before sending their key. The RPM manual’s RPC Interface chapter has an example in Python.