For IT

What to install

• Windows: an installer.
• Linux: an RPM package for Rocky Linux, AlmaLinux and RHEL 8, 9 and 10.
• Linux: a DEB package for Ubuntu.
• Linux: a portable archive, which needs no administrator rights.
• Guests install nothing: they join from a web browser.

The player is free to download, with no account, from the download page.

Administrator rights

• The Windows installer, the RPM package and the DEB package are installed by an administrator.
• The portable archive is unpacked and started by the user, without administrator rights.
• Opening a port in a workstation's firewall is done by an administrator. It is needed only for sessions hosted on the studio network (see below).
• Guests in a browser need no rights and no account.

Network: online sessions

Online sessions go through the relay. The workstations only make outgoing connections: nothing has to be opened towards the studio.

• With outgoing TCP 443 to both names, everything works. Video then uses TURN over TLS, with a little more latency.
• Studio sign-in (SSO) uses the system's browser to reach the studio's identity provider, over HTTPS on port 443.
• With a relay installed in the studio (Enterprise offer), use the names given by the person who runs it.

To check from a workstation of the studio:

curl -sS https://review.bernardengine.com/api/v1/health

Expected: a JSON answer that contains "status":"ok".

Network: sessions on the studio network

A session hosted on the local network uses neither the relay nor the internet. The other players connect to the host's workstation on TCP port 9000 (the default; it can be changed).

Open this port on the host's workstation only, for incoming connections from the internal network. Online sessions do not need it.

• Windows: the installer adds the firewall rules for the Domain and Private profiles, never for the Public profile.
• If a Group Policy manages the Windows firewall and ignores local rules, add the rule in the policy: incoming TCP 9000, Domain and Private profiles.

firewalld (Rocky Linux, AlmaLinux, RHEL):

sudo firewall-cmd --permanent --zone=<zone> --add-service=bernard-review
sudo firewall-cmd --reload

ufw (Ubuntu):

sudo ufw allow from <subnet> to any port 9000 proto tcp

Replace <zone> with the zone of the internal network and <subnet> with the studio's subnet.

Proxy and certificate authority

• An HTTP proxy must allow CONNECT to both names of the relay on port 443.
• Exclude both names from TLS inspection: a proxy that decrypts the traffic breaks TURN over TLS.
• Do not close idle connections in less than 120 seconds.
• An HTTP proxy carries no UDP: behind a proxy alone, video uses TURN over TLS.
• A relay installed in the studio can use certificates from the studio's own certificate authority, with names from the internal DNS.

Secrets

• The player keeps its sign-in secrets in the operating system's credential store.
• The relay stores session passwords, tokens and codes as hashes, never in clear.

What the player does not do

• Used alone, locally or on the studio network, the player sends no data to AArts Lab.
• In the current version of the service, the studio's media files are not sent to AArts Lab: they stay on the studio's machines.
• Video, voice and chat are not recorded: the stream exists only during the session.

Security contact

For a security question, or to ask for the security file: contact form