RSG · Penjelasan teknikal

Apa itu RSG dan mengapa anda memerlukannya.

Butiran teknikal: Revit Server Guard is a software gateway that's installed on the same host as Autodesk Revit Server. It intercepts TCP and HTTP traffic to the RS ports, reads its metadata (which user, which project, which section, which action), and applies access rules that don't exist in Revit Server itself.

Gambaran keseluruhanSkrin ini mengurus Gambaran keseluruhan: data, penapis, tindakan dan eksport dikumpulkan dalam panel RSG. ProjekSkrin ini mengurus Projek: data, penapis, tindakan dan eksport dikumpulkan dalam panel RSG. PerananSkrin ini mengurus Peranan: data, penapis, tindakan dan eksport dikumpulkan dalam panel RSG. Log auditSkrin ini mengurus Log audit: data, penapis, tindakan dan eksport dikumpulkan dalam panel RSG.

01 — Gambaran umum

Apa itu RSG dan mengapa anda memerlukannya.

Butiran teknikal: Revit Server Guard is a software gateway that's installed on the same host as Autodesk Revit Server. It intercepts TCP and HTTP traffic to the RS ports, reads its metadata (which user, which project, which section, which action), and applies access rules that don't exist in Revit Server itself.

Secara lalai, Revit Server tidak menyediakan hak akses telus mengikut pengguna, projek, bahagian dan tindakan. Jika peserta mempunyai akses kepada pelayan, RS tidak mempunyai model terbina dalam yang menghadkan peserta tersebut secara boleh dipercayai hanya kepada bidang tanggungjawabnya. Dalam pasukan kecil, ini mungkin boleh diterima. Dalam projek dengan banyak syarikat, peserta sementara dan tahap tanggungjawab yang berbeza, latihan dan peraturan dalaman tidak mencukupi: RSG menghapuskan sekatan teknikal ini.

Siapa yang memerlukannya

• Butiran teknikal: Design firms running multiple clients in parallel who don't want client A's team to see what's being done for client B.
• Butiran teknikal: BIM coordinators who need to separate rights at the section level — structural engineers see and edit structures, MEP engineers see their own discipline, and so on.
• Butiran teknikal: Contractors and freelancers who get temporary access to a specific project and a specific section, and need to be locked out with one click when their contract ends.
• Butiran teknikal: Teams with regulatory requirements (government contracts, restricted-access facilities) where a who-opened-what-and-when log is mandatory.

01 Gambaran keseluruhanSkrin ini mengurus Gambaran keseluruhan: data, penapis, tindakan dan eksport dikumpulkan dalam panel RSG.

02 — Seni bina

Empat komponen, satu hos Windows.

RSG ialah satu monolit, tetapi mempunyai empat modul berasingan yang dipasang bersama. Ini disengajakan: setiap komponen bertanggungjawab terhadap ruang lingkupnya sendiri dan boleh dimulakan semula secara bebas apabila perlu.

Fungsi setiap komponen

1. Butiran teknikal: RSG.Proxy — a TCP/HTTP proxy that listens on port 8086 instead of the default RS port. Unwraps Revit Server SOAP envelopes, extracts request metadata, asks RSG.Server «is this allowed?» — and either passes it through or returns 403 to the client.
2. Butiran teknikal: RSG.Server — a Windows service on.NET 8 that holds access rules in local SQLite/SQL Server, runs the audit log, validates the license, and talks to the License API. The «brain» of the solution.
3. Butiran teknikal: RSG.AdminPanel — a React SPA available on localhost:5080 (or inside the corporate network over HTTPS). The admin uses it to create users, projects, rules, and view the audit log.
4. Butiran teknikal: RSG.LicenseTool — a separate CLI tool for offline activation. Used only in air-gapped networks; not needed in a normal online installation.

Penting

Butiran teknikal: Revit Server stays exactly as it was. RSG doesn't modify its binaries, doesn't rewrite the database, doesn't replace configs. It sits alongside and operates through standard network interfaces. If you turn RSG off, Revit Server keeps working exactly as it did before RSG was installed.

02 Get laluan RSSkrin ini mengurus Get laluan RS: data, penapis, tindakan dan eksport dikumpulkan dalam panel RSG.

03 — Kawalan akses

Tiga aras hak: projek, seksyen, tindakan.

Butiran teknikal: RSG grants rights not «all or nothing» but granularly. You don't hand out «server access» — you hand out «access to project X, section Architecture, read-only». Under the hood this happens at the SOAP-request level of Revit Server, where RSG inspects the operation type and makes a decision.

Butiran teknikal: Users and AD groups are bound to roles. A role is a set of permissions for a specific project and its sections. One user can have different roles in different projects: «coordinator» in one, «observer» in another, «no access» in a third.

Tahap

• Project. Unit asas ialah folder root projek pada server. Pengguna melihat projek dalam senarai, tetapi tidak boleh membukanya.
• Model section. Architecture, structures, engineering, coordination — setiap section boleh mempunyai haknya sendiri. Jurutera kontraktor hanya membuka section miliknya; selebihnya tidak dimuatkan ke dalam Revit client.
• Action. read, edit. View tanpa edit ialah hak berasingan daripada edit tanpa publish.

03 ProjekSkrin ini mengurus Projek: data, penapis, tindakan dan eksport dikumpulkan dalam panel RSG.

Peranan dan kumpulan

Butiran teknikal: Below — how it looks in the admin panel. The matrix: projects in rows, roles in columns, permission state in cells.

Butiran teknikal: Legend: full access · read only · mixed by section · none

Contoh konfigurasi peraturan

Butiran teknikal: Every rule is expressed as a JSON document that can be edited through the UI or imported in batch from CSV/JSON when migrating from in-house tools.

04 PerananSkrin ini mengurus Peranan: data, penapis, tindakan dan eksport dikumpulkan dalam panel RSG.

04 — Panel pentadbir

Panel pentadbir web menggantikan CLI dan registry.

Butiran teknikal: All management — through a React SPA available locally on the RSG host. No regedit, no gpedit, no manual XML edits. The admin opens a page in the browser and sees the dashboard, license, audit, and permissions matrix. If remote access is needed, it's served behind a reverse proxy with TLS.

Butiran teknikal: The home page is the dashboard. Four numbers across the top for the day, an event feed below, and a license panel.

05 PenggunaSkrin ini mengurus Pengguna: data, penapis, tindakan dan eksport dikumpulkan dalam panel RSG.

06 SeksyenSkrin ini mengurus Seksyen: data, penapis, tindakan dan eksport dikumpulkan dalam panel RSG.

05 — Audit sistem

Setiap tindakan — dalam log.

Butiran teknikal: Audit isn't an optional feature, it's part of the main flow. Every request that passes through RSG.Proxy leaves a record: who, what, against which project/section, which action, what result, from which IP, from which Revit version. Logs are stored locally and exported to CSV/JSON/SIEM.

Butiran teknikal: The admin panel has a table with filters on every field. Clicking a row opens the full event JSON.

Apa yang direkodkan

• Butiran teknikal: Identity: AD login, IP, Revit client version, user's machine name.
• Butiran teknikal: Target: project ID, file name, section/workset, element ID (where applicable).
• Butiran teknikal: Action: open, sync_to_central, reload_latest, create_local, publish, delete_local, borrow_workset, etc.
• Butiran teknikal: Result: allow / deny / warn (warn — not blocked, but flagged for review).
• Butiran teknikal: Context: which rule made the decision, timestamp with TZ, operation duration.

Penyimpanan

Butiran teknikal: By default the log is kept for 18 months. This is configurable. Logs can be streamed to a SIEM system over webhook (JSON payload), written to your company's SQL Server, or exported in batch via CLI.

07 Log auditSkrin ini mengurus Log audit: data, penapis, tindakan dan eksport dikumpulkan dalam panel RSG.

08 SandaranSkrin ini mengurus Sandaran: data, penapis, tindakan dan eksport dikumpulkan dalam panel RSG.

06 — Pelesenan

Lesen bertandatangan yang diikat kepada mesin.

Butiran teknikal: An RSG license is a signed envelope (LicenseEnvelope) containing a payload with rights and a signature. The signature is produced on our side with an ECDSA P-256 private key and verified on the client side with a public key embedded in the RSG binary.

Butiran teknikal: That means: forging a license or running «your own License API» at the same URL is impossible without the private key. A keygen physically can't exist — you'd have to either break ECDSA P-256 (theoretically unrealistic) or steal the private key from our HSM.

Fingerprint mesin

Butiran teknikal: The license is bound to a machine through a fingerprint — SHA-256 of a deterministic string assembled from the machine name and MAC addresses of network interfaces.

Butiran teknikal: Network interfaces are sorted — that matters. If the system has multiple MACs, the OS may enumerate them in a different order, and sorting removes that instability. The machine name is uppercased for the same reason.

Aktivasi online dan offline

Butiran teknikal: When the host has outbound HTTPS to our domain, activation is one click in the admin panel. RSG.Server sends a JSON with the fingerprint and metadata, the License API returns a signed envelope, which is applied immediately.

Butiran teknikal: When there's no network (closed perimeter, government segment, isolated test range), activation goes through files:

1. Butiran teknikal: In the admin panel → «Generate license request» → save request.rsgreq to a USB drive.
2. Butiran teknikal: In the personal cabinet on the website → «Activate offline» → upload .rsgreq → receive license.rsglic.
3. Butiran teknikal: Upload the .rsglic back into the admin panel. Done.

Apa berlaku selepas tamat tempoh

Butiran teknikal: After the trial or a term license expires, RSG switches to bypass mode — protection turns off, Revit Server works as it did before RSG was installed. This is intentional: we don't want a customer running into a broken production at 23:50 on a Friday. When the license is restored, RSG returns to full automatically.

09 KonfigurasiSkrin ini mengurus Konfigurasi: data, penapis, tindakan dan eksport dikumpulkan dalam panel RSG.

07 — Pemasangan

Dalam satu petang: daripada pemasang kepada peranan pertama.

Butiran teknikal: RSG installs via a Windows installer (MSI or EXE). No docker, no kubernetes, no external dependencies except the.NET 8 LTS Runtime — which is either already installed on Windows Server 2022/2025 or pulled by the installer.

Perkara yang diperlukan sebelum pemasangan

• Butiran teknikal: Windows Server 2019 / 2022 / 2025 on the same host as Revit Server.
• Butiran teknikal: An account with admin rights on that host.
• Butiran teknikal: Read-only access to the RS database (RSG doesn't write to it, only reads project metadata).
• Butiran teknikal: One free TCP port (8086 by default) — RSG.Proxy will bind to it.
• Butiran teknikal: ~250 MB of disk for the installation, ~5 GB for the audit log over six months.

Langkah

1. Butiran teknikal: Download RSG-Setup-1.0.0.exe from your personal cabinet.
2. Butiran teknikal: Run the installer as administrator. Specify the proxy port and the path to the RS database.
3. Butiran teknikal: Open http://localhost:5080 — the first-run wizard will ask you to create an admin-panel superuser.
4. Butiran teknikal: Import users from AD (one click) or add them manually.
5. Butiran teknikal: Create a first access rule on a test project.
6. Butiran teknikal: Redirect Revit clients to the new proxy port (via DNS or Group Policy).

Konfigurasi

Butiran teknikal: Most settings live in appsettings.json of RSG.Server. Most admins never touch it — everything is configurable through the UI — but sometimes it's needed.

08 — Keserasian

Berfungsi dengan infrastruktur yang anda sudah gunakan.

Butiran teknikal: RSG was designed for existing installations, not greenfield ones. No requirement for a new Windows version, a new Revit Server version, or a clean infrastructure. It works with what's there.

Prestasi

Butiran teknikal: The proxy adds ~3–8 ms of latency per request under typical load (measured on a Xeon E-2336, Windows Server 2022, 100 concurrent Revit clients). It's imperceptible for the user — Revit isn't known for being lightning-fast over the network anyway.

• Butiran teknikal: RAM: 200–400 MB resident with 100 active users.
• Butiran teknikal: CPU: <5% of one core under peak load.
• Butiran teknikal: Disk I/O: ~15 MB/hour of audit log with 100 users.
• Butiran teknikal: Network: close to zero overhead — RSG doesn't buffer, it streams the proxy traffic through.

10 StatistikSkrin ini mengurus Statistik: data, penapis, tindakan dan eksport dikumpulkan dalam panel RSG.

09 — Keselamatan

Apa yang dilindungi oleh RSG — dan apa yang tidak dilakukannya.

Butiran teknikal: Honestly: RSG isn't a silver bullet. It addresses one specific class of problems — authorization for access to Revit Server. Below — what's inside its threat model, and what's outside.

Dalam model ancaman RSG

• Butiran teknikal: An insider with legitimate AD access trying to read others' projects. Closed: project + section + action check on every request.
• Butiran teknikal: A contractor whose contract ended but whose AD account hasn't been disabled yet. Closed: rules with validUntil and denyOnExpired: true.
• Butiran teknikal: A leak via a fake site or a fake License API. Closed: the license is signed with ECDSA P-256, the key is embedded in the client. Substituting the site without the private key is impossible.
• Butiran teknikal: Moving a license to someone else's machine. Closed: machine fingerprint in the payload, validated on every service start.

Di luar model ancaman RSG

• Butiran teknikal: A compromised AD server. If an attacker gains DA rights — they get access to RSG.AdminPanel too. That's an AD security problem, not RSG's.
• Butiran teknikal: Physical access to the RSG host. With local admin access the service can be stopped. Infrastructure-level protection — bitlocker, physical control.
• Butiran teknikal: Screenshots and photographs of the screen. If a user has legitimate access to a project, they can see it and photograph it. RSG isn't a DLP solution.
• Butiran teknikal: Leaks via local Revit files. When a Revit client downloads a local copy of a project, it physically lives on the user's drive. That requires disk encryption and DLP.

Kriptografi

• Butiran teknikal: License signing: ECDSA P-256 + SHA-256, format IEEE P1363, length 64 bytes.
• Butiran teknikal: Communication with the License API: TLS 1.2+, certificate validation.
• Butiran teknikal: Internal AdminPanel ↔ RSG.Server traffic: HTTPS with a self-signed certificate by default (replaceable with a corporate one).
• Butiran teknikal: Storage of the signing private key on our side: managed key vault with rotation policy.

10 — Soalan Lazim (FAQ)

Soalan lazim — khusus tentang RSG.

Butiran teknikal: What happens if RSG.Server crashes overnight?

Butiran teknikal: In that case RSG.Proxy switches to fail_open or fail_closed mode — configurable. By default, fail_open: when the brain is unreachable, the proxy passes traffic to Revit Server without checks (as if RSG weren't there). That gives safe behavior on RSG failure: the business keeps working. If your company's requirements are the opposite — better to block everything than to risk a leak — you set fail_closed.

Butiran teknikal: What if a network card's MAC changes?

Butiran teknikal: The fingerprint changes, and the license will be rejected. Two solutions: either set quantity = 2 at purchase time (then the license is valid for two fingerprints and you can use one more activation), or request a re-issue from your personal cabinet — it's free and instant.

Butiran teknikal: Can RSG run in HA configuration (two nodes)?

Butiran teknikal: Right now (v2.4.x) — no, single-instance only. HA configuration is on the roadmap for v3.0. As a workaround, teams typically keep a «cold» second node with the same config and switch DNS on failure.

Butiran teknikal: Does RSG read .rvt files?

Butiran teknikal: No. RSG operates at the level of Revit Server's network protocol — it sees SOAP requests, project metadata, section names. It doesn't parse or store model contents. For content-level control (DLP based on what's inside models) you need separate solutions.

Butiran teknikal: How many licenses do I need for two Revit Servers?

Butiran teknikal: Two — each license is bound to one fingerprint, and the fingerprints of two hosts are different. Discounts for multi-server configurations are quoted individually, write to info@.

Butiran teknikal: Can I migrate from an in-house solution?

Butiran teknikal: If you have any matrix of «user × project × right» in Excel/CSV/SQL — importing it into RSG is supported via the rsg-import CLI. If your in-house solution did something more complex (e.g., rights based on geometric properties inside the model) — RSG doesn't cover that, you'll have to leave that part as it was.

Sedia untuk mencuba?

Butiran teknikal: Install RSG next to Revit Server today.3 bulan of trial, no card.

Muat turun pemasang dari kabinet peribadi anda, pasangkannya pada hos yang sama dengan RS dan luangkan kira-kira setengah jam. Menjelang petang, anda akan nampak perkara yang RSG lakukan yang tidak disediakan oleh Revit Server secara lalai.