attachment:aqhbci-tool-README.txt von AqBanking

   1 This folder contains the tool "aqhbci-tool". It can be used to setup and
   2 manage HBCI users/customers/accounts.
   3 
   4                               Content
   5 
   6                      1. Command Overview
   7                      2. Setup Scenarios
   8                      2.1. Setup using a blank RSA card
   9                      2.2. Setup using a new RSA keyfile
  10                      2.3. Setup using a DDV card
  11                      2.4. Setup using Pin/Tan
  12                      2.5. Setup using an existing RSA keyfile
  13                      2.6. Setup using a pre-personalized RSA card
  14 
  15 
  16 
  17 1. Command Overview
  18 ===================
  19 
  20 The following commands are implemented:
  21 
  22 
  23 mkpinlist
  24 ---------
  25 
  26 Creates an empty PIN file to be used by "aqbanking-tool".
  27 
  28 
  29 addmedium
  30 ---------
  31 
  32 Makes a new crypttoken available to AqHBCI.
  33 
  34 
  35 listmedia
  36 ---------
  37 
  38 Shows a list containing the currently known media.
  39 
  40 
  41 
  42 adduser
  43 -------
  44 
  45 Creates a HBCI user. Currently only importing of existing security media is
  46 supported.
  47 
  48 
  49 
  50 getkeys
  51 -------
  52 
  53 Retrieve the servers keys and store them in the crypttoken of the given
  54 user.
  55 
  56 
  57 createkeys
  58 ----------
  59 
  60 Create new keys for the given user. These must be sent to the server.
  61 
  62 
  63 
  64 resetkeys
  65 ---------
  66 
  67 Use this function to overwrite keys which already exist on your crypttoken.
  68 Only use this for keys you haven't already sent to the bank !
  69 
  70 
  71 sendkeys
  72 --------
  73 
  74 Send the users keys to the bank server. After this you will have to print
  75 the ini letter and sent this via mail to your bank. A few days later your
  76 account will be activated and you can use the next commands.
  77 
  78 
  79 getaccounts
  80 -----------
  81 
  82 Retrieves a list of accounts from the bank. However, some banks don't return
  83 such a list.
  84 
  85 
  86 
  87 getsysid
  88 --------
  89 
  90 Retrieves a system id for this application. This is needed for PIN/TAN and 
  91 RDH modes.
  92 
  93 
  94 activate
  95 --------
  96 
  97 Activates AqHBCI so that it can be used with AqBanking programs.
  98 
  99 
 100 
 101 deactivate
 102 ----------
 103 
 104 Deactivates AqHBCI.
 105 
 106 
 107 
 108 
 109 
 110 2. Setup Scenarios
 111 ==================
 112 
 113 Please note that after successfully setting up an HBCI account you must
 114 use the command
 115 
 116 "aqhbci-tool activate"
 117 
 118 to activate the AqHBCI backend of AqBanking.
 119 
 120 
 121 2.1. Setup using a blank RSA card
 122 ---------------------------------
 123  1) gct-tool create -t starcoscard
 124     This is only needed if the card does not already have a pin !!!
 125     This is the case with completely new and empty cards. In this case
 126     the pin must be changed from the preset value (the serial number of
 127     the card in bcd encoding) in order to make the card available for use.
 128 
 129  2) aqhbci-tool addmedium -t card
 130  3) aqhbci-tool listmedia
 131  4) aqhbci-tool adduser -m 0 [-s SERVER-ADDRESS]
 132  5) aqhbci-tool getkeys [-c CUSTOMER_ID]
 133      You will be asked three times to enter a pin:
 134      a) normal cardholder pin
 135      b) normal cardholder pin
 136      c) gateway pin
 137         Normally this pin is left to the initial value, so in this case you
 138         must hit the ENTER key without entering any data !
 139         You will then be asked whether you want to use the default value
 140         which is ok in this case.
 141         However, some banks set this pin to a secret value. In such a case you
 142         can not change public or private keys on the card.
 143 
 144  6) aqhbci-tool iniletter -B [-c CUSTOMER_ID]
 145      This prints the iniletter of your bank. Please compare the data to the
 146      one on the letter from your bank.
 147 
 148  7) aqhbci-tool createkeys [-c CUSTOMER_ID]
 149      You will be asked twice to enter a pin:
 150      a) normal cardholder pin
 151      b) gateway pin
 152         Normally this pin is left to the initial value, so in this case you
 153         must hit the ENTER key without entering any data !
 154         You will then be asked whether you want to use the default value
 155         which is ok in this case.
 156         However, some banks set this pin to a secret value. In such a case you
 157         can not change public or private keys on the card.
 158 
 159  8) aqhbci-tool sendkeys [-c CUSTOMER_ID]
 160 
 161  9) aqhbci-tool iniletter [-c CUSTOMER_ID]
 162      This prints your iniletter to stdout. 
 163      If you just created and sent your keys you will have to create the 
 164      INI-Letter and send it via mail to your bank.
 165      A few days later the bank will approve your application and enable your
 166      HBCI account. Only then you can continue with the following steps.
 167 
 168 10) aqhbci-tool getsysid [-c CUSTOMER_ID]
 169 
 170 11) aqhbci-tool getaccounts [-c CUSTOMER_ID]
 171 
 172 11) aqhbci-tool listaccounts
 173 
 174 
 175 
 176 2.2. Setup using a new RSA keyfile
 177 ----------------------------------
 178 
 179  1) gct-tool create -t ohbci -n ABSOLUTE_PATH_TO_NEW_FILE
 180     This creates an empty keyfile. This file can not be used with older
 181     version of AqHBCI/AqBanking or OpenHBCI!
 182  
 183  2) aqhbci-tool addmedium -t file -m ABSOLUTE_PATH_TO_FILE
 184  3) aqhbci-tool listmedia
 185  4) aqhbci-tool adduser -m 0 [-s SERVER-ADDRESS]
 186  5) aqhbci-tool getkeys [-c CUSTOMER_ID]
 187  6) aqhbci-tool iniletter -B [-c CUSTOMER_ID]
 188      This prints the iniletter of your bank. Please compare the data to the
 189      one on the letter from your bank.
 190 
 191  7) aqhbci-tool createkeys [-c CUSTOMER_ID]
 192 
 193  8) aqhbci-tool sendkeys [-c CUSTOMER_ID]
 194 
 195  9) aqhbci-tool iniletter [-c CUSTOMER_ID]
 196      This prints your iniletter to stdout. 
 197      If you just created and sent your keys you will have to create the 
 198      INI-Letter and send it via mail to your bank.
 199      A few days later the bank will approve your application and enable your
 200      HBCI account. Only then you can continue with the following steps.
 201 
 202 10) aqhbci-tool getsysid [-c CUSTOMER_ID]
 203 
 204 11) aqhbci-tool getaccounts [-c CUSTOMER_ID]
 205 
 206 11) aqhbci-tool listaccounts
 207 
 208 
 209 
 210 2.3. Setup using a DDV card
 211 ---------------------------
 212 
 213  1) aqhbci-tool addmedium -t card
 214 
 215  2) aqhbci-tool listmedia
 216 
 217  3) aqhbci-tool adduser -m 0 [-s SERVER-ADDRESS]
 218 
 219  4) aqhbci-tool getaccounts [-c CUSTOMER_ID]
 220 
 221  5) aqhbci-tool listaccounts
 222 
 223 
 224 
 225 2.4. Setup using Pin/Tan
 226 ------------------------
 227 
 228  1) aqhbci-tool addmedium -t pintan
 229 
 230  2) aqhbci-tool listmedia
 231 
 232  3) aqhbci-tool adduser -m 0 
 233                         -u USER_ID [-c CUSTOMER_ID] 
 234                         -b BANKLEITZAHL 
 235                         [-s SERVER-ADDRESS]
 236 
 237  4) aqhbci-tool getsysid [-c CUSTOMER_ID]
 238    This is the first contact with the bank server, so you will most
 239    probably be presented a dialog which contains the servers SSL
 240    certificate. Please check the line "Status : xyz".
 241    If this line looks suspect to you or the given finger print does not
 242    match a known fingerprint of the servers SSL certificate you should
 243    abort the connection and contact your bank.
 244 
 245  5) aqhbci-tool getaccounts [-c CUSTOMER_ID]
 246 
 247  6) aqhbci-tool listaccounts
 248 
 249 
 250 
 251 2.5. Setup using an existing RSA keyfile
 252 ----------------------------------------
 253 
 254  You can only import keyfiles created by programs based on OpenHBCI or
 255  AqHBCI/AqBanking.
 256  Proprietary keyfiles (StarMoney, MoneyPlex) can not be used since the
 257  manufacturers of these programs do not publish the format of their files.
 258  
 259  1) aqhbci-tool addmedium -t file -m ABSOLUTE_PATH_TO_FILE
 260  
 261  2) aqhbci-tool listmedia
 262  
 263  3) aqhbci-tool adduser -m 0 [-s SERVER-ADDRESS]
 264  
 265  4) aqhbci-tool getsysid [-c CUSTOMER_ID]
 266 
 267  5) aqhbci-tool getaccounts [-c CUSTOMER_ID]
 268 
 269  6) aqhbci-tool listaccounts
 270 
 271 
 272 
 273 2.6. Setup using a pre-personalized RSA card
 274 --------------------------------------------
 275 
 276  You can simply import RSA cards which have been used with other
 277  programs (like MoneyPlex, or OpenHBCI-/AqHBCI-based programs).
 278  
 279  1) aqhbci-tool addmedium -t card
 280  
 281  2) aqhbci-tool listmedia
 282  
 283  3) aqhbci-tool adduser -m 0 [-s SERVER-ADDRESS]
 284  
 285  4) aqhbci-tool getsysid [-c CUSTOMER_ID]
 286 
 287  5) aqhbci-tool getaccounts [-c CUSTOMER_ID]
 288 
 289  6) aqhbci-tool listaccounts