|
8. Installing and Running the Unattended iAgent on Linux or UNIX
iTivity provides a UNIX/Linux version of the Unattended iAgent for remote support of UNIX/Linux systems. This chapter explains how to install, configure and use the Unattended iAgent on UNIX or Linux. 8.1 Capabilities of the Unattended iAgent on
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
COMMON OPTIONS |
|
|
Programdir |
Specifies the directory in which the Unattended iAgent is installed. This setting is automatically configured by the Installation program. Default: /usr/lib/iTivity/iAgent |
|
dataDir |
Specifies the directory where the Unattended iAgent stores information between program invocations. This information includes encryption keys and other data used internally. Default: /usr/lib/iTivity/iAgent/itivity_data |
|
vnchostname vnchostdesc |
The iAgent name and Description as listed in iTivity iManager for this Unattended iAgent. The default vnchostname is the UNIX/Linux machine name. The vnchostdesc can be entered during the Installation procedure. |
|
CONNECTOR |
|
|
randomFile keyFile caFile |
These settings specify the filenames and location of three files used for encryption. The Unattended iAgent automatically generates default versions of these files the first time it runs. There is no need to change these settings unless the default files in the dataDir directory are not acceptable. Defaults: randomFile=/usr/lib/iTivity/IAgent/itivity_data/random.dat keyFile=/usr/lib/iTivity/iAgent/itivity_data/keys.pem caFile=/usr/lib/iTivity/iAgent/itivity_data/root.pem |
|
autoAcceptAllCerts |
This flag enables or disables verification of the encryption certificate received from the iServer. Enabling this option (setting the value = 1) prevents a change in the encryption certificate on the iServer from blocking access. Caution: Enabling this function prevents iTivity from detecting a man-in-the-middle attack on the encrypted connection. The recommended practice is to copy the "root.pem" file from your iServer to the iAgent system. For example, From: To: When the root.pem file is copied from the iServer to the iAgent system the iServer's certificate will be trusted correctly. At this point, autoAcceptAllCerts can remain disabled and providing a higher level of security. Default: autoAcceptAllCerts=0 |
|
Log
File Flags |
The following options control which events are written to the Syslog. A value of 1 (one) enables logging and a value of 0 (zero) disables logging. Syslog facility and priority: iTivity.daemon |
|
connectSysLogMask |
Arrival of an encrypted connection. Default = 0. |
|
disconnSysLogMask |
Closing of an encrypted connection. Default = 0. |
|
startSysLogMask |
iAgent startup. Default = 1. |
|
stopSysLogMask |
iAgent shutdown. Default = 1. |
|
allowSysLogMask |
Granting of user permission by the iAgent. Default = 0 |
|
telnetService |
Initiation of a TELNET session with the iAgent. Default = 0 |
|
ftpServiceSys |
Granting of FTP access by the iAgent. Default = 0 |
|
chatServiceSys |
Granting of Chat access by the iAgent. Default = 0 |
|
TCP
Connection |
These settings control the TCP connection ports and interface of the Unattended iAgent. |
|
transportPort |
Must always match proxySvcPort=21800. Default = 21800 |
|
iasServerPort |
The port for iServer connections. Default = 23800. |
|
iasServerHost |
Host DNS for the iServer. Note: You must enter the DNS name for your iServer here for the iAgent to connect. Default none. Example: iserver.acme_heavy_industries.com |
|
transportTimeout serviceTimeout |
These two settings control the timeout behavior of Unattended iAgent data connections. transportTimeout - Timeout in milliseconds set for end-to-end or host to host network connections. Keep this value high if using the Internet or other high-latency network transport (such as satellite connections). serviceTimeout - Timeout in milliseconds for internal or local connections between Unattended iAgent daemons. Defaults: transportTimeout=90000 serviceTimeout=45000 |
|
Keep-Alive
Settings |
These three settings control the keep-alive behavior of Unattended iAgent data connections. |
|
endToEndKeepAlive |
Determines whether the Unattended iAgent sends keep alive packets. Not supported on all transports. Values are: 1 (one) - send packets Default = 1. |
|
iasVerifySessionFlag |
In addition, the Unattended iAgent can send application messages to guarantee the connections are viable and detect lost connections more reliably. Set this flag to 1 (enabled) to have the iServer verify session status when there is otherwise no network traffic. Values are 1, enabled, and 0, disabled. Default = 1. |
|
iasVerifySessionTimeout |
If the iasVerifySessionFlag is set to 1, this value controls how often, in seconds, the verification packets are sent. Default = 240. |
|
connectToIASCycleTime connectToIASMaxRetries |
These settings control the reconnect behavior of the Unattended iAgent when the connection to the iServer fails. The default is to retry every five minutes for 24 hours. connectToIASCycleTime is the cycle time specified in milliseconds between reconnect tries. Default = 300000. connectToIASMaxRetries is the maximum number of retries. Default = 288. |
|
disableSessionDNSLookup |
Prevents DNS lookups for new connections to query the host name of the foreign system. This can be useful to improve performance in environments with slow DNS service. Values are: 1 (one) - prevent DNS lookup Default = 0. |
|
cipherList |
Specifies the list of cipher algorithms to be allowed for incoming connections. If you add other ciphers to the list, it is highly recommended that you keep the default setting as an option. If this Unattended iAgent connects to an iServer or is contacted by an iManager and there is no mutually acceptable cipher algorithm, the connection will fail. In order for a different cipher to be used, it must also be allowed by the cipherList of the iServer. The recommended best practice is to set the same cipherList in all iTivity systems. Supported OpenSSL ciphers:
DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA AES256-SHA Default: cipherList= AES128-SHA:DES-CBC3-SHA |
|
Connector
Port Number |
These settings provide the ability to control the port number on which the Connector will attempt to find the local service daemons. Local service daemons listen on the localhost interface and provide local, unencrypted access to services. |
|
|
commandSvcPort |
Remote control authorization and commands. Must always match connectPort=6800 Default = 6800 |
|
|
rfbSvcPort |
Unencrypted, raw VNC data Default = 5900 |
|
|
telnetSvcPort |
Telnet daemon Default = 23 |
|
|
ftpCtlSvcPort |
FTP server control port. Default = 21 |
|
|
ftpDataSvcPort |
FTP server data port (passive mode) Default = 20 |
|
|
proxySvcPort |
Forwarded iServer connections. Must always match transportPort=21800 Default = 21800 |
|
|
defaultHostPermissions |
This setting provides control over which services the iTivity iManager user can access on this iAgent system via iTivity. Each individual service is controlled via a bit flag in this integer. (See the Examples below.) The iManager user must first authenticate with the iAgent system before being allowed to access any services. After authentication (and the authorization check), then the remote user is subject to the permissions restrictions listed in the table. A Status of N/A indicates that this service is Not Available in the UNIX/Linux Unattended iAgent. Decimal 1 required Command Protocol 2 optional View desktop permission 4 N/A Control desktop permission 8 optional Telnet permission 16 optional FTP permission 32 required Proxy permission 64 N/A Chat permission 128 optional TTY remote control permission 256 optional TTY listing permission 1024 N/A desktop sharing The default is to allow access to all supported iTivity services (after remote user authenticates and passes authorization check). Default= 65535 Examples For FTP access only, use a value of 1 + 16 = 17, since the command protocol is required and the FTP permission has a value of 16. For telnet access only, use a value of 1 + 8 = 9. For TTY Listing and TTY remote control only, use a value of 1 + 128 + 256 = 385 |
|
|
Connector_debugMode |
Enables debugging output in the connector daemons. A setting of zero ("0") disables output. As the mode number increases from one ("1") to twelve ("12"), more and more information is written to the log file. This option should be disabled in production systems, unless instructed otherwise by Tridia staff. Default = 0. |
|
|
PROCESSOR |
|
|
|
permissionGroup authscheme |
These settings control the authentication required of iTivity iManager users to view and control the Unattended iAgent system. The authscheme setting controls the way the Unattended iAgent authenticates. The default setting is “passwd”, which requires that the remote user have an account in the native /etc/passwd database. The other currently valid setting is "none, which disables authentication at the Unattended iAgent level may be disabled using the “none” setting. This is useful in environments where the iTivity iServer is trusted and its authentication is deemed sufficient. Other authscheme values are reserved for future use. The permissionGroup specifies the name of the user group with permission to view and access this system via the Unattended iAgent. To grant a user of iTivity iManager access, simply add the user to this group. To block a user from using the iServer, remove their user id from the group. A user in this group must log in with username and password before viewing this system through iTivity iManager. Defaults: |
|
|
logonSysLogMask logoffSysLogMask |
These flags control whether it is recorded in the syslog each time a user of iTivity iManager logs on and logs off of the iAgent system. Setting the flags to 1 (one) enables logging and provides an audit log of authentication. Setting the flags to 0 (zero) disables logging. Syslog facility and priority: iTivity.authpriv logonSysLogMask - Log iTivity iManager user logon (succeed or fail). Default = 1. logoffSysLogMask - Log iManager user logoff (disconnect). Default = 1. |
|
connectPort connectHost connectTimeout |
These settings specify the TCP network interface and port on which the processor daemon listens for new Unattended iAgent authentication connections. These connections are internal to the Unattended iAgent and generally use localhost. The connectPort value must always match the value of commandSvcPort. The connectTimeout value specifies the socket timeout for processor connections in milliseconds. Caution: Tridia strongly recommends that you do not change these settings. Defaults: |
|
Processor_debugMode |
Enables debugging output in the processor daemon. The default setting of 0 (zero) disables output. As the number increases from 1 to 12, more and more information is written to the log file. This option should be disabled unless instructed otherwise by Tridia staff. Default: 0 (disabled) |
|
ITIVITY
WEBTUNNEL SETTINGS |
These settings can be used to configure network applications that will be added to the iTivity WebTunnel scan list for this iAgent. For more information on WebTurnnel, see Section 1.5.1, Configuring iTivity WebTunnel. |
|
customAppScan_X |
Declares services or applications local to the iAgent that will be scanned by the iAgent for the purpose of application tunneling using iTivity WebTunnel. You can configure custom TCP network based services or applications specific to your environment. customAppScan
definitions are indexed using a sequential number ordering. You can configure
multiple applications as long as you increment the count. Example:
customAppScan_1, customAppScan_2,… Tunneling of a custom application can be disabled by
commenting out the service or application customScanApp_X definition in the
iAgent.conf file and re-loading the iAgent configuration settings. |
|
port |
Declares the TCP port number of the local iAgent service or application. If the iAgent detects a daemon or service listening on your custom port, it will report the service or application as accessible to a connected iManager. The port value should be between 0 and 65536. This is a required setting for an enabled customAppScan definition. |
|
protocol |
Declares the protocol used by the local iAgent service or application. Supported protocols include: http, https, telnet, vnc, rdp For web applications, the protocol should be either “http” or “https’. This is a required setting for an enabled customAppScan definition |
|
appname |
Declares the user readable display name of the service or application to be tunneled. The name should have a clear meaning to an iManager user. This setting is not required but is highly recommended. |
|
session |
Some operating systems have platform specific session labels. This setting should declare the session in which the application or service is running, if any. Typical session names would include “tty0”,”pts/4”,’:4”k”tcp”,”#7’, etc. This setting is optional. |
|
path |
Specifies the path to the default page or landing page for the application. Typically used for web/http applications. This configuration setting is optional. |
|
PROXY
SERVER |
These settings can be used configure the Unattended iAgent to connect to the iServer through a proxy server running the SOCKS v5 protocol. |
|
socksMode |
One of the following iTivity modes used to define when the iAgent uses a Proxy Server to connect: 1 - Disable. Only connect to iServer directly, no proxy server used. 2 - Require. Only connect to iServer via proxy, no direct connect. 3 - Fallback. If direct connection fails, then attempt the proxy connection. 4 - Override. If the proxy connection fails, then attempt the direct connection. |
|
socksHost |
DNS name of the Proxy Server |
|
socksPort |
Port used to connect to the Proxy Server |
|
socksUser |
User name used for secure login to the Proxy Server. |
|
socksPwd |
Password used for secure login to the Proxy Server. |
8.4.2 Changing a Configuration
You can change configuration options without stopping and restarting the Unattended iAgent software. The options can be changed without losing current connections.
To reload the settings of a running Unattended iAgent, run the following script:
/usr/lib/iTivity/iServer/iagent_config_reload
8.5 UNIX/Linux Unattended iAgent Commands
Administrators can use the programs explained in this section to display information about the Unattended iAgent and control its operation.
iagent_downall
This command stops execution of the Unattended iAgent by stopping all daemons.
iagent_version
This command displays version information for the currently installed Unattended iAgent.
install_daemon
This command installs the scripts that launch the Unattended iAgent at boot time.
rc_iagent_daemon
This script starts the Unattended iAgent at system startup.
remove-iagent
This program removes the Unattended iAgent files from the system.
start_iagent
This program can be used to manually start the Unattended iAgent.
stop_iagent
This program can be used to manually stop the Unattended iAgent.
8.6 Installing
the Secure Dial (igetty) iAgent
The Secure Dial (igetty) iAgent is installed on a Linux or UNIX system if you want to connect to that system through the iTivity secure dial feature. The installation process is very similar to installing the Unattended iAgent.
For more information on secure dial, see Section 4.1.2.2, Add Secure Dial Site.
Available
Versions
The igetty iAgent is named for the UNIX getty utility and is available for these UNIX versions:
· Linux, Red Hat versions RH 9.0 through RH ES 3.x / 4.x Intel
· AIX versions 4.3.1, 4.3.2, 4.3.3, 5.1, 5.2, 5.3
· SCO versions 3.2.5.04 through 3.2.5.07
· HP-UX 11.00/11.11 32 and 64 bit systems
Installation
Follow these steps to download and install the Secure Dial (igetty) iAgent. The iAgent distribution is available in a .tar file on the Tridia ftp site. The filename depends on which version you are installing. Contact Tridia Support for the filename and FTP location.
1. Download the distribution .tar file from the Tridia FTP site. Save the file to the /tmp directory on the target Linux or UNIX system.
2. If not logged in as root, su to root.
3.
Change to the /tmp directory
cd /tmp
4.
Run
tar –xvf <filename>
Where <filename> is the name of the distribution .tar file.
5.
Run
install-igetty
6. Choose the installation directory for igetty. Default is /usr/lib/iTivity/igetty
7. Add the tty device when prompted. Enter the device name of the modem you will be securing with secure dial.
Example: /dev/ttyS0
8. Important: The SecureFile.Key created in the iServer itivity_data directory must be copied over to the Linux or UNIX system. This is the secure key that the iServer and igetty iAgent must share. Without this key, connections are not allowed.
Copy the SecureFile.Key to the following directory on the Linux or UNIX system:
/usr/lib/iTivity/igetty/itivity_data
Installation is now complete:
 |
Table of Contents |  |
Copyright © 2004 - 2009, Tridia
Corporation
Copyright and License Information