Dell Wyse Enhanced Ubuntu Linux T50- Manuals

10.3.4. Security Considerations and Limitations ........................................................ 123 11. Connecting to Windows Terminal Servers ............................................................................... 125 11.1. Introduction ................................................

14.2.6. Parameters in /tlwebadm/ ................................................................................ 15614.2.7. Parameters in /webaccess/............................................................................... 156 14.3. Configuring Logging on ThinLinc servers .......................

17.2.6. Distribute Configuration to all agent hosts ..................................................... 194 17.3. Enabling the Custom Desktops for users..................................................................... 19417.4. Tips & Tricks with TLDC ..........................................

Chapter 1. Introduction 1.1. About the Documentation This document is separated into five parts. This, the first part, is an introduction to the subject withgeneral information about the product. The second part is about how to install different components inThinLinc and integrate those with other s...

Chapter 2. ThinLinc Architecture The goal of this chapter is to give a technical overview of how the system works for someone who willinstall or maintain a ThinLinc installation. ThinLinc is a product for managing server based computing . The system is largely based on open source software, which ha...

Chapter 3. Installation 3.1. Overview This chapter describes how to install the ThinLinc software on ThinLinc Linux Terminal Servers and MSWindows Terminal Servers. To upgrade an existing installation, see Section 3.5. 1. If your setup includes a MS Windows Terminal Server, we suggest installing thi...

Chapter 3. Installation spreadsheet now and then will cope with a considerably lower amount of concurrent users if they areaccessing internet sites with streaming video. When ThinLinc is used as a Windows Terminal Server frontend, meaning that the only application runis rdesktop, experience shows th...

Chapter 3. Installation 3.4. Installing the ThinLinc Terminal Server 3.4.1. Starting the Installation Program The installation program is located in the root directory of the Server Bundle. Extract the bundle andstart the installation program as follows: sh ./install-server If you prefer, you can al...

Chapter 3. Installation Note: The ThinLinc GINA is currently only relevant in Active Directory configurations. When using Novell eDirectory, use the Novell GINA instead. Note: The ThinLinc GINA is not supported on Windows 7, Windows Server 2008 or later. 3.7.2. Installing the WTS Tools Package on Wi...

Chapter 4. License Handling 4.1. Overview To run a session against a ThinLinc cluster, the server must be equipped with license files. The licensefiles specify the number of concurrent users the cluster is allowed to run. If no license files are installed on the cluster, a maximum of ten concurrent ...

Chapter 4. License Handling If license violations occurs, ThinLinc sends email to the person defined as system administrator in theparameter /vsmserver/admin_email in vsmserver.hconf . E-mail messages warning about license violations are sent every 12 hours if any license violations have occured. 4....

Chapter 5. Printer Features 5.1. Overview of ThinLinc Printer Features ThinLinc has several printer-related features that aims to provide the user with maximum flexibilitywhile making the administrator’s work easier. A ThinLinc system normally uses CUPS (Common UnixPrinting System) to provide normal...

Chapter 5. Printer Features • After a print job is completed, the application must close the port. As the emulation is unaware of theprinter protocol, closing the port is the only way it can determine where one job ends and anotherbegins. To access the emulated parallel port, configure the applicati...

Chapter 5. Printer Features After creating the symlinks, try connecting to your ThinLinc cluster with a ThinLinc cluster and bring upan application that lists the available printers. The list of printers should now be limited according toconfiguration. Note: The printer list limitation doesn’t work ...

Chapter 6. High Availability (HA) Both machines have an unique hostname and an unique IP address, but there is also a third IP addressthat is active only on the node currently responsible for the VSM server service. This is the so called HAaddress, the address the clients are connecting to. 6.2. Con...

Chapter 6. High Availability (HA) Warning It is VERY IMPORTANT that 127.0.0.1 is not in the list of terminal servers. If the machines running VSM server are also VSM agents, theirunique hostnames or IP addresses must be added to the /vsmserver/terminalservers instead of 127.0.0.1. The reason for thi...

Chapter 7. The ThinLinc Client 7.1. Client usage Starting the ThinLinc client is normally easy, but the method can differ somewhat between the availableoperating systems. See Chapter 8 for instructions on how to start the client on different platforms. 7.1.1. The started ThinLinc client When the Thi...

Chapter 7. The ThinLinc Client The session selection window presents the user with a list of relevant sessions and several buttons to acton those sessions: Connect Connect to the selected session, or create a new session if the current selection is "Create newsession...". End session Forcefu...

Chapter 7. The ThinLinc Client 7.1.4. The ThinLinc session life cycle When the user has started a ThinLinc session the client login interface disappears from the desktop. Theclient program continues to run in the background as long as the ThinLinc session is running. The cliententers a service mode ...

Chapter 7. The ThinLinc Client All arguments written on the command line overrides the settings saved from previous sessions. Theoptions window will show the current settings, including the settings from the command line. The clientsettings is only stored to file when the user press the OK button in...

Chapter 7. The ThinLinc Client All programs that support the Enlightened Sound Daemon (EsounD) or PulseAudio should automaticallybe aware of this tunnel and send their sound to the client. See also Section 12.3 for information aboutsupporting other applications. The sound data that is sent from the ...

Chapter 7. The ThinLinc Client the session so there is nothing to configure except an activation switch. The ThinLinc client relies on the PC/SC interface present on the system to communicate with the smartcard readers. If you have a reader that uses another system, then that reader will not be expo...

Chapter 7. The ThinLinc Client Description of options tab settings Here follows detailed description of the settings available in the options tab. Start a Program If enabled, the client requests that the server should start the session with the command supplied bythe client. Otherwise, the session c...

Chapter 7. The ThinLinc Client Description of local devices tab settings Here follows detailed description of the settings available in the local devices tab. Export - Sound Device When enabled, sound will be sent from the ThinLinc server to your local client. A small local sounddaemon will be start...

Chapter 7. The ThinLinc Client The Export Local Drives window consists of two parts. At the top there is a list containing exported paths, with two control buttons below. The lower half contains settings fields for the currentlyselected path. When you select a path listed in the upper list you will ...

Chapter 7. The ThinLinc Client 7.4.3. Screen tab The "Screen" tab contains options regarding the session screen. This includes initial screen size, resizebehaviour and full screen mode. Figure 7-9. Client settings Screen tab Description of screen tab settings Here follows detailed descriptio...

Chapter 7. The ThinLinc Client Figure 7-10. Client settings Optimization tab Description of optimization tab settings Here follows detailed description of the settings available in the optimization tab. Auto select This option makes the ThinLinc system try to automatically select the best suited enc...

Chapter 7. The ThinLinc Client Description of security tab settings Here follows detailed description of the settings available in the security tab. SSH Port This option selects the TCP/IP port to use when the client tries to establish an SSH connection withthe ThinLinc server. The normal SSH port i...

Chapter 7. The ThinLinc Client Smart card - certificate filter A certificate filter is used to present only allowed certificates for authentication, certificates thatdoes not match any filter will be hidden from the user. When no certificate filters are configured, all available certificates on the ...

Chapter 7. The ThinLinc Client C:\> set Observe that some directories in the Windows %TMP% path may be flagged as hidden by the Windowssystem. This means that you need to change directory options to display hidden files and directories tonavigate to the log file. 7.7. Client configuration storage...

Chapter 7. The ThinLinc Client 7.7.3. Adding Custom Branding to the ThinLinc Client Login Window It is possible to add a custom logo to the main ThinLinc client window, making it easily distinguishablefrom a generic client. The custom logo will be placed to the right of the input fields. Adding the ...

Chapter 8. Client Platforms There are several ways to run the ThinLinc client, and also some ways to access ThinLinc serverswithout running the client. In this chapter we will document how to install, configure and run the ThinLinc client on all differentplatforms including dedicated thin terminals....

Chapter 8. Client Platforms 8.6. Running ThinLinc on a Thinstation terminal The Thinstation project (http://thinstation.github.io/thinstation/) is an opensource thin client Linuxdistribution that can be booted in many different ways, including entirely over the network on disklessmachines and via a ...

Chapter 8. Client Platforms the user to verify the fingerprint of the key. At subsequent connects, this copy is used to verify that theclient is connecting to the correct server. When running on a diskless Thinstation host, the key can be stored only in volatile memory (on a RAMdisk), so the client ...

Chapter 9. Authentication in ThinLinc In this chapter we will describe how authentication of users is performed in ThinLinc 9.1. Pluggable Authentication Modules Authentication of users in ThinLinc is performed using the Pluggable Authentication Modules (PAM). This means ThinLinc can authenticate us...

Chapter 9. Authentication in ThinLinc 9.3. Using Novell eDirectory with ThinLinc 9.3.1. Configuring eDirectory and ThinLinc with TLNC Within ThinLinc, a tool called ThinLinc Novell Configurator (TLNC) helps in the task of configuringThinLinc to interoperate with a Novell eDirectory server. By using ...

Chapter 9. Authentication in ThinLinc • Create a default group to be used for ThinLinc Users All users of a ThinLinc server need to have a default posixGroup assigned to their user objects. Thisgroup can be created by TLNC. • Create indices needed for proper performance For proper performance, a few...

Chapter 9. Authentication in ThinLinc In ThinLinc, this problem is solved using two programs, tl-nds-posixuser and tl-nds-posixgroup that searches the directory for users that don’t have posixAccount among their objectclasses, and for groupsthat don’t have posixGroup among their objectclasses. When ...

Chapter 9. Authentication in ThinLinc Hiveconf parameter path Command line parameter Explanation /utils/tl-nds/posixgroup/cachefilename --cachefilename The file name of the filenamewhere the last used gidNumber isstored. The default is /var/opt/thinlinc/utils/tl-nds/posixgroup/cache , and generally,...

Chapter 9. Authentication in ThinLinc mechanism that prevents even the server from gaining access to the authentication information. Thissection will describe how to configure ThinLinc to use it. 9.4.2. Key Generation In order to use public key authentication, a pair of encryption keys must be gener...

Chapter 9. Authentication in ThinLinc 9.5. Using Smart Card Public Key Authentication 9.5.1. Introduction Smart card public key authentication is an advanced version of the method described in Section 9.4. Ituses the same basic principle but stores the private key on a smart card, where it can never...

Chapter 9. Authentication in ThinLinc 9.5.7.2. Configuration tl-ldap-certalias uses the /utils/tl-ldap-certalias hiveconf folder for configuration purposes. On a standard ThinLinc installation, it’s located in /opt/thinlinc/etc/conf.d/tl-ldap-certalias.hconf . Configuration parameters /utils/tl-ldap...

Chapter 9. Authentication in ThinLinc 5. Normally, when not using OTPs, the VSM and SSH Server PAM configuration is the same. This is often accomplished by a symbolic link /etc/pam.d/thinlinc pointing to /etc/pam.d/sshd . When using OTPs, this symbolic link should be replaced with a private copy: # ...

Chapter 10. File Access ThinLinc supports accessing files on both Windows and Novell file servers. 10.1. Accessing Windows File Servers 10.1.1. Introduction This chapter describes how to setup a ThinLinc server to access Windows file servers via the SMB/CIFSprotocol. CIFS is a modern version of SMB....

Chapter 10. File Access Example 2: User "john" is part of a workgroup that shares files using a share called "project" on the fileserver \\alabama. This share can be mounted on /home/john/winshares/project with the following command: $ tl-mount-cifs //alabama/project ~/winshares/proj...

Chapter 10. File Access You should also make sure that tl-umount-all-ncp runs at logout. This can be done with the following command: # ln -s /opt/thinlinc/bin/tl-umount-all-ncp /opt/thinlinc/etc/xlogout.d Given the example above, the user’s Netware home directory will be mounted on the directory no...

Chapter 10. File Access 10.2.3.3. Mounting Shares After login, shares can be mounted by using the map command, part of the Novell Linux Client. They can also be mounted as part of the login procedure by adding the -r parameter to tl-nwlogin . This will cause the Novell Client to run the user’s login...

Chapter 10. File Access On the other hand, using Netware mode (if your fileserver runs Netware 6.5 or later) means you don’thave to assign uid and gid values to all home directories from the Linux side, since Netware will do thistranslation on the server side. However, since a NFS export from Netwar...

Chapter 10. File Access 10.2.4.4.2. Mounting the homedirectories on the ThinLinc server Depending on how the NFS-exports of filesystems on the Netware servers are organized, it’s more or lesseasy to mount the homedirectories on the ThinLinc server(s). 10.2.4.4.2.1. All homedirectories on one export ...

Chapter 10. File Access The reason for this behaviour is that when tl-nds-mountpath is used in combination with tl-nds-posixuser , assigning uid/gid values, a whole directory with many home directories can be assigned incorrect uid/gid values, if the ndsHomeDirectory attribute of one user has a bad ...

Chapter 10. File Access directories Since exports from Netware 6.5 don’t support hard links, they cannot be used as home directories inLinux without special care. Both the X Window System, Gnome and KDE use hard links when lockingfiles. One workaround for this is to perform the following steps. • Cr...

Chapter 11. Connecting to Windows Terminal Servers 11.1. Introduction This chapter describes how to connect to Windows Terminal Servers via RDP. This makes it possible toprovide ThinLinc users with Windows desktops, but also to publish individual Windows applications to aThinLinc desktop, running on...

Chapter 12. Accessing Client Resources from the Terminal Server In this chapter we will describe how to access client resources, such as local drives and serial ports, fromthe Terminal Server. 12.1. Accessing the Clients Local Drives 12.1.1. Introduction Using ThinLinc, it is possible to access the ...

Chapter 12. Accessing Client Resources from the Terminal Server 12.3.3.4. ALSA applications All applications that use the Advanced Linux Sound Architecture (ALSA) will also work well withThinLinc provided the correct plug-ins are installed and configured. The plug-ins can be found in thealsa-plugins...

Chapter 13. Commands on the ThinLinc Server In this chapter, we will describe the commands shipped as part of the ThinLinc server that are meant forthe common user. Commands in /opt/thinlinc/bin tl-best-winserver server [ server ...] The tl-best-winserver command asks the Windows Terminal Servers li...

Chapter 13. Commands on the ThinLinc Server tl-limit-printers This command is run by VSM Server at session startup and reconnect if the Printer Access Controlfeature of ThinLinc is activated. See Section 5.5 for details. tl-mount-cifs This command is used to mount CIFS/SMB network file systems at lo...

Chapter 13. Commands on the ThinLinc Server tl-run-rdesktop [ options ] The tl-run-rdesktop program is a wrapper around the rdesktop program. It extends the functionality of rdesktop by connecting to one of the Windows Terminal Servers specified by the system administrator in /appservergroups/rdp/&l...

Chapter 13. Commands on the ThinLinc Server tl-shadow-notify This command starts the tl-shadow-notify command for the lifetime of the session. This will enable notifications when the session is shadowed. tl-single-app command [ arguments ] The tl-single-app command can be used to execute a single ap...

Chapter 13. Commands on the ThinLinc Server tl-wfica [ options ] [ connection file ] This command is a front-end for the Citrix ICA client ( wfica ), which provides Single Sign-On for ICA sessions in a secure fashion. This command does not modify any ICA Client configurationfiles. The ThinLinc Singl...

Chapter 14. Server Configuration 14.1. Configuring ThinLinc Servers in a Cluster In this section, we will describe how to configure a ThinLinc cluster with multiple agent servers to allowload-balancing and redundancy. Note: This section does not address configuration of high availability (HA). For i...

Chapter 14. Server Configuration ships with the tool tl-rsync-all to ensure that configuration changes can be synchronised easily across all agents in a cluster. See Chapter 13 for more information on how to use this tool. The tl-rsync-all command should be run on the master server, since it is the ...

Chapter 14. Server Configuration /appservergroups/rdp/<appgroup>/rdesktop_args Extra arguments for RDP connections to Windows Terminal Servers. See the documentation for tl-run-rdesktop in Chapter 13 for information about the possible values of this parameter. /appservergroups/rdp/<appgroup...

Chapter 14. Server Configuration If the image contains transparency then the color set by background_color will shine through. /sessionstart/keyboard_layout The default virtual keyboard layout used by Xvnc. The protocol is not dependent on this beingconfigured, but some applications can misbehave if...

Chapter 14. Server Configuration 14.3.1.1.1. Writing Logs to File The file name for the log file written to local disk is configured by editing the parameter logfile under the logging folder. To turn off logging to file, set the parameter log_to_file to 0. Note that the log file will still be create...

Chapter 14. Server Configuration The log level configured can be seen as a barrier. If the log level is set to for example INFO, logmessages with a level of INFO or higher are let through. If the log level instead is set to DEBUG2, all logmessages are let through, since all log levels are higher tha...

Chapter 14. Server Configuration 14.4.9. Forcing sessions for some users to certain agent hosts In some situations, it is desirable to force sessions for certain users to be started on a specific agent host.Examples of when this is needed is when testing a new server platform, allowing a group of te...

Chapter 14. Server Configuration Terminate after s seconds of user inactivity. Note: Never use a value smaller than 60. In addition to the options above which control the lifetime of the ThinLinc session, the option -IdleTimeout can be used to configure how long an idle session should remain connect...

Chapter 15. Hiveconf 15.1. Overview Hiveconf is the name of the configuration system used in ThinLinc. It is however not a ThinLinc-specificconfiguration system, but instead a generic configuration framework for storing key/value pairs in ahuman readable way, although still in a format that’s easy t...

Chapter 16. Administration of ThinLinc using the Web Administration Interface • Home allows you to view current status of VSM services. • VSM Master allows you to start or stop the service, and modify a subset of the configuration options. • VSM Agent allows you to start or stop the service, and mod...

Chapter 16. Administration of ThinLinc using the Web Administration Interface Figure 16-2. New terminal form There are three editable fields in this view, Hardware (MAC) address , Terminal name and Location . They are described in Table 16-1 below. To save changes, press the Save button. When you ha...

Chapter 16. Administration of ThinLinc using the Web Administration Interface 16.3.6. The Desktop Customizer Module The ThinLinc Desktop Customizer is described more fully in its own chapter, Chapter 17. Links tosections of this chapter pertaining to the respective menus of the Desktop Customizer Mo...

Chapter 16. Administration of ThinLinc using the Web Administration Interface To edit an existing server group, click on the name of the group in the list. To add a new server group,click on the Add new Unix Group button - Figure 16-6 shows the page for adding new UNIX server groups. Figure 16-6. Ad...

Chapter 17. Building Custom Linux Desktops with the ThinLincDesktop Customizer In this chapter, we will document how to create custom desktops for ThinLinc users using either the KDesktop Environment (http://www.kde.org) or the Gnome Desktop Environment (http://gnome.org), incombination with the Thi...

Chapter 17. Building Custom Linux Desktops with the ThinLinc Desktop Customizer Choose in which application server group the command should be run in the select box labeled Application Server Group . By having several application server groups, you can have several groups of Windows Terminal Servers...

Chapter 17. Building Custom Linux Desktops with the ThinLinc Desktop Customizer Add to the left selectbox the applications that should appear in the menu folder selected above, for theusers that are assigned this Application Group. The right selectbox lists the applications defined orfound installed...

Chapter 17. Building Custom Linux Desktops with the ThinLinc Desktop Customizer This can be used for example to activate application groups based on OU in eDirectory installations byusing the tl-nds-memberof-container command. It can also be used to activate an application group for all users by run...

Chapter 17. Building Custom Linux Desktops with the ThinLinc Desktop Customizer 17.4. Tips & Tricks with TLDC 17.4.1. Unwanted Icons on the Desktop with KDE At first login for each user, KDE copies files from /usr/share/apps/kdesktop/DesktopLinks to the Desktop directory of the user. This means ...

Appendix A. TCP Ports Used by ThinLinc A.1. On Machine Running VSM Server 22: SSH Daemon Port 22 is not used by ThinLinc per se , but since no ThinLinc installation can work without a running SSH daemon, we list port 22 here. Port 22 is the normal SSH port, but basically any portcan be used - the cl...

Appendix B. Troubleshooting ThinLinc In this appendix, we will describe how to troubleshoot common problems in a ThinLinc installation. We will begin by giving a general view of the recommended troubleshooting method, and then continuewith more detailed instructions for troubleshooting specific prob...

Appendix B. Troubleshooting ThinLinc If inspecting /var/log/vsmagent.log on the server that was selected for the session does not reveal the reason for the failure, there is a per-session log in /var/opt/thinlinc/sessions/<username>/last/xinit.log where the output of commands run during sessio...

Appendix C. Manually Configuring Integration with NovelleDirectory In Section 9.3, we explain how to integrate a ThinLinc Cluster with Novell eDirectory using the ThinLincNovell Configurator (TLNC). In this chapter we will explain how to do it manually, without the TLNC. This information is provided...

Appendix C. Manually Configuring Integration with Novell eDirectory • Begin by creating a user in eDirectory at an appropriate place in the tree. This user is a so-called application DN , so if your tree already has a place for similar users, place the user there. In our example, the DN of the user ...

Appendix C. Manually Configuring Integration with Novell eDirectory ACL: 3#subtree#cn=tl-posixsearcher,ou=thinlinc,o=example#UID ACL: 3#subtree#cn=tl-posixsearcher,ou=thinlinc,o=example#gidNumber ACL: 3#subtree#cn=tl-posixsearcher,ou=thinlinc,o=example#homeDirectory ACL: 3#subtree#cn=tl-posixsearche...

Appendix D. Configuring CUPS queues on Windows TerminalServers If your ThinLinc cluster uses a Windows Terminal Server for some applications, printers must be madeavailable on the Windows servers as well. This is normally handled automatically by ThinLinc, seeSection 5.6. In some special cases, it m...

Appendix D. Configuring CUPS queues on Windows Terminal Servers 210