Sun Ray Server Software 4.0 Installation and Configuration Guide for Solaris

This chapter describes how to configure Solaris Trusted Extensions as well as how to configure the Sun Ray server. Procedures in this chapter include:

• Configure a Dedicated Sun Ray Interconnect for Trusted Extensions
• Configure Shared Multilevel Ports (MLP) for Sun Ray Services
• Increase the Number of X Server Ports
• Configure a Dedicated Sun Ray Interconnect Interface
• Configure the Sun Ray Server on a LAN
• Turn the Sun Ray LAN Connection On or Off
• Configure Sun Ray Server Software
• Configure the Sun Ray Server Hierarchy
• Synchronize Primary and Secondary Sun Ray Servers
• Synchronize the Sun Ray DTU Firmware
• Convert and Synchronize the Sun Ray Data Store Port
• Re-enable the Old SunDS Service
• Determine the Integrity of the Configuration Files
• Replace the Xservers and Xconfig Files
• Reboot the Sun Ray Server
• Migrating from Controlled Access Mode (CAM) to Kiosk Mode

For more details on Sun Ray network configuration, see Deployment on Shared Networks of the Sun Ray Server Software 4.0 Administrator’s Guide.

For further instructions on Solaris Trusted extensions, see Appendix A.

---

Configuring SRSS 4.0 on Trusted Extensions

Perform the following procedures as root from ADMIN_LOW (global zone).

• Configure a Dedicated Sun Ray Interconnect for Trusted Extensions
• Configure Shared Multilevel Ports (MLP) for Sun Ray Services
• Increase the Number of X Server Ports
• Reboot the System

Use the Solaris Management Console (SMC) Security Templates to assign the cipso template to the Sun Ray Server. Assign all other Sun Ray devices on the network an admin_low label.

The /etc/security/tsol/tnrhdb file should contain the following entries when you finish:

192.168.128.1:cipso
192.168.128.0:admin_low

1. Start the Solaris Management Console (SMC).

# smc &

2. Make the following selections:

a. In the SMC, select Management Tools
->Select hostname:Scope=Files, Policy=TSOL.

b. Select System Configuration->Computers and Networks
->Security Templates->cipso.

c. From the menu bar, Select Action->Properties->Hosts Assigned to Template.

d. Select Host and enter the IP Address of the Sun Ray interconnect
(for example, 192.168.128.1).

e. Click Add then OK.

f. Select System Configuration->Computers and Networks
->Security Families->admin_low.

g. From the menu bar, Select Action->Properties->Hosts Assigned to Template.

h. Select Wildcard.

i. Enter the IP Address of the Sun Ray Interconnect Network (192.168.128.0).

j. Click Add then OK.

3. Assign all Sun Ray Servers in the failover group a cipso label.

a. Select System Configuration->Computers and Networks
->Security Families->cipso.

b. From the menu bar, Select Action->Properties->Hosts Assigned to Template.

c. Select Host and enter the IP Address of the other Sun Ray Server.

d. Click Add then OK.

In order to have access to certain Sun Ray services from a labeled zone, a shared multilevel port has to be added to the global zone for Sun Ray services.

1. Start the Solaris Management Console (SMC).

# smc &

2. Make the following selections under Management Tools:

a. Select hostname:Scope=Files, Policy=TSOL.

b. Select System Configuration->Computers and Networks
->Trusted Network Zones->global.

c. From the menu bar, Select Action->Properties.

d. Click Add under Multilevel Ports for Shared IP Addresses.

e. Add 7007 as Port Number, Select TCP as Protocol, and click OK.

f. Repeat this step for ports 7010 and 7015.

g. Restart network services by running the following command:

# svcadm restart svc:/network/tnctl

h. Verify that these ports are listed as shared ports by running the following command:

 # /usr/sbin/tninfo -m global

The default entry in /etc/security/tsol/tnzonecfg makes three displays available (6001-6003). Increase the number of available X server ports as required.

1. Start the Solaris Management Console (SMC).

# smc &

2. Make the following selections:

a. In the SMC, Under Management Tools
->Select hostname:Scope=Files, Policy=TSOL option.

b. Select System Configuration->Computers and Networks
->Trusted Network Zones->global.

c. From the menu bar, Select Action->Properties

d. Under Multilevel Ports for Zone’s IP Addresses, select 6000-6003/tcp.

e. Click Remove.

f. Click Add->Enable Specify A Port Range.

g. Enter 6000 in Begin Port Range Number and 6050 (for 50 displays) in End Port Range Number.

h. Select TCP as Protocol.

i. Click OK.

  When you have finished configuring SRSS 4.0 on Trusted Extensions, reboot.

See Reboot the Sun Ray Server for instructions.

---

Configuring the Sun Ray Server

Sun Ray Server Software manipulates the /etc/dt/config/Xservers file. Generally speaking, you should copy /usr/dt/config/Xservers to /etc/dt/config/Xservers.SUNWut.prototype and customize it as needed. Sun Ray Server Software uses the contents of that file as a base configuration when you add Sun Rays DTUs to /etc/dt/config/Xservers.

The Xservers file shipped with dtlogin includes an entry for DISPLAY:0, on the assumption that there is a frame buffer in the system. On a headless Sun Ray server, you need to configure /etc/dt/config/Xservers.SUNWut.prototype so that dtlogin does not try to start an Xsun on DISPLAY:0. For instructions, see /etc/dt/config/README.SUNWut.

1. Log in as the superuser of the Sun Ray server, either locally or remotely.

2. Open a shell window and change to the following directory:

# cd /opt/SUNWut/sbin

3. Configure the Sun Ray interconnect interface:

# ./utadm -a interface-name

where interface-name is the name of the interface to the Sun Ray interconnect, for example: hme1, qfe0, or ge0.

The utadm script begins configuring DHCP for the Sun Ray interconnect, restarts the DHCP daemon, and configures the interface. The script then lists the default values and asks if they are acceptable.

Caution - If the IP addresses and DHCP configuration data are not set up correctly when the interfaces are configured, the failover feature cannot work properly. In particular, configuring the Sun Ray server’s interconnect IP address as a duplicate of any other server’s interconnect IP address may cause the Sun Ray Authentication Manager to generate “Out of Memory” errors.

4. If you are satisfied with the default values, and the server is not part of a failover group, answer y.

5. Otherwise, answer n and accept whatever default values are shown by pressing return or provide the correct values from the worksheet.

The utadm script prompts for the following:

• New host address (192.168.128.1)
• New netmask (255.255.255.0)
• New host name (hostname-interface-name)
• Offer IP addresses for this interface? ([Y]/N)
• New first Sun Ray DTU address (192.168.128.16)
• Total number of Sun Ray DTU address (X)
• New authorization server address (192.168.128.1)
• New firmware server address (192.168.128.1)
• New router address (192.168.128.1)
• To specify an additional server list.
  If you answer yes, it requests either a file name (filename) or a
  Server IP Address (192.168.128.2).

6. The utadm script again lists the configuration values and asks if they are acceptable. Answer appropriately.

• If you answer n, go back to Step 5.
• If you answer y, the following Sun Ray-specific files are configured:


/etc/hostname.interface-name /etc/inet/hosts /etc/inet/netmasks /etc/inet/networks

The utadm script configures the Sun Ray DTU firmware versions and restarts the DHCP daemon.

7. Repeat Step 1 through Step 6 for each of the secondary servers in your failover group.

8. Do one of the following:

• If you upgraded Sun Ray Server Software without upgrading the Solaris operating environment, go to Synchronize the Sun Ray DTU Firmware.
• Otherwise, go to Configuring the Sun Ray Server.

1. Log in as the superuser of the Sun Ray server.

You can log in locally or remotely use the rlogin or telnet commands.

2. Open a shell window and change to the following directory:

# cd /opt/SUNWut/sbin

3. Configure the Sun Ray LAN subnet:

# ./utadm -A subnet#

Where subnet# is the name (really a number) of the subnet, such as 192.168.128.0.

The utadm script begins configuring DHCP for the Sun Ray interconnect, restarts the DHCP daemon, and configures the interface. The script then lists the default values and asks if they are acceptable.

Caution - If the IP addresses and DHCP configuration data are not set up correctly when the interfaces are configured, the failover feature cannot work properly. In particular, configuring the Sun Ray server’s subnet IP address as a duplicate of any other server’s subnet IP address may cause the Sun Ray Authentication Manager to throw “Out of Memory” errors.

4. If you are satisfied with the default values, and the server is not part of a failover group, answer y.

5. Otherwise, answer n and accept whatever default values are shown by pressing return or provide the correct values from the worksheet.

The utadm script prompts for the following:

• New netmask (255.255.255.0)
• New first Sun Ray DTU address (192.168.128.16)
• Total number of Sun Ray DTU addresses
• New authorization server address (192.168.128.1)
• New firmware server address (192.168.128.10)
• New router address (192.168.128.1)
• To specify an additional server list. If you answer yes, it requests either:
• File name (filename)
• Server IP Address (192.168.128.2)

6. The utadm script again lists the configuration values and asks if they are acceptable. Answer appropriately.

• If you answer n, go back to Step 5.
• If you answer y, the utadm script configures the Sun Ray DTU firmware versions and restarts the DHCP daemon.

7. Repeat Step 1 through Step 6 for each of the secondary servers in your failover group. See Configure Sun Ray Server Software.

8. Do one of the following:

• If you upgraded Sun Ray Server Software without upgrading the Solaris operating environment, go to Synchronize the Sun Ray DTU Firmware.
• Otherwise, proceed to Configure Sun Ray Server Software.

9. Proceed to Configure Sun Ray Server Software.

When you configure a Sun Ray server for a shared network, the utadm -A command enables the server’s LAN connection. If you do not use utadm -A, however, and you still wish to enable or disable the LAN connection, use this procedure.

When the LAN connection is turned off, Sun Ray DTUs on the LAN cannot attach to the server.

1. Log in as the superuser of the Sun Ray server, either locally or remotely.

2. Turn the Sun Ray LAN connection on:

# /opt/SUNWut/sbin/utadm -L on

3. Restart services as prompted:

# utrestart

1. If you have not already done so, log in as the superuser of the Sun Ray server.

You can log in locally or remotely use the rlogin or telnet commands.

2. Open a shell window and change to the following directory:

# cd /opt/SUNWut/sbin

3. Configure Sun Ray Server Software.

# ./utconfig

4. Accept the default utconfig values shown by pressing Return or provide the correct values from the worksheet.

The utconfig script prompts for the following:

• Whether the script should continue (press Return)
• Sun Ray administration password (adminpass)
• Sun Ray administration password again

• To configure the Sun Ray Web Administration (Admin GUI), (press Return)
• Path to the Apache Tomcat installation directory (/opt/apache-tomcat)
• Web server port number (1660)
• Whether to enable secure connections ([y]/n)
• If Yes, to enter HTTPS port number (1661)
• To supply a user name for the Tomcat process (utwww)
• Whether you want to enable remote administration ([y]/n)
• Whether you want to configure Kiosk Mode ([y]/n). If yes, it requests:
• User prefix (utku)
• Group (utkiosk)
• User ID range start (150000)
• Number of users (25)

• Whether you want to configure for a failover group
• Whether the script should continue (press Return)

The utconfig script begins configuring Sun Ray Server Software.

• If you responded that this is a failover group, the script requests the signature (signature1)
• The signature again

The Sun Ray Data Store is restarted.

The utconfig script ends, indicating a log file is available at the following location:

• /var/adm/log/utconfig.year_month_date_hour:minute:second.log

where the year, month, etc. are represented by numeric values reflecting the time utconfig was started.

5. Repeat Step 1 through Step 4 for each secondary server if in a failover group.

6. Do one of the following:

• If you have a failover group, see Configure the Sun Ray Server Hierarchy.
• Otherwise, go to Synchronize the Sun Ray DTU Firmware.

Perform this task after all servers in the failover group have been configured.

1. If you have not already done so, log in as the superuser of the primary Sun Ray server.

You can log in locally or remotely use the rlogin or telnet commands.

2. Open a shell window and change to the following directory:

# cd /opt/SUNWut/sbin

3. Configure this server as the primary Sun Ray server and identify all secondary servers.

# ./utreplica -p secondary-server1 secondary-server2 ...

Where secondary-server1, secondary-server2, ... identifies the host names of the secondary servers. Include all secondary servers in this command.

The utreplica script:

• Stops and starts the Sun Ray services
• Reads the Authentication Manager policy
• Indicates a log file is available at the appropriate location:
• /var/adm/log/utreplica.year_month_date_hour:minute:second.log

4. Log in as the superuser of a secondary Sun Ray server.

You can log in locally or remotely using the rlogin or telnet commands.

5. Open a shell window and change to the following directory:

# cd /opt/SUNWut/sbin

6. Configure the server as a secondary Sun Ray server and identify the primary server.

# ./utreplica -s primary-server

Where primary-server is the host name of the primary server configured in Step 3.

7. Repeat Step 4 through Step 6 for all remaining secondary servers.

8. When you are finished, go to Synchronize the Sun Ray DTU Firmware.

Log files for Sun Ray servers contain time-stamped error messages which are difficult to interpret if the time is out of sync. To make troubleshooting easier, please make sure that all secondary servers periodically synchronize with their primary server. For instance:

# rdate <primary-server>

1. If you have not already done so, log in as the superuser of the Sun Ray server.

You can log in locally or remotely using the rlogin or telnet commands.

2. Open a shell window and change to the following directory:

# cd /opt/SUNWut/sbin

3. Synchronize the Sun Ray DTU firmware:

# ./utfwsync

The Sun Ray DTUs will reboot themselves and load the new firmware.

4. When you are finished, go to Reboot the Sun Ray Server for instructions how to reboot the server.

In place of the old Sun Directory Service (Sun DS) used in Sun Ray Server Software versions 1.0 through 1.3, versions 2.0, 3, and later provides a private data store service, the Sun Ray Data Store (SRDS).

SRDS uses service port 7012, to avoid conflict with the standard LDAP port number, 389. When you upgrade a server to SRSS 2.0 or later, the LDAP port remains in use until all the servers in the failover group have been upgraded and converted. Port conversion is required only if you plan to continue to run SunDS on the recently upgraded SRSS server.

1. If you have not already done so, log in as the superuser of the primary Sun Ray server.

You can log in locally or remotely use the rlogin or telnet commands.

2. Open a shell window and change to the following directory:

# cd /opt/SUNWut/sbin

3. Convert and synchronize the Sun Ray Data Store service port number on all the servers in a failover group:

# ./utdssync

This step restarts the Sun Ray Data Store on all the servers.

This procedure re-enables the old SunDS, in case you need to use it for old private data on the Sun Ray servers.

The following task requires you to have completed the utdssync command. See Convert and Synchronize the Sun Ray Data Store Port.

1. If you have not already done so, log in as the superuser of the primary Sun Ray server.

2. Open a shell window and change to the following directory:

# cd /etc/opt/SUNWconn/ldap/current

3. Rename the saved configuration file to dsserv.conf:

# mv dsserv.conf_save_date_time dsserv.conf

where date is the current date, in YYMMDD format, and time is the time the save file is created, in hh:mm format.

4. Start the SunDS service:

 # /etc/init.d/dsserv start

Two configuration files are susceptible to corruption:

• /etc/dt/config/Xservers
• /etc/dt/config/Xconfig

When they are corrupt, the dtlogin daemon cannot start the Xsun server properly. To prevent or correct this problem, use the following procedure.

1. As a user of the Sun Ray server, open a shell window and compare the
/usr/dt/config/Xservers and /etc/dt/config/Xservers files:

% diff /usr/dt/config/Xservers /etc/dt/config/Xservers

This command compares a known good file with the suspect file. The output should be similar to the following example:

106a107,130
> # BEGIN SUNRAY CONFIGURATION
> :3 SunRay local@none /etc/opt/SUNWut/basedir/lib/utxsun :3 -nobanner
    .
    .
> :18 SunRay local@none /etc/opt/SUNWut/basedir/lib/utxsun :18 -nobanner
> # END SUNRAY CONFIGURATION

In the first line of output, there is 106a107,130. The 106 means that the two files are identical to the 106th line of the files. The a107,130 means that the information on lines 107 through 130 of the second file would have to be added to the first file to make it the same as the second.

If your output shows the first three digits to be a number less than 100, the
/etc/dt/config/Xservers file is corrupt.

2. Compare the /usr/dt/config/Xconfig and /etc/dt/config/Xconfig files:

% diff /usr/dt/config/Xconfig /etc/dt/config/Xconfig

The output should be similar to the following example:

156a157,180
> # BEGIN SUNRAY CONFIGURATION
> Dtlogin.*_8.environment: SUN_SUNRAY_TOKEN=ZeroAdmin.m1.at88sc1608.6d0400aa
    .
    .
> Dtlogin.*_9.environment: SUN_SUNRAY_TOKEN=ZeroAdmin.m1.at88sc1608.a10100aa
> # END SUNRAY CONFIGURATION

If your output shows the first three digits to be a number less than 154, the
/etc/dt/config/Xconfig file is corrupt.

Caution - Replacing the Xserversfile requires shutting down all Sun Ray DTU services. Remember to inform users of the outage.

1. As superuser, open a shell window and stop the Sun Ray server:

# /etc/init.d/utsvc stop

2. Replace the Xservers and Xconfig files as appropriate:

# /bin/cp -p /usr/dt/config/Xservers /etc/dt/config/Xservers 
# /bin/cp -p /usr/dt/config/Xconfig /etc/dt/config/Xconfig

3. Re-initialize the authentication policy:

# /opt/SUNWut/sbin/utrestart -c

The extra lines within the previous Xservers and Xconfig files are automatically rebuilt.

After following the configuration procedures, reboot the Sun Ray server(s).

1. If you have not already done so, log in as the superuser of the Sun Ray server.

You can log in locally or remotely use the rlogin or telnet commands.

2. Open a shell window and reboot the Sun Ray server:

# sync;sync;init 6

The Sun Ray server is rebooted.

3. Repeat Step 1 and Step 2 for each Sun Ray server.

---

Migrating from Controlled Access Mode (CAM) to Kiosk Mode

As of the Sun Ray Server Software 4.0 release, CAM has been replaced by Kiosk Mode. To continue using previous CAM configuration with Kiosk Mode, you must migrate all relevant CAM configuration data to its Kiosk Mode equivalent. The utcammigrate(1m) tool creates all the required Kiosk Mode applications and prototypes needed to convert an old CAM configuration to Kiosk Mode.

1. To complete the migration process, execute the following command.

# /opt/SUNWut/sbin/utcammigrate -u

The -u option instructs utcammigrate to upload the relevant Kiosk Mode session configuration and selected applications list to the Sun Ray Data Store. This effectively selects the migrated session for use with all subsequent client connections. If you do not wish to select the session for immediate use, you may omit the -u option from the command above and configure your session manually using the Sun Ray Admin GUI.

2. When Kiosk configuration is complete, perform a cold restart of Sun Ray services.

You can select the server on the Servers tab of the Admin GUI and press the Cold Restart button, or you can execute the following command:

Failover Group Migration

Specifying the -u option to utcammigrate results in the automatic selection of the migrated session. This selection applies to all hosts in a failover group and, as such, it is essential that the migration be completed first before the selection takes place. To ensure that this is the case, execute /opt/SUNWut/sbin/utcammigrate without any options on all hosts but one in a failover group. You may then safely execute /opt/SUNWut/sbin/utcammigrate -u on the last host in the group.

For a more detailed explanation of the migration process, see the utcammigrate(1m) man page.

Sun Ray Server Software 4.0 Installation and Configuration Guide for Solaris

820-0413

Copyright © 2007, Sun Microsystems, Inc. All Rights Reserved.