Sun ONE logo     Previous     Contents     Index     Next     
Sun One Portal Server, Secure Remote Access 6.0 Administration Guide



Chapter 3   Configuring the Netlet


This chapter describes how you can use the Netlet to run applications securely between users' remote desktops and the servers running applications on your intranet. Topics covered include:


Overview of the Netlet

Sun ONE Portal Server users may want to run popular or company-specific applications on their remote desktops in a secure manner. You can provide secure access to these applications by setting up the Sun ONE Portal Server Netlet on your platform.

Netlet enables users to securely run common TCP/IP services over insecure networks such as the internet. You can run TCP/IP applications (such as Telnet and SMTP), HTTP applications, and any fixed port applications.

You can run an application over the Netlet if:

  • It is TCP/IP-based.

  • It uses fixed ports.


    Note You cannot use the Netlet with applications that dynamically allocate ports. The exceptions are Microsoft Exchange (Microsoft Exchange 2000 is not supported) and FTP, for which Netlet supports dynamic port capability.


Components of the Netlet

The various components involved in the working of the Netlet are shown in Figure 3-1.

Figure 3-1    Components of the Netlet


This figure illustrates the various components involved in a Netlet operation. See the description following the figure for a description of all the entities.

Listen Port on localhost

This is the port on the client machine on which the Netlet applet listens. The client machine is the localhost.

Netlet Applet

The Netlet applet is responsible for setting up an encrypted TCP/IP tunnel between the remote client machine and intranet applications such as Telnet, Graphon or Citrix. The applet encrypts the packets and sends them to the gateway, and decrypts the response packets from the gateway and sends them to the local application.

If there are static Netlet links on the Portal desktop, Netlet applet is downloaded automatically when the user logs into the portal. If there are only dynamic links, the applet is downloaded when the user clicks on the link.

See "Types of Rules" for details on static and dynamic rules.

Netlet Rules

A Netlet rule maps an application that needs to run on a client machine to the corresponding destination server. This means that the Netlet operates only on packets sent to ports defined in the Netlet rule. This ensures greater security.

As an administrator, you need to configure certain rules for the functioning of the Netlet. These rules specify various details such as the algorithm to be used, URL to invoke, the applets to be downloaded, the destination port and the destination host. When a user on a client machine makes a request through the Netlet, these rules help determine how the connection has to be established. See "Defining Netlet Rules" for details.

Netlet Provider

This is the UI component of the Netlet. The provider enables users to configure the required applications from the Sun ONE Portal Server desktop. A link is created in the provider, and the user clicks on this to run the required application. Users can also specify the destination host for a dynamic rule in the desktop Netlet provider. See "Defining Netlet Rules".

EProxy

All client requests are routed through the EProxy. EProxy handles only Netlet requests and passes any other request to the RProxy. EProxy parses the Netlet requests and passes them to the Netlet proxy (if it is enabled) or directly to the destination host.

Netlet Proxy (Optional)

The gateway ensures a secure tunnel between the remote client machine and the gateway. Netlet packets are decrypted at the gateway and sent to the destination servers. However, the gateway needs to access all the Netlet target hosts through the firewall between the demilitarized zone (DMZ) and the intranet. This requires opening a large number of ports in the firewall.

Netlet proxy enhances the security between the gateway and the intranet by extending the secure tunnel from the client, through the gateway to the Netlet proxy that resides in the intranet. With the proxy, the Netlet packets are decrypted by the proxy and then sent to the destination server. This reduces the number of ports required to be opened in the firewall.

Netlet proxy is optional and you may choose not to install this proxy during the installation.

Destination Port

This is the port on the destination on which the destination application's server listens.

Netlet Usage Scenario

The following sequence of events are involved in using the Netlet:

  1. The remote user logs in to the Sun ONE Portal Server desktop.

  2. If a static Netlet Rule has been defined for a user, role or organization, the Netlet applet is automatically downloaded to the remote client.

    If a dynamic rule has been defined for a user, role or organization, the user needs to configure the required application in the Netlet Provider. The Netlet applet is downloaded when the user clicks on the application link in the Netlet Provider. See "Defining Netlet Rules" for details on static and dynamic rules.

  3. Netlet listens on the client ports defined in the Netlet rules. See Client Port under Netlet Rule Syntax.

  4. Netlet sets up a channel between the remote client and server over the ports specified in the Netlet rule.

Working With Netlet

For the Netlet to work as required for various users across different organizations, you need to do the following:

  1. Determine whether you need to create static or dynamic rules based on the user requirements. See "Types of Rules".

  2. Define the global options in the Netlet template in the Service Management view on the iPlanet Directory Server Access Management Edition admin console.

  3. Assign the permission to execute Netlet in the Policy Management view on the Administration Console.

  4. Determine whether the rules should be organization, role, or user-based and make modifications as required at each level. See the Sun ONE Portal Server Administrator's Guide for details on organization, role and user.


Defining Netlet Rules

Netlet configuration is defined through Netlet rules that are configured in the iPlanet Directory Server Access Management Edition admin console. Netlet rules can be configured for organizations, roles, or users. If the Netlet rule is for a role or user, select the desired role or user after selecting the organization.

Netlet Rule Syntax

Netlet rules consist of the following fields:

Table 3-1 lists the fields in the Netlet rule. Table 3-1 has three columns. The first column lists the field name. The second column describes the field, and its function in the Netlet rule. The third column lists possible values for that particular field.


Table 3-1    Fields in a Netlet Rule

Parameter

Description

Value

Rule Name  

Designates a name for this Netlet rule. You need to specify a unique name for each rule. This is useful while defining user access to specific rules. See "Defining Access to Netlet Rules" for details.  

 

Encryption Algorithms  

Defines the encryption algorithm, or specifies the list of algorithms that the user can choose from.  

The list of algorithms that you select appear in the Netlet provider as a drop-down list. The user can choose the required algorithm. If you select only one from the list, the algorithm is fixed, and the user does not have the option to choose the algorithm.

Select "Null" only if you want a significant performance enhancement, and if you are sure that the users are browsing in a safe environment.

Default - The Default Encryption Algorithm specified in the Netlet admin console is used.  

URL  

Specifies the URL that the browser opens when the user clicks the associated link in the Netlet provider. The browser opens the window for the application and connects to localhost at the local port number specified later in the rule.

You need to specify a relative URL.  

URL to the application invoked by the Netlet rule. For example, telnet://localhost:30000.

null - Value that you set if the application is not started by a URL or controlled by the desktop. This is normally true for non-web-based applications.  

Download Applet  

Indicates whether it is necessary to download an applet for this rule.  

Disabled - Do not download an applet.

Enabled - Download the applet from the Sun ONE Portal Server machine using the loopback port.

Specify the applet details in the format clientport:server:serverport where:

  • clientport indicates the destination port on the client. This port must be different from the default loopback port. Assigning the Default Loopback Port for details. Specify a unique client port for each rule.

  • server is the name of the server from which to download the applet.

  • serverport represents the port on the server used to download the applet.

If true, and if the applet location is not specified, the applet is downloaded from the Sun ONE Portal Server server.  

Extend Session  

Indicates that the Sun ONE Portal Server should not time out when the Netlet connection is active.  

Enabled - Extend the Portal Server session if Netlet connection is active.

Disabled - Do not extend the Portal Server session even if Netlet connection is active.  

Client Port  

Port on the client where the Netlet listens.  

The value of client port must be unique. You cannot specify a particular port number in more than one rule.

Specify multiple client ports if you are specifying multiple hosts for multiple connections. See "Static Rule With Multiple Host Connections" for the syntax.  

Target Host(s)  

Recipient of the Netlet connection.  

host - Name of the host to receive the Netlet connection. This is used in a static rule. Use either the simple host name such as siroe, or a fully-qualified DNS-style host name such as siroe.mycompany.com. You can specify multiple hosts to:

TARGET - Rules that specify TARGET in the syntax are dynamic rules. TARGET indicates that end users can specify the required destination host or hosts in the Netlet provider of desktop.

You cannot have a combination of a static host and TARGET in a single rule.  

Target Port(s)  

The port on the target host  

In addition to the host and target, you must specify a destination port.

You can specify multiple destination ports in case of multiple destination hosts. Specify multiple ports in the format port1+port2+port3-port4+port5.

The plus (+) sign between ports numbers indicates the alternative ports for a single target host.

The minus (-) sign between port numbers is the separator between the port numbers for different target hosts.

Here, Netlet tries to connect to the first destination host specified using port1, port2 and port3 in order. If this fails, Netlet tries to connect to the second host using port4 and port5 in that order.

You can configure multiple ports only for static rules.  

Types of Rules

There are two types of Netlet rules based on how the destination host is specified in the rule.

Static Rule

A static rule specifies a destination host as a part of the rule. If you create a static rule, the user does not have the option to specify the required destination host. In the following example, sesta is the destination host. See "Netlet Rule Syntax" for the syntax of the rules.




Rule Name

Encryption Algorithm

URL

Download Applet

Extend Session

Client Port

Target Host(s)

Target Port(s)

ftpstatic  

RC4  

null  

false  

true  

30021  

sesta  

21  

You can configure multiple target hosts and ports for static rules. See Static Rule With Multiple Host Connections for an example.

Dynamic Rule

In a dynamic rule, the destination host is not specified as a part of the rule. The user can specify the required destination host in the Netlet Provider. In the following example, TARGET is the placeholder for the destination host. See "Netlet Rule Syntax" for the syntax of the rules.




Rule Name

Encryption Algorithm

URL

Download Applet

Extend Session

Client Port

Target Host(s)

Target Port(s)

ftpdynamic  

RC4  

null  

false  

true  

30021  

TARGET  

21  

Encryption Algorithm

Based on the encryption algorithm, Netlet rules can be further classified as follows:

  • User Configurable Algorithm Rules - In this rule, you can specify a list of algorithms that users can choose from. These optional algorithms appear as a drop-down list in the Netlet provider. The user can choose the required algorithm from the list. In the following example, the user can choose from DES and RC4 algorithms.




    Rule Name

    Encryption Algorithm

    URL

    Download Applet

    Extend Session

    Client Port

    Target Host(s)

    Target Port(s)

    Telnet  

    DES  

    null  

    false  

    true  

    30000  

    TARGET  

    23  

     

    RC4  

     

     

     

     

     

     


    Note Although the Sun ONE Portal Server server may have various algorithms enabled, the user can choose only from the list that is configured as part of the Netlet rule.


See Supported Algorithms for a list of the algorithms supported by the Netlet, and the corresponding keywords.

  • Administrator Configured Algorithm Rules - In this rule, the algorithm is defined as part of the Netlet rule. The user does not have the option to choose the required algorithm. In the following example, the algorithm is configured to be RC4.




    Rule Name

    Encryption Algorithm

    URL

    Download Applet

    Extend Session

    Client Port

    Target Host(s)

    Target Port(s)

    Telnet  

    RC4  

    null  

    false  

    true  

    30000  

    TARGET  

    23  

See Supported Algorithms for a list of algorithms supported by the Netlet, and the corresponding keywords.

Supported Algorithms

Table 3-2 lists the algorithms supported by the Netlet in the first column, and the keyword used to associate an algorithm in the second column. Use the corresponding keywords to specify the algorithms in the Netlet rules.


Note Select "Null" only if you want a significant performance enhancement, and if you are sure that the gateway and Portal Server are running in a secure environment.



Table 3-2    List of Supported Algorithms

Algorithm Name

Keyword

Rivest Cipher #4  

RC4  

Data Encryption Standard  

DES  

Triple DES/DESede  

TripleDES  

AES/Rijndael  

Rijndael  

No Encryption/Null Cipher  

Null  

Backward Compatibility

Earlier versions of the Sun ONE Portal Server did not support algorithms as part of the Netlet rules. For backward compatibility with existing rules without algorithms, a default algorithm is used by the rules. An existing rule without algorithms such as:




Rule Name

Encryption Algorithm

URL

Download Applet

Extend Session

Client Port

Target Host(s)

Target Port(s)

Telnet  

 

telnet://localhost:30000  

false  

true  

30000  

TARGET  

23  

is interpreted as:




Rule Name

Encryption Algorithm

URL

Download Applet

Extend Session

Client Port

Target Host(s)

Target Port(s)

Telnet  

Default Algorithm  

telnet://localhost:30000  

false  

true  

30000  

TARGET  

23  

This is similar to an Administrator Configured Rule with the Encryption Algorithm field chosen as Default. See "Specifying the Default Encryption Algorithm" for details.

Default Ports for Applications

Table 3-3 identifies the reserved ports for various applications and services. The first column lists the application name, and the second column lists the specific reserved port.


Table 3-3    Default Listen Ports for Certain Applications 

Predefined Netlet Rule

Reserved Port

Telnet  

30000  

GO-Joe  

10491  

Citrix  

1494  

pcANYWHERE  

4631, 5632  

CarbonCopy  

1138  

LapLink  

51547  

RapidRemote  

45414  

ReachOut  

43188  

RemotelyPossible  

799  

loopback*  

8000  

FTP  

30021  

* loopback is used internally by the system.


Note Netlet rules cannot contain any port number higher than 64000.


Netlet Rule Examples

This section contains some examples of Netlet rules to illustrate how the Netlet syntax works.

Basic Static Rule

This rule supports a Telnet connection from the client to the machine sesta.




Rule Name

Encryption Algorithm

URL

Download Applet

Extend Session

Client Port

Target Host(s)

Target Port(s)

myrule  

RC4  

null  

false  

true  

1111  

sesta  

23  

where:

  • myrule is the name of the rule.

  • RC4 indicates the algorithm to be used.

  • null indicates that this application is not invoked by a URL or run through the desktop.

  • false indicates that the client does not download an applet to run this application.

  • Indicates that the Sun ONE Portal Server should not time out when the Netlet connection is active.

  • 1111 is the port on the client where the Netlet listens for a connection request from the target host.

  • sesta is the name of the recipient host in the Telnet connection.

  • 23 is the port number on the target host for the connection, in this case the well-known port for Telnet.

Description
The desktop Netlet provider does not display a link, but Netlet automatically starts and listens on the port specified (1111). Instruct the user to start the client software - in this case a Telnet session that connects to localhost on port 1111.

For example, to start the Telnet session, the client needs to type the following on the UNIX command line in a terminal:

% telnet localhost 1111

Static Rule With Multiple Host Connections

This rule supports a Telnet connection from the client to two machines, sesta and siroe.




Rule Name

Encryption Algorithm

URL

Download Applet

Extend Session

Client Port

Target Host(s)

Target Port(s)

myrule  

RC4  

null  

false  

true  

1111  

sesta  

23  

 

 

 

 

 

1234  

siroe  

23  

where:

  • 23 is the port number on the target host for the connection - reserved port for Telnet.

  • 1111 is the port on the client where the Netlet listens for a connection request from the first target host sesta.

  • 1234 is the port on the client where the Netlet listens for a connection request from the second target host siroe.

The first six fields in this rule are the same as in Basic Static Rule. The difference is that three more fields identify the second target host.

When you add additional targets to a rule, you must add three fields, client port, target host, and target port, for each new target host.


Note You can have multiple sets of three fields describing the connection to each target host. Listen port numbers which are less than 2048 must not be used if the remote client is UNIX-based because low numbered ports are restricted and you must be root to start a listener.


Description
This rule works the same as the previous rule. The Netlet provider does not display any link, but the Netlet automatically starts and listens on the two ports specified (1234). The user needs to start the client software, in this case a Telnet session that connects to localhost on port 1111 or the local host on port 1234 to connect to host example2.

Static Rule with Multiple Host Selection

Use this rule to specify multiple alternative hosts. If connection to the first host in the rule fails, Netlet tries to connect to the second host specified and so on.




Rule Name

Encryption Algorithm

URL

Download Applet

Extend Session

Client Port

Target Host(s)

Target Port(s)

gojoe  

RC4  

/gojoe.html  

8000:gojoeserver:8080  

true  

10491  

siroe+sesta  

35+26+491-35+491  

where:

  • 10491 is the port on the client where the Netlet listens for a connection request from the target host.

  • Netlet tries to establish connection with siroe on port 35, port 26 and port 491 in the same order, depending on which one is available.

  • If connections to siroe are not possible, Netlet tries to connect to sesta on port 35 and 491 in the same order.

    • The plus (+) sign between hosts indicates alternative hosts.

    • The plus (+) sign between ports numbers indicates the alternative ports for a single target host.

    • The minus (-) sign between port numbers is the separator between the port numbers for different target hosts.

Dynamic Rule to Invoke a URL

This rule enables a user to configure the destination host required, enabling the user to telnet to various hosts over the Netlet.




Rule Name

Encryption Algorithm

URL

Download Applet

Extend Session

Client Port

Target Host(s)

Target Port(s)

myrule  

RC4  

telnet://localhost:30000  

false  

true  

30000  

TARGET  

23  

where:

  • myrule is the name of the rule.

  • RC4 indicates the algorithm to be used.

  • telnet://localhost:30000 is the URL invoked by the rule.

  • false indicates that no applets are to be downloaded.

  • Indicates that the Sun ONE Portal Server should not time out when the Netlet connection is active.

  • 30000 is the port on the client where the Netlet will listen for connection requests for this rule.

  • TARGET indicates that the destination server needs to be configured by the user using the Netlet provider.

  • 23 is the port on the target host opened by the Netlet, in this case the well-known port for Telnet.

Description
After this rule is added, the user must complete some steps to get the Netlet running as expected. The user needs to do the following on the client side:

  1. Click Edit in the Netlet provider section of the Sun ONE Portal Server desktop.

    The new Netlet rule is listed under Rule Name in the Add New Target section.

  2. Choose the rule name and type the name of the target host.

  3. Save the changes.

    The user returns to the Desktop with the new link visible in the Netlet provider section.

  4. Click the new link.

    A new browser is launched that goes to the URL given in the Netlet rule.


    Note You can add more than one target host for the same rule by repeating these steps.


Dynamic Rule to Download an Applet

This rule defines a GO-Joe connection from the client to hosts that are dynamically allocated. The rule downloads a GO-Joe applet from the server on which the applet is located, to the client.




Rule Name

Encryption Algorithm

URL

Downlaod Applet

Extend Session

Client Port

Target Host(s)

Target Port(s)

gojoe  

RC4  

/gojoe.html  

8000:gojoeserve:8080  

true  

3399  

TARGET  

58  

where:

  • gojoe is the name of the rule.

  • RC4 indicates the algorithm to be used.

  • /gojoe.html is the path of the HTML page containing the applet, relative to the iPS installation directory InstallDir/SUNWps/public_html (in a default installation).

  • 8000:server:8080 indicates that port 8000 is the destination port on the client to receive the applet, gojoeserve is the name of the server providing the applet, and 8080 is the port on the server from which the applet is downloaded.

  • Indicates that the Sun ONE Portal Server should not time out when the Netlet connection is active.

  • 3399 is the port on the client where the Netlet listens for connection requests of this type.

  • TARGET indicates that the destination server needs to be configured by the user using the Netlet provider.

  • 58 is the port on the destination server opened by the Netlet, in this case the port for GoJoe. Port 58 is the port that the target host listens to for its own traffic. The Netlet passes information to this port from the new applet.

Creating a Netlet Rule

You can create Netlet rules at a global level in the Service Management view of the iPlanet Directory Server Access Management Edition admin console. These rules are inherited by any new organization that you create.

You can also create new rules or modify existing rules at the organization, role, or user levels.


Note This chapter lists the procedures to configure various aspects of the Netlet at the organization level.


To Create a Netlet Rule

  1. Log in to the iPlanet Directory Server Access Management Edition admin console as administrator.

  2. Choose the User Management view.

  3. Choose the Organization for which you want to create the rule.

  4. Click the arrow next to Netlet under SRAP Configuration in the left pane.

    The Netlet page is displayed in the right pane.

  5. Click Add in the Netlet Rules field.

    The Add Netlet Rule page is displayed. All the fields of the rule are populated with sample values that you can change as required.

  6. Type a unique name for the rule in the Rule Name field.

  7. Specify the required Encryption Algorithms. Select Default to retain the default encryption algorithm. Select Other to choose from the list of available algorithms.

    See To Specify the Default Algorithm for details on the default algorithm.


    Note Select "Null" only if you want a significant performance enhancement, and if you are sure that the users are browsing in a safe environment.


  8. Type the URL to the application to be invoked in the URL field.

  9. Select the Download Applet checkbox if an applet needs to be downloaded. Type the applet details in the format client port:server host:server port in the associated edit box.


    Note Specify a unique client port for each rule.


    You need to specify the applet details only if the applet needs to be downloaded from a host other than the Portal Server host. The edit box is disabled if you do not select the checkbox.

  10. Select the Extend Session checkbox to ensure that the Portal Server session time is extended while the Netlet session corresponding to this rule is running.

  11. Type the client port on which Netlet listens in the Client Port field.

  12. Type the host that will receive the Netlet connection in the Target Host(s) field.

  13. Type the port on the target host in the target Port(s) field.

  14. Click Add to List to reflect the last three entries in the Port-Host-Port List field.

  15. Click Save.

    The rule is saved and you are returned to the Netlet page. The new rule name appears in the Netlet Rules list.

Modifying an Existing Netlet Rule

You can modify Netlet rules at a global level in the Service Management view of the Administration Console. These rules are inherited by any new organization that you create.

You can also modify existing rules at the organization, role, or user levels.

To Modify a Netlet Rule

  1. Log in to the iPlanet Directory Server Access Management Edition admin console as administrator.

  2. Choose the User Management view.

  3. Choose the Organization for which you want to modify the rule.

  4. Click the arrow next to Netlet under SRAP Configuration in the left pane.

    The Netlet page is displayed in the right pane.

  5. Click Edit... next to the rule that you want to modify under the Netlet Rules field.

    The Edit Netlet Rule page is displayed.

  6. Make changes as required and click Save.

    The modified rule is saved and you are returned to the Netlet page.

Deleting a Netlet Rule

You can delete Netlet rules at a global level in the Service Management view of the Administration Console.

To Delete a Netlet Rule

  1. Log in to the iPlanet Directory Server Access Management Edition admin console as administrator.

  2. Choose the User Management view.

  3. Choose the Organization for which you want to delete the rule.

  4. Click the arrow next to Netlet under SRAP Configuration in the left pane.

    The Netlet page is displayed in the right pane.

  5. Select the checkbox next to the rule that you want to delete from the Netlet Rules list.

  6. Click Delete.

    The selected rule is removed from the Netlet Rules list.


Configuring Netlet Attributes

Other than the Netlet rules, you need to configure the following attributes of Netlet based on your site's requirements. These attributes can be configured at the organization or user levels.


Note This chapter describes the configuration of all the attributes at the organization level.


When you create a new user, you need to select the Netlet checkbox in the Create User procedure. This will make the Netlet application available to the new user.

You can carry out the following configurations in the Netlet service:

Netlet Attributes at the Service Management Level

The attributes at the Service Management level serve as a template. Any new organization or user that is created inherits these values by default. You can make changes to the attribute values at the Service Management level. The new values are reflected only when new organizations are added. Changes in the attribute values at the service management level do not affect existing organizations or users.

Netlet Attributes at the Organization Level

If you configure an attribute at the organization level, the attribute becomes available to all the users under that organization.

Netlet Attributes at the User Level

If you configure an attribute at the user level, the attribute value is valid only for that particular user.

All the attributes that can be configured at the organization level can also be configured at the user level. The values set at the user level override the values set at the organization level. See the Administration Guide, iPlanet Directory Server Access Management Edition for more information on organization, role and user level attributes.

In addition, some extra attributes can be configured at the user level. If you do not specify these values in the admin console, the user will be asked for this information when a connection is being established through Netlet for the first time. The user will be asked for this information if:

  • The user has Internet Explorer 4.x, 5.x or 6.x with Java plug-in (version 1.3.1._01 or 1.3.1_02), has enabled the "Use Browser Settings" option in the Proxies tab of the Java Plug-in Control Panel, and has specified a PAC or INS file in the "Use automatic configuration script" field in the Local Area Network Settings dialog of Internet Explorer.

  • The user has Netscape 6.2 with Java plug-in (version 1.3.1._01 or 1.3.1_02) and has enabled the "Use Browser Settings" option in the Proxies tab of the Java Plug-in Control Panel. Any proxy setting specified by the user is not considered.

In both these cases, Netlet may not be able to determine the browser settings, and hence the user is asked to supply the information.

Browser proxy type

This attribute can take the values DIRECT or MANUAL. If you choose DIRECT from the drop-down list, Netlet connects directly to the gateway host.

Browser proxy host

Specify the required proxy host through which Netlet needs to connect.

Browser proxy port

Specify the port on the proxy host through which Netlet needs to connect.

Browser proxy override list (Comma separated)

Specify the hosts for which you do not want Netlet to connect through the proxy. This list can contain multiple comma-separated hostnames.

Netlet Password

If you have enabled reauthentication in the admin console, the Netlet Authentication dialog appears each time the user connects to an application through Netlet. The user needs to supply the Netlet password. If reauthentication is not enabled in the admin console, the user will not have the option to change the password.


Note By default, the Netlet authentication password is srap-netlet.


You can change this authentication password for the user in this field. The user can also change this password using the Edit button on the Netlet channel.

If you have not enabled reauthentication, a port warning dialog appears on the user desktop stating the port through which Netlet is trying to establish connection. The Netlet Authentication dialog does not appear.


Note The port warning dialog also may not appear if you have disabled the option in the Netlet administration console.


To Configure Netlet Attributes at the User Level

  1. Log in to the iPlanet Directory Server Access Management Edition admin console as administrator.

  2. Select the User Management view.

  3. Select Organizations from the Show drop-down list.

  4. Click the required organization name. The selected organization name is reflected as the location in the top left corner of the Administration Console.

  5. Select Users from the Show drop-down list for the selected organization.

  6. Click the arrow next to the required user in the left pane.

    The username page appears in the right pane.

  7. Scroll down to the Netlet section and click Edit.

    The Netlet attributes page appears.

  8. Make changes to the attribute values as required.

    See the procedure for the respective configuration.

  9. Click Save at the top or bottom of the Netlet page to record the change.

Setting the Conflict Resolution Level

You can set the priority level for all the Netlet attributes. If a user inherits multiple attribute templates, say from an organization and a role assignment, and there is a template conflict between the attributes in the two templates, the template with the highest priority is returned. There are seven settings available ranging from Highest to Lowest.

See the Administration Guide, iPlanet Directory Server Access Management Edition for more details on conflict resolution.

To Set the Conflict Resolution Level

  1. Log in to the iPlanet Directory Server Access Management Edition admin console as administrator.

  2. Select the User Management view.

  3. Select Organizations from the Show drop-down list.

  4. Click the required organization name. The selected organization name is reflected as the location in the top left corner of the Administration Console.

  5. Select Services in the Show drop-down list.

  6. Click the arrow next to Netlet under SRAP Configuration.

    The Netlet page is displayed in the right pane.

  7. Scroll down to the Conflict Resolution Level field, and select the required level from the drop-down list.

  8. Click Save at the top or bottom of the Netlet page to record the change.

Specifying the Default Encryption Algorithm

You need to specify the default algorithm for the Netlet rules. This is useful when using existing rules that did not include the algorithm as a part of the rule. This is a mandatory field. See "Backward Compatibility".

To Specify the Default Algorithm

  1. Log in to the iPlanet Directory Server Access Management Edition admin console as administrator.

  2. Select the User Management view.

  3. Select Organizations from the Show drop-down list.

  4. Click the required organization name. The selected organization name is reflected as the location in the top left corner of the Administration Console.

  5. Select Services from the Show drop-down list for the selected organization.

  6. Click the arrow next to Netlet in the left pane.

    The Netlet page appears in the right pane.

  7. Scroll down to the Default Encryption Algorithm field and select the required algorithm from the drop-down list. See Supported Algorithms for a list of supported algorithms.


    Note Select "Null" only if you want a significant performance enhancement, and if you are sure that the users are browsing in a safe environment.


  8. Click Save at the top or bottom of the Netlet page to record the change.

Specifying the Key Size for Algorithms

You can specify the key size to be associated with each algorithm in the Key Size Specification field. A larger key size ensures greater security, but the performance is affected. The following table lists the recommended key sizes for various algorithms. The table has two columns. The first column lists the algorithm name, and the second column lists the recommended key size.




Algorithm

Recommended Key Size

TripleDES  

192  

Rjindael  

128 or 192 or 256  

RC4  

128  

DES  

64  

To Specify the Key Size for the Algorithms

  1. Log in to the iPlanet Directory Server Access Management Edition admin console as administrator.

  2. Select the User Management view.

  3. Select Organizations from the Show drop-down list.

  4. Click the required organization name. The selected organization name is reflected as the location in the top left corner of the Administration Console.

  5. Select Services from the Show drop-down list for the selected organization.

  6. Click the arrow next to Netlet in the left pane.

    The Netlet page appears in the right pane.

  7. Scroll down to the Key Size Specification field.

  8. Type the required algorithm name and the key size in the format keyname|keysize and click Add.

    The keyname-keysize value is updated in the Key Size Specification list box.

  9. Click Save at the top or bottom of the Netlet page to record the change.

Assigning the Default Loopback Port

This attribute specifies the port to be used on the client when applets are downloaded through the Netlet. The default value of 8000 is used unless it is overridden in the Netlet rules.

To Assign the Default Loopback Port

  1. Log in to the iPlanet Directory Server Access Management Edition admin console as administrator.

  2. Select the User Management view.

  3. Select Organizations from the Show drop-down list.

  4. Click the required organization name. The selected organization name is reflected as the location in the top left corner of the Administration Console.

  5. Select Services from the Show drop-down list for the selected organization.

  6. Click the arrow next to Netlet in the left pane.

    The Netlet page appears in the right pane.

  7. Scroll down to the Default Loopback Port field and type the desired port number.

  8. Click Save at the top or bottom of the Netlet page to record the change.

Enabling Reauthentication for Connections

Enable this option if you want the user to enter the Netlet password each time a Netlet connection needs to be established. If you enable this option, the warning popup for connections is not displayed on the user's desktop. See Disabling Warning Popup for Connections for details.

Enabling this option allows the user to change the reauthentication password using the Netlet channel edit option. The initial password is srap-netlet by default.

To Enable Reauthentication for Connections

  1. Log in to the iPlanet Directory Server Access Management Edition admin console as administrator.

  2. Select the User Management view.

  3. Select Organizations from the Show drop-down list.

  4. Click the required organization name. The selected organization name is reflected as the location in the top left corner of the Administration Console.

  5. Select Services from the Show drop-down list for the selected organization.

  6. Click the arrow next to Netlet in the left pane.

    The Netlet page appears in the right pane.

  7. Scroll down to the Reauthentication for connections field and select the option.

  8. Click Save at the top or bottom of the Netlet page to record the change.

Disabling Warning Popup for Connections

This attribute displays a message on the user's desktop warning that someone is trying to connect to Netlet through the listen port. The message appears when the user runs the application over the Netlet, and also when an intruder tries to gain access to the desktop through the listen port.

If you do not want the popup to appear on the user's desktop, deselect this attribute.

To Enable the Warning Popup for Connections

  1. Log in to the iPlanet Directory Server Access Management Edition admin console as administrator.

  2. Select the User Management view.

  3. Select Organizations from the Show drop-down list.

  4. Click the required organization name. The selected organization name is reflected as the "location" in the top left corner of the Administration Console.

  5. Select Services from the Show drop-down list for the selected organization.

  6. Click the arrow next to Netlet in the left pane.

    The Netlet page appears in the right pane.

  7. Select the Warning Popup for Connections checkbox to enable the warning popup.

  8. Click Save at the top or bottom of the Netlet page to record the change.

Enabling the Show Checkbox in Port Warning Dialog

A warning popup is displayed on the user's desktop when Netlet tries to connect to the destination host through a freely available port on the local machine. This warning popup appears on the user's desktop only if the Warning Popup for Connections option is enabled in the admin console.

You can allow the user to suppress this warning popup by enabling the Show Checkbox in Port Warning Dialog option in the administration console.

To Allow the User to Suppress the Port Warning Dialog

  1. Log in to the iPlanet Directory Server Access Management Edition admin console as administrator.

  2. Select the User Management view.

  3. Select Organizations from the Show drop-down list.

  4. Click the required organization name. The selected organization name is reflected as the location in the top left corner of the Administration Console.

  5. Select Services from the Show drop-down list for the selected organization.

  6. Click the arrow next to Netlet in the left pane.

    The Netlet page appears in the right pane.

  7. Scroll down to the Show checkbox in port warning dialog field and select the option.

  8. Click Save at the top or bottom of the Netlet page to record the change.

Setting the Keep Alive Interval

You can set the time interval in minutes for which a Netlet connection is kept alive even if there is no operation.

If you do not specify a value for this attribute, the idle Netlet connection times out with all other Portal Server idle connections per the "Max idle time (minutes)" value specified in the Session Attributes section of the DSAME Configuration.

To Set the Keep Alive Interval

  1. Log in to the iPlanet Directory Server Access Management Edition admin console as administrator.

  2. Select the User Management view.

  3. Select Organizations from the Show drop-down list.

  4. Click the required organization name. The selected organization name is reflected as the location in the top left corner of the Administration Console.

  5. Select Services from the Show drop-down list for the selected organization.

  6. Click the arrow next to Netlet in the left pane.

    The Netlet page appears in the right pane.

  7. Scroll down to the Keep Alive Interval (in minutes) field, and type the required time interval.

  8. Click Save at the top or bottom of the Netlet page to record the change.

Setting the Terminate Netlet at Portal Logout Option

Enable this option if you want to ensure that all connections are terminated when a user logs out of Sun ONE Portal Server. This ensures greater security. This option is enabled by default.

Disable this option to ensure that live Netlet connections are operational even after the user has logged out of the Sun ONE Portal Server desktop.


Note Disabling this option does not allow the user to make new Netlet connections after logging out of Portal Server. Only existing connections are preserved.


To Set the Terminate Netlet at Portal Logout Option

  1. Log in to the iPlanet Directory Server Access Management Edition admin console as administrator.

  2. Select the User Management view.

  3. Select Organizations from the Show drop-down list.

  4. Click the required organization name. The selected organization name is reflected as the location in the top left corner of the Administration Console.

  5. Select Services from the Show drop-down list for the selected organization.

  6. Click the arrow next to Netlet in the left pane.

    The Netlet page appears in the right pane.

  7. Scroll down to the Terminate Netlet at Portal Logout field and select or deselect the option as required.

  8. Click Save at the top or bottom of the Netlet page to record the change.

Defining Access to Netlet Rules

You can define access to specific Netlet rules for certain organizations, roles or users.

To Define Access to Netlet Rules

  1. Log in to the iPlanet Directory Server Access Management Edition admin console as administrator.

  2. Select the User Management view.

  3. Select Organizations from the Show drop-down list.

  4. Click the required organization name. The selected organization name is reflected as the location in the top left corner of the Administration Console.

  5. Select Services from the Show drop-down list for the selected organization.

  6. Click the arrow next to Netlet in the left pane.

    The Netlet page appears in the right pane.

  7. Scroll down to the Access to Netlet Rules field.

  8. Type the name of the rule that you want to make available for the selected organization in the Access to Netlet Rules field.

    An asterisk (*) in this field indicates that all the defined Netlet rules are available for the selected organization.

  9. Click Add.

    The specified rule is added to the Access to Netlet Rules list.

  10. Repeat steps 7, 8 and 9 for each Netlet rule that you want to make available.

  11. Click Save at the top or bottom of the Netlet page to record the change.

Denying Access to Netlet Rules

You can deny access to specific Netlet rules for certain organizations, roles or users.

To Deny Access to Netlet Rules

  1. Log in to the iPlanet Directory Server Access Management Edition admin console as administrator.

  2. Select the User Management view.

  3. Select Organizations from the Show drop-down list.

  4. Click the required organization name. The selected organization name is reflected as the location in the top left corner of the Administration Console.

  5. Select Services from the Show drop-down list for the selected organization.

  6. Click the arrow next to Netlet in the left pane.

    The Netlet page appears in the right pane.

  7. Scroll down to the Deny Netlet Rules field.

  8. Type the name of the rule to which you want to deny access for the selected organization in the Deny Netlet Rules field.

    An asterisk (*) in this field indicates that all the defined Netlet rules are denied access for the selected organization.

  9. Click Add.

    The specified rule is added to the Deny Netlet Rules list.

  10. Repeat steps 7, 8 and 9 for each Netlet rule for which you want to deny access.

  11. Click Save at the top or bottom of the Netlet page to record the change.

Allowing Access to Hosts

You can define access to specific hosts for certain organizations, roles or users. This enables you to restrict access to certain hosts. For example, you can set up the Allow list with five hosts to which the user can telnet.

To Allow Access to Hosts

  1. Log in to the iPlanet Directory Server Access Management Edition admin console as administrator.

  2. Select the User Management view.

  3. Select Organizations from the Show drop-down list.

  4. Click the required organization name. The selected organization name is reflected as the location in the top left corner of the Administration Console.

  5. Select Services from the Show drop-down list for the selected organization.

  6. Click the arrow next to Netlet in the left pane.

    The Netlet page appears in the right pane.

  7. Scroll down to the Allowed Hosts field.

  8. Type the name of the host for which you want to allow access in the Allow Hosts field.

    An asterisk (*) in this field indicates that all the hosts in the specified domain are accessible. For example, if you specify *.sesta.com, all the Netlet targets within the sesta.com domain can be executed by the user. You can also specify a wild card IP address such as xxx.xxx.xxx.*.

  9. Click Add.

    The specified host is added to the Allowed Hosts list.

  10. Repeat steps 7 and 8 for each host that you want to make available.

  11. Click Save at the top or bottom of the Netlet page to record the change.

Denying Access to Hosts

You can deny access to specific hosts within an organization. Specify the host for which you want to deny access in the Denied Hosts list.


Note If you have configured a static rule for a particular host, say sesta, and have also included sesta in the Denied Hosts list, the host sesta will not be denied access.


To Deny Access to Hosts

  1. Log in to the iPlanet Directory Server Access Management Edition admin console as administrator.

  2. Select the User Management view.

  3. Select Organizations from the Show drop-down list.

  4. Click the required organization name. The selected organization name is reflected as the location in the top left corner of the Administration Console.

  5. Select Services from the Show drop-down list for the selected organization.

  6. Click the arrow next to Netlet in the left pane.

    The Netlet page appears in the right pane.

  7. Scroll down to the Denied Hosts field.

  8. Type the name of the host for which you want to deny access in the Denied Hosts field.

    An asterisk (*) in this field indicates that the user is denied access to all the hosts within the selected organization. For example, to deny access to all the hosts in the organization sesta, type *.sesta.com in the Denied Hosts field.

    To deny access to a specific host, specify the fully qualified name. For example, to deny access to a host abc, type abc.sesta.com.

  9. Click Add.

    The specified domain is added to the Access to Domains list.

  10. Repeat steps 7 and 8 for each domain that you want to make available.

  11. Click Save at the top or bottom of the Netlet page to record the change.


Configuring the Netlet Proxy

Netlet proxy is useful for the following reasons:

  • To add an additional layer of security.

  • To minimize the use of extra IP addresses and ports from the gateway through an internal firewall in a significantly sized deployment environment.

  • To restrict the number of open ports between the gateway and the Sun ONE Portal Server server to 1. This port number can be configured during installation.

  • To extend the secure channel between the client and the gateway, up to the Portal Server as shown in the "With Netlet Proxy Configured" section of Figure 3-2. The Netlet proxy offers improved security benefits through data encryption but may increase the use of system resources.

See the Sun ONE Portal Server, Secure Remote Access 6.0 Installation Guide for instructions on installing the Netlet proxy.

You can:

  • Choose to install the Netlet proxy on the Portal Server node on or on an independent node.

  • Install multiple Netlet proxies and configure them for a single gateway using the admin console. This is useful in load balancing. To Configure the Netlet Proxy for details.

  • Configure multiple instances of Netlet proxy on a single machine.

  • Point multiple instances of the gateway to a single installation of Netlet proxy.


    Note If you are using a single Netlet proxy for multiple instances of the gateway, ensure that you specify different Netlet proxy ports in the various gateway profile.


Figure 3-2 shows 3 sample implementations of the gateway and Portal Server with and without the Netlet proxy installed. The components include a client, 2 firewalls, the gateway that resides between the 2 firewalls, the Portal Server, and Netlet target servers.

The first scenario shows the gateway and Portal Server without Netlet proxy installed. Here the data encryption extends only from the client to the gateway. A port is opened in the second firewall for each Netlet connection request.

The second scenario shows the gateway and the Portal Server with the Netlet proxy installed on the Portal Server. In this case, the data encryption extends from the client all the way to the Portal Server. Since all Netlet connections are routed through the Netlet proxy, only one port needs to be opened in the second firewall for Netlet requests.

The third scenario shows the gateway and the Portal Server with the Netlet proxy installed on an independent node. Installing the Netlet proxy on an independent node reduces the load on the Portal Server node. Here again, only two ports need to be opened in the second firewall. One port services requests to the Portal Server, and the other port routes Netlet requests to the Netlet proxy server.

Figure 3-2    Implementation of Netlet proxy


This figure illustrates possible configurations involving the Netlet proxy, and depicts the advantage of having a Netlet proxy. See the description preceeding the figure for details.

To Configure the Netlet Proxy

  1. Log in to the iPlanet Directory Server Access Management Edition admin console as administrator.

  2. Select the Service Management view.

  3. Click the right arrow icon next to Gateway under SRAP Configuration in the left frame.

    The Gateway page appears on the right pane.

  4. Click the required profile.

    The Gateway > Edit Gateway Profile page appears in the right pane.

  5. Scroll down and select the Enable Netlet Proxy check box to enable the Netlet proxy.

  6. Type the desired Netlet proxy host and port in the Netlet Proxy Hosts edit field, in the format host name:port. Click Add.


    Tip From the command line, enter:

    netstat -a | grep port_number | wc -l

    To determine if the port desired is available and unused. port_number is the required port.


  7. Click Save at the top or bottom of the page to save the changes.

  8. For the changes to take effect, restart the gateway by typing:

    InstallDir/SUNWps/bin/gateway -n gateway profile name start

Restarting the Netlet Proxy

You can configure the Netlet proxy to restart whenever the proxy is killed accidentally. You can schedule a watchdog process to monitor the Netlet proxy and restart it if it goes down.

You can also restart the Netlet proxy manually.

To Restart the Netlet Proxy

In a terminal window, connect as root and do one of the following:

  • Start the watchdog process using:

    InstallDir/SUNWps/bin/netletd watchdog on

    This creates an entry in the crontab and the watchdog process is now active. The watchdog monitors the Netlet proxy port and brings up the proxy if it goes down.


    Note You need to ensure that Netlet proxy is running before enabling the watchdog.

    To stop the Netlet Proxy, ensure that the watchdog is stopped first.


  • Start the Netlet proxy manually using:

    InstallDir/SUNWps/bin/netletd -n profilename start

    where profilename is the profile name corresponding to the required gateway instance.

Configuring Multiple Instances of the Netlet Proxy

Use the nlpmultiinstance script to create a new instance of the Netlet proxy. You can create a new instance in the following scenarios:

Creating a New Instance on a Portal Server Node

  1. Login as root and navigate to the following directory:

    InstallDir/SUNWps/bin

  2. Run the multi instance script:

    ./nlpmultiinstance

Table 3-4 lists the questions that the script asks. The first column lists the question, the second column lists the default value, and the third column has the description.


Table 3-4    Checklist for creating a new Netlet proxy instance on a Portal Server node  

Parameter

Default Value

Description

New Netlet proxy instance uses Portal Server instance running on this node  

y  

The script detects an existing instance of the Portal Server and asks this question.

Specify y if you want the Netlet proxy to run with the Portal Server instance on the same node.

Choose n if you want to use a different instance of the Portal Server. In this case, the Creating a New Instance on a non-Portal Server Node checklist applies.  

Portal Server instance is the default one created during installation  

y  

Specify which instance of the Portal Server you want the new Netlet proxy instance to work with.

If you choose y, the default Portal Server instance that is created during installation is used with the new Netlet proxy.

If you choose n, you will be asked to specify the name of the required Portal Server instance.  

New Portal Server instance created  

y  

This question is asked only if you have chosen not to use the default Portal Server instance.

Specify whether the Portal Server instance that you want to use with your new Netlet proxy instance has already been created.

If you choose n, you are asked to create the instance first, and the script aborts.  

Name of the new Portal Server instance  

Portal Server instance name  

This question is asked only if you have chosen not to use the default Portal Server instance.

Specify the name of the Portal Server instance that you want the new Netlet proxy instance to use.  

Port on which the new Portal Server instance listens  

81  

This question is asked only if you have chosen not to use the default Portal Server instance.

Specify the port on which the new Portal Server instance listens.  

Deployment URI  

/portal  

This question is asked only if you have chosen not to use the default Portal Server instance.

Specify the deployment URI of the new Portal Server instance.  

Name of the new Netlet proxy instance  

 

Specify the name of the new Netlet proxy instance that you want to create.  

Port on which the new Netlet proxy instance listens  

10558  

Specify the port on which the new Netlet proxy instance needs to listen. Ensure that this port has not been specified for any other Netlet proxy instance.  

Created a corresponding gateway profile for the new Netlet proxy instance  

y  

You are asked if you have created a gateway profile for the new Netlet proxy instance.

See To Create a Gateway Profile for details on creating a new gateway profile.  

Start the new instance of the Netlet proxy with the required gateway profile name.

InstallDir/SUNWps/bin/netletd -n profilename start

where profilename is the profile name corresponding to the required gateway instance.

Creating a New Instance on a non-Portal Server Node

  1. Login as root and navigate to the following directory:

    InstallDir/SUNWps/bin

  2. Run the multi instance script:

    ./nlpmultiinstance

Table 3-5 lists the questions that the script asks. The first column lists the question, the second column lists the default value, and the third column has the description.


Table 3-5    Checklist for creating a new Netlet proxy instance on a non- Portal Server node 

Parameter

Default Value

Description

New Netlet proxy instance uses Portal Server instance running on this node  

n  

This question is not asked if the script does not detect an instance of the Portal Server on this node.

The script detects an existing instance of the Portal Server and asks this question.

Specify y if you want the Netlet proxy to run with the Portal Server instance on the same node.

Choose n if you want to use a different instance of the Portal Server.  

Host name of the Directory Server  

hostname  

This is the machine on which the Directory Server is installed.

Specify the machine on which Directory Server was installed for the Portal Server.  

Sub-domain name for hostname  

subdomain  

This is the sub-domain to which the Directory Server belongs.

Specify the sub-domain of the machine on which the Directory Server was installed for the Portal Server.  

Domain name for hostname  

domain  

This is the domain to which the Directory Server machine belongs.

Specify the domain of the machine on which the Directory Server was installed for the Portal Server.  

Port used to access the Directory Server  

389  

This is the port which the Portal Server uses to access the Directory Server.

Specify the Directory Server port specified during the Portal Server installation.  

Root suffix of the directory tree  

o=isp  

This is the default top level organization. Any new organization that you create is created under this organization.  

Organization name  

subdomain.domain  

This is the name of the default organization that is created.  

Hostname of Portal Server  

Portal Server hostname  

This is the hostname of the Portal Server.  

sub-domain for Portal Server hostname  

 

This is the sub-domain to which the Portal Server machine belongs.  

domain name for Portal Server hostname  

 

This is the domain to which the Portal Server machine belongs.  

Port used to access Portal Server  

80  

This is the port used to access the Portal Server.  

Protocol used to access Portal Server  

http  

Specify the protocol that is used to access the Portal Server.  

DSAME server deployment URI  

/amserver  

This is the DSAME deployment URI. Do not change this value.  

Portal Server deployment URI  

/portal  

Specify the deployment URI of the new Portal Server instance.  

Name of the new Netlet proxy instance  

 

Specify the name of the new Netlet proxy instance that you want to create.  

Port on which the new Netlet proxy instance listens  

10662  

Specify the port on which the new Netlet proxy instance needs to listen. Ensure that this port has not been specified for any other Netlet proxy instance.  

Created a gateway profile for the new Netlet proxy instance  

y  

You are asked if you have already created a profile for the new Netlet proxy instance.

See To Create a Gateway Profile for details on creating a new gateway profile.  

Start the new instance of the Netlet proxy with the required gateway profile name.

InstallDir/SUNWps/bin/netletd -n profilename start

where profilename is the profile name corresponding to the required gateway instance.

To Configure the Netlet Proxy Watchdog

You can configure the time interval at which the watchdog monitors the status of the Netlet proxy. This time interval is set to 60 seconds by default. To do this, edit the following line in the crontab:

0-59 * * * * InstallDir/bin/checkgw /var/opt/SUNWps/.gw 5 > /dev/null 2>&1


Sample Netlet Rules

Table 3-6 lists sample Netlet rules for some common applications.

The table has 7 columns corresponding to the following fields in a Netlet rule: Rule Name, URL, Download Applet, Client Port, Target Host, Target Port. The last column includes a description of the rule.


Note Table 3-6 does not list the Cipher and Extend Session fields of the Netlet rule. Assume these to be "RC4" and "true" for the samples provided.



Caution

Microsoft Exchange 2000 is not supported.



Table 3-6    Sample Netlet Rules

Rule

URL

Download Applet

Client Port

Target Host

Target Port

Description

IMAP  

null  

false  

10143  

imapserver  

143  

The Netlet client port on the client side need not be the same as the target port on the server side. If you use anything other than the standard IMAP and SMTP ports, make sure that the client is configured to connect on a port that is different from the standard port.

Solaris client users will have trouble connecting to port numbers lower than 1024 unless they are running as root.

SMTP  

null  

false  

10025  

smtpserver  

25  

Lotus Web Client  

null  

false  

80  

lotus-server  

80  

This rule tells the Netlet to listen for the client on port 80, and connect to the server lotus-server on port 80. A requirement of the Lotus Web Client is that the client listen port must match the server port.  

Lotus Notes Non-
web Client  

null  

false  

1352  

lotus-domino  

1352  

With this rule, the Lotus Notes client can connect to a Lotus Domino server through the Netlet. Ensure that when the client tries to connect to the server it must not point to localhost as the server name. It must point to the actual server name of the Lotus Domino server. The server name must be the same as the system name for the server. The client must resolve that name to 127.0.0.1 when using the Netlet. There are two ways to accomplish this:

  • Set the server name to point to 127.0.0.1 in the client host table.

  • Export a DNS entry of the name of the server that points to 127.0.0.1.

The server name must be the same server name that was used to configure the Domino server during setup.  

Microsoft Outlook and Exchange Server

This will not work for Windows NT and Windows 2000. Use Outlook web access through the rewriter for Windows NT and 2000.  

null  

false  

135  

exchange  

135  

This rule tells the Netlet to listen at port 135 on the client and connect to the server exchange on port 135. The Outlook- client uses this port to make an initial attempt to contact the Exchange server and determine what subsequent ports to use to talk to the server.

On the client machine:

  • The user needs to change the hostname of the Exchange server that is configured in the Outlook client to localhost. The location of this option varies with different versions of Outlook.

  • The user must now map the hostname (single and fully qualified) of the Exchange server to the IP address 127.0.0.1 using the hosts file.

  • On Windows 95/98, the file is in \Windows\Hosts On Windows NT4, the file is in \WinNT\System32\rivers...
    tc\Hosts    .

The entry looks like this:

127.0.0.1 exchange exchange.company.com

The exchange server sends back its own name to the Outlook client. Hence this mapping ensures that the Outlook client uses the Netlet client to make the connection back to the server.  

FTP  

null  

false  

30021  

your_ftp_
server.your_domain  

21  

You can provide FTP service to a single FTP Server, with controlled end user accounts. This will ensure secure remote FTP transfers from an end user system to a single location. Without a username, an FTP URL is interpreted as an anonymous FTP connection.

You must define port 30021 as the client port for your Netlet FTP rule.

Dynamic FTP is not supported using a Netlet connection.  

Netscape 4.7 Mail Client  

null  

false  

10143

10025  

TARGET

TARGET  

143

25  

In the Netscape client, the user needs to specify:

localhost:30143 for IMAP or incoming mails

localhost:30025 for SMTP or outgoing mails  

Graphon  

third_party/xsession_
start.html  

true  

10491  

TARGET  

491  

This is the rule used to access Graphon through Netlet. xsession_start.html is bundled with Graphon.  

Citrix  

third_party/citrix_start.html  

true  

1494  

TARGET  

1494  

This is the rule used to access Citrix through Netlet. citrix_start.html is bundled with Citrix.  

Remote
Control  

third_party/pca_start.html  

true  

5631

5632  

TARGET

TARGET  

5631

5632  

This is the rule used to access Remote Control through Netlet. pca_start.html is bundled with Remote Control.  


Enabling Netlet Logging

You can enable logging of Netlet related activities in the gateway admin console. The log files are created in the directory specified in the Log Location attribute as part of the Logging section of the DSAME Configuration attributes. The log file name has the following convention:

srapNetlet_gateway hostname_gateway profile name

The Netlet log captures the following information:

  • Start time

  • Source address

  • Source port

  • Server address

  • Server port(s)

  • Stop time

  • Status (start or stop)

To Enable Netlet Logging

  1. Log in to the iPlanet Directory Server Access Management Edition admin console as administrator.

  2. Select the Service Management view.

  3. Click the arrow next to Gateway under SRAP Configuration.

    The Gateway page appears.

  4. Click Edit... next to the gateway profile for which you want to set the attribute.

    The Gateway > Edit Gateway Profile page appears.

  5. Select the Enable Netlet logging checkbox to enable Netlet logging.

  6. Click Save at the top or bottom of the page to record the changes.


Customizing the Netlet

You can customize the text that appears in message windows, in the Netlet provider, and on the Netlet administration console.

Editing Text on the Netlet Attributes Page

You can edit the text that appears on the Netlet attributes page of the admin console. You need to make the required changes in the following files:

InstallDir/SUNWam/locale/srapNetlet.properties

Editing Message Text in the Netlet Provider

You can edit the messages that appear in the Netlet provider on the end user's desktop. You need to make the required changes in the following files:

InstallDir/SUNWam/locale/srapNetletProvider.properties

Editing the Error Messages File

You can edit the srapNetletApplet.properties file for messages that appear when Netlet has problems with the browser's proxy settings. You need to make the required changes in the following file:

InstallDir/SUNWam/locale/srapNetletApplet.properties

Editing the Netlet Messages File

You can edit the srapNetletServlet.properties file for messages that appear when Netlet is loading. You need to make the required changes in the following file:

InstallDir/SUNWam/locale/srapNetletServlet.properties


Previous     Contents     Index     Next     
Copyright 2002 Sun Microsystems, Inc. All rights reserved.

Last Updated September 26, 2002