Installing Anyware Manager - External Configuration
For the Anyware Manager external installation, you should configure an external database and secret storage, a repository to download and save configuration files, configure SELinux policies, and run the installation package. Anyware Manager can be installed and configured along with a default or an external database. This section outlines the external configuration installation method for Anyware Manager.
Installation Time
The default configuration of Anyware Manager uses an internal Vault and MongoDB. It takes approximately 45 minutes to complete the installation.
Data Migration
Anyware Manager does not do any data migration when configuring your database and secret storage application. Any data stored when Anyware Manager is used with the default database and secret storage configuration is not transferred if the same Anyware Manager instance is re-configured to run with an external database and secret storage.
Firewall and Load Balancing Considerations
For information on firewall and load balancing ports connected to Anyware Manager and Connector, see Firewall and Load Balancing Considerations
By default, Anyware Manager installs a database and secret storage on the same virtual machine. If you want to use an external database and secret storage, which we recommend for scaling, continue with the steps outlined below to prepare the external database and secret store.
Preparing an External Database and Secret Storage¶
The following sections outline how to prepare a secret storage application and MongoDB that can be configured to work with Anyware Manager.
Verified Versions¶
The table below outlines the versions of MongoDB and Vault that are verified with Anyware Manager:
Anyware Manager Version | Vault Version | MongoDB Version |
---|---|---|
22.01 | 1.7.1 | 4.2.14 |
22.04 | 1.7.1 | 4.2.14 |
22.09 | 1.7.10 | 4.2.14 |
23.01 | 1.7.10 | 4.2.14 |
23.04 | 1.11.6 | 4.2.14 |
Preparing a Secret Storage Application¶
It is possible to use either Hashicorp Vault or Azure Key Vault, depending on your environment and needs, for secret and key encryption and storage with Anyware Manager. Once you have successfully installed Anyware Manager you need to configure Anyware Manager to use the defined secret store. Please be aware that you can only configure one secret storage option with Anyware Manager.
The sections below outline the prerequisite steps required to prepare these secret stores:
You can't configure the secret storage application to work with Anyware Manager until you have successfully installed Anyware Manager. Please complete the installation and then perform the required configurations.
Preparing an External Database¶
The following section provides guidelines and best practices involved when preparing and deploying a production MongoDB solution with Anyware Manager.
Reference Instructions for MongoDB and Vault Configuration
For detailed deployment instructions on installing and configuring MongoDB and Vault in a single virtual machine to be used by Anyware Manager, see the following Knowledge Base article. This article outlines in detail how to install and configure an instance of MongoDB and an instance of Vault on the same virtual machine. This KB article should be used in conjunction with the installation steps outlined in this section.
Reference Steps Only
All configuration steps outlined should be used as a reference only. For specific details, visit the vendor's official documentation and knowledge base. For information on the main reference list for MongoDB, see https://docs.mongodb.com/manual/administration/.
Guidelines and Best Practices¶
The following are some of the guidelines and best practices that We encourage when deploying a MongoDB to work with Anyware Manager:
- Ensure the machine is deployed in a secure subnet with no public facing access.
- Ensure that the host firewalls are leveraged to control inbound and outbound traffic.
- MongoDB only needs to be accessible to the Anyware Manager and to administrators so it is better to be overly restrictive when granting access, and follow the rules of granting least privilege access.
- Anyware Manager cannot connect to an external MongoDB from behind a proxy.
- Remote desktop or SSH access to the system should be disallowed altogether if possible - realistically this is highly unlikely - or heavily restricted to essential users only, with a security-conscious configuration (e.g. add certificates for RDP, use passphrase-protected SSH keys and disallow password based authentication, change default SSH port, etc).
- Keep the host OS patched and up to date to ensure security fixes are deployed.
- It is best to use the latest stable version of MongoDB to ensure there are as few vulnerabilities, bugs, and issues as possible.
- It is best to maintain a regular update cadence for both MongoDB and the host machine in order to maintain latest security fixes.
- It is best to run MongoDB on a Long Term Support variant of Linux (ex, RHEL x86_64 or Ubuntu x86_64) VM.
- In order to maintain data integrity, it is best to run Mongo with Journaling enabled (enabled by default) in a geographically distributed replica set.
- Regular backups are also important to ensure Anyware Manager can be restored in case of a crash.
To keep MongoDB secure, it is important to create the appropriate admin accounts for granting access and ensuring that all communication is done over a secured TLS connect. Details for creating an appropriate service account can be found in the official MongoDB documentaton, as well as:
- Details for enabling data encryption at rest.
- How to enable TLS on the MongoDB server.
- Additional tips for hardening the system.
Installing Anyware Manager¶
The following section outlines how to install Anyware Manager with the default database and secret storage. These steps should be performed on the target machine by connecting via SSH or console.
Before you begin
Follow the prerequisite steps in the Anyware Manager System Requirements section to prepare your target machine. It is important to read and address all the prerequisites outlined. Once you have completed these steps and prepared the target machine, return to this page and continue with the installation.
1. Add Anyware Manager Repository¶
The virtual machine you are adding the repo to must have access to the internet to be able to download and install the required files.
Anyware Manager Repositories
The new repository teradici-anyware-manager
is introduced. If you currently have teradici-cas-manager
repository, you must remove it. See Repository Management to remove them. Once the unwanted repos are removed, you can proceed with the installation process below.
To access the scripts and to configure and add the RHEL and Rocky Linux repository, select the Downloads and scripts option from the
Anyware Manager support site.
If you see a login button instead, click it to log into the site and then proceed.
Accept the End User License Agreement, then click Set Up Repository.
The window expands and displays the setup scripts for each supported operating system. Copy the command for your system to the clipboard.
Paste command on the target machine where you wish to install Anyware Manager and press Enter
.
The command fetches a configuration script from our servers and runs it locally, setting up and configuring the repository on the local machine.
Run the following command to confirm teradici-anyware-manager
repos were added into dnf repo.
dnf repolist --enabled teradici-anyware-manager*
The output from this command should list the repo id, names as outlined in the example below:
repo id repo name
teradici-anyware-manager-beta teradici-anyware-manager-beta
teradici-anyware-manager-beta-noarch teradici-anyware-manager-beta-noarch
teradici-anyware-manager-beta-source teradici-anyware-manager-beta-source
2. SELinux Configuration¶
SELinux policies are required for persistent storage and container logging on Anyware Manager. If SELinux policies are not found, data stored in Anyware Manager is lost when the Anyware Manager Machine is shut down.
Once configured, and the installation has verified SELinux, all Anyware Manager related data persists when the target machine hosting Anyware Manager is re-booted. To check if SELinux is already installed on your system, run the following command:
sudo dnf list installed | grep anyware-manager-selinux
The output from this command notifies if you if selinux
is already running on your system. If it is not then you need to run the following commands to install the SELinux policies:
Run the following command to install the SELinux policies and set the basic framework for persistent database and Vault:
Run the following command to install a specific version of SELinux that has been tested for K3s:
Run the following command to install SELinux from the Anyware Manager repo:
Install Command Alias
The older command sudo dnf install -y cas-manager
works as an alias for Anyware Manager installation.
3. Install Anyware Manager¶
Installation Commands Updated
Anyware Manager installation requires two commands comparing to previous version where only one command is required. If you have automated the installation in scripting, make sure the script is updated accordingly.
Run the following command to install Anyware Manager RPM:
sudo dnf install -y anyware-manager
The installer installs Anyware Manager, as well as all external components required.
These external components are:
- k3s
- MongoDB (data store)
- Vault (secret store from HashiCorp)
- A self-signed SSL certificate for HTTPS access
Run the following command to install Anyware Manager with the appropriate flags suits your needs, see "Installation Flags and Options" for all supported flags. The command example below installs Anyware Manager with self-signed certificate from teradici-anyware-manager* repo added in the pervious steps. Debug level log is displayed to help troubleshooting.:
sudo /usr/local/bin/anyware-manager install --accept-policies --self-signed --debug
Password Configuration¶
You need to configure a password to install Anyware Manager instance on your system. The password adds a layer of protection to the system and is required when accessing the Web Admin Console. To meet the security standards, the password should be 8 characters in length with minimum 1 uppercase, 1 lowercase, 1 number and 1 special character.
Password Special Character
The %
character and whitespaces are not supported.
Anyware manager installer requires Web Admin password and prompts for it, if this behavior is not preferred the password could be passed to the install command using:
--manager-admin-password
In case you forget the password, you can reset it using the following flag with the configure
command:
--reset-admin-password
Password File
The /opt/teradici/casm/temp-creds.txt
file that has the ability to store Anyware Manager password is not created any more by the installer. If you forget your password, you need to reset it using the --reset-admin-password
flag.
Installation Flags and Options¶
For detailed information on the installation flags and the configuration file parameters that you can pass during installation, see the table outlined below:
Flags | Example | Description |
---|---|---|
--accept-policies |
sudo /usr/local/bin/anyware-manager install --accept-policies | If this flag is set, the installer does not prompt for accepting policies. This flag is optional |
--clear |
sudo /usr/local/bin/anyware-manager install --clear | This flag Removes data and files of an existing or previous Anyware Manager instance. |
--manifest |
sudo /usr/local/bin/anyware-manager install --manifest | This flag is set to provide a path for manifest files. This flag is optional. |
--self-signed |
sudo /usr/local/bin/anyware-manager install --self-signed | This flag is set to Automatically generate self-signed TLS cert and key. Setting this flag ignores --tls-key and --tls-cert flags. |
--tls-key |
sudo /usr/local/bin/anyware-manager install --tls-key | If this flag is set, it requires the full path and filename of the TLS key to use with the Anyware Manager. |
--tls-cert |
sudo /usr/local/bin/anyware-manager install --tls-cert | If this flag is set,it requires the full path and filename of the TLS certificate to use Anyware Manager. |
--registry |
sudo /usr/local/bin/anyware-manager install --registry | This flag is used to specify the container registry from which the Anyware Manager pulls container images. |
--registry-username |
sudo /usr/local/bin/anyware-manager install --registry-username | This flag is used to authenticate Anyware Manager username to the registery and to pull container images. |
--registry-password |
sudo /usr/local/bin/anyware-manager install --registry-password | This flag is used to authenticate Anyware Manager password to the registry to pull container images. |
--manager-admin-password |
sudo /usr/local/bin/anyware-manager install --manager-admin-password | This flag is used to create a new password for Anyware Manager during installation. |
--reset-admin-password |
sudo /usr/local/bin/anyware-manager configure --reset-admin-password | This flag is used to reset the password for Anyware Manager. |
sudo dnf install -y anyware-manager-selinux
sudo dnf install -y https://github.com/k3s-io/k3s-selinux/releases/download/v1.1.stable.1/k3s-selinux-1.1-1.el8.noarch.rpm
sudo dnf install -y selinux-policy-base container-selinux
The external components are:
- k3s
- A self-signed SSL certificate for HTTPS access
The installation process takes 5-10 minutes to complete, depending on your network connection speed and other environment variables. During this process, Anyware Manager is running a health check every 15 seconds to confirm that all required services are deployed and running successfully before reporting that the installation is complete.
Once the installation has been successful you should see a message stating Anyware Manager installation complete. The IP address and the version of your Anyware Manager instance isdisplayed.
If the installation appears unhealthy, you should generate a support bundle and send this to HP for investigation. For more information on generating a support bundle, see Support Bundle. For more information on monitoring and assessing the health status of Anyware Manager, see Health Status.
Generated Self-Signed Certificates
The installer automatically generates several certificates to ensure that internal communication within the Anyware Manager and communication to the Anyware Manager itself are done over encrypted TLS connections. These certificates are automatically generated as needed when Anyware Manager is initially installed or when upgrades are done. If you do not wish to upgrade, certificates must be periodically renewed, see TLS Certificates for steps on how to do this.
4. Configure Anyware Manager to use Proxy¶
The following section outlines the steps involved in enabling the proxy configuration with Anyware Manager:
- If the proxy environment variables were not set before installing Anyware Manager, please see the Proxy Configuration Variables section above for the steps involved in setting these variables. If you already have these variables set, continue to step 2.
- Establish a new ssh/shell session.
-
Configure Anyware Manager to use the proxy configuration by running the following command:
sudo /usr/local/bin/anyware-manager configure -–enable-proxy
5. Configure Anyware Manager to use a Secret Storage Application¶
Once you have successfully installed Anyware Manager you must configure it to use the secret store you prepared in the prerequisite steps prior to installing Anyware Manager. You need to have prepared the selected secret storage application before installing Anyware Manager, as outlined in the Preparing a Secret Storage Application section above. For information on how to configure Anyware Manager to work with these secret stores, see the following sections based on what type of secret storage you prepared:
6. Configure Anyware Manager to use MongoDB¶
Once you have successfully installed Anyware Manager you must configure it to use the external MongoDB you prepared in the prerequisite steps prior to installing Anyware Manager.
The following section outlines how to configure Anyware Manager to use MongoDB:
- SSH to your target machine where you installed Anyware Manager.
-
Create a file that contains the following data:
{ "db-connection-string": "mongodb://<username>:<password>@<address>/<db_name>", "db-enable-tls": true, "db-skip-verify-cert": false }
URL Encoding
If the username or password contain any of the following special characters: /, ?, #, [], @, %, those characters must be converted using URL encoding in the MongoDB connection string. For example, if you defined user 'awmuser' with password 'Password%' in MongoDB, then in Anyware Manager the
db-connection-string
for MongoDB would look like this:mongodb://awmuser:Password%25@ip_of_mongodb:27017/name_of_mongodb
If you require more characters to be encoded, or want to test encoding or decoding your data, see https://www.urlencoder.org/.
-
Replace the following place holders with your own values:
- username: Username of the MongoDB user that Anyware Manager authenticates MongoDB requests.
- password: Password for the MongoDB user referenced in "username".
- address: Address to the MongoDB server.
- db_name: Name of the MongoDB database that Anyware Manager can use. Note that if no db name is specified, the db named "test" is used.
-
Run the following command to configure Anyware Manager to use MongoDB:
sudo /usr/local/bin/anyware-manager configure --config-file path-to-your-config-file
MongoDB Database Name
If no database name is provided as part of the connection string, a default name "test" is used instead, for example:
db-connection-string:"mongodb://user:pass@mongo:27017/ results in the creation of a database with the name "test".
If you provide a database name, for example:
db-connection-string:"mongodb://user:pass@mongo:27017/awm_db. Then the name "awm_db" is used as the database name.
After running this command, Anyware Manager validates the configuration by attempting to query the MongoDB server. If the request is successful, then Anyware Manager is configured to use this MongoDB. The configure command should only take a few minutes to complete.
Here's an example of creating a user for the Anyware Manager Database "awm_db":
use awm_db
db.createUser(
{
user: "anyware",
pwd: passwordPrompt(), // or cleartext password
roles: [ {db: "awm_db", role:"readWrite"} ], // user only needs readWrite Access to awm DB,
authenticationRestrictions: [
{
clientSource: [
"<AWM-IP>", // IP address of the AWM Host
"10.42.0.0/24" // Subnet for the AWM pods
],
serverAddress: ["<MongoDB IP>"] // IP for the MongoDB server
}
],
}
)
The connection string for this user would be:
mongodb://anyware-manager:<password>@<MongoDB IP>/awm_db
Configuration Templates
HP provides configuration template files and parameters that can be generated and used when configuring your MongoDB, see Configuration Templates.
6.1 Connecting a MongoDB with Self-Signed TLS Certificates¶
Anyware Manager allows for the option to provide a database connection string, a flag to enable/disable TLS, a flag to enabled/disable TLS cert validation, and also provide a custom Certificate Authority certificate for the MongoDB Server certificate. This is only recommended during proof-of-concept testing. In this mode, TLS must be enabled and certificate validation must be carried out. A server certificate signed by a public Certificate Authority is also highly recommended.
Tested on CentOS Only
The following steps have been tested on CentOS. These steps may not work, or work differently, on different systems.
The following steps outline how to connect a MongoDB that uses self-signed TLS certificates:
- SSH to your target machine where you installed Anyware Manager.
- Create a file that contains the following data:
{ "db-connection-string": "mongodb://<username>:<password>@<address>/<db_name>", "db-enable-tls": true, "db-ca-cert-file": "/path/to/mongo/TLS/custom/certificate/authority", "db-skip-verify-cert": false }
- Replace the following place holders with your own values:
- "db-connection-string": Follow the same guidelines as mentioned above.
- "db-ca-cert-file": Path to MongoDB's custom Certificate Authority's public certificate, in PEM format, if one is used. This is only required to validate self-signed certificates or certificates signed by a non-public Certificate Authority.
- Run the following command to configure Anyware Manager to use MongoDB:
sudo /usr/local/bin/anyware-manager configure --config-file path-to-your-config-file
- If you want to skip certificate verification, include
"db-skip-verify-cert": true
in your configuration file. Please note that this is not secure and is not recommended for production use cases:
{
"db-connection-string": "mongodb://<username>:<password>@<address>/<db_name>",
"db-enable-tls": true,
"db-ca-cert-file": "/path/to/mongo/TLS/custom/certificate/authority",
"db-skip-verify-cert": true
}
7. Accessing the Admin Console¶
The following section outlines how to access and unlock the Anyware Manager Admin Console.
-
Open a web browser and go to https://{ip-address-or-dns-name-of-anyware-manager}. This is the IP address of the target machine where Anyware Manager is installed.
-
When presented with the Anyware Manager Login page, use the following credentials to begin using Anyware Manager:
username: adminUser
password: The password that is configured during Anyware Manager installation.
-
Click Login.
You are now able to use Anyware Manager as the adminUser user.
To unlock the Admin Console enter your Anyware Software registration code into the Unlock dialog that appears when you first log-in. Anyware Manager verifies the registration code and then create a new deployment on your behalf. For further information on using the Admin Console, see Admin Console.
8. Anyware Manager dnf Repo Management¶
By default, Anyware Manager installs any updates that are available, when you update all managed packages with the following command:
dnf upgrade anyware-manager
or
dnf update anyware-manager
This system wide update includes any new Anyware Manager version updates. If you do not want this system wide update, the Anyware Manager repo(s) should be disabled once installation is complete.
Locking Anyware Manager version in the dnf repo¶
The following section outlines how to lock the Anyware Manager in the dnf repo:
- Run this command:
sudo dnf config-manager --set-disabled teradici-anyware-manager*
. - To confim the settings, run this command:
dnf repolist teradici-anyware-manager*
.
The output from this command should list the repo id, names and their status, as outlined in the example below:
repo id repo name status
teradici-anyware-manager teradici-anyware-manager disabled
teradici-anyware-manager-noarch teradici-anyware-manager-noarch disabled
teradici-anyware-manager-source teradici-anyware-manager-source disabled
Installing the Connector¶
Once you have installed the Anyware Manager you can install Connector(s) by following the instructions outlined in the Installing the Connector section.