ESET REMOTE ADMINISTRATOR 6

Transcription

1 ESET REMOTE ADMINISTRATOR 6 Virtual Appliance Deployment Guide Click here to navigate to the most recent version of this document

2 ESET REMOTE ADMINISTRATOR 6 Copyright 2015 by ESET, spol. s r.o. ESET Remote Admi ni s tra tor 6 wa s devel oped by ESET, s pol. s r.o. For more i nforma ti on vi s i t et.com. Al l ri ghts res erved. No pa rt of thi s documenta ti on ma y be reproduced, s tored i n a retri eva l s ys tem or tra ns mi tted i n a ny form or by a ny mea ns, el ectroni c, mecha ni ca l, photocopyi ng, recordi ng, s ca nni ng, or otherwi s e wi thout permi s s i on i n wri ti ng from the a uthor. ESET, s pol. s r.o. res erves the ri ght to cha nge a ny of the des cri bed a ppl i ca ti on s oftwa re wi thout pri or noti ce. Cus tomer Ca re: et.com/s upport REV. 02/09/2015

3 Contents 1. VA Deployment Prerequisites Supported...6 hypervisors 4. ERA Appliance...7 deployment process 4.1 vsphere Standalone...9 ERA VAgentHost Appliance 4.2 VMware...11 Workstation/Player 4.3 Microsoft...12 Hyper-V 4.4 Oracle...15 VirtualBox 5. ERA...17 Virtual Appliance configuration 5.1 ERA...17 Server Appliance 5.2 ERA...19 Proxy Appliance 5.3 ERA...20 MDM Appliance 6. ERA...23 certificates 7. Manual...24 ERA VA configuration 8. Troubleshooting ERA...31 Virtual Appliance FAQ 10. DNS...33 Service Record

4 1. VA Deployment The ERA Virtual Appliance (ERA VA) is available for users who want to run ESET Remote Administrator in a virtualized environment. Additionally, the ERA Virtual Appliance simplifies deployment of ESET Remote Administrator and is faster than using the All-in-one installer or component installation packages. The ERA Virtual Appliance can be deployed in most virtual environments. It supports native/bare-metal hypervisors (VMware vsphere/esxi and Microsoft Hyper-V) as well as hosted hypervisors that usually run on desktop operating systems (VMware Workstation, VMware Player and Oracle VirtualBox), see Supported hypervisors for a complete list. The ERA Virtual Appliance comes as an OVA (Open Virtualization Appliance) file. It is available from the download section of the ESET website under Remote Administrator 6 (click to expand the category). The appliance is available in two forms, ERA_Appliance.ova and ERA_VAgentHost.ova. ERA_Appliance.ova - contains multiple ERA Appliance types. Deploy this file to choose which type of appliance you want to run. The ERA Appliance type can be: ERA Server - An ERA Server that will run on a dedicated VM. Also includes Rogue Detection Sensor. ERA Proxy - An ERA Proxy component that will run on a dedicated VM. Intended for distant/ remote locations and laptops that connect to your network from outside. To use this type of appliance, ERA Proxy should be exposed to the external network (for example, located within a DMZ), and connected to your ERA Server. This ERA VA also contains Rogue Detection Sensor. ERA MDM - The mobile device management component only. If you do not want to expose your ERA Server, you can make the ERA MDM VM accessible from the Internet in order to manage mobile devices. ERA_VAgentHost.ova - is basically a standalone ERA VAgentHost Appliance. The only difference relative to the ERA VAgentHost Virtual Appliance type mentioned above is that this configuration includes a wizard style deployment process for use on vsphere/esxi, provided that you are connected to vcenter Server and not directly to ESXi server. If you are connected directly to ESXi server, you must use the ERA VA web interface to configure it. The same appliance type options available during deployment using ERA_Appliance.ova are available. The OVA file is a template that contains a functional CentOS 6.6 operating system. To deploy the ERA VA OVA file, follow the instructions for your hypervisor. When using ERA_Appliance.ova, once you've deployed the appliance, you can choose which ERA Appliance type you want your VM to run. When you have selected the type, you can start configuring your ERA Virtual Appliance. After you deploy the.ova file, select the appliance type and configure settings for your VA. The VA is a complete environment with ESET Remote Administrator (or one of its components). Before you begin deployment, make sure that all Requirements are met. Once you finish the deployment and configuration process, you can connect to the ERA Server using the ERA Web Console and start using ESET Remote Administrator. NOTE: ESET provides the ERA Virtual Appliances, however ESET is not responsible for support and maintenance of your OS or OS components. ERA Virtual Appliances are designed to simplify usage and deployment, and come with a publicly available operating system that includes non-eset components. Managing and updating these components is the sole responsibility of the user of ERA Virtual Appliance. We recommend that you regularly update the operating system to prevent any security issues (the same approach as when ERA is installed in Windows environment). 4

5 2. Prerequisites The following prerequisites must be met to deploy the ERA Virtual Appliance: You must use a supported hypervisor. Verify that the guest operating system (if a hosted hypervisor, such as VMware Workstation/Player or Oracle VirtualBox is used) is supported. VT must be enabled in the host system BIOS. The feature may be named VT, Vanderpool Technology, Virtualization Technology, VMX, or Virtual Machine Extensions. You can often find this setting in the security screen of the BIOS. The location of this setting varies depending on the system vendor. Make sure the connection for the network adapter on your Virtual Machine is set to Bridged (alternatively NAT). During ERA VA configuration, you can specify network settings including domain details so that the Static Group Synchronization task to run properly. If you are using NAT mode, port forwarding must be configured on your virtual machine for ERA to be accessible from the internet. Ports that need forwarding are displayed in the console window of your ERA VA after you've deployed and configured it. Important: We recommend that you create a snapshot of your newly deployed and configured ERA VA and synchronize it with AD. We also recommend that you create a snapshot prior to deploying the ERA Agent on client computers. ERA certificates are required to deploy ERA Proxy, ERA MDM or ERA VAgentHost. You must have an ERA Server instance running to generate these certificates, which encrypt communication between ERA components. 5

6 3. Supported hypervisors The ERA Virtual Appliance (ERA VA) ( ERA_Appliance.ova and ERA_VAgentHost.ova) is a vmx-07 virtual hardware family type appliance. The following table contains supported hypervisors for different ERA VA types: Hypervisor Version ERA Server Appliance ERA Proxy Appliance ERA ERA MDM VAgentHost Appliance Appliance VMware vsphere/esxi 5.0 and newer x *** *** x VMware Workstation 9 and newer x *** *** N/A VMware Player 7 and newer x *** *** N/A Microsoft Hyper-V Server 2012 and 2012 R2 x *** *** N/A Oracle VirtualBox and newer x *** *** N/A NOTE: *** A DHCP (Dynamic Host Configuration Protocol) server is necessary, otherwise it is not possible to select an ERA VA type. DHCP is only necessary for ERA VA configuration via web console. Once your ERA VA is configured, DHCP is not needed. Important: We recommend that you to include a DHCP server in your network so that your ERA VA is automatically assigned an IP address. This IP address is necessary for access to the ERA VA configuration web interface. If you do not have a DHCP server, you will only have the ERA Server appliance type and will need to configure it manually. 6

7 4. ERA Appliance deployment process Click the supported Hypervisor you will use to view deployment instructions: vsphere VMware Workstation/Player Microsoft Hyper-V Oracle VirtualBox 4.1 vsphere Deploying ERA VA in a vsphere Client 1. Connect to your vcenter Server using vsphere Client, or directly to ESXi server. 2. Click File > Deploy OVF Template. 3. Click Browse, navigate to the ERA_Appliance.ova file that you downloaded from ESET.com and then click Open. 4. Click Next in the OVF Template Details window. 5. Read and accept the End User License Agreement (EULA). 6. Follow the instructions on screen to complete installation and specify the following information about your virtual client: Name and Location Host/Cluster Resource Pool Storage Disk Format Network Mapping 7. Click Next, review the deployment summary and click Finish. The process will automatically create a virtual machine with the settings you specify. 8. Once the ERA VA is successfully deployed, power it on. The following information will be displayed: 7

8 Open your web browser and enter the IP address of your newly deployed ERA Appliance in the address bar. You can see the IP address listed in the console window (as shown above). It will say "First time appliance configuration needs to be performed through a web browser by connecting to: address]:8443". The next step is to configure your appliance via the web interface. NOTE: If you do not have a DHCP server in your network, you will need to configure your ERA VA manually. The following information will be displayed; the URL will not contain an IP address. NOTE: We highly recommend that you configure vcenter roles and permissions in such a way that VMware users won't be able to access the ERA virtual machine. This will prevent users from tampering with the ERA VM. There is no need for ERA users to access the VM. To manage access to ESET Remote Administrator, use Access Rights in the ERA Web Console. 8

9 4.1.1 Standalone ERA VAgentHost Appliance Deploying a standalone ERA VAgentHost Appliance in vsphere Client 1. Connect to vcenter Server using vsphere Client (do not connect directly to ESXi server). 2. Click File in the top menu bar and select Deploy OVF Template. 3. Click Browse, navigate to the ERA_VAgentHost.ova file that you downloaded from ESET.com and then click Open. 4. Click Next in the OVF Template Details window. 5. Read and accept the End User License Agreement (EULA). 6. Follow the instructions on screen to complete installation and specify the following information about your virtual client: Name and Location Host/Cluster Resource Pool Storage Disk Format Network Mapping 7. In the Properties page, specify following (fields not mentioned are optional): Hostname - this will be the hostname of your ERA VAgentHost appliance Password - this will be used for your ERA VM as well as its CentOS root password ERA Server Hostname - type in the hostname or IP address of your ERA Server or ERA Proxy, so that ERA VAgentHost can connect to ERA Server/Proxy ERA Server Port - port of your ERA Server or ERA Proxy, the default is If you are using a different port, replace the default port with your custom port number Certification Authority - Base64 - paste your Certification Authority here in Base64 format. See ERA certificates for details on how to obtain the certificate Proxy Certificate - Base64 - paste your Proxy Certificate here in Base64 format, see ERA certificates for details on how to obtain the certificate Agent Certificate - Base64 - paste your Agent Certificate here in Base64 format, see ERA certificates for details on how to obtain the certificate 9

10 8. Click Next and review the deployment summary. Make sure the configuration is correct because additional configuration changes are not possible. Click Finish when you are finished making changes. The process will automatically create a virtual machine with the settings you specified. 10

11 9. Once the VM is successfully created, power it on. 4.2 VMware Workstation/Player Deploying ERA VA in VMware Workstation/Player We recommend that you use the latest version of VMware Player. Set the connection for the network adapter on your VM to Bridged or NAT. NOTE: Port forwarding must be configured on your virtual machine for ERA to be accessible from the internet. 1. Select File > Open a Virtual Machine. 2. Navigate to the ERA_Appliance.ova file that you downloaded from the ESET website and click Open. 3. Provide a name and local store path for the new virtual machine and click Import. 4. Read and accept the End User License Agreement (EULA) if you agree with it. 5. Once the appliance is deployed, power it on. The following information will be displayed: Open your web browser and enter the IP address of your newly deployed ERA Appliance in the address bar. You can see the IP address listed in the console window (as shown above). It will say "First time appliance configuration needs to be performed through a web browser by connecting to: address]:8443". The next step is to configure your appliance via the web interface. 11

12 NOTE: If you do not have a DHCP server in your network, you will need to configure your ERA VA manually. The following information will be displayed; the URL will not contain an IP address. 4.3 Microsoft Hyper-V Deploying ERA VA in Microsoft Hyper-V 1. Extract the ERA_Appliance.ova file (that you downloaded from ESET.com) using a utility such as Tar or 7-Zip. You'll see a number of extracted files including the.vmdk file (for example ERA_Appliance-disk.vmdk). 2. Download and install Microsoft Virtual Machine Converter details.aspx?id= Make sure that you have Windows PowerShell 3.0 (or later) available on your system, especially on Windows 7. To do so, follow the instructions below: a. b. c. d. open a Windows Command Prompt (cmd.exe). type powershellinto the command prompt and press Enter. In PowerShell, type $PSVersionTable and press Enter. If PSVersion 3.0 (or later) is displayed, go to step 5. If not, download and install Windows Management Framework e. Repeat steps a-c to verify that Powershell 3.0 or later is installed and then skip to step Run PowerShell and execute the commands in the following steps. 5. Run the Import module command: import-module 'C:\Program Files\Microsoft Virtual Machine Converter\MvmcCmdlet.psd1' 6. To confirm that the import was successful, review the modules imported using the following command: get-command -Module mvmccmdlet 7. Convert the.vmdk disk you extracted in step 1. ( ERA_Server-disk1.vmdk if you're deploying ERA Server): a. In Windows 7, you must use the VHD format: ConvertTo-MvmcVirtualHardDisk -SourceLiteralPath <path>\era_server-disk1.vmdk DestinationLiteralPath <output-dir> -VhdType DynamicHardDisk -VhdFormat Vhd 12

13 b. In Windows 8 and later, you can use the VHDX format: ConvertTo-MvmcVirtualHardDisk -SourceLiteralPath <path>\era_server-disk1.vmdk DestinationLiteralPath <output-dir> -VhdType DynamicHardDisk -VhdFormat Vhdx 8. Connect to Hyper-V. 9. Create a new virtual machine (Generation 1) with at least 4 Cores and 4 GB of RAM. This VM should use the existing disk that you converted in step Once the VM is successfully created, power it on. The following information will be displayed: Open your web browser and enter the IP address of your newly deployed ERA Appliance in the address bar. You can see the IP address listed in the console window (as shown above). It will say "First time appliance configuration needs to be performed through a web browser by connecting to: address]:8443". The next step is to configure your appliance via the web interface. 13

14 NOTE: If you do not have a DHCP server in your network, you will need to configure your ERA VA manually. The following information will be displayed; the URL will not contain an IP address. 14

15 4.4 Oracle VirtualBox Deploying ERA VA in VirtualBox We recommend that you use the latest version of VirtualBox. Set the connection for the network adapter on your VM to Bridged, or alternatively NAT. NOTE: Port forwarding must be configured on your virtual machine for ERA to be accessible from the Internet (if required). 1. Click File and select Import Appliance. 2. Click Browse, navigate to the ERA_Appliance.ova file that you downloaded from ESET.com and click Open. 3. Click Next. 4. Review your appliance settings and click Import. 5. Read and accept the End User License Agreement (EULA) if you agree with it. 6. Once the ERA VA is successfully deployed, power it on. The following information will be displayed: Open your web browser and enter the IP address of your newly deployed ERA Appliance in the address bar. You can see the IP address listed in the console window (as shown above). It will say "First time appliance configuration needs to be performed through a web browser by connecting to: address]:8443". The next step is to configure your appliance via the web interface. 15

16 NOTE: If you do not have a DHCP server in your network, you will need to configure your ERA VA manually. The following information will be displayed; the URL will not contain an IP address. 16

17 5. ERA Virtual Appliance configuration ERA VA can easily be configured via its web interface. You will need to have a DHCP server in your network so that your ERA VA is automatically assigned an IP address, which in turn allows you to access the ERA VA configuration web interface. If you do not have DHCP server, you will be required to use the ERA Server Appliance type, which must be configured manually. Once you've deployed your ERA Virtual Appliance VM, you need to choose which ERA Appliance type you want to run. In your web browser, select the ERA Appliance type you want your VM to run from the drop-down menu and configuration it. Click the appropriate link below to view configuration instructions for different appliance types: ERA Server Appliance ERA Proxy Appliance ERA MDM Appliance 5.1 ERA Server Appliance This is the configuration page for the ERA Server Appliance. It consists of two sections, Application and Networking properties. Complete all mandatory fields (marked in red). You can specify optional configuration parameters if necessary. NOTE: This ERA Virtual Appliance type runs ERA Server on a dedicated VM. This configuration is mostly recommended for enterprise-sized networks. Mandatory configuration fields for the ERA Server Appliance: Password - this password is important because it will be used in the VM, ERA database, ERA Server Certification Authority and ERA Web Console. Although not mandatory, we recommend that you specify optional parameters. For example Domain details, DC details, Domain Administrator account credentials, etc. This is useful for domain actions, such as synchronization. 17

18 You can also enable Apache HTTP Proxy to cache updates. Select the check box next to Enable HTTP forward proxy to enable this feature. Optionally, you can activate Apache HTTP Proxy later. See ERA Virtual Appliance FAQ for details. Review specified configuration parameters. Make sure the configuration is correct because additional configuration change is not possible. Click Submit. After, you click Submit, you'll see following information: NOTE: Do not refresh this page in your web browser, close the tab and go to your ERA VA console window. Your ERA Virtual Appliance console window will display status information. The ERA component versions as well as ERA Server hostname, IP address and port number will be displayed. The ERA Web Console address will also be present in the format and address]:8443. Enter the ERA Web Console address (as shown above) in your web browser and log into the ERA Web Console. Your hostname and IP address will most likely be different, those shown above are for illustration only. Once your are logged in, you can begin using ESET Remote Administrator. 18

19 5.2 ERA Proxy Appliance This is the configuration page for the ERA Proxy Appliance. Configuration consists of two sections, Application and Networking properties. Fill-in all mandatory fields (marked in red). You can specify other optional configuration parameters if necessary. NOTE: This ERA Virtual Appliance type runs ERA Proxy on a dedicated VM. It is suitable for enterprise-sized networks, but can be also used in a small business setting. Mandatory configuration fields for the ERA Proxy Appliance: Password - it will be used for this ERA VM as well as its CentOS root password. ERA Server Hostname - type in the ERA Server or ERA Proxy hostname or IP address, so that ERA MDM or ERA VAgentHost can connect to ERA Server/Proxy. ERA Server Port - the default ERA Server port is 2222, if you are using a different port, replace the default port with your custom port number. Certification authority Base64 - paste Certification Authority Certificate in Base64 format, see ERA certificates for details on how to obtain the certificate. Proxy Certificate Base64 - paste Proxy Certificate in Base64 format, see ERA certificates for details on how to obtain the certificate. Agent Certificate Base64 - paste Agent Certificate in Base64 format, see ERA certificates for details on how to obtain the certificate. Review your configuration parameters. Make sure the configuration is correct because additional configuration changes are not possible. Click Submit when you are finished making changes. After you click Submit, the following notification will be displayed: 19

20 NOTE: Do not refresh this page in your web browser, close the tab and go to your ERA VA console window. Your ERA Virtual Appliance console window will display status information. The ERA component versions as well as ERA Server hostname, IP address and port number will be displayed. ERA Proxy is ready to use once this screen is displayed. 5.3 ERA MDM Appliance This is the configuration page for the ERA MDM Appliance. Configuration consists of two sections, Application and Networking properties. Fill-in all mandatory fields (marked in red). You can specify other optional configuration parameters if necessary. NOTE: This ERA Virtual Appliance type runs ERA MDM on a dedicated VM. Suitable for enterprise sized networks, but can be also used for small business. Mandatory configuration fields for ERA MDM Appliance: Password - it will be used for this ERA VM as well as its CentOS root password. ERA Server Hostname - type in the ERA Server or ERA Proxy hostname or IP address, so that ERA MDM or ERA VAgentHost can connect to ERA Server/Proxy. ERA Server Port - the default ERA Server port is 2222, if you are using a different port, replace the default port with your custom port number. Certification authority Base64 - paste Certification Authority Certificate in Base64 format, see ERA certificates for details on how to obtain the certificate. 20

21 Proxy Certificate Base64 - paste Proxy Certificate in Base64 format, see ERA certificates for details on how to obtain the certificate. Agent Certificate Base64 - paste Agent Certificate in Base64 format, see ERA certificates for details on how to obtain the certificate. Review the configuration parameters. Make sure the configuration is correct because additional configuration changes are not possible. Click Submit when you are finished making changes. After you click Submit, the following notification will be displayed: NOTE: Do not refresh this page in web browser, close the tab and go to your ERA VA console window. Your ERA Virtual Appliance console window will display its status information. You'll find ERA component versions as well as ERA MDM hostname, IP address and port number. You'll also find MDM enrollment address in format and address]:

22 Enter displayed MDM enrollment address (as shown above) into your web browser to confirm the Mobile Device Connector is running correctly. Your hostname and IP address will most likely be different, those shown above are for illustration only. If the deployment was successful, you'll see following message: 22

23 6. ERA certificates ERA certificates are required to deploy the ERA Proxy, ERA MDM or ERA VAgentHost ERA Appliance types. Certificates for ERA components are available in Web Console. To copy the contents of a certificate in Base64 format, click Admin > Peer Certificates, select a certificate and then select Export as Base64. You can also download the Base64 encoded certificate as a file. Repeat this step for other component certificates as well as for your Certification Authority. NOTE: If you are using custom certificates that are not in Base64 format, they will need to be converted to Base64 format (alternatively, you can export these certificates as described above). This is the only format accepted by ERA components to connect to ERA Server. For more details about how to convert certificates see man/1/base64 and base64.1.html. For example: 'cat ca.der base64 > ca.base64.txt' a 'cat agent.pfx base64 > agent.base64.txt' 23

24 7. Manual ERA VA configuration Manual configuration is required if your ERA VA is not assigned an IP address by DHCP. In order to configure your ERA VA you must modify the ovf.xml configuration file to include specific settings for your environment. To do so, follow these instructions: Press Enter on your keyboard to enter management mode. You will be prompted for your password. Type eraadmin and press Enter to login. Select Exit console using the arrow keys and press Enter. Type nano 24 ovf.xml as root in the terminal and press Enter to open the ovf.xml file in nano editor.

25 Edit the OVF configuration parameters for your server, type the following items in to their corresponding fields: The Fully qualified hostname for this VM The VM, database, Server certification authority and Web Console password field, type The locale used for pre-defined objects created during installation (for example en-us) 25

26 The workgroup or NetBIOS domain name for this server The domain for this server (leave blank if domain synchronization and authorization will not be performed) The domain controller for this server If the domain controller hostname is not recognized by the default DNS server, please set this domain controller's IP address as the DNS server for this VM (leave blank if no domain actions will be performed) The administrator account used to join the domain The administrator password used to join the domain (leave blank if your ERA VA will not join a domain) The SNMP manager hostname that will receive forwarded SNMP traps (leave blank if SNMP traps will not be forwarded) The value to enable HTTP forward proxy for caching updates (True or False) 26

27 The IP address for this interface (leave blank if DHCP is desired) The netmask for this interface (leave blank if DHCP is desired) The default gateway address for this VM (leave blank if DHCP is desired) The domain name server for this VM (IP address) Domain from FQDN hostname will be used for short DNS names lookup - optional for DHCP The second domain name server for this VM (IP address) - optional field Press Ctrl+X to close nano editor. You will be prompted to save changes, press Y to save or N to discard changes. Press Ctrl+C to cancel if you want to make more changes. 27

28 Press Enter to confirm your changes and save them to an ovf.xml file. Type shutdown -r now in the root terminal to restart the appliance. Following initial configuration of your ERA VA, you should be able to connect to the ERA Server using the ERA Web Console and start using ESET Remote Administrator. If you are editing the configuration of your existing ERA VA, check to make sure changes were successful. NOTE: You can use the ls command while in shell to list useful text files and scripts such as the following: 28

29 Domain connection troubleshooting: help-with-domain.txt A list of Domain configuration files that should be monitored: configure-domain.sh Join your ERA VA to a Domain if a connection to the DC gets broken: rejoin-domain.sh Allow ports on a firewall: firewall-ports.sh See the ERA VA installation log: appliance-configuration-log.txt See Troubleshooting ERA VA for more information. 29

30 8. Troubleshooting The following log files can be used to troubleshoot the ERA Virtual Appliance. If ERA VA deployment fails, do not restart the appliance and check this log file: /root/appliance-configuration-log.txt ERA Server installation log: /var/log/eset/remoteadministrator/eraserverinstaller.log NOTE: Other ERA components use a similar path and corresponding file name. Check your ERA Server trace logs: trace.log, status.html and last-error.html located in /var/log/eset/remoteadministrator/server/ NOTE: Other ERA components use similar path and file names. ERA Server dumps: /var/opt/eset/remoteadministrator/server/dumps/ More information can be found in Manual ERA VA configuration. 30

31 9. ERA Virtual Appliance FAQ Q: How do I find out which ERA components are installed on my ERA Virtual Appliance and which versions they are? A: A list of installed ERA components and their versions is available in the console window of your ERA Virtual Appliance. Q: How do I upgrade my ERA Virtual Appliance to a newer version? A: Use the Component Upgrade task in ERA Web Console to upgrade to the latest version. Alternatively, you can deploy a new ERA Virtual Appliance and preform a migration, however the component upgrade task is significantly less complicated. Q: How do I enable Apache HTTP proxy on my ERA Virtual Appliance after initial configuration? A: Run the following commands as root in terminal to enable Apache HTTP proxy: 1.echo /opt/apache/bin/apachectl start >> /root/http-forward-proxy.sh 2.echo /opt/apache/bin/htcacheclean -d60 -i -p/var/cache/apache2 -l >> /root/http-forward-prox 3.echo iptables -A INPUT -p tcp --dport j ACCEPT >> /root/firewall-ports.sh 4.echo ip6tables -A INPUT -p tcp --dport j ACCEPT >> /root/firewall-ports.sh 5.reboot This will start Apache HTTP Proxy and enable port 3128 in an firewall. You will need to create policies for all ESET products / ERA components to communicate via Apache HTTP Proxy and allow the caching of installation files / update files for ESET products. For more information see our Knowledgebase article. Q: How do I configure LDAP to allow for Static Group synchronization on ERA VA? A: If the domain join operation fails, it is usually due to incorrect configuration of the ERA VA (ovf.xml), for more information see our Knowledgebase article. Q: I have a problem with ESET Remote Administrator 6.x running on a Hyper-V Server 2012 R2. After logging into ERA Web Console, the error message "Unable to handle Kernel NULL pointer dereference at (null)" is displayed. A: Disable Dynamic memory in virtual computer settings to resolve this issue. Q: Do I need to add other components to my ERA Virtual Appliance? A: No, ERA Virtual Appliance runs out of the box. You just need to deploy the appliance and configure it. It's truly the simplest way to deploy ESET Remote Administrator as long as you use a supported hypervisor. 31

32 Q: How do I change the database parameters after installation on a Linux machine/ova? A: You can change database information on a Linux machine by editing the StartupConfiguration.ini in /etc/opt/eset/ RemoteAdministrator/Server. The same location and file is used in OVA. Q: How do I recover a Forgotten password for ERA Virtual Appliance: A: First, boot your ERA VA in a Single-User Mode, for instructions, see Once you are in the shell in Single-User Mode, you can change your root password using the passwd command. To recover your password for ERA Web Console, see the contents of the following file /etc/opt/ eset/remoteadministrator/server/startupconfiguration.ini Q: I have a problem with RD Sensor running on Hyper-V Server. A: Make sure that MAC address spoofing is enabled in your Hyper-V Manager settings (see below). Q: How do I change the port number of my ERA Virtual Appliance? A: To change the port number, modify the following two files appropriately: /etc/tomcat6/server.xml /root/firewall-ports.sh 32

33 10. DNS Service Record To set up a DNS Resource Record: 1. On your DNS Server (DNS server on your Domain controller), navigate to Control Panel > Administrative Tools. 2. Select the DNS value. 3. In the DNS Manager, select _tcp from the tree and create a new Service location (SRV) record. 4. Enter the service name in the Service field according to DNS standard rules, type an underline symbol ( _ ) in front of the service name (use your own service name, for example _era). 5. Enter the tcp protocol in the Protocol field in the following format: _tcp. 6. Enter the port 2222 in the Port number field. 7. Enter the ERA Server fully qualified domain name (FQDN) in the Host offering this service field. 8. Click OK > Done to save the record. The record will be displayed in the list. To verify the DNS record: 1. Log into any computer in your domain and open a command prompt (cmd.exe). 2. Type nslookup into the command prompt and press Enter. 3. Type set querytype=srv and press Enter. 4. Type _era._tcp.domain.name and press Enter. The service location is displayed correctly. NOTE: This procedure is the same for Windows and Linux. NOTE: Don't forget to change the "Host offering this service:" value to the FQDN of your new server when you install ESET Remote Administrator Server on a different machine. 33