SUSE Linux Enterprise Point of Service

Transcription

1 FAQ SUSE Linux Enterprise Point of Service Frequently Asked Questions March 2012

2 2 W h a t i s S U S E L i n u x E n t e r p r i s e P o i n t o f S e r v i c e? SUSE Linux Enterprise Point of Service is the only enterprise-class Linux operating system optimized and tailored specifically for the retail industry. Built on the solid foundation of SUSE Linux Enterprise, it provides a reliable, flexible and open platform for point of service and point of sale terminals, kiosks, self-service systems and reversevending systems. W h a t c h a l l e n g e s d o e s S U S E L i n u x E n t e r p r i s e P o i n t o f S e r v i c e a d d r e s s? With SUSE Linux Enterprise Point of Service, you can: Reduce your total cost of ownership through lower-cost software and hardware and simplified management Increase the flexibility of your point of service devices and image building and management Enhance the reliability and uptime of your point of service devices Utilize stronger security to prevent data loss Explore all vendor options: SUSE Linux Enterprise Point of Service is open and compatible with many systems, and virtually eliminates vendor lock-in Get a complete solution through the global SUSE partner ecosystem H o w d o e s S U S E L i n u x E n t e r p r i s e P o i n t o f S e r v i c e w o r k? The SUSE Linux Enterprise Point of Service architecture consists of three main components: one centralized administration server, one or more branch servers, and the point of service terminals. These can be standard PCs running retail check-out applications or specialized point of sale machines such as cash registers and customer kiosks. p. 2

3 3 All system information (system structure, image information, the configuration and deployment method for each branch server and point of service terminal, etc.) is stored in an LDAP database on the administration server. The administration server usually also holds the master repository for the images required to boot and configure the terminals and provides the utilities required to build those images. Each branch server downloads the system information and images required for its local point of service terminals from the administration server. The terminals, in turn, download their respective images from the branch server when they boot. W h a t e x a c t l y a r e t h e f u n c t i o n s o f t h e a d m i n i s t r a t i o n s e r v e r? The administration server is the central administration point for SUSE Linux Enterprise Point of Service. It is usually located in the main office and is used to manage the entire point of service infrastructure, to host the LDAP database and to create images to send to the branch servers. The LDAP server running on the administration server stores the configuration of the point of service clients, the configuration of new terminals (and which images to deploy to the terminal) needs to be accepted in a YaST module. The administration server: Maintains the master LDAP directory for the branch server systems Usually provides the tools to create and customize system images and stores the system images for distribution to the branch servers and point of service terminals Stores the configuration parameters for the branch servers Provides the infrastructure to distribute the system images and software updates to the branch server systems Supports Network Time Protocol (NTP) time synchronization for the branch servers Consolidates the syslog output from the branch servers (optional) W h a t d o e s t h e b r a n c h s e r v e r d o? The branch server provides the network boot and system management infrastructure for the point of service terminals. It can also serve as a generic system platform for in-store applications such as database systems and back ends for point of service applications. In your system, the branch server: Runs DNS services for the local network May run DHCP to control the network boot process. Conversely, instead of setting up the DHCP service on the branch server, an external DHCP server can be used Provides a multi-cast boot infrastructure for point of service terminals Transfers system images from the administration server to the terminals The branch server uses a software distribution mechanism to pull new system images from the administration server. It then downloads the system images and configuration files to the point of service terminals. Other than emergency handling, no system administration is necessary on the branch server. All administrative tasks are controlled from the central administration server or are regularly executed by daemons running on the branch server. For emergencies and debugging, all administrative functions can be triggered locally or via SSH login by calling scripts with few or no command line parameters. If you need to update the point of service images stored on the branch server, you can manually trigger the update process and download new image files from the administration server. Similarly, if you need to update the hardware configuration information stored on the branch server, you can p. 3

4 4 run commands that regenerate the hardware configuration and configuration address files for all point of service terminals found in LDAP. W h a t a r e s o m e o f t h e k e y c a p a b i l i t i e s i n S U S E L i n u x E n t e r p r i s e P o i n t o f S e r v i c e 1 1? SUSE Linux Enterprise Point of Service 11 includes several exciting innovative capabilities, such as: Templates for use by the Kiwi image building tool instead of inflexible, prebuilt images Support of offline branch server setup to help install the environment for newly opened shops that have no direct connection with the central LDAP yet. You can export all LDAP data for a specific branch server on the administration server to a file, and you can set up a branch server with local LDAP cache from an export file Tools to migrate LDAP settings and configuration from Novell Linux Point of Service 9 servers to SUSE Linux Enterprise Point of Service servers Security enhancements (e.g., encrypted LDAP communication, ACL certificates) New features in the Kiwi image building tools Extended documentation, including ready-to-run setup example scripts W h a t e n h a n c e m e n t s h a d b e e n a d d e d w i t h S U S E L i n u x E n t e r p r i s e P o i n t o f S e r v i c e 1 1 S e r v i c e P a c k 1 With SUSE Linux Enterprise Point of Service 11 Service Pack 1, we have added features such as: Role-based configuration: You can choose from several images directly on the point of service terminal at boot time Delta image support: The service pack comes with a tool that takes one operating system image as the baseline and another as the target. It then creates a file that only contains the difference (or delta) between the two images. This feature helps you deploy critical security updates much faster and at a much lower cost. It also helps you keep the initial download size low if you have many similar images to deploy to your branch. Customizable images Easy rollback to a previous image version directly from the terminal and that is triggered remotely Problem solving tools, based on SUSE Linux Enterprise 11 support tools A n d w h a t i s n e w w i t h S U S E L i n u x E n t e r p r i s e P o i n t o f S e r v i c e 1 1 S P 2? SUSE Linux Enterprise Point of Service 11 Service Pack 2 features several enhancements and updated functionalities. To name just a few enhancements, SUSE Linux Enterprise Point of Service 11 SP2: integrates the Subscription Management Tool for SUSE Linux Enterprise to easily help you keep your environment up-to-date. This tool lets you centrally manage software updates within the firewall on a persystem basis. You can maintain corporate security policies and regulatory compliance while also tracking your entitlements across large deployments. By downloading all patches at once, the Subscription Management Tool helps reduce redundant use of bandwidth. While SUSE provides this Linux management tool with every subscription, other companies charge for it. offers an extended rollback functionality that stores all related configuration files, custom PXE configurations and similar associated files. p. 4

5 5 allows you to set the hostname of a terminal at register time (first boot), a functionality that is very similar to the IBM IRES2 role-based configuration. supports RAID-1 (redundant array of independent disks level 1) with SUSE Linux Enterprise Point of Service PXE images making it possible to create images that provide for two-disk mirroring on a terminal in a transparent way in order to deliver better resilience and availability of data while also improving performance. improves security by offering support for encrypted disks on terminals to encrypt both data and root partitions and provides the administrators with the functionality necessary to build Payment Card Industry Data Security Standards (PCI DSS) compliant systems. ships with the latest version of KIWI, a full-blown imaging suite that allows you to configure, build and deploy your own operating system images. As KIWI is also used within other SUSE products (e.g. SUSE Studio), this provides for a better integration with the entire product family. comes with an image template to create a complete branch server, based on the central configuration information stored in the central LDAP data base. Using the imaging infrastructure on the administration server, you can easily build ready-to-go branch server images with Image Creator and KIWI. features a new posadmin-gui, a graphical tool that makes it easy for you to create new branch server, image and cash register objects. ships with built-in LDAP (Lightweight Directory Access Protocol) validation and checking. You can automatically perform a simple validation and checking during each posadmin addition or modification call. H o w a r e t h e p o i n t o f s e r v i c e c l i e n t i m a g e s c r e a t e d? SUSE Linux Enterprise Point of Service automates the roll-out of terminals as much as possible. To assist in this automation, the product makes extensive use of image building technology. For each type of terminal, whether it is a non-graphical system or a graphical environment, you can create customized images to be downloaded automatically from the branch server when the terminal boots. To help get you started, SUSE Linux Enterprise Point of Service comes with a set of pre-built image templates that you can customize to set up your own system. Every terminal requires two images: a boot image and a system image. The boot image contains the kernel and a bootstrap image, providing the minimum your terminals need to initially start up from a bootable CD or USB stick, or from the network (via remote boot technology). You can also create your own images. SUSE Linux Enterprise Point of Service uses Kiwi as the main tool for creating system images. YaST provides Image Creator, a GUI front end to Kiwi for easy image building, but you can also use a command line tool. Install the image building tools by selecting the SUSE Linux Enterprise Point of Service Image Server and the SUSE Linux Enterprise Point of Service images software patterns in YaST. When you build images for the point of service terminals, all the information required to run the terminal the Linux operating system, drivers, configuration settings, application files and so forth can be compiled into a single image file. This file can then be electronically distributed to terminals over the network. Additionally, you can generate an ISO version of the image file that can be burned to a CD or copied to a USB stick for manual distribution. p. 5

6 6 I n w h a t e n v i r o n m e n t s c a n I u s e S U S E L i n u x E n t e r p r i s e P o i n t o f S e r v i c e? SUSE Linux Enterprise Point of Service is broadly scalable so that a small shop with five point of service terminals can be managed just as well as a large chain with one thousand branches. For organizations with several branch servers, the link between the branch and administrative servers is maintained over WAN. During execution of administrative tasks, such as the installation of new point of service terminals in a branch, steps must be taken to ensure that the WAN link to the administration server is available. W h y s h o u l d I c h o o s e S U S E L i n u x E n t e r p r i s e P o i n t o f S e r v i c e o v e r a W i n d o w s b a s e d s o l u t i o n? There are several good reasons to choose SUSE Linux Enterprise Point of Service over a Windows-based solution for your retail environment. The most important arguments, however, might be: Technically, image building for point of service clients is made very easy You can reduce your total cost of ownership (TCO) You ll get a very secure and reliable solution C a n y o u t e l l m e m o r e a b o u t t h e t e c h n i c a l a d v a n t a g e s o f t h e i m a g e b u i l d i n g? From a technical point of view, with SUSE Linux Enterprise Point of Service, you can easily create and deploy tailored images, which is not possible with Windows Embedded Point of Service (WEPOS) or POSReady SUSE Linux Enterprise Point of Service uses the image builder Kiwi that lets you automatically generate your image templates, while with WEPOS you have to manually redo and adapt your images. And, with SUSE Linux Enterprise Point of Service you can flexibly customize and tailor your images as you need them and as they fit for your hardware, from very small footprints to even large images. Also the deployment of new or patched images works automatically and makes administration and maintenance more simple. H o w c a n I r e d u c e m y T C O w i t h S U S E L i n u x E n t e r p r i s e P o i n t o f S e r v i c e? Regarding total cost of ownership, SUSE Linux Enterprise Point of Service eliminates operating system licensing fees and enables you to pay only for the maintenance subscriptions and services that add value to your business. You can use your SUSE Linux Enterprise Point of Service operating system during your subscription period for whatever hardware system you want. It is not tied to a specific device like WEPOS is. This means you can buy new hardware or re-purpose old hardware as often as you want. You need only one subscription for each machine you have deployed. During times you don t use a certain point of service system, you don t even pay for it. With WEPOS you have already paid for that system in advance, even if you don t use it. During the subscription period you can upgrade from an older version of SUSE Linux Enterprise Point of Service to the newest version without any additional costs. And with SUSE Linux Enterprise Point of Service, you don t have to think about client access licenses. In addition, SUSE Linux Enterprise Point of Service is based on the SUSE Linux p. 6

7 7 Enterprise platform and shares a common code base with all other products. You literally have a solution that can work across your entire infrastructure. This helps you reduce the complexity of your environment and leverage the existing skills of your staff. W h a t a r e t h e s e c u r i t y a d v a n t a g e s o f S U S E L i n u x E n t e r p r i s e P o i n t o f S e r v i c e? For many retailers, Windows security issues are a serious concern. But with Linux there is a proven alternative. The strong security of Linux, like its reliability, comes from its advanced design. Unlike Windows, which typically gives applications and users access to the Windows kernel, SUSE Linux Enterprise creates a strong wall of separation between the kernel and users. Each layer of Linux has limited access to the others, which reduces the risk of unauthorized access to your system and data. W h a t a r e t h e t e c h n i c a l r e q u i r e m e n t s f o r S U S E L i n u x E n t e r p r i s e P o i n t o f S e r v i c e? The following system requirements should be fulfilled for the administration server: Supported processor platform: x86, x86-64 Disk space: 4 GB (minimum); recommended are 15 GB (The required space depends on the size of your images) RAM: 512 MB (minimum); recommended 512 MB - 3 GB (at least 512 MB per CPU) One network card If you need to set up a dedicated image building server in addition to the administration server, the following system requirements should be met: Supported processor platform: x86, x86-64 Disk space: 4 GB (minimum); recommended are 25 GB (The required space is dependent on the size of your images) RAM: 512 (minimum); recommended 512 MB - 3 GB (at least 512 MB per CPU) One network card If you decide to run your administration server with image building components, the following system requirements apply: Supported processor platform: x86-64, x86 Disk space: 25 GB (minimum); this will vary depending on the number and size of the images RAM: 512 MB (minimum); recommended are 512 MB-3 GB with at least 512 MB per CPU To run your branch server(s), the following system requirements apply: Supported processor platform: x86, x86-64 Disk space: 4 GB (minimum); recommended are 10 GB (The required space is dependent on the size of the images you distribute to your Point of Service terminals) RAM: 512 MB (minimum); recommended 512 MB - 3 GB (at least 512 MB per CPU) At least two network cards per server - one for the Administration Server's public network and one for the Branch Server's private network If you plan to set up an administration/branch server combination, the following system requirements should be met: p. 7

8 8 Supported processor platform: x86, x86-64 Disk space: 4 GB; recommended are 25 GB (The required space is dependent on the size of your images) RAM: 512 MB (minimum); recommended 512 MB - 3 GB (at least 512 MB per CPU) One network card With regard to the client, the following system requirements apply: Supported processor plattform: x86 Disk space: 4 GB (minimum); recommended are 10 GB (empfohlen) RAM: 256MB (minimum), recommended are 512 MB (Lower requirements, e.g. diskless clients, might be supported depending on your needed feature set) H o w c a n I i n s t a l l S U S E L i n u x E n t e r p r i s e P o i n t o f S e r v i c e? To install the SUSE Linux Enterprise Point of Service server, you must install the SUSE Linux Enterprise Server base system first. You can choose to install the SUSE Linux Enterprise Point of Service add-on together with your base system during the initial installation process, or you can install the SUSE Linux Enterprise Point of Service addon on top of an already installed base system at a later time. For the exact installation instructions, please refer to the SUSE Linux Enterprise Point of Service Guide at H o w c a n I s e c u r e m y S U S E L i n u x E n t e r p r i s e P o i n t o f S e r v i c e e n v i r o n m e n t? A SUSE Linux Enterprise Point of Service setup includes various components that should be secured against intentional and unintentional tampering with the data and against software misbehavior. SUSE Linux Enterprise Point of Service comes with tools and capabilities that help you to secure your complete solution. It not only supports encrypted communication between the servers and uses security certificates, but also ships with all security tools delivered with SUSE Linux Enterprise Server, like VPN, Secure Shell, integrated firewall, AppArmor application security framework, and more. Securing your setup involves several different aspects. First and foremost, every server component of the SUSE Linux Enterprise Point of Service setup must be secured against unauthorized access. Physically isolating the servers from other machines is just one aspect of providing physical security. All servers connected with each other over potentially insecure networks take the administration server and the branch servers for example need to be secured against unauthorized access via the networks they are connected to. Both the administration server and the branch server contain vital data that needs to be protected to maintain a fully functional and secure setup. The most important part in this is securing the LDAP directory on the administration server that is used to maintain the system structure, configuration and deployment method for all branch servers and Point of Service terminals, and other important data. And finally, once physical, network and data security are provided, you should tighten the security of your setup even further by using AppArmor. AppArmor profiles are used to confine applications and keep them from performing unnecessary file or directory accesses and this helps to make sure that every profiled application just does what it was designed to and not become a security risk itself. p. 8

9 9 For detailed information on how to secure your SUSE Linux Enterprise Point of Service environment, please refer to the security chapter of the SUSE Linux Enterprise Point of Service Guide at H o w c a n I p r e v e n t m y S U S E L i n u x E n t e r p r i s e P o i n t o f S e r v i c e s e t u p f r o m e x p e r i e n c i n g d o w n t i m e? The SUSE Linux Enterprise Point of Service architecture is highly centralized. However, administrative tasks can also be performed on subunits for role-based administration. Moreover, although the LDAP directory is not replicated on the branch server, the branch server provides all the services necessary for the operation and management of the point of service terminals. Consequently, the branch server and can function independently of the administration server in the event of server failure or downed connection. If you need a high availability environment, branch servers can be configured in two-node pairs. The primary node runs all of the scripts and services required to download branch server configuration information, synchronize time, and download system images from the administration server. The secondary node stays synchronized with the primary, ready to take over and run the scripts and services if the primary fails. For information on installing a high availability environment, refer to the general high availability guide, available from D o e s S U S E L i n u x E n t e r p r i s e P o i n t o f S e r v i c e s c a l e? The flexibility of the architecture of SUSE Linux Enterprise Point of Service provides broad scalability so that in large environments components can be distributed to improve system performance, while in smaller environments components can be consolidated to maximize the use of system resources. However, the recommended maximum number of point of service terminals being serviced by a single branch server is 100. You can adjust this number up or down depending on how frequently the terminals are re-imaged and whether you can control when the terminals come online. I a m r u n n i n g S U S E L i n u x E n t e r p r i s e P o i n t o f S e r v i c e 1 0 / N o v e l l L i n u x P o i n t o f S e r v i c e 9. C a n I u p g r a d e t o S U S E L i n u x E n t e r p r i s e P o i n t o f S e r v i c e 1 1? SUSE Linux Enterprise Point of Service subscriptions are sold for one- or three-year durations. A subscription entitles you to updates, new product releases, maintenance and installation support. Renewing your subscription ensures that you continue to receive these benefits. Subscriptions cover multiple versions of SUSE Linux Enterprise Point of Service, including SUSE Linux Enterprise Point of Service 10. As long as you have an active subscription to one of these previous versions of SUSE Linux Enterprise Point of Service 11, you can upgrade anytime to the new version. It also ships with tools to migrate the LDAP settings and configurations from SUSE Linux Enterprise Point of Service 10 servers to SUSE Linux Enterprise Point of Service 11 servers. Please also keep in mind that you should p. 9

10 10 always update your administration server to the latest service pack to make sure your environment is up to date and fully maintained. If you run an environment based on Novell Linux Point of Service 9, please contact your SUSE sales representative, as Novell Linux Point of Service 9 has reached end of life. I a m r u n n i n g I B M R e t a i l E n v i r o n m e n t f o r S U S E L i n u x ( I R E S ), c a n I u p g r a d e o r r e n e w t o S U S E L i n u x E n t e r p r i s e P o i n t o f S e r v i c e? The IBM Retail Environment for SUSE Linux is based on Novell Linux Point of Service 9, which has reached end of life. Technically, however, you can upgrade anytime to SUSE Linux Enterprise Point of Service during your active subscription period. For the actual upgrade or renewal process, we recommend you reach out to your IBM contact or IBM channel partner. D o I n e e d t o u p g r a d e m y c o m p l e t e p o i n t o f s e r v i c e e n v i r o n m e n t t o t h e n e w v e r s i o n o f S U S E L i n u x E n t e r p r i s e P o i n t o f S e r v i c e? If you prefer to keep your point of service client systems untouched, there are a several options. In any case, you should upgrade your administration server to SUSE Linux Enterprise Point of Service 11. Then: If your branch server runs SUSE Linux Enterprise Point of Service 11, you can continue to run your point of service clients on SUSE Linux Enterprise Point of Service 10, or you can decide to upgrade them to SUSE Linux Enterprise Point of Service 11 If you decide to keep your branch server running SUSE Linux Enterprise Point of Service 11, you can still run your point of service images on SUSE Linux Enterprise Point of Service 10 However, please be aware that for building images for your point of service client devices running a different version from the version that is installed on your administration server (where you usually would build your POS client images), you need to set up a separate image build server running the same operating system version than your point of service client devices. H o w m u c h d o e s S U S E L i n u x E n t e r p r i s e P o i n t o f S e r v i c e c o s t? The pricing of SUSE Linux Enterprise Point of Service 11 is as follows: Basic Standard Priority Client 1-year Client 3-year Branch Server 1-year Branch Server 3-year Administration Server 1-year Administration Server 3-year $37 $56 $106 $99 $152 $285 $213 $323 $610 $580 $870 $1,640 $362 $550 $1,040 $980 $1,480 $2,790 p. 10

11 11 Please contact your local SUSE sales team for purchase, or visit: W h e r e d o I g e t m o r e i n f o r m a t i o n? For more information about SUSE Linux Enterprise Point of Service, please visit For more information on how to install and configure SUSE Linux Enterprise Point of Service, please visit For general information about SUSE Linux Enterprise subscription and renewals, please visit SUSE. All rights reserved. SUSE and the SUSE logo are registered trademarks of Novell in the United States and other countries. All other third-party trademarks are the property of their respective owners. p. 11