Extending Remote Desktop for Large Installations. Distributed Package Installs

Transcription

1 Extending Remote Desktop for Large Installations This article describes four ways Remote Desktop can be extended for large installations. The four ways are: Distributed Package Installs, List Sharing, Report Aggregation, and HTMLReports. Distributed Package Installs lets a single administrator install packages to clients attached to multiple task servers. List Sharing enables administrators to easily share Remote Desktop computer lists and credentials. Report Aggregation lets a single administrator view reports for computers attached to multiple task servers. HTML Reports demonstrate how the Remote Desktop database can be accessed to present report data on the web. Distributed Package Installs Distributed package installs allow you distribute package installations from a single administrator computer to multiple delegate administrators. This is useful when you have several administrators managing different groups of computers but want to control updates from a single location. There are three components involved in distributed package installs: the Register Admin application, the Remote Desktop Assistant application, and the Distribute Package Drop Box Automator workflow.

2 Distributed Package Install Overview Register Admin (installed on delegate administrators) The Register Admin application connects a delegate administrator to the administrator computer. Register Admin Application NOTE: Delegate administrators do not support remote task servers. If you have a remote task server, then you need to install Remote Desktop Administrator on the remote task server. Remote Desktop Assistant (installed on the administrator computer) Remote Desktop Assistant displays package installation progress in the Task Monitor tab. Delegate administrators send progress to the administrator computer at various stages of a distributed package installation.

3 Remote Desktop Assistant Application Distribute Package Drop Box (installed on the administrator computer) Distribute Package Drop Box is an Automator workflow that distributes packages from the administrator computer to the delegate administrators. Setup Distributed Package Drop Box Automator Workflow

4 Preparation Determine the administrator computer connection parameters (network address, username, and password). This is the username and password of the user who will run Remote Desktop Assistant to view task progress On the administrator computer, create a computer list in the Remote Desktop administrator named Delegation Servers. Add all of the delegate administrators to this list On the administrator computer, go to System Preferences -> Sharing and make sure Remote Login is turned on. Delegate Administrator Setup (repeat for each one) 1. Under System Preferences->Sharing, verify Remote Login is enabled. 2. Copy Register Admin to the hard drive 3. Launch Register Admin application 4. Enter the address, username, and password of the administrator computer. TaskMonitorAgent will be installed and start running at this point, and is responsible for communication with the administrator computer 5. Due to a known issue in Remote Desktop, you must start Remote Desktop, select the All Computers list, and leave Remote Desktop running for the delegated package install. Otherwise you may get Not Authorized errors. Make sure the All Computers list remains selected. Setting up a delegate administrator with Register Admin SECURITY NOTICE: an SSH key-pair will be created from each delegate administrator to the administrator computer. That means the delegate administrator will have remote login access to the administrator computer without a password (i.e. it will be possible to ssh to the administrator computer from the delegate administrator without a password). To remove access to the administrator computer from a specific delegate administrator, you must delete the entry for the delegate administrator from the ~/.ssh/authorized_keys file on the administrator computer (where ~ is the home folder of the administrator computer (e.g. /Users/admin)). Administrator Computer Setup 1. Copy Remote Desktop Assistant to the hard drive 2. Copy Distribute Package Drop Box to the hard drive

5 Perform a Distributed Package Install 1. Start Remote Desktop Assistant on the administrator computer. 2. Drag and drop a package on the Distribute Package Drop Box Drag and drop the package to install on the Distribute Package Drop Box 3. Monitor installation progress in Remote Desktop Assistant

6 Monitor installation progress in Remote Desktop Assistant

7 List Sharing List Sharing allows you to share computer lists with other administrators. You can publish your lists and download lists created by others. When you download a list that has new computer entries you will also get the login credentials. There are two components involved in List Sharing: the Shared List Repository and Remote Desktop Assistant. Shared Lists Repository (installed anywhere) The Shared Lists Repository is a computer on the network that stores the available computer lists for sharing. An non-administrator account should be created on the Shared Lists Repository. Each list sharing participant needs this username and password to connect to the Shared Lists Repository. Remote Desktop Assistant (installed on each computer that will share lists) Remote Desktop Assistant can connect to the Shared List Repository in order to publish computer lists and download computer lists published by other users. Setup Shared Lists Repository 1. Go to System Preferences -> Account and create a new non-administrator account. 2. Go to System Preferences -> Sharing and verify Remote Login is turned on. Also verify the account you created in the previous step has permission to make a remote connection. Remote Desktop Assistant 1. Copy Remote Desktop Assistant to the hard drive 2. Launch Remote Desktop Assistant 3. Click Remote Desktop Assistant -> Configure Lists Repository 4. Enter the address, username, and password for the repository 5. Click Configure Configure an administrator to connect to the list share repository Using the Application

8 Publishing Your Lists 1. Start Remote Desktop Assistant 2. Select the List Sharing tab 3. Click File -> Select Lists to Publish (NOTE: If there are no lists then you haven t created any lists in Remote Desktop). 4. Check the lists to publish 5. Select either the List Repository password or set a custom password for each list. 6. Click Publish. NOTE: The main list sharing window only shows lists published by other administrators so your lists will not appear there. Select lists to publish Downloading Lists 1. Start Remote Desktop Assistant 2. Select the List Sharing tab 3. Check the lists you want to download. 4. Press the Sync button. If you try to sync to a list that is not using the List Repository password, then you will be prompted to enter the password for the list. 5. Start Apple Remote Desktop to see the imported lists.

9 Select lists to sync

10 Report Aggregation Report aggregation merges reports collected by delegate task servers into a single master task server. This allows all reports to be viewed from a single administrator computer. The report aggregation scripts are located in the aggregation folder. You will need to modify config.php for your environment and run PostgreSQLNetworkConfig.sh and aggregate.sh as described in the Setup section below. Report Aggregation Overview Setup 1. Identify the computers that will fill the following roles: Administrator computer (1 computer) Master task server (1 computer) NOTE: It is possible for the administrator computer and the master task server to be the same computer in the case of running a local task server. Delegate task servers (1 or more computers) 2. On the administrator computer, download and install PHP configured for PostgreSQL from Use PHP or later for Apache 1.3. Be sure to follow the installation instructions. This package configures Apache and installs PHP in /usr/local/php5. To run the scripts, use /usr/local/php5/

11 bin/php <scriptname>. This version of PHP is required to connect to the PostgreSQL database used by Apple Remote Desktop. 3. On the administrator computer, open Terminal and verify you are running the bash shell. If you are not sure, simply enter bash <return>. 4. Run cd <aggregator-folder> to change into the aggregator folder (where <aggregator-folder> is the path to your aggregator folder). Type ls <return> and you should see the following output: Contents of the aggregator folder 5. On all task servers (both master task server and delegate task servers) you must enable TCP/IP connections to the Remote Desktop PostgreSQL database by running: $ sudo./postgresqlnetworkconfig.sh If this is not the first time you have run this script, you will be prompted to run the following command first: $ sudo./revertpostgresnetworkconfig.sh The RevertPostgresNetworkConfig.sh script reverts all changes made to some of the PostgreSQL configuration files since PostgreSQLNetworkConfig.sh was run. 6. You may be prompted to re-run PostgreSQLNetworkConfig.sh because Apple Remote Desktop will reinstall the PostgreSQL database if it thinks something has been corrupted. Occasionally this happens after running the script and when it does the changes the script makes are reverted and therefore the script must be run again.

12 Running PostgreSQLNetworkConfig.sh 7. Collect the PostgreSQL passwords for all the task servers (including the master task server). You can do this from the administrator computer by using the Send UNIX Remote Desktop command to send the contents of the GetPostgreSQLPassword.sh script to all the task servers. To do this: 7.1.Open GetPostgreSQLPassword.sh, select all and copy Copy the contents of the GetPostgreSQLPassword.sh file 7.2.Open Remote Desktop.app 7.3.Select the delegate task servers

13 Select the delegate task servers 7.4.Click Manage->Send UNIX Command 7.5.Paste the contents of the GetPostgreSQLPassword.sh into the text field. Paste contents of GetPostgreSQLPassword.sh into the text field 7.6.Select the User: option for Run command as: and enter root in the field. 7.7.Click Send and record the password output from each task server. The first line of the output on each task server is the database username and the second line is the password for that username.

14 Viewing the output of GetPostgreSQLPassword.sh 7.8.If the master task server is a local task server, simply run sudo./getpostgresqlpassword.sh from the command line. The first line of output is the database username and the second line is the password. Running GetPostgreSQLPassword.sh 8. Use the information gathered in the previous step to configure the config.php file. You must add an entry for each delegate task server to config_taskserverstosnarf

15 and you must modify config_mastertaskserver so that it points to the database on the master task server. Updating config.php 9. To avoid entering passwords several times every time you run the scripts, you should setup an SSH key-pair between the machine running Remote Desktop and the master task server (see SSH Key-pair Setup below for more information). If you do not setup an SSH key-pair, you must setup a password for root on the master task server. You can do this by logging on as an administrator user to the master task server and running the following command: $ sudo passwd root Optional SSH Key-pair Setup aggregate.sh uses SSH to communicate between the master task server and the administrator computer where the reports will be displayed. In order to avoid entering the root password for the master task server several times when you run aggregate.sh, an SSH key-pair can be setup between the two machines. 1. Run ssh-keygen with no options as the user on the administrator computer who will display the aggregated reports. Be sure to enter a blank password when prompted. 2. Copy the file created by ssh-keygen (~/.ssh/id_rsa.pub) on the administrator computer to /var/root/.ssh/authorized_keys on the master task server by running the following command (replacing with the IP address or hostname of your master task server): $ ssh root@ cat < ~/.ssh/id_rsa.pub ">>" /var/root/.ssh/authorized_keys 3. Make sure you can ssh to root@<taskserver> (where <taskserver> is the hostname or IP address of the master task server) from the localhost without entering a password Running the Script The aggregate.sh script merges reports from the delegate task servers into the master task server and adds computer entries into the administrator when necessary. The script, aggregate.sh, can be setup to run as a cron job from the Remote Desktop administrator computer (the computer where the reports will be displayed).

16 1. On the administrator computer, Quit Remote Desktop.app, if it is running. 2. Open Terminal, cd to the aggregate folder, and run aggregate.sh. Running aggregate.sh 3. Start Remote Desktop.app 4. You should now see a computer entry for each computer that has a report stored in one or more of your delegate task servers 5. Select some newly added computers 6. Click Report -> System Overview Select the computers added by aggregate.sh

17 Defining a report 7. Click Get Report (make sure Rebuild data for report is not checked.) 8. View the report Viewing a report

18

19 HTMLReports HTMLReports demonstrates how to access and Apple Remote Desktop database using PHP. A version of PHP that can access the PostgreSQL database must be installed. The PHP package at meets the criteria. Setup This setup shows you how to install HTMLReports using the Personal Web Server. You will be able to access the pages with your web browser by navigating to 1. Install Entropy s version or later PHP5 module for Apache Copy the HTMLReports folder to your Sites folder in your home folder. Copy the HTMLReport folder to the Sites folder 3. Select System Preferences -> Sharing and start Personal Web Sharing.

20 Starting Personal Web Sharing 4. Configure the PostgreSQL database on the task server to accept TCP/IP connections. See Report Aggregation setup for more information. 5. Update the config_mastertaskserver entry in the config.php in the HTMLReports folder to point to the database running on the task server you want to connect to. NOTE: This is a different config.php than the one setup for report aggregation, but the format is similar. See Report Aggregation setup for more information. Updating config.php for HTMLReports 6. Open Safari and navigate to (make sure you replace yourusername with your username). The following page should be displayed.

21 Viewing HTMLReports in Safari