Installing the Connector on RHEL/Rocky Linux

You can configure the firewall, setup the system, download and install the Anyware connector on RHEL/Rocky Linux. If you are currently using Connector on Ubuntu, it is important to read and understand the differences Connector on RHEL/Rocky Linux introduced, To find out the side by side comparison, see Difference between Anyware Connector on Ubuntu and RHEL/Rocky Linux.

The following sections outlines how to download and install the Connector on Rocky Linux and RHEL. There are five main steps involved in this process:

1. Adding the Connector repository
2. Configuring the SELinux components
3. Installing the RPM
4. Generating the Connector Token
5. Connecting to a Remote Workstation with a PCoIP Client

Prerequisite Steps¶

For instructions and documentation on the Connector prerequisite steps when installing on RHEL/Rocky Linux, see Connector System Requirements. It is important to read and address all the prerequisites outlined.

1. Adding the Connector Repository¶

The virtual machine you are adding the repo to must have access to the internet. If it doesn't, you cannot download and install the required files.

Checking Existing Repositories for Anyware Connector¶

If the Anyware Connector was installed previously on your virtual machine, there could be existing repos related to it on your system. Run the command below to check all existing repos related to Anyware Connector (Skip this step if Anyware Connector was never installed on your virtual machine).

dnf repolist teradici-anyware-manager*

Check the current Anyware Connector repo to make sure it is the desired repo that you want to use for installation. If there are unwanted repositories on your VM, see Repository Management to remove them.

Adding a Repository¶

1. To access the scripts and to configure and add the RHEL and Rocky Linux repository, select the Downloads and scripts option from the Anyware Manager support site.

   

   If you see a login button as such:

   

   Click it to log into the site and then proceed.

2. Accept the End User License Agreement, then click Set Up Repository.

   

3. The window expands and displays the setup scripts. Copy the curl script to clipboard.

4. On the machine where you want to install Anyware Connector, run the curl script:

   • RHEL/Rocky 8:

     curl -1sLf 'https://dl.anyware.hp.com/<token>/anyware-manager/setup.rpm.sh' | sudo -E bash 
     

   • RHEL/Rocky 9:

     curl -1sLf https://dl.anyware.hp.com/<token>/anyware-manager/cfg/setup/bash.rpm.sh | sudo -E distro=el codename=8 bash  
     

2. Configuring SELinux Policies¶

The following SELinux policies enable persistent storage and container logging on the Connector. If SELinux policies are not found and the virtual machine is shutdown, the data stored in the Connector is lost.

Once configured, and the installation has verified SELinux, all Connector related data persists when the target machine hosting the Connector is re-booted. To check if selinux is already installed on your system, run the following command:

sudo dnf list installed | grep anyware-manager-selinux

The output from this command notifies if selinux is already running on your system. If it is not, then you need to run the following commands to install the SELinux policies:

1. Run the following command to install the SELinux policies and set the basic framework for persistent database and Vault:

   sudo dnf install -y selinux-policy-base container-selinux
   

2. Run the following command to install a specific version of SELinux that has been tested for K3s:

    sudo dnf install -y https://github.com/k3s-io/k3s-selinux/releases/download/v1.5.stable.1/k3s-selinux-1.5-1.el8.noarch.rpm
   

3. Run the following command to install SELinux from the Anyware Manager repo:

   sudo dnf install -y anyware-manager-selinux
   

3. Installing the Connector RPM¶

Once you have installed and configured the SELinx policies you must install the Connector RPM and configuration files.

Run the following command to install the Connector RPM, the sample configuration files are generated once the install is done:

sudo dnf install -y anyware-connector

4. Generating a Connector Token¶

You must generate a Connector token using the Admin Console. The steps outlined below must be performed on the target virtual machine.

You need to create or have created a deployment prior to obtaining a token. For information on how to log into the Admin Console, see Admin Console Connection. The following section outlines how to obtain a Connector token using the Admin Console:

1. Click Connectors from the console sidebar.
2. Click the add connector button (+ sign located beside Connectors heading) to display the connector creation panel.
3. Enter the following information:
   • Select the deployment you want to add the Connector to. If you do not have an existing deployment you need to create one.
   • Enter the name of the Connector.
   • Follow the step by step instructions outlined below.
4. Click GENERATE.
5. Copy the Connector token by click the copy icon.

You can now use this Connector token when prompted during installation.

5. Configuring the Connector-Example Commands¶

The following section provides example configuration commands for configuring the Connector with Anyware Manager and Anyware Manager as a Service. These example commands use flags, but the same parameters can be configured using the configuration files also.

Configuring the Connector for Anyware Manager¶

Once you have installed the Connector RPM, and have generated a Connector token from the Anyware Manager installed in your enterprise network, run the following commands to configure the Connector to work with the Anyware Manager in your enterprise network. The first line for these commands maps the Connector token to a variable in the shell, the ' ' for the string values are not required if there are no special chars in the string.

Minimum Configuration Sample Command for Quick Start¶

The following command with dummy values configures a Connector with minimum flags to work with the Anyware Manager in your enterprise network. Communications with external integrations such as PCoIP clients, Active Directory server, etc are not secure without certificate validation are not secure without certificate validation, this should only be used for testing purpose.

export token=<token from Anyware Manager Admin Console>
/usr/local/bin/anyware-connector configure \
--manager-url 'https://ipv4.Anyware.Manager.Installable' \
--token $token \
--domain 'testlab.internal' \
--accept-policies \
--enable-ad-sync=false \
--ldaps-insecure \

You can use the minimum command for testing or base installation excluding additional configurations. When editing a workstation, you should manually add workstations from the Admin Console and add a user assignment by the user's UPN as the domain users or computers are synced.

!!! Note: The ability to manually add a user assignment by the user's UPN is supported only in Anyware Manager as a Service combined with Anyware Connector RHEL/Rocky Linux 23.06 or later or Ubuntu Connector version 164 or later."

Typical Configuration Sample Command¶

export token=<token from Anyware Manager admin console>
sudo /usr/local/bin/anyware-connector configure \
--manager-url 'https://ipv4.Anyware.Manager.Installable' \
--token $token \
--domain 'testlab.internal' \
--sa-user 'sampleuser' \
--sa-password 'Passwordstring' \
--ldaps-ca-cert '/home/rocky/DC-Cert.pem' \
--computers-dn 'CN=Computers,DC=testlab,DC=internal' \
--users-dn 'CN=Users,DC=testlab,DC=internal' \
--external-pcoip-ip 'public.ipv4.sg.ip' \
--self-signed \
--accept-policies \
--manager-insecure \
--debug

• --manager-url Sets the Anyware Manager URL that the Connector will connect to. If this flag is not provided, the connector will connect to Anyware Manager as a Service (https://cas.teradici.com). Required for instances of Anyware Manager Installable.

• Installable only: The --manager-ca-cert flag provides the PEM-formatted public certificate for the root CA used to sign the Anyware Manager certificate. This flag is required when Anyware Manager Installable is using a custom certificate that is not signed by a public CA. This flag has no effect when connecting to Anyware Manager as a Service.

• Installable only: The --manager-insecure flag is required if the target Anyware Manager is using self-signed certificates. This flag is not required if Anyware Manager is using trusted TLS certificates signed by a public CA. This flag has no effect when connecting to Anyware Manager as a Service.

• --external-pcoip-ip: Explicitly sets the public IP for PCoIP Client to PCoIP Agent connection, and is highly recommended as a best practice. If not provided, the installer will attempt to automatically resolve the external IP by reaching out to https://cas.teradici.com. This flag is required if automatic resolution fails, or if the Connector does not have a connection to the public internet.

• The first time you install a connector in a deployment, use --computers-dn and/or --users-dn flags to sync AD objects to Anyware Manager. Subsequent connectors installed in the same deployment will automatically inherit the configuration from Anyware Manager.

  If these flags are not provided, the AD sync synchronises all objects from the AD to the Anyware Manager.

• If --self-signed flag is not used, you should use --tls-key and --tls-cert flags to provide the full path and filename of the TLS key and PEM formatted TLS certificate to use.

• If --ldaps-ca-cert flag is not used, you should use either --ldaps-insecure to skip certificate validation, or --enable-ldap-plaintext for test purposes.

Ensure that you use the options and flags that best suit your system architecture and requirements. If required values are not provided on the command line, you are prompted for them. For additional flags and options, see Installation Flags and Options.

Additional Configurations for the Anyware Connector¶

Multi-Factor Authentication¶

When you enable MFA for the Connector for RHEL/Rocky Linux, all PCoIP Clients authenticated through the Connector are prompted to enter MFA credentials. Previously, only the external PCoIP Clients were prompted for MFA information.

Ensure that you use the options and flags that best suit your system architecture and requirements. If required values are not provided on the command line, you are prompted for them. For additional flags and options, see Installation Flags and Options.

Installing the Connector for Internal Connections¶

The following steps outline how to install the Connector for internal connections to bypass MFA:

1. Prepare a virtual machine in your private network that meets the system requirements with the following sub-steps:
   • Skip the step for preparing the system for external access.
   • Skip the step for setting up MFA.
2. Install the Connector with the following sub-steps:
   • If you don't have external users, then you could disable security gateway by passing --enable-security-gateway=false, otherwise it's set to true enabled by default.
   • Do not set the Public IP using the --external-pcoip-ip flag. The Connector returns the virtual machines IP address.
   • No MFA flag is required as MFA is disabled by default.
3. Once you have installed the Connector connect to a remote workstation with a PCoIP Software Client with the following sub-step:
   • In the Host Address or Code field enter the private IP of the internal Connector you just installed and log-in.

Installing the Connector for External Connections¶

The following steps outline how to install the Connector for external connections:

1. Prepare a virtual machine in your private network that meets the system requirements with the following sub-steps:
   • Skip the step for preparing the system for internal access.
2. Install the Connector with the following sub-steps:
   • Set the Public IP using the --external-pcoip-ip flag.
3. Once you have installed the Connector, connect to a remote workstation with a PCoIP Software Client with the following sub-step:
   • In the Host Address or Code field enter the IP address or DNS name of the external Connector you just installed and log-in.

Updating CIDR for Connector Cluster¶

The default CIDR for Connector Cluster are as follows:

• 10.42.0.0/16 cluster CIDR
• 10.43.0.0/16 Service CIDR
• 10.43.0.10 Cluster DNS

If the default CIDRs conflict with your internal network, use the following flags to update the cluster with different CIDR.

To update, run the following command:

sudo anyware-connector configure --cluster-cidr <IP Address> --service-cidr <IP Address> --cluster-dns <IP Address>

Example Command with dummy values:

sudo anyware-connector configure --cluster-cidr 192.168.10.0/24 --service-cidr 172.16.0.0/16 --cluster-dns 172.16.0.10

Installation Flags and Options¶

For detailed information on the installation flags and the configuration file parameters that you can pass during installation, see the table outlined below:

Anyware Manager Flags¶

Connector Flags¶

Connector MultiFactorAuthentication Flags¶

Connector TLS Flags¶

Connector Session Flags¶

Connector Session TrustedCustomerLicensing Flags¶

Connector ClusterNetwork Flags¶

Connector Domain Flags¶

Connector Domain ServiceAccount Flags¶

Connector Domain ADSync Flags¶

Connector OAuth Flags¶

Connector SSO Flags¶

Connector OAuth OpenSSL Flags¶

5. Connecting to a Remote Workstation with a PCoIP Client¶

After successfully installing a Connector, you can initiate a session to connect to a remote workstation with a PCoIP Software Client. We enable customers to use multi-factor authentication for these PCoIP Client sessions. The following steps outline how to connect to a remote workstation using the PCoIP Software Client:

1. Double-click the PCoIP Client desktop icon or program file PCoIPClient to launch the application.
2. In the Host Address or Code field, enter one of the following:
   • For direct connections, provide the address of the host machine.
   • For managed connections, provide the address of the connection manager.
3. Click NEXT.
4. Select your domain and enter the credentials for the remote workstation. If you have enabled MFA then you are prompted for the 2^nd factor passcode. The method of how this passcode is communicated depends on the provider you used. It is usually either a One Time Password or push notification.
5. Click LOGIN.
6. If your login is successful you should be able to select the remote workstation and connect to it. Please note that if you have a single remote workstation, that remote workstation is automatically selected and the connection is initiated immeadiately. In this case you are not presented with a remote workstation selection screen.

For more information about the PCoIP Software Client, please see the following PCoIP Software Client guides:

• PCoIP Software Client for Windows
• PCoIP Software Client for macOS
• PCoIP Software Client for Linux