Single-Node Anyware Trust Center Installation

For small deployments, or as a proof-of-concept test, you can deploy the Anyware Trust Center using the included trust-center-ctl script. This script will create a single-node Kubernetes cluster and install the Anyware Trust Center and its dependencies.

Deploying the Anyware Trust Center involves the following steps:

1. Create a new VM to host the Anyware Trust Center.
2. Choose a domain name for connections to the Anyware Trust Center.
3. Configure DNS for the new machine.
4. Get the installation script from our website.
5. Run the installation script on the Anyware Trust Center machine.

1. Create a New VM

Deploy a dedicated server to host the Anyware Trust Center. The method used to do this will depend on your environment; if you are unsure how to proceed, ask your system administrators.

The Anyware Trust Center requires a dedicated server with the following specifications:

Requirement
Operating System	RHEL 9 Rocky Linux 9
CPUs	4 vCPUs
Memory	16GB RAM
Disk	120GB+, including 80GB+ disk space on /var for persistent volumes. On ESXi or similar hypervisors, the Trust Center does not support installation on Sparse (thin) provisioned disks. Please use raw or thick provisioned disks.
Network	IP network accessible by your endpoints, with configured DNS. The Anyware Trust Center does not support connections via raw IP addresses. TCP 32443 (Communication with Trusted Zero Clients) TCP 443 (Communication with OTA update CDN)
Python	The post-installation and initialization scripts require Python 3.8.2+.
Other software	The OS must have cURL available.

Test Environment Specifications

The Trust Center has been thoroughly tested on Amazon EC2 m5a xlarge, which has the following specifications.

Requirement
vCPUs	4
Memory	16GB RAM
Memory per vCPU	4GB
Physical Processor	AMD EPYC 7571
Clock Speed	2.5GHz
CPU Architecture	x86_64

Older or slower VMs may experience issues during installation, upgrades, or general use of the Trust Center. For optimal performance, we recommend using a newer instance or allocating additional vCPU cores.

2. Choose a Domain Name

The Anyware Trust Center requires 5 domain names added to your DNS records. In this step, you're creating the base domain for the Anyware Trust Center, which will be used to construct the other 4 subdomains. You'll use this value in multiple locations during setup, so record the value and be ready to copy it.

In this procedure, we will use trust-center.example.com to demonstrate the domain name, and how it is leveraged to create the other required values.

3. Create DNS Records

Once your new dedicated server has been created, you must set up the following DNS A records that point to it. For each of the following items, replace <domain-name> with the domain name you recorded in the previous step.

• <domain-name>

  This is the root domain for your Trust Center. This is what is entered on Trusted Zero Clients if anywaretrustcenter is not configured on your LAN.

• api.<domain-name>

  The api subdomain is used by Endpoint Management Systems to control the Trust Center. Sometimes, the EMS requires the api subdomain to be specified, but often only the { domain-name } is required.

• endpoint-connector.<domain-name>

  The endpoint-connector subdomain is used by Trusted Zero Clients to register and communicate with the Trust Center.

• ota.<domain-name>

  The ota subdomain is used by Clients to retrieve Over-the-Air updates from the Trust Center.

• register.<domain-name>

  The register subdomain is used by Trusted Zero Clients to onboard with the Trust Center.

Info

If you manually enter the Trust Center address, you can either:

• Provide the root domain name like this: register.<domain-name>.
• Provide the root domain name without "register". In this scenario, "register" is added to the address as a prefix.

Important: Supporting automatic Anyware Trust Center discovery

If you plan to support automatic Anyware Trust Center discovery by endpoints, you must also create a CNAME record that redirects anywaretrustcenter to register.<domain-name>.

Example Illustrating Use of trust-center.example.com

Using trust-center.example.com as the base domain, you would create DNS records for the following:

• trust-center.example.com
• api.trust-center.example.com
• endpoint-connector.trust-center.example.com
• ota.trust-center.example.com
• register.trust-center.example.com

This example shows a different DNS configuration using Windows DNS Manager:

4. Get the Installation Script

Note: Support account is required

To download the Anyware Trust Center installer, you must have an account on our support site (https://help.teradici.com). You can create one from the login screen if you don't already have one.

To download the installer:

1. Go to https://anyware.hp.com/find/product/anyware-trusted-endpoints/2025.03/anyware-trust-center.
2. If you are not already logged in, click Log in to download and authenticate your session.

3. Click Downloads and scripts:

   

4. Read and accept the End User License Agreement. Once the agreement has been accepted, the download form is shown:

   

5. Provide your chosen FQDN—recorded earlier—in the Trust Center Hostname (FQDN) field, and click Get installation script.

   Note: FQDN field is optional

   The FQDN value is required to run the installer, but you do not have to supply it here. If you leave this field blank, you must manually add the actual FQDN to the script command before executing it.

6. The website will generate a download command and display it:

   

   Copy the entire command displayed. There are two parts, and both are required: a curl command that downloads the installation script, and second command that executes the script.

   The installation script command looks like this:

   curl -sSL https://dl.anyware.hp.com/{token}/trust-center/raw/names/trust-center-tgz/versions/{version}/trust-center_{version}.tar.gz | tar -xz && sudo ./trust-center-ctl install --fqdn {trust-center-FQDN} --token {jwt token}
   

   Important: This script is time-limited

   The generated command is valid for 1 hour, after which installation will fail. If that occurs, return to the download page and generate a new command.

The rest of the steps below take place on the Anyware Trust Center VM. If you acquired the script command on a different machine, transfer it to the Anyware Trust Center VM using any acceptable method.

5. Run the Installation Script

1. Create or choose a directory on your newly-created VM, and enter it. The following example will create and enter a new tc-installation directory:

   mkdir tc-installation
   cd tc-installation
   

2. In a terminal window, paste the installation script command you copied earlier.

   The installation script will download all required packages and install them on the machine. The installer takes approximately 15 minutes to complete. There will be periods of time where the process stops printing messages to the terminal and may appear to hang; this is normal.

   Note: Troubleshooting problems

   If you encounter breaking issues during installation, see troubleshooting for help.

   When executed, the installation command does the following:

   • Downloads the archive for the installer executable
   • Unzips the installer
   • Run the installer as root, passing in two required flags:
   • fqdn: The value must be a valid fully-qualified domain name using only lowercase letters, numbers, and periods, and should point to the location where the Anyware Trust Center is installed.
   • token: the JWT token provided by the support site. This value should not be modified, and is valid for one hour after creation.

   Note: Installation certification errors

   You may see certification errors during installation, which are related to a plugin for Anyware Manager. These errors can be disregarded.

   After installation completes, you will see a message similar to this:

   

3. To validate the installation, run the following command:

   sudo ./trust-center-ctl diagnose
   

   All services should report healthy.

If the diagnostic process finds that the installation completed successfully, you will see log output as shown below, where all service information is indicated as "Health=Healthy". You will not see any "error" in the log.

If the diagnostic process finds that the installation did not complete successfully, you will see log output as shown below, where one or more services indicate an error with "ERROR ...... Health=Unhealthy".

The Trust Center may be unhealthy for the following reasons:

• Some databases used in the Trust Center are not compatible with Sparse (thin) Virtual Disks. This incompatibility can lead to installation failures without clear error messages. If you encounter an installation failure and are using Sparse Disk Images, switch to Thick Disk Provisioning.

• The firewall may be blocking k3s functionality. If this is the case, disable any firewall rules that could be obstructing k3s local network communications.

After Installing

After installation completes, you can set up your management tool to interact and manage Trusted Zero Clients via the Anyware Trust Center.

Refer to the API documentation installed with the Anyware Trust Center for complete details.

Note: The administrator password is automatically generated

The administrator password is automatically generated by the Anyware Trust Center installer, and has the ability to create service account keys. The generated password is placed in the config.yaml file in your installation directory.

<installation_folder>/config.yaml:

global:
images:
    registry: "docker.cloudsmith.io/teradici/trust-center"
    username: "teradici/trust-center"
    password: <repository password>
tc:
    domain: <your domain>
    password: <this is the auto-generated password>
    endpointUpdate: 
      accessKey: <repository password>
      repository: "teradici/trusted-zero-client"

Troubleshooting

Installation failures

Installation can fail on some distributions or environments unless additional configuration is done. Check the additional configuration requirements listed above. If any steps were missed:

1. Uninstall the Anyware Trust Center
2. Perform the relevant configuration steps
3. Install the Anyware Trust Center again. You will likely need to return to the download site and generate a new download command.

Creating a Support Bundle

Support bundles are archives that capture the current state of the Anyware Trust Center, and are used by our support team to diagnose and troubleshoot issues you may experience.

If you need to contact support, generate a support bundle using the procedure detailed in Creating a Support Bundle.

Checking for a Default Gateway

The Anyware Trust Center requires a default gateway to be set on the dark site machine, even without an internet connection.

To check whether a default gateway exists:

1. Open a console window, and run:

   ip route | grep default
   

   If the response looks similar to this example, then a default route already exists, and you can continue with installation:

   default via 10.X.X.X dev ens5 proto dhcp src 10.X.X.X metric 100
   

2. If the response indicates that no default gateway is present, run the following commands to create a dummy route:

   ip link add dummy0 type dummy
   ip link set dummy0 up
   ip addr add 203.0.113.254/31 dev dummy0
   ip route add default via 203.0.113.255 dev dummy0 metric 1000
   

Troubleshooting Hostname Changes

If the hostname of the machine on which the Anyware Trust Center is installed changes after installation, the Trust Center will not start properly.

To resolve this issue, please follow the troubleshooting steps in troubleshooting.