8

Managing Sun Ray 1 Appliances

This chapter describes how to use the Sun Ray web-based and command-line administration application to manage your Sun Ray 1 enterprise appliances. The following procedures for managing appliances (desktops) are covered:

• "Main Administration Page" on page 102
• "Changing the Administrator's Password" on page 103
• "Viewing System Status" on page 104
• "Listing All Desktops" on page 107
• "Searching for Desktops" on page 109
• "Listing Currently Connected Desktops" on page 111
• "Listing Desktops in Dump Format" on page 112
• "Displaying a Desktop's Current Properties" on page 113
• "Editing Single Desktop's Properties" on page 116
• "Editing the Properties of Multiple Desktops" on page 117
• "Viewing Failover Group Status" on page 119
• "Examining Log Files" on page 125
• "Reset/Restart Sun Ray Services" on page 130
• "Smart Card Usage and Solaris Lock Screen" on page 136
• "Ordering Sun Ray 1 Smart Cards" on page 137

See "Administration Application" on page 91, for background about Sun Ray 1 appliances and the administration application.

For the web-based interface, this chapter assumes you have already launched your browser, and logged in to the web-based application. All of the functionality detailed in this chapter can be reached from the Main (initial) Administration page, as shown in FIGURE 8-1.

For the command-line interface, this chapter assumes you are logged into the Sun Ray server as superuser, have /opt/SUNWut/sbin in your path, and are at a shell prompt.

Main Administration Page

The Main Administration page is initial page displayed once a system administrator successfully logs into the server.

FIGURE  8-1 Main Administration Page

For additional information on the Summary Status data "Viewing System Status" on page 104.

Changing the Administrator's Password

To Change the Administrator's Password

FIGURE  8-2 Changing Administrator's Password Frame

---

Note - Refer to the passwd man page for information on proper syntax for passwords. 

---

Viewing System Status

To View System Status

FIGURE  8-3 System Status Frame

Listing All Desktops

To List All Desktops From the Web-Based Interface

FIGURE  8-4 List All Desktops Frame

To List All Desktops From the Command-Line Interface

Type the following command:      # utdesktop -l

This command displays the complete list of desktops in the administration database. For example:      # utdesktop -l Desktop ID      Location                  Other Info --------------- ------------------------- ---------------------- 08002086e18f    SFO12-2103                Token Reader 080020a85112    SFO12-210      080020a8512c    SFO12-2105                John Smith's office 3 desktops total.

Searching for Desktops

To Search for Desktops From the Web-Based Interface

FIGURE  8-5 Search Results Frame

To Search for Desktops From the Command-Line Interface

Type the following command:      # utdesktop -li <substring>

Where <substring> is the full or partial Desktop ID you want to search for. This command displays the list of appliances in the administration database whose Token IDs match this substring. For example:      # utdesktop -li a851 Desktop ID      Location                  Other Info --------------- ------------------------- ---------------------- 080020a85112    SFO12-2103                 080020a8512c    SFO12-2105                John Smith's office  2 desktops total.

Listing Currently Connected Desktops

To List Currently Connected Desktops From the Web-Based Interface

---

Note - The Authentication Manager must be operating to perform these procedures. 

---

FIGURE  8-6 List of Current Desktops Frame

To List Currently Connected Desktops From the Command-Line Interface

1.

Type the following command:      # utdesktop -lc

The command lists only the desktops that are currently connected to this Sun Ray server and communicating with the Authentication Manager or any other Sun Ray server in the same failover group as this server. For example:      # utdesktop -lc Desktop ID   Location             Current User ------------ -------------------- ------------------------------------------- 080020a85112 SFO12-2103           MicroPayflex.00004f9665000100 (John Parker)  080020a8512c SFO12-2105                                                         2 desktops currently connected.

2.

Type the following command to get a longer listing:      # utdesktop -Lc

The longer listing displays the same information as the normal listing, but adds the Other Info column.

3.

Or you can view currently connected desktops and the servers they are connected to by typing the following command:      # utdesktop -G

Listing Desktops in Dump Format

There is no web-based interface for this procedure.

To Output the Desktop List in Dump Format From the Command-Line Interface

Type the following command:      # utdesktop -o

The command outputs the full list of desktops from the administration database in comma-delimited format. For example:      # utdesktop -o 08002086e18f,SFO12-2103,Token Reader 080020a85112,SFO12-2103, 080020a8512c,SFO12-2105,John Smith's office

The format of each line is:      <Desktop ID>,<Location>,<Other Info>

This output can be saved to a file and used later to perform a batch edit operation. For example, use this command when moving or upgrading a Sun Ray enterprise server.

Displaying a Desktop's Current Properties

To Display a Desktop's Current Properties From the Web-Based Interface

FIGURE  8-7 Desktop Properties Frame

To Display a Desktop's Current Properties From the Command-Line Interface

Type the following command:      # utdesktop -p <Desktop ID>

Where <Desktop ID> is the ID you want to get properties for. The command displays all information about the specified desktop, as obtained from the administration database and Authentication Manager. For example:      # utdesktop -p 080020a85112 Current Properties:   Desktop ID            = 080020a85112   Model                 = CoronaP1   Firmware Revision     = 1.0,REV=1999.04.22.19.24   Location              = SFO12-2103   Other Info            =    Current Status        = Up   Last Status Update at = 04/29/1999 16:06:38   First Connection      = 04/29/1999 15:40:04   Current User          = MicroPayflex.00004f9665000100 (John Parker)

See TABLE 8-4 for descriptions of the fields displayed.

Editing Single Desktop's Properties

To Edit Single Desktop's Properties From the Web-Based Interface

FIGURE  8-8 Edit Desktop Properties Frame

To Edit Single Desktop's Properties From the Command-Line Interface

Type the following command:      # utdesktop -e "<Desktop ID>,<Location>,<Other Info>"

Where <Location> and <Other Info> can be left empty if you want to clear the respective field. The command updates the desktop's information in the administration database. For example:      # utdesktop -e "080020a85112,SFO12-2103,John's Office" 1 Desktop Modified

To specify one of the optional fields, enter no text between the commas. The following example clears the Location field:      # utdesktop -e "080020a85112,,John's Office," 1 Desktop Modified.

Use the output of the utdesktop -o command as input to this command (line by line). Remember to put quotes around the data.
 
 

Editing the Properties of Multiple Desktops

There is no web-based interface for this procedure.

To Edit the Properties of Multiple Desktops From the Command-Line Interface

1.

Prepare a file with the desktop information. Each desktop should be on a separate line. For example:      <Desktop ID>,<Location>,<Other Info>

---

Note - You can use the output of utdesktop -o to create this file. 

---

# utdesktop -ef <filename>

# utdesktop -o > desktops

# cat desktops

08002086e18f,SFO12-2103,Token Reader

080020a85112,SFO12-2103,

080020a8512c,SFO12-2105,John Smith's office

# vi desktops

# cat desktops

08002086e18f,SFO12-2103,Token Reader

080020a85112,SFO12-2103,Desktop 1

080020a8512c,SFO12-2105,Desktop 2

# utdesktop -ef desktops

No modifications necessary for 08002086e18f.

Modified 080020a85112

Modified 080020a8512c

2 desktops modified

1 desktop did not require changes

Viewing Failover Group Status

The Failover Group Status frame (FIGURE 8-9) describes the health and current state of multiple Sun Ray servers within your failover group. It also describes the health of any Sun Ray servers that have responded to a Sun Ray broadcast.

• The Failover Group Status frame provides information on group membership and network connectivity.
• Sun Ray servers are constantly gathering information from other Sun Ray servers including their interface configuration and reachability.
• Failover Group Status only displays public networks and Sun Ray interconnect fabrics.

For example, in FIGURE 8-9, the second column (from the left) is public network (denoted by the 192.144.167.0 IP address). The third and fourth columns display information on two Sun Ray interconnect fabrics.

---

Note - The Sun Ray server broadcasts do not traverse over routers or non-Sun Ray servers. 

---

For more information on Failover Groups refer to the Sun Ray Enterprise Server Software 1.1 Advanced Administrator's Guide. TABLE 8-5 describes the Failover Group status icons
 

TABLE  8-5   Sun Ray Failover (F/O) Group Status Icons 

Icons	Name/Description
	Sun Ray fabric: A Sun Ray interconnect fabric is established and functioning properly.
	Sun Ray fabric - Unreachable: A Sun Ray interconnect fabric is not established. This network is unreachable from the server performing the Failover Group Status. This appears in two scenarios: an alert and a failover situation. The administrator must investigate this situation.
	No-connect: the servers are unreachable. This network is unreachable from the server performing the Failover Group Status. This could be an alert situation. Over a public network the conditions could be normal, except for the Sun Ray broadcast information, which can not traverse over routers.
	Server Up: represents an unconnected server within the group. This icon only occurs in a (row) public network display. It reinforces the fact that the displayed information is from the perspective of the system performing the Failover status.
	Group: Servers that appear in the same group use this icon. The signature files, /etc/opt/SUNWut/gmSignature, on those two machines are identical. Also identifies systems as trusted hosts. Failover will occur for any Sun Ray appliances connected between these systems. The utgroupsig utility is used to set the gmSignature file. Refer to the Sun Ray Enterprise Server Software 1.1 Advanced Administrator's Guide for information regarding the gmSignature file and utgroupsig utility.

.

To View Failover Group Status

1.

Starting at the Main Administration page select Failover->Status.

The Failover Group Status frame appears (FIGURE 8-9).

FIGURE  8-9 Failover Group Status Frame

Interpreting Failover Group Status Information

The status screen displays all of the Sun Ray servers that it sees and identifies group members. It identifies trusted hosts with a group icon (refer to TABLE 8-5), which indicates the server is in a failover group. It also displays, in column format, all of the identified networks (on a per server basis) and whether those networks are public networks or Sun Ray interconnect fabrics. It also lists each server's IP address.

For example, in FIGURE 8-9 there is one public network and two Sun Ray interconnect fabrics. Sun Ray 5 (a) has the potential for failover for all of the Sun Ray appliances that its on the 192.168.128.1 network. On the 192.168.140.0 network (e) they are not intended for failover and considered completely private to Sun Ray 5 (a).

---

Note - The Sun Ray server performing the Failover Group Status should also be reflected in the header of the status frame. For example, notice that Sun Ray 5 is called out in both (a) and (d) locations. 

---

The Sun Ray 5 server can currently communicate with those IP addresses shown in the Failover Group Status frame. Out of all of those addresses, Sun Ray 11 (b) is the only server in the same group as Sun Ray 5. They share the same "Group icon. Established connections to servers appear in the upper-left hand quadrant of the frame and propagate outward from that location. Is is normal to have open cells in the frame.

---

Note - The /24 in the IP addresses is Common InterDomain Routing (CIDR) notation for the subnet mask. This represents the number of bits that are significant as part of the netmask. For example, /24 is the same as 255.255.255.0. 

---

The network/netmask headings (xxx.xxx.xxx.x/24) refer to all of the networks that are observed. Group Membership is represented by the group Icon. Other Sun Ray servers that are visible on the screen, may also be members of another group. That information is not visible until you select a different server, to change the point of view, which refreshes the broadcasted information and reveals other groups. It is possible that multiple groups maybe using the same network IDs for their private interconnect fabrics and this is considered a legitimate configuration. For example, the group Sun Ray 5 and Sun Ray 11 are using a specific network. The connection only exist between those two servers. However, at the same time Sun Ray 41 and Sun Ray 55.

From the Sun Ray 41 point of view, the 192.168.128.1 interconnect fabric is functional. However, from Sun Ray 5's point of view, the Sun Ray 41's 192.168.128.0 network is unreachable (the address space is the same). This means that since two failover groups are using the same network, it could be considered a legitimate configuration.The important note to remember is that they are not sharing a common physical network, just the name for the network.
 

TABLE  8-6   Icon Background Definitions 

Background Color	Description
Dark Blue	Connected
Light Blue/Grey	Alert. Network connection status has changed recently.

 

Example Configurations

An administrator could have several servers (in separate groups) and two of the servers are in one group and two others in another group. They may be connected to the public network, but also have private networks that span between the two servers (in separate groups).

FIGURE  8-10 Sample Network Configuration

Legend:

1. Public Network (129.144.167.0)

2. A= private network (192.168.128.0)

3. Sun Ray 5 Sun Ray enterprise server

4. Sun Ray 11 Sun Ray enterprise server

5. Sun Ray 41 Sun Ray enterprise server

6. Sun Ray 55 Sun Ray enterprise server

7. Failover Group 1

8. Failover Group 2

In FIGURE 8-10, both networks are classified as private networks and are connected to a public network. Corona 5 also uses a private network. Notice that Sun Ray 5 and Sun Ray 41 use the same IP address, but are not physically connected.This is the same situation for Sun Ray 11 and 55. Both private networks, in both segments, have exactly the same amount of address space. Consequently, they never connect and since this is a private network there are no address conflicts.

Examining Log Files

Every time a file is retrieved from the Sun Ray server, it is recorded. The server stores this information in text files. Both the authentication log and the message log files have a numeral as an extension. Many administration activities are logged (including).

• Policy changes
• Login/logout
• Timeout
• Failed login
• Modifying a policy
• Changing a password
• Interrupting a service, user or desktop

Log files which can be viewed from the SunRay server include:

Messages Log File (/var/opt/SUNWut/log/messages) - Lists events from the server's appliances including detail of registration, insertion or removal of smart card. The messages log file is aged daily and archived files are stored on the server for 1 week and are annotated using numeral extensions (for example, from messages.0 to messages.5). Refer to FIGURE 8-11.

Authentication Log File (/var/opt/SUNWut/log/auth_log). Lists events logged from the authentication manager. The auth_log file is aged (up to a limit of 10) every time the server's authentication policy is changed and whenever it is started. The archived authentication files are annotated using numeral extensions (for example, from auth_log.0 to auth_log.9).

Administration Log File (/var/opt/SUNWut/log/admin_log). Lists operations performed when administering the server. This log is aged daily and archived files which are stored on the system for up to one week are annotated using numerical extensions (for example, from filename admin_log.0 to admin_log.5).

The following sections describe how to access a log file.

Viewing Message Logs

To View Messages Logs

FIGURE  8-11 Message Log File Frame

Viewing Authentication Logs

To View Authentication Logs

FIGURE  8-12 Authentication Log File Frame

Viewing Administration Logs

To View Administration Logs

The Administration Log frame appears.

FIGURE  8-13 Administration Log File Frame

Viewing Archived Logs

To View Archived Logs

FIGURE  8-14 Archived Log File Frame

Reset/Restart Sun Ray Services

To Reset Sun Ray Services

FIGURE  8-15 Sun Ray Services Reset/Restart Frame

To Restart Sun Ray Services

1.

Starting at the Main Administration page select Admin->Reset Services.

The Sun Ray Services frame appears (FIGURE 8-15).

Locating Token Readers

The Administration application can locate Sun Ray appliances that have been designated as token readers. These dedicated appliances can be used by site administrators to administer Sun Ray users. Token readers use the smart card ID to register users. Some manufacturers print the smart card ID on the card itself, but many do not. Since all of the administrative functions refer to this token ID, the Sun Ray server software provides a way to designate one or more specific enterprise appliances as dedicated token readers. If you enable an authentication policy with registered users, you need to identify smart card IDs.

To Locate Token Readers

• Starting at the Main Administration page select Admin->Token Readers.

FIGURE  8-16 Token Readers Frame

Restarting Sun Directory Services

If you restart the Sun^TM Directory Services daemon (dsserv), you need to restart the Sun Ray Authentication Manager. The Sun Directory Services (SunDS) daemon might need to be restarted if you change one of its configuration parameters. The following procedure shows the correct order of steps to take if you need to restart SunDS.

To Restart Sun Directory Services

1.

Stop the Sun Ray services:      # /etc/init.d/utsvc stop

2.

Stop the SunDS daemon:      # /etc/init.d/dsserv stop

3.

Start the SunDS daemon:      # /etc/init.d/dsserv start

4.

Restart the Sun Ray services:      # /etc/init.d/utsvc start

Changing Policies

Changing policies involves changing the policy scope. The scope is either local or group (default). For a normal configuration (Group) all policies are the same on all Sun Ray servers (FIGURE 8-17). If the administrator needs to override the default setting, they can choose the Local setting. The local setting binds the policy to the current server and is not applied to other Sun Ray servers.

---

Note - It is recommended to have the same policies on all of the Sun Ray servers in the same failover group. For example, if all of the servers are configured to use the same policies, then when a failover occurs, all policies are remain consistent. 

---

Changing group policies affects all Sun Ray servers in the same group.

Solaris Authentication Considerations

If users are registered you can then indicate whether they need to be authenticated by solaris by entering valid username and password. The administrator can ensure that this happens by selecting the Self Registration Requires Solaris Authentication radio button in the Change Policy frame (FIGURE 8-17). This is separate from the standard dtlogin. For example, if the admin chooses registered, you can have both registered non-smart card users or registered smart card users, or both. But when the admin selects Solaris authentication it refers to any registered user. Non-card users can be defined as psuedo-terminals. Card users are registered users.

Changing the Local/Group Policy

To Change the Local/Group Policy

FIGURE  8-17 Sun Ray Change Policy Frame (Local Policy)

Accessing Online Documentation

Online documentation is available from within the Administration application. When the system administrator logs into the Administration application a locale is selected. This action determines which language is selected for the online documentation (HTML-based). After a successful login, the following (locales-specific) documents are accessible:

• Sun Ray Enterprise Server Software 1.1 Installation Guide
• Sun Ray Enterprise Server Software 1.1 Administrator's Guide (this book)
• Sun Ray Enterprise Server Software 1.1 Advanced Administrator's Guide

---

Note - The Administration application links all languages (locales) to the English HTML documentation. However, the Japanese documentation is provided in HTML format. 

---

To Access Online Documentation

1.

Starting at the Main Administration page select Online Documents.

2.

Select a document from the list.

The documentation appears in the body frame.

Smart Card Usage and Solaris Lock Screen

The following commands are used to lock the screen when a user removes the smart card.

End Users Using CDE

End users can type this command to lock the screen for the current session.
 

% /opt/SUNWut/lib/utaction -d '/usr/dt/bin/dtaction LockDisplay' &

If the user wants to make this feature the default, the command needs to be placed at the end of the .dtprofile file in the user's home directory.

End Users Using OpenWindows

The end users can type this command to lock the screen for the current session. This command needs to be typed on one line.
 

% /opt/SUNWut/lib/utaction -d   '/usr/openwin/bin/xlock -delay 1000000 -mode blank'

If the user wants to make this feature the default, the command needs to be placed at the end of the .xinitrc file in the user's home directory.

System Wide Default

The system administrator can make this the system default by placing this script in /etc/dt/config/Xsession.d as an executable file (named, for example,
/etc/dt/config/Xsession.d/0999.screenlock).
 

#!/bin/ksh # # Turn on screen-lock on disconnect for Sun Ray sessions # if [ "$DTUSERSESSION" != "" -a "$SESSIONTYPE" != "altDt" ] then         /opt/SUNWut/lib/utaction -d '/usr/dt/bin/dtaction LockDisplay' \                 2>/dev/null >/dev/null & else         /opt/SUNWut/lib/utaction -d \                 '/usr/openwin/bin/xlock -delay 1000000 -mode blank' \                 2>/dev/null >/dev/null & fi

 

Ordering Sun Ray 1 Smart Cards

Full commercial orders of smart cards can be placed with your Solaris-Ready vendor. Custom smart cards will bear your company's logo or the vendor's logo. For more information on Sun Ray 1 smart cards, go to the following URL:

http://www.sun.com/sunray1