NoMachine Server Administrator's Guide for the Enterprise Advanced Functions

Transcription

1 NoMachine Server dministrator's Guide for the Enterprise - dvanced Functions D-309_006-NMS-D pproved by: mended: NoMachine Server dministrator's Guide for the Enterprise dvanced Functions Page 1 of 45

2 NoMachine Server dministrator's Guide for the Enterprise - dvanced Functions D-309_006-NMS-D pproved by: 1. NoMachine dministrator's Guide - dvanced Functions mended: Feature Comparision dvanced Functions and the Default Behavior Document Convention 4 Page 2 of 45

3 NoMachine Server dministrator's Guide for the Enterprise - dvanced Functions D-309_006-NMS-D pproved by: 1.4. Resources on the Web 2. Groups of Users mended: Creating a Group dding an User to a Group Updating a Group Listing Groups Deleting a Group 8 3. Profiles Resources vailability vs. Profiles Disabling Profiles Listing Profiles Creating Rules Updating Rules Removing Rules Profile Rules to Manage Sessions llowing or Forbidding Session Types Rules for Sessions on the Remote Node Limiting the Number of Connections on the Remote Node llowing or Forbidding Sessions on the Remote Node Profile Rules to Manage Services 5.1. llowing or Forbidding Services 6. Profile Rules to Manage Features Managing Features Limiting Bandwidth Controlling Clipboard Functionalities 22 Page 3 of 45

4 NoMachine Server dministrator's Guide for the Enterprise - dvanced Functions D-309_006-NMS-D pproved by: mended: 6.4. Enabling or Disabling Manual Node Selection Enabling or Disabling Support for Guest Users on Linux Enabling or Disabling Multi-node Support n Overview of Multi-Node NoMachine User dministration on the Node Host dding a System ccount Removing a System account Setting-up the Multi-Node Environment 9.1. dding the Node to the Server 10. Configuring the Multi-Node Environment Enabling or Disabling the Manual Selection of the Node Limiting Number of Concurrent Connections on the Node Creating a Pool of Nodes for Specific User(s) Customizing the Connection Timeout between the Node and Server Managing the Multi-Node Environment Listing the vailable Nodes Modifying Values Set for the Node Keeping Node Resource List Up-to-Date Using a Custom lgorithm for Load-Balancing Virtual Desktops Using the Node Load verage for Load-Balancing Virtual Desktops Managing ccess to the Nodes Enabling and Disabling Connections to the Node Removing the Node from the List of vailable Nodes Disable Direct ccess to an Enterprise Desktop Installation Disabling Multi-Node Support 33 Page 4 of 45

5 NoMachine Server dministrator's Guide for the Enterprise - dvanced Functions D-309_006-NMS-D pproved by: 13. Federating the Enterprise Servers into a Cluster mended: Prerequisites Setting-up and Configuring the Cluster dding a Machine to the Cluster Updating the Cluster Configuration Deleting a Machine from the Cluster Guest ccounts Enabling the utomatic Provision for Guest ccounts Configuring the utomatic Provisions for Guest ccounts Setting Disk Quota for Guest ccounts Configuring Guest Sessions Creating Profiles for Guest ccounts dding a Guest ccount Manually Listing Guest ccounts Removing a Guest ccount Redirecting the Session Redirecting on a Per-Client Basis Specifying a Family of Client IPs or Hostnames to be Redirected Listing Per-Client Redirection Directives Modifying Per-Client Redirection Directives Removing Per-Client Redirection Directives Redirecting on a Per-User Basis Listing Redirection Directives for Users Editing the per-user Redirection Directives Disabling Per-User Redirection Directives 41 Page 5 of 45

6 NoMachine Server dministrator's Guide for the Enterprise - dvanced Functions D-309_006-NMS-D pproved by: mended: 16. ccess Remote Desktops by RDP and VNC Enabling RDP and VNC (RFB) Sessions NoMachine dministrator's Guide - dvanced Functions Welcome to the System dministrator's guide for NoMachine version 4. This guide deals with the following advanced functionalities: User and System Profiles. Multi-node support. utomatic generation of guest accounts (for Linux only). Session redirection on a per-client or per-user basis. ccess Remote Desktops by RDP and VNC and applies to all the supported platforms Feature Comparision NoMachine offers a range of products suitable for the Enterprise whicha are differentiated by the functionalities included. You can consult the up-to-date list of functionalities available for each server typology on the NoMachine web site at: dvanced Functions and the Default Behavior Multi-node capabilities and profiles are enabled by default. The automatic provision of guest accounts on Linux hosts has to be explicitly activated by setting the proper profile rule. In the same way, multi-node capabilities and profiles can be disabled/enabled by means of profile rules. Disabling profiles implies that the server doesn't rely on any of the rules that may have been set to tune its behaviour. This means that if you want to make effective, for example the disabling of the multi-node support or the enabling of automatic generation of guest accounts, you need to have profiles enabled. Redirect capabilities are always available but ineffective until you instruct the server to redirect connecting clients or users. Support for RDP and VNC sessions is disabled by default. You need to configure NoMachine for activating it. It's necessary that you have the RDP and VNC client installed on the NoMachine server host Document Convention The following conventions are used in this guide: Page 6 of 45

7 NoMachine Server dministrator's Guide for the Enterprise - dvanced Functions D-309_006-NMS-D pproved by: mended: BaseDirectory indicates the base directory where the NoMachine binaries and libraries are installed. By default, BaseDirectory is "/usr" on Linux, "C:\Program Files\" on Windows and "/pplications" on Mac OS X. Samples included in this guide refer to the the default location for the NX installation. Notices: Operations such as start/stop a service, create/remove users and similar are intended to be executed by a privileged user, even when done via the administrative UI. Server and node commands are intended to be run from xterm or similar and from CMD console on Windows. They require administrative privileges. For a complete list of all server and node commands, run respectively 'nxserver --help' and 'nxnode --help' from xterm or similar. Server and node configuration files are server.cfg and node.cfg, respectively. They are placed in the BaseDirectory/NX/etc directory on Linux, BaseDirectory/NoMachine/etc directory and Windows and BaseDirectory/NoMachine.app/Contents/Frameworks/etc on Mac OS X. Portal Server includes the web player application. Its configuration file, webplayer.cfg is stored in the same etc directory. The same applies to the Cluster Server configuration file, cluster.cfg. ll the configuration files can be edited via a text editor, e.g. 'vi' on Linux and Mac OS X and 'notepad' on Windows. To set a value different from the default the configuration key must be uncommented, i.e., the '#' pre-pended to the configuration key name must be removed. When a configuration key supports an on/off status, set value to '0' to disable it and to '1' to enable it. Changes to configuration files become effective at the next session startup, without the need to restart the server Resources on the Web The NoMachine website, provides a variety of online resources in conjunction with the software and its usage: The NoMachine Packages The latest version of the NoMachine packages is available at: Latest News To stay updated with the most recent releases of the NoMachine software, as well as the latest news, Page 7 of 45

8 NoMachine Server dministrator's Guide for the Enterprise - dvanced Functions D-309_006-NMS-D pproved by: mended: please subscribe to the mailing list: The Installation Guides For detailed information about how to install and upgrade your NoMachine installation, view the guides available at: The Knowledge Base The NoMachine Knowledge Base, provides technical documents especially for administrators as well as end-user guides, articles, and howto's. Leave Feedback bout This Guide Our goal is to provide comprehensive and clear documentation for all NoMachine products. If you would like to send us your comments and suggestions, you can use the contact tool available at selecting Web Quality Feedback as your option. 2. Groups of Users NoMachine Server allows to define groups of users. Each user can be assigned to a group so that profile rules or specific settings (like for example redirection) can be defined on a per-group basis and applied to all users belonging to such group Creating a Group The general form of the command to create a group is: nxserver --groupadd GROUP OPTION where GROUP is the name of the group and OPTION can be: --redirect <server:port> --priority <priority> redirect the user's connectio assign a priority level to the groups. If a rule is set for m overrides the other settings Example: Create the 'Developers' group with priority '2' and redirect it to testdrive.nomachine.com nxserver --groupadd Developers --priority 2 --redirect testdrive.nomachine.com 1. NX Server Installation Guide The general form of the command to add an already existing user to a group is: nxserver --useradd USERNME --group GROUP where USERNME and GROUP are respectively the name of the user and of the group. Page 8 of 45

9 NoMachine Server dministrator's Guide for the Enterprise - dvanced Functions D-309_006-NMS-D pproved by: mended: If the user doesn't yet have a system account, it's possible to assign it to a group while creating the system account: nxserver --useradd USERNME --group GROUP --system dd user nxtest01 to group 'testers' nxserver --useradd nxtest01 --group testers Create user developer01 and add it to group 'developers' nxserver --useradd developer01 --group developers --system 2.3. Updating a Group The general form of the command to change settings for a group is: nxserver --groupedit GROUP OPTION where OPTION can be: --redirect <server:port> --priority <priority> redirect the user's connection to the spec assign a priority level to the group. The s different groups. If a rule is set for multip high priority overrides the other settings 2.4. Listing Groups The general form of the command to list groups and their attributes is: nxserver --grouplist This command lists all users divided on a per-group basis Tip You can verify to which group a user belongs by running: nxserver --userlist 2.5. Deleting a Group Page 9 of 45

10 NoMachine Server dministrator's Guide for the Enterprise - dvanced Functions D-309_006-NMS-D pproved by: mended: The general form of the command is: nxserver --groupdel GROUP where GROUP is the name of the group 3. Profiles In the default configuration, NoMachine server has support for profiles enabled. profile is defined by a set of rules applied by default on a per-server basis. Rules on per-server basis apply to all users which log-in to that server and to all nodes added to that server. Some definitions for the profile behaviour: Rules scope is on a per-system basis, if not otherwise specified. It can be also on a per-user, per group, per-guest and per-node basis, when applicable. Rules are grouped into classes. Each of them is made of a number of class types. For each rule it is necessary to define the following items: class, class type, value and option. Option indicates on which basis the rule has to be applied (e.g. per-system, per-user etc...). Rules concerning the server behaviour (enable/disable use of profiles, multi-node support and automatic generation of guest accounts) can be applied only on a per-system basis. Rules enabling/disabling the manual selection of the node can be set on a per-system or per-user basis. Rules set for guest accounts apply to all guest users and do not affect other users. Support for the automatic generation of guest accounts must be enabled in profiles. This feature is available only on Linux. Default profile of NoMachine server Until the administrator explicitly defines a set of rules, the server relies on its default profile, which allows all the supported functionalities, except for automatic generation of guest accounts and the manual selection of the remote node. llow and deny class types rule to allow or deny a class type (e.g. forbid a session type) or set a behavior (e.g. limit the bandwidth usage) has to be explicitly set, otherwise the server continues to rely on its default behaviour. Modify rules Page 10 of 45

11 NoMachine Server dministrator's Guide for the Enterprise - dvanced Functions D-309_006-NMS-D pproved by: mended: You can change value set for a rule by simply re-adding it and specifying its new value. Rules and profiles disabled If profiles are disabled, you may still create and/or delete rules, but the server doesn't rely on any of these rules until profiles are enabled again. NoMachine server tools to manage profiles NoMachine server provides a command line interface to create rules for setting profiles and retrieve information Resources vailability vs. Profiles NoMachine server and each of the nodes are able to provide a list of their resources. When the node is local, its list corresponds to the one of the server. Resource list reports what is available on that host, for example which session type can be run or which service (audio, printing etc...) is supported. The default profile of the server is based on that list and can be modified by setting profile rules. The general form of the command to retrieve a complete list of all resources is: nxserver --resourcelist OPTION where OPTION can be: --class <class> --value --user USERNME --guest --node NODE filter results by class. Classes are: session, service, feature and node filter results by value show resources for the specified user show resources available for guest accounts (available on Linux only) list all resources available on the node The availability of some resources strictly depends on the system: this is the case of services like audio, microphone, sharing and printing which can rely on a third party software for example on Linux. Retrieve a complete list of all resources nxserver --resourcelist Retrieve resources for the class feature nxserver --resourcelist --class feature Page 11 of 45

12 NoMachine Server dministrator's Guide for the Enterprise - dvanced Functions D-309_006-NMS-D pproved by: mended: Retrieve resources available for user: nxtest01 nxserver --resourcelist --user nxtest01 --value yes Retrieve resources not available for guest users nxserver --resourcelist --guest --value no Retrieve which kind of sessions are available on that server nxserver --resourcelist --class session --value yes Retrieve list of resources available on the remote node testdrive.nomachine.com nxserver --resourcelist --node testdrive.nomachine.com:4000 Setting profile rules is like creating a subset of available resources. When the user logs in to the system, NoMachine Server verifies what is allowed for that user by comparing available resources and set of profile rules Disabling Profiles Support for Profiles is enabled by default. The general form of the command to enable or disable use of profiles is: nxserver --ruleadd --class feature --type enable-profiles --value --system Disable profiles: nxserver --ruleadd --class feature --type enable-profiles --value no --system Enable profiles: nxserver --ruleadd --class feature --type enable-profiles --value yes --system 3.3. Listing Profiles The general format of the command is: nxserver --rulelist OPTION OPTION can be any of the following: --system --user USERNME --guest --node NODE --class CLSS --group GROUP list list list list list list only the rules defined for the server all the rules set for the specified user all rules defined for guest accounts all the rules set for the specified node all the rules set for the specified class all the rules set for the specified group Page 12 of 45

13 NoMachine Server dministrator's Guide for the Enterprise - dvanced Functions D-309_006-NMS-D pproved by: mended: If no option is provided, list all the rules set in the NX Profile DB. Note that this command will show only rules that are effectively set. List all the rules set for the system nxserver --rulelist --system List all the rules set for user: nxtest nxserver --rulelist --user nxtest List all the rules set for class: service nxserver --rulelist --class service List all the rules set for class: service for node: testdrive.nomachine.com nxserver --rulelist --class service --node testdrive.nomachine.com:4000 List all the rules set for group: Developers nxserver --rulelist --group developers 3.4. Creating Rules The general format of the command is: nxserver --ruleadd --class CLSS --type TYPE --value value OPTION CLSS can be any of the following classes: --session --service --feature --node For each class there is a number of available types, which are listed in detail in the following paragraphs. Depending on TYPE, value could need to be specified as 'yes' or 'no', or as value. OPTION can be any of the following options, depending on the type of rule: --system set the rule on a per-server basis. The NX System and to every user accessin --user USERNME set the rule on a per-user basis. The r specified user only Page 13 of 45

14 NoMachine Server dministrator's Guide for the Enterprise - dvanced Functions D-309_006-NMS-D pproved by: mended: --guest the rule will be applied to all guest use users. Guest accounts are available on --node NODE set the rule for the specified NODE on --group GROUP set the rule for the specified GROUP. Tip You can always omit the --system parameter, the server assumes that query is per-server if not otherwise specified Updating Rules To modify the value set for a rule it is enough to add the same rule by specifying the new value in the --value option 3.6. Removing Rules The general format of the command is: nxserver --ruledel OPTIONS OPTIONS can be any of the following options: --system remove all the rules set for the serve --user USERNME remove all the rules set for the specified user --guest remove all the rules set for guest accounts --node NODE remove all the rules set for the specified group --group GROUP set the rule for the specified GROUP. Remove all the rules set on a per-server basis (it removes also rules set for the nodes) nxserver --ruledel --system Remove all the rules set for node: testdrive.nomachine.com nxserver --ruledel --node testdrive.nomachine.com:4000 Remove rules set for user nxtest only nxserver --ruledel --user nxtest Page 14 of 45

15 NoMachine Server dministrator's Guide for the Enterprise - dvanced Functions D-309_006-NMS-D pproved by: mended: Remove all the rules set for guests nxserver --ruledel --guest Remove all the rules set for group: Developers nxserver --ruledel --group developers 4. Profile Rules to Manage Sessions 4.1. llowing or Forbidding Session Types The general form of the command is: nxserver --ruleadd --class session --type TYPE --value OPTION Where TYPE can be any of the available session types listed below. Note that creating rules for session types from 6 to 13 work only if server is configured to emulate NX behavior and relies on the list of available session types. Please consult the NoMachine Server dministrator's Guide for the Enterprise for more information about emulating a server vailable on TYPE Possible Values Description Windows, Mac OS 1 physical-desktop Connect to a X, Linux remote desktop session. Linux 2 unix-xsession-defau lt Linux 3 shadow Linux 4 windows Linux 5 vnc Linux 6 unix-console Run the default virtual desktop as set on the system Connect to a virtual desktop session Run a RDP session encapsulated into a virtual session Run a VNC session encapsulated into a virtual session Run a virtual Unix console application. It can be embedded into the player session window or be a floating window console depending on the user's Page 15 of 45

16 NoMachine Server dministrator's Guide for the Enterprise - dvanced Functions D-309_006-NMS-D pproved by: mended: Linux 7 unix-desktop Linux 8 unix-application Linux 9 unix-gnome Linux 10 unix-kde Linux 11 unix-xdm Linux 12 unix-default Linux 13 unix-script path to the script Windows, Mac OS X, Linux 14 vms Solaris Sparc (obsolete) 15 unix-cde choice: run or not the command in a virtual desktop Run a virtual custom application embedded into the player session window Run a virtual custom application. It can be embedded into the player session window or be a floating window application depending on the user's choice: run or not the command in a virtual desktop Run a virtual GNOME desktop Run a virtual KDE desktop Run a virtual desktop through the X Desktop Manager Run a virtual session by using the default X client script on server Run a virtual session by using the X client script on server as specified by path Connect to a VMware virtual machine configured for being available via VNC Run a virtual Solaris Common Desktop Environment. This session type is dismissed since v. 4.0 Page 16 of 45

17 NoMachine Server dministrator's Guide for the Enterprise - dvanced Functions D-309_006-NMS-D pproved by: mended: OPTION can be: --system --user USERNME --guest node NODE --group GROUP Forbid use: nxtest to connect to virtual desktops running on that host nxserver --ruleadd --class session --type shadow --value no --user nxtest Forbid guest users to connect to physical desktop of server host machine: nxserver --ruleadd --class session --type physical-desktop --value no --guest Forbid user nxtest to run RDP sessions nxserver --ruleadd --class session --type vindows --value no --user nxtest Forbid all users to run VNC sessions on node testdrive.nomachine.com nxserver --ruleadd --class session --type vnc --value no --node testdrive.nomachine.com:22 Forbid user nxtest to run a KDE session nxserver --ruleadd --class session --type unix-kde --value no --user nxtest Tips If your server supports only connections to the physical desktop, do not forbid physical-desktop type on per-system basis or you will be no longer be able to connect by NoMachine to that host. Starting from version 4, when user requests to create a new virtual deskop, NoMachine runs the default desktop environment set on the system. To provide a list of available desktops, configure the server to emulate behavior of In this case, or when user is connecting using client 3.5.0, it makes sense to create a rule to forbid unix-kde or unix-gnome session type Rules for Sessions on the Remote Node The general form of the command is: Page 17 of 45

18 NoMachine Server dministrator's Guide for the Enterprise - dvanced Functions D-309_006-NMS-D pproved by: mended: nxserver --ruleadd --class node --type TYPE --value OPTION TYPE is: TYPE limit Possible Values numeric value <node:port> Description Limit the maximum number of concurrent sessions on the node Manage access to the specified node where <node:port> is the name of the node as listed by the nxserver --nodelist command. Name of the remote node is made of a hostname(or IP):port pair, as it appears in the list of nodes. OPTION for the rule to limit the number of concurrent sessions on the node is: --system --node <node:port> OPTION in case of rule for limiting access to the remote nodes is: --system --user USERNME --guest --group GROUP 4.3. Limiting the Number of Connections on the Remote Node The number of connections allowed on the remote node can be limited on a per-node basis or for all the nodes. The general form of the command is: nxserver --ruleadd --class node --type limit --value <value> OPTION OPTION is: --system --node <node:port> Page 18 of 45

19 NoMachine Server dministrator's Guide for the Enterprise - dvanced Functions D-309_006-NMS-D pproved by: mended: Limit the number of connections to 15 on node: testdrive.nomachine.com nxserver --ruleadd --class node --type limit --value 15 --node testdrive.nomachine.com:4000 Limit the number of connections to 10 on all nodes nxserver --ruleadd --class node --type session-limit --value 10 --system 4.4. llowing or Forbidding Sessions on the Remote Node The general form of the command is: nxserver --ruleadd --class node --type <node:port> --value OPTION OPTION is: --system --user USERNME --guest --group GROUP Forbid guest users to run sessions on node: testdrive.nomachine.com nxserver --ruleadd --class node --type testdrive.nomachine.com: value no --guest Forbid user: nxtest01 to run sessions on node: testdrive.nomachine.com nxserver --ruleadd --class node --type testdrive.nomachine.com:22 --value no --user nxtest01 5. Profile Rules to Manage Services 5.1. llowing or Forbidding Services The general form of the command is nxserver --ruleadd --class service --type TYPE --value OPTION TYPE is: TYPE audio Possible Values Description Manage sup server to us Page 19 of 45

20 NoMachine Server dministrator's Guide for the Enterprise - dvanced Functions D-309_006-NMS-D pproved by: microphone client-printer-sharing server-printer-sharing client-disk-sharing server-disk-sharing client-file-transfer server-file-transfer client-network-sharing server-network-sharing session-recording client-usb-sharing server-usb-sharing client-smartcard-sharing mended: Manage sup user's pc to Manage con server side Manage con user's pc Manage con user's pc to Manage con server to us Manage the user's pc to Manage the side to a sp Manage con...) from use Manage con...) forwardi Manage cre session Manage for pc to serve Manage for to user's pc Manage for to server si OPTION is: --system --user USERNME --guest --node NODE --group GROUP Tip Two-way services such as printer sharing or USB forwarding can be disabled or enabled on one side only, or on both. To disable or enable the service from client to server, set the rule named as client-servicename (e.g. client-printer-sharing). To completely disable the service, set the rules for both client and server side. Forbid connecting disks Page 20 of 45

21 NoMachine Server dministrator's Guide for the Enterprise - dvanced Functions D-309_006-NMS-D pproved by: mended: nxserver --ruleadd --class service --type server-disk-sharing --value no system nxserver --ruleadd --class service --type client-disk-sharing --value no system Disable audio support for guest users nxserver --ruleadd --class service --type audio --value no --guest Forbid file printing from local to remote for all users nxserver --ruleadd --class service --type client-printer-sharing --value no Disable USB forwarding for all users nxserver --ruleadd --class service --type client-usb-sharing --value no system nxserver --ruleadd --class service --type server-usb-sharing --value no --system Disable microphone on node testdrive.nomachine.com nxserver --ruleadd --class service --type microphone --value no --node testdrive.nomachine.com:22 6. Profile Rules to Manage Features 6.1. Managing Features The general form of the command is: nxserver --ruleadd --class feature --type TYPE --value value OPTION TYPE is: TYPE Possible Values bandwidth client-clipboard value server-clipboard manual-node-selection enable-guest enable-multinode enable-profiles De Se Ma sid Ma pc Ma wh sta ba Ma ac Ma su de the Ma OPTION can be, depending on the feature type: Page 21 of 45

22 NoMachine Server dministrator's Guide for the Enterprise - dvanced Functions D-309_006-NMS-D pproved by: mended: --system --user USERNME --guest --node NODE --group GROUP Tips Rules for enabling/disabling multi-node support, the automatic generation of guests accounts and use of profiles can be applied only on a per-server basis. Rules for enabling/disabling the manual selection of the node can be applied instead on a per-server or per-user basis. Enable support for guest users nxserver --ruleadd --class feature --type enable-guest --value yes --system Forbid copy&paste operations for user: nxtest nxserver --ruleadd --class feature --type client-clipboard --value no --user nxtest nxserver --ruleadd --class feature --type server-clipboard --value no --user nxtest llow user: nxtest to choose the remote node where the session has to be started nxserver --ruleadd --class feature --type manual-node-selection --value yes --user nxtest Set limit on bandwidth usage on node testdrive.nomachine.com nxserver --ruleadd --class feature --type bandwidth --value 1G --node --user nxtest testdrive.nomachine.com: Limiting Bandwidth The general form of the command is: nxserver --ruleadd --class feature --type bandwidth --value VLUE OPTION VLUE is the value to be assigned to bandwidth, expressed in byte, kilobyte, megabyte or gigabyte. The unit of measure has to be specified as it follows: byte -> B or b kilobyte -> K or k megabyte -> M or m gigabyte -> G or g OPTION is: --system --user USERNME Page 22 of 45

23 NoMachine Server dministrator's Guide for the Enterprise - dvanced Functions D-309_006-NMS-D pproved by: mended: --guest --node NODE Limit the bandwidth to 256K for each the guest users nxserver --ruleadd --class feature --type bandwidth --value 256k --guest Limit the bandwidth to 1G for user: nxtest nxserver --ruleadd --class feature --type bandwidth --value 1G --user nxtest Limit the bandwidth to 1G when a user runs sessions on node: testdrive.nomachine.com nxserver --ruleadd --class feature --type bandwidth --value 1G --node testdrive.nomachine.com: Controlling Clipboard Functionalities The general form of the command is: nxserver --ruleadd --class feature --type TYPE --value OPTION TYPE can be: client-clipboard or server-clipboard. OPTION is: --system --user USERNME --guest --node NODE --group GROUP Disable copy&paste operations from within the NX session to local for all users nxserver --ruleadd --class feature --type server-clipboard --value no --system Disable copy&paste operations for guests nxserver --ruleadd --class feature --type client-clipboard --value no guest nxserver --ruleadd --class feature --type server-clipboard --value no guest Disable copy&paste operations on node testdrive.nomachine.com nxserver --ruleadd --class feature --type client-clipboard --value no --node testdrive.nomachine.com:4000 nxserver --ruleadd --class feature --type server-clipboard --value no --node testdrive.nomachine.com:4000 Page 23 of 45

24 NoMachine Server dministrator's Guide for the Enterprise - dvanced Functions D-309_006-NMS-D pproved by: mended: 6.4. Enabling or Disabling Manual Node Selection This applies only to Linux Nodes supporting virtual desktop sessions. The manual node selection is disabled by default, i.e. it is up to the server to automatically select the node where the new session has to be started. The general form of the command to enable or disable the manual node selection is: nxserver --ruleadd --class feature --type manual-node-selection --value OPTION OPTION is: --system --user USERNME --guest --group GROUP llow user: nxtest to select the node where to start the NX session nxserver --ruleadd --class feature --type manual-node-selection --value yes --user nxtest llow all users to select the node where to start the session nxserver --ruleadd --class feature --type manual-node-selection --value yes --system Disable the manual node selection nxserver --ruleadd --class feature --type manual-node-selection --value no --system 6.5. Enabling or Disabling Support for Guest Users on Linux The automatic generation of guest accounts is available only on Linux platform and it is disabled by default. The general form of the command to enable or disable support for guest users is: nxserver --ruleadd --class feature --type enable-guest --value --system Enable the automatic provisioning of guest accounts nxserver --ruleadd --class feature --type enable-guest --value yes --system Page 24 of 45

25 NoMachine Server dministrator's Guide for the Enterprise - dvanced Functions D-309_006-NMS-D pproved by: mended: Disable the automatic provisioning of guest accounts nxserver --ruleadd --class feature --type enable-guest --value no --system Tip Behaviour of the server when support for guest users is active can be tuned via the Server configuration file. Note that the Server by default tries to set 'guest' as GID (Group Identifier) for the guest user. To successfully create guest accounts, It is necessary that this group is present on the system or that the server is configured to set a different group Enabling or Disabling Multi-node Support The general form of the command to enable or disable multi-node is: nxserver --ruleadd --class feature --type enable-multinode --value --system If the node is a Linux host and virtual desktop sessions are available, the server adds this node automatically to the list of nodes available for load-balancing. Tip In the case of Linux nodes with support for virtual desktop sessions, if you have disabled load balancing, you can still have access to the remote nodes by enabling the manual selection of the nodes. Disabling Multi-node nxserver --ruleadd --class feature --type enable-multinode --value no --system Enabling Multi-node nxserver --ruleadd --class feature --type enable-multinode --value yes --system 7. n Overview of Multi-Node In its default configuration, NoMachine Server with multi-node support has multi-node capabilities enabled. Multi-node support By default, if no remote node has been added, the session always starts on the server host machine (localhost). Localhost stays in the list of available nodes unless the administrator explicitly stops or removes it from Nodes db. When a node is added to the server, it is automatically included in the list of available nodes unless otherwise specified. It is however possible to keep the node out of this list at any moment. Page 25 of 45

26 NoMachine Server dministrator's Guide for the Enterprise - dvanced Functions D-309_006-NMS-D pproved by: mended: Set-up a multi-node environment In order to set up a multi-node environment, it is necessary to install the NoMachine Enterprise Server on the machine which acts as single entry point (the server) and Enterprise Desktops and/or Enterprise Nodes on the remote node hosts. Multi-node with physical desktops Phisical desktops of all nodes are displayed when the end-user is prompted with the list of available connections in the client GUI. This list appears as soon as the user authenticated to the server. Load-balancing of virtual desktops The selection of the remote node is made by the server according to a round-robin mechanism applied to the list of nodes stored in the Nodes db. It's possible to configure the server to use a weighted round-robin algorithm. Load-balancing applies only to nodes supporting virtual desktops (NoMachine Enterprise Nodes). Selecting where to start a new virtual desktop manually If manual node selection is enabled in the per-server or per-user profile, the server provides the list of available nodes to its clients so that the end-user can decide on which node the new session will start. Session persistence Virtual Desktop sessions started on a node are persistent: user can disconnect and reconnect their virtual sessions and leave applications running unless the server is configured to disable reconnection capabilities. NoMachine Server and high availability NoMachine Enteprise Server provides a fallback mechanism to keep sessions alive in case of server failure or even for maintenance operations. t least 2 Enterprise Servers are necessary to create a cluster. 8. NoMachine User dministration on the Node Host 8.1. dding a System ccount The general form of the command is: nxnode --useradd USERNME --system OPTIONS OPTIONS on Linux and OS X can be any of the following options. If no option is specified, the node will create the account using the default settings configured for the useradd system command: --home HOMEDIR specify the user's home don't create the user's home --nohome Page 26 of 45

27 NoMachine Server dministrator's Guide for the Enterprise - dvanced Functions D-309_006-NMS-D pproved by: mended: If no option is specified, the user's home is created according to the system configuration. Create a system account for user: nxtest nxnode --useradd nxtest --system Create a system account for user: nxtest01, without home directory nxnode --useradd nxtest01 --system --nohome 8.2. Removing a System account The general form of the command is: nxnode --userdel USERNME --system OPTION OPTION on Linux and Mac OS X is any of the following: --home HOMEDIR remove the user's home --nohome don't remove the user's home. This is the default behavior. Delete system account for user: nxtest and remove the home directory nxnode --userdel nxtest --system --home 9. Setting-up the Multi-Node Environment These are steps necessary to set-up a multi-node environment: Step 1 - Users must have the same system account on both node and server hosts. ccess credentials may be different. Step 2 - dd the node to the server. It is necessary to make the server aware of the new node by adding the node to the server. This is made on the server host dding the Node to the Server This operation has to be done on the server host. The general form of the command is: nxserver --nodeadd NODE OPTIONS Page 27 of 45

28 NoMachine Server dministrator's Guide for the Enterprise - dvanced Functions D-309_006-NMS-D pproved by: mended: OPTIONS are any of the following: --protocol NX SSH HTTP Connection to the node protocol. HTTP not supp --port <port> Specify port for the sele --load-balancing --label LBEL --comment COMMENT --weight WEIGHT dd or remove an ente llow to specify a short llow to specify a short Specify a weight for the custom algorithm for lo NoMachine custom scri Set the maximum numb value is used by the No --limit LIMIT When running the --nodeadd command, NoMachine Server tries to connect to the node. If it cannot authenticate using NoMachine servers public key, it will ask you to login as a privileged user to that node and will try to add the server public key there. If connecting completes succesfully, server will retrieve information from the node, including a list of resources available there. If connecting fails, the server will add the node to its NX Nodes db, but will not be able to store information. In this case, it 's mandatory to update node info as soon as connection with that host can be established. : dd node: testdrive.nomachine.com and specify a label nxserver --nodeadd testdrive.nomachine.com --label "Test Drive machine" dd the Enterprise Node testdrive, but exclude it from the load balancing list nxserver --nodeadd testdrive --load-balancing no dd an Enterprise Desktop, testdrive2, and assign a weight and a limit for connections nxserver --nodeadd testdrive2 --weight 2 --limit Configuring the Multi-Node Environment Enabling or Disabling the Manual Selection of the Node Manual Selection applies to Enterprise Nodes for Linux. By default, when user chooses to create a Page 28 of 45

29 NoMachine Server dministrator's Guide for the Enterprise - dvanced Functions D-309_006-NMS-D pproved by: mended: new virtual desktop, the server chooses automatically on which node to start that desktop. The choice is made by considering nodes that provide the virtual desktop type selected by the user and according to a round-robin mechanism. Instead of letting the server decide, it's possible to enable the manual node selection. In this case the user will be provided with the list of all nodes that have this desktop type available, plus other information for each node. Manual selection of the node can be enabled by setting a profile rule. This overrides the automatic selection of the node made by the Server in the case of Enterprise Nodes Limiting Number of Concurrent Connections on the Node When multi-node support is enabled, it is possible to limit the number of concurrent sessions on the nodes by means of profile rules. That limit cannot be higher than the number of connections specified in the subscription files and the value set in the server configuration file Creating a Pool of Nodes for Specific User(s) Support for profiles allows to create rules for allowing or forbidding to start sessions on the specified node(s). This set of rules can be applied to all users, to a specified user, to a group or to guest users (only for Linux) Customizing the Connection Timeout between the Node and Server By default, NoMachine Node considers the connection lost with the server if it doesn't receive a reply within 120 seconds. This value can be modified by editing the node configuration file: uncomment and set the desired value in the key above. If value is set to 0, timeout is disabled on the node. NodeConnectionTimeout Managing the Multi-Node Environment Listing the vailable Nodes The general form of the command is: nxserver --nodelist [ NODE] [OPTIONS] If NODE is specified, it displays details only about this particular node. Page 29 of 45

30 NoMachine Server dministrator's Guide for the Enterprise - dvanced Functions D-309_006-NMS-D pproved by: OPTIONS can be: --comment --resource mended: Display also comment for each of the listed nodes, if present Display list of resources available on each of the nodes List all the available nodes rnxserver --nodelist Retrieve information about node: testdrive.nomachine.com rnxserver --nodelist testdrive.nomachine.com:4000 Retrieve the comment, if present rnxserver --nodelist testdrive.nomachine.com: comment Retrieve information about resources available on the node: nxserver --nodelist testdrive.nomachine.com: resource Modifying Values Set for the Node It is possible to modify some of the information stored for the node by using the following command: nxserver --nodeedit NODE:PORT OPTIONS NODE is the hostname or the IP of the machine as specified when the node has been added to the server. PORT is the SSH port as specified when the node has been added to the server. By default it is 22. OPTIONS are any of the following: --load-balancing --label LBEL --weight WEIGHT --limit LIMIT If not provided, the Ente load-balancing. It allows to specify a sho Update weight set for th for weighted round-robin Update maximum numb by the NoMachine custo Page 30 of 45

31 NoMachine Server dministrator's Guide for the Enterprise - dvanced Functions D-309_006-NMS-D pproved by: mended: Tip To modify name of the node, remove it and add it again by specifying the new IP or hostname. Exclude Enterprise Node testdrive.nomachine.com:4000 from load-balancing list nxserver --node edit testdrive.nomachine.com: load-balancing no Modify comment for the node testdrive.nomachine.com:4000 nxserver --node edit testdrive.nomachine.com: comment "NoMachine Test Drive is installed on this host" Keeping Node Resource List Up-to-Date When a new resource is made available on the node, it is necessary to synchronize information stored in NX Node db accordingly. The general format of the server command to do that is: nxserver --nodeupdate NODE Tip If server was not able to connect to the node during the 'nodeadd' operation, ensure that the node machine is reachable and try to run the nxserver --nodeupdate command. Update list of resources available for node testdrive.nomachine.com nxserver --nodeupdate testdrive.nomachine.com: Using a Custom lgorithm for Load-Balancing Virtual Desktops The Server allows to use a custom script to define a weighted round-robin algorithm for load-balancing virtual desktops. The installation provides a default custom script, written in perl which implements a basic weighted round-robin algorithm for the selection of the node. You can modify such algorithm or replace the custom script with your own. This script is nxweightedroundrobin.pl placed in the scripts/lb directory under the installation directory. In the default script, intended to be just an example, given a weight for each node and a limit of connections for that node, the algorithm selects the node with an higher weight counted as: weight = [weight of node] - [number of sessions connected to the node] Page 31 of 45

32 NoMachine Server dministrator's Guide for the Enterprise - dvanced Functions D-309_006-NMS-D pproved by: mended: The node with the higher weight is the node where the session will be started. If limit for connections on the node is reached, the algorithm falls back to choose the first node provided by the server list. Weight of the node can be set when adding the node. By default, the server uses the plain round-robin algorithm. You can configure the server to use a custom script by editing the server configuration file and set: LoadBalancinglgorithm custom If you want to use a script different from the default one provided with the installation of NoMachine, specify path and name of the custom script in NodeSelectionScript key in the server configuration file. Tip You can add or modify weight assigned to a node by using the 'nxserver --nodeedit' command Using the Node Load verage for Load-Balancing Virtual Desktops The Server can be configured to choose the node with the minimum load average. Edit the server configuration and set: LoadBalancinglgorithm average 12. Managing ccess to the Nodes 12.1 Enabling and Disabling Connections to the Node The general form of the command to enable and disable starting new connections to the node is: nxserver --nodestart NODE nxserver --nodestop NODE NODE is the name of the node as stored in the Nodes db, a comma-separated list of nodes is accepted too. To check the status of a specified node: Page 32 of 45

33 NoMachine Server dministrator's Guide for the Enterprise - dvanced Functions D-309_006-NMS-D pproved by: mended: nxserver --nodestaus NODE Disable starting connections to testdrive1 and testdrive2 nxserver --nodestop testdrive1:4000,testdrive2:22 Enable starting of sessions on testdrive2 nxserver --nodestart testdrive2: Removing the Node from the List of vailable Nodes The general form of the command is: nxserver --nodedel NODE where NODE is the name of the node as stored in the Nodes db. To remove node testdrive.nomachine.com from the NX Nodes db nxserver --nodedel testdrive.nomachine.com: Disable Direct ccess to an Enterprise Desktop Installation The Enterprise Desktop product is a server product to give access to the physical desktop of the host machine. It can be federated under an Enterprise Server to be part of a multi-node environment. In this case, it's possible to access the Enterprise Desktop in two ways: By connecting directly to the server (using the IP or hostname of the Enterprise Desktop machine) Through the Enterprise Server that acts as a gateway to give access to the remote nodes of its multi-node environment. To disable direct access to the Enteprise Desktop, stop the server service by running on that machine: nxserver --stop Disabling Multi-Node Support Page 33 of 45

34 NoMachine Server dministrator's Guide for the Enterprise - dvanced Functions D-309_006-NMS-D pproved by: mended: Multi-node support can be disabled via profile rules. When multi-node capabilities are disabled, the session will always start on the NoMachine server host machine. 13. Federating the Enterprise Servers into a Cluster Prerequisites Pre-requisites for creating a cluster are: 2 or more NoMachine Enterprise Servers. number of nodes, Enterprise Desktops and/or Enterprise Nodes. multi-node environment is prepared. Multiple platforms are supported. Instructions below assumes to have 2 NoMachine Enterprise Servers. One of them will act as the master server in the cluster. ll configurations are made on that server. The other server will be the passive one ready to replace the master server in case of failure. Let's say that the master server is ES1 and the passive server is ES2. Before activating the cluster, set-up the multinode environment: add nodes to ES1 according to instructions at chapter Setting-up and Configuring the Cluster Let's assume that ES1 must become the master server. On ES1 host run the nxserver --clusteradd command to add the local machine to the cluster, set it as master server and eventually configure cluster options. The general form of the command is: nxserver --clusteradd --local <server> --shared <cluster> OPTIONS OPTIONS can be: --master <server> --proto <protocol:port> --interface <interface> --netmask <mask> --grace <time> --retry <number> --probe <time> --interval <number>] --timeout <number> Page 34 of 45

35 NoMachine Server dministrator's Guide for the Enterprise - dvanced Functions D-309_006-NMS-D pproved by: mended: Command above set-up the main configuration for the cluster: it specifies IP for the local host (ES1) with --local and for the cluster host with --shared option. By default the local server is also the master. The --master option can be used to specify a different master server. The supported protocols are NX and SSH which uses port 4000 and 22 respectively. Protocols and ports can be specified as a comma-separated list by using the --proto options, e.g. proto nx:4000,ssh:22 --interface and --netmask parameters allow to a network interface and subnet mask for the cluster different from the default 'eth0:0' and ' '. The following options can be used to configure behavior of the cluster monitor: grace period is time to be elapsed at cluster startup before initiating the failover procedure and is set by default to 30 seconds while retry interval is 10 seconds. Change them by using the --grace and --retry options respectively. Probe timeout indicates for how long cluster monitor must stay connected to a cluster machine and interval for probing specify how often the monitor must probe status of cluster machines. They are set to 60 and 5 seconds. Provide --probe and --interval to modify these values. Cluster timeout is for how long cluster monitor has to wait before considering the machine as faulty. It is set to 10 seconds. It can be modified by issuing the --timeout parameter dding a Machine to the Cluster Syntax of command to add a machine to the cluster is: nxserver --clusteradd <server> OPTIONS where OPTIONS can be: --interface <interface> --netmask <mask> dd a machine to the cluster by specifying its IP (<server>). This command synchronizes SSHD host key across the cluster. Options --interface and --netmask are available to specify a network interface and subnet mask different from default 'eth0:0' and ' ' Updating the Cluster Configuration The following command allows to synchronize configurations of the cluster machine and to set a different network interface and/or subnet mask for the specified machine (<server> is the IP of that machine). It allows also to specify a different IP for the local host, the master host and the cluster host. Grace period, retry interval, probe timeout, probe interval and cluster timeout can be modified Page 35 of 45