pinbox Manual Version 1.2

Transcription

1 Manual Version 1.2

2 Table of contents 1 Introduction Setting up Scope of delivery and device features Security Hardware Installation Software installation Determine IP address About "Detection Tool" About the DOS box Opening the admin tool Quick test Access via internet Setting up a domain Public IP Dynamic DNS service Integrated DynDNS services Router Port authorisation Configuring encryption Let's Encrypt Own certificate Configuring direct access Target computer Determine IP address Allowing access to PCs Link generation Two-Factor Authentication By Via Google Authenticator Two-Factor Authentication Google Authenticator Active Directory Notification System Display language Access via internet System logging Static IP Address Restart Print Licensing Change password Info Log out Using Technical Data Miscellanea System requirements Copy protection... 39

3 18.3 Legal information Disposal... 39

4 1 Introduction The is a hardware box based on ARM technology (Raspberry Pi). It is connected to a local area network, usually to a router or a switch. Appropriate port authorisations in the router/firewall will allow access to any PC in the network via a browser. Unlike a so-called VPN, the does not require any installations or configurations on the user side. Moreover, it needs no browser extensions or other tools. The combination of HTML5 technology and the Internet allows access -provided Internet is available - to PCs, mobile devices and desktops of all operating systems. You just need a browser. Access security is based on Internet standards such as HTTPS/SSL and the use of certificates. The supports the free certificate system "Let's Encrypt" for free certificates. Furthermore, it also supports the so-called two-factor authentication via or Google Authenticator.

5 2 Setting up It is necessary to install the hardware and the software for the initial setup of the. 2.1 Scope of delivery and device features The package includes the hardware box, a network cable and a power adaptor. 2.2 Security Please note the following safety instructions: - Operate the in a dust-free and dry place away from direct sunlight with adequate ventilation - The may only be operated inside buildings. Ensure that liquids do not enter the device - The must not be opened, as you may endanger yourself by improper opening

6 2.3 Hardware Installation 1.) Remove the from the packaging and connect it to a router, hub or switch using the network cable. 2.) Connect the power adapter to the and the mains electricity supply. Switch on the device. 3.) Wait approx. 2-3 minutes until the system is ready for operation.

7 2.4 Software installation Determine IP address In order to access the web interface, the IP address must first be determined About "Detection Tool" Download the Detection Tool from the Pintexx Home Page. The tool detects all corresponding networks and then starts to determine the IP address. If a system is found, a link with the IP address is displayed which allows direct access to the web interface About the DOS box Open a DOS box (right-click on Windows icon, run, "cmd" and enter "nslookup pinbox" in the box. The IP address should then be displayed Opening the admin tool If the IP address is known, the system can be retrieved via http: // <IP address> in a browser. The first time you log in, the setup wizard appears:

8 Enter an appropriate password here and repeat it. The password must be at least 8 characters long and contain at least one uppercase letter. Warning: Please note the password, otherwise access to the system is no longer possible. Thereafter, the system is restarted, and the login screen is displayed.

9 Enter the password to access the Admin area.

10 Overview of the administration interface:

11 3 Quick test Enter "gwdemo.pintexx.com" in the "Direct access" menu as RDP host / IP and go to "Generate link" at the bottom. Then open the desktop connection with "open link". In the login dialog, enter "testuser1" as the login and " " as the password. You should then be able to log in to the desktop. When you log out of the desktop, the window should be closed automatically.

12 4 Access via internet Warning: The should always communicate via an encrypted line. 4.1 Setting up a domain To set up an encrypted connection, a so-called domain is required. e.g. or Domains can be obtained from well-known Internet providers. The domain must then point to a public IP address of the router. Example:

13 4.1.1 Public IP You need a public IP address to connect to the Internet. This is visible in the router. Example: The domain must point to this IP address. Warning: If your Internet provider does not provide a static IP address, the IP changes constantly. This means that the outside access will stop working after a change, because the domain will point to the wrong IP address. A so-called dynamic DNS service (DYNDNS) might be suitable in this situation. See 4.1.2

14 4.2 Dynamic DNS service If the Internet provider does not provide a static IP address, you can also use a dynamic DNS service. The service can be configured in or in router Integrated DynDNS services From version 1.2 dynamic DNS services can be directly used inside. The following services are available: DynDNS No IP Dynu DNS Free DNS An account is required for the corresponding service. For each service a login/password as well as the domain hast o be entered. By pressing IP Update the current IP can be manually updated. Warning: It can take some minutes until the service is available!

15 4.2.2 Router This service always "connects" a domain to the current IP address of the provider. Example: 4.3 Port authorisation Once the domain has been set up, access to the from the outside must be possible. To that end, set up a so-called port authorisation. This "connects" the corresponding ports with the IP address of the. Please ensure that ports 80 and 443 remain available for setup should you wish to use the free certificate system "Let's Encrypt". If, conversely, you intend to use your own certificates, only port 443 is required. Example:

16 5 Configuring encryption Access to should definitely be done via an encrypted connection. PinBox supports its own certificate as well as the free certificate system "Let's Encrypt". 5.1 Let's Encrypt The free certificate system "Let's Encrypt" provides free certificates. In order to use Let's Encrypt, must be accessible via a domain such as.pintexx.com. Only in this situation will the installation be authorised. Furthermore, ports 80 and 443 must be accessible over the Internet to allow installation. Finally, the option "Allow Internet access" in the menu "System" must be enabled. If these conditions are met, you may install a Let's Encrypt certificate. 1) Access via the domain e.g., pinbox.mydomain.co.uk 2) Log in to the

17 3) Go to tab "SSL" 4) Press on Install "Let's Encrypt" 5) Provide your address. This serves informational purposes alone, e.g., when the certificate has expired. 6) Wait until Status shows: Installed 7) Log out 8) Access at From now on, all traffic to and from will be encrypted. 5.2 Own certificate A separate certificate should be available in P12 or PFX format. This file must be selected via "Browse". The certificate password must also be specified. Afterwards, you may activate the certificate with "Install certificate". Once the certificate is successfully installed, the can be accessed at

18 6 Configuring direct access Access to a PC is achieved by generating a link. The link is encrypted and can only be decrypted by the. The link contains NO passwords. The link will then be sent to the respective user. Warning: Please ensure that the link does not fall into the wrong hands! The direct access function generates a link for the user.

19

20 Users access the link through their browser. If a cookie is used, a login dialogue appears on the first access (depending on the setting in "Cookie Duration"): At this point, users must enter their desktop credentials. If a domain is available, the domain name + "\" + login must be specified. Using this information, the system attempts to connect to the desktop. If the Cookie Duration is > 0, the credentials are stored in a cookie that is valid for the specified time. In this case, no further credentials must be provided for this period. If the Cookie Duration is set 0, you must always log in. If no cookie is used, the Windows login screen appears.

21 The following options are available for link configuration: Option Use cookie Description If this option is activated, a so-called cookie is created during the first execution of the access link that stores the login and password information. This enables the options "cookie duration" and "cookie reset link". If no cookie is used, a login on the target computer is ALWAYS necessary. Cookie duration Cookie Reset Link RDP Host/IP Load Balance Info Determines the duration of the cookie storing the credentials. If the duration is set to 0, you must always log in. Users can access this link to delete the cookie from their computer The address of the desktop to be accessed. This can be specified as an IP address or a host name. If a terminal server with load balancing is used, enter the load balance information here. This has the following format: tsv://ms Terminal Services Plugin.1.<Name of collection> Languages Keyboard Upload/Download Clipboard Print Sound WakeOnLAN Display the Toolbar Mobile keyboard Min. Width Min. Height Setting for the message display language Keyboard layout setting Enables/disables the upload/download function via the toolbar Enables/disables access to the clipboard This option is available only when printing is enabled in the Print menu. Enables/disables the print function. Enables/disables the sound function. If this function is enabled, the MAC address of the destination computer must be entered. Then can automatically start the target computer before establishing a connection. The WakeOnLAN function must be activated in the BIOS of the target computer. Once the desktop connection has been established, the toolbar can be displayed by moving the mouse to the top. The toolbar displays an icon for displaying an on-screen keyboard. Sets the minimum width of the desktop on mobile devices. This allows increasing the display width. Sets the minimum height of the desktop on mobile devices. This allows increasing the display height.

22 Colours RDP Background RDP Topics RDP character smoothing RDP window content RDP window animation RDP desktop design Sets the colour depth in bits Optimizes the background display Optimizes the topic display Optimizes the display of text characters If a window is moved, the entire window content moves Allows window animation The desktop design represents the user interface elements of Windows Aero, such as Windows Vista. For example, transparent windows are available for Remote Desktop sessions

23 6.1 Target computer The target computer is the PC or VM to be accessed from outside Determine IP address The unique identifier in the network is the so-called IP address. This is entered in the "RDP IP/Host" field in the "Direct access" menu. The IP address can be determined as follows: - Run the command prompt on the target computer - Run the ipconfig command The IP address consists of 4 individual numbers, separated by a dot. In the example: " " Allowing access to PCs This access must be allowed for to access PCs. To do so, go to the "System and Security" section of the Control Panel and click on "Allow remote access".

24 Then, click on the option "Allow connection of computers on which..." for Windows 7. For Windows 10 "Allow remote connection to this computer". Confirm with "OK". This allows remote access to the PC and the access link can now be generated.

25 6.2 Link generation Click on "Generate link" to display the corresponding link. The link can be copied to the clipboard or opened directly. 6.3 Two-Factor Authentication By If two-factor authentication via has been configured in the "Two-Factor" menu, an address must be specified when configuring the link. A numeric code is sent to this address, which must be entered before the connection is established. Correct notification settings are required to use 2FA by Via Google Authenticator If two-factor authentication via Google Authenticator has been configured in the "Two-Factor" menu, the login and domain (optional) information must be provided when configuring the link.

26 If the link is generated, a link to the QR code and the code itself will also be generated. The QR code link should be sent to the user who then executes it in the browser. The code can then be scanned using the Google Authenticator app.

27 7 Two-Factor Authentication Two-factor authentication provides another security level. Further to logging in using login and password, users must specify another number that is known only to them. Whilst not strictly necessary, its use is highly recommended. You can choose from " " and "Google Authenticator" If the user chooses " ", a corresponding code word is sent to their address. This code must be entered before the connection is established. 7.2 Google Authenticator If the user chooses "Google Authenticator", the Google Authenticator app must first be installed on the user's smartphone. The URL of the QR code or the code is displayed directly when creating the direct access link. This QR code must be scanned by the user through the Google Authenticator app. The app then generates a code that must be entered before the connection is established. Warning: The time of the smartphone and the time of the system must be roughly the same.

28 8 Active Directory If an Active Directory is used, it is possible to perform a logon data verification before the connection is established. The AD domain can be specified If is part of the domain. Otherwise, the IP address should be used. Using this feature is recommended when an AD is available because it provides an extra security layer.

29 9 Notification The "Notifications" section allows setting up parameters for submission. The notification function is required if you use two-factor authentication via . These are required for general system information and when using two-factor authentication via .

30 10 System The system area allows various actions and settings Display language The display language can be set to "German" or "English" Access via internet Access via the Internet can be allowed. This option should be enabled as long as the system is configured. Internet access should be switched off when the configuration is completed. At that point, only access via the local network is possible System logging System logging can be activated and the system log displayed as required. This is needed for any support cases.

31 10.4 Static IP Address The system is configured from the start so that the IP address is received from a DHCP server. Alternatively, you may set up a static IP address. If this is entered in the "Static IP address" field, then further values can be set for Gateway and DNS. The "Set" option carries out the data transfer. The "Switch off" option switches back to DHCP Restart The "Restart" option restarts the system.

32 11 Print This function requires additional software. This can be automatically installed by activating the "Print" box. License conditions are recognized upon activation.

33 12 Licensing The is licensed using the so-called "concurrent users" metric, i.e. a 2-user license allows two users to access a PC simultaneously. The is either already delivered with a valid license or the license key is pending installation. If the license information contains "Evaluation", then a license key is required. Otherwise "Release" should be displayed. If a license file must be installed, you will receive the license file upon purchase. Select it by clicking "Browse" and press "Install". This will install the license on the system and reboot the system. License information about the validity of the license will be displayed afterwards.

34 13 Change password You can change the access password on the "Change Password" page. The password has a minimum length of 8 characters and should contain a capital letter, a lowercase letter, and a number.

35 14 Info The info area provides information about the version status as well as a link to additional information on our home page.

36 15 Log out You can log out from the admin tool via the "Logout function".

37 16 Using When using the to access a PC over the internet, you should observe the following advice: - ALWAYS use encrypted access to the. If not, your credentials (login, password) will be transmitted unencrypted and can be spied on by hackers! - Use a two-factor authentication This gives you another level of security and therefore increased security! - Switch off external access to the admin area Disabling the "Allow Internet access" option in the "System menu" prohibits access to the admin area via the Internet. You can still access the local network.

38 17 Technical Data Option Dimensions: Operating voltage: Operating temperature: Active power (max): Active Power (average): Weight: Network connection: Description 105mm * 75mm * 35mm 230V, 50Hz A / C degrees Celsius 3.7 W 2.4 W 100g Via RJ45 socket

39 18 Miscellanea 18.1 System requirements For correct operation, the requires a connection to a network, usually to the Internet. This is done by connecting to a network router, hub or switch Copy protection The has copy protection on the SD Card. Therefore, to check the correct version, it will run read-only access to Pintexx servers Legal information It is forbidden to make a copy of the enclosed SD Card. CE- Declaration of Conformity Pintexx GmbH hereby declares that the device complies with the essential requirements of EU directives. The full CE Declaration of Conformity can be found at Disposal The, the power adaptor and the cable must not be disposed of with household waste in accordance with the German Electrical and Electronic Equipment Act (ElektroG). Please contact your local authority regarding disposal.