LWL StratusphereReferenceGuide 03092011
LWL StratusphereReferenceGuide 03092011
Reference Guide
Version 4.6.0
Copyright 2010 Liquidware Labs, Inc. All rights reserved. Stratusphere is a trademark of Liquidware Labs. Other brands, product names and trademarks are the property of their respective owners. The software discussed in this document is furnished under a license agreement or nondisclosure agreement. Information in this document is subject to change without notice. No part of this publication may be reproduced in whole or in part, stored in a retrieval system, or transmitted in any form or any means electronic or mechanical, including photocopying and recording for any external use by any person or entity without the express prior written consent of Liquidware Labs. Patents pending. Liquidware Labs 3600 Mansell Road, Suite 200 Alpharetta, Georgia 30022 U.S.A. 678.397.0500 or 888.566.9143 www.liquidwarelabs.com
Table of Contents
Chapter Chapter 1, Introduction to ssconsole Chapter 2, Adding Disk Space Chapter 3, Upgrade Chapter 4, Command Line Install Parameters for Connector ID Key Page 1 21 27 35
At the ssconsole prompt, type the command as shown in the left column
below. Some commands have arguments that give you additional control. These are shown in smaller print in the left column, below the command they are used with. ssconsole executes action commands as soon as you enter them. Commands that return confirmation prompts are noted below. ssconsole reports any errors it encounters to the console and to the system log. You can use action commands in any order.
exit
This command ends the ssconsole session.
Note: Any configuration changes you have made during the session will not be
saved unless you execute the write command before exiting.
help or ?
help Type help before another command to display all subcommands within that category. The following shows the result of using the help command with the policy command:
3
? Type a ? after a partial command to display related configurations and preferences. The following shows the result of using the ? command with the software command:
Note that the ? command returns you to the command prompt including the partial command you typed before you added the ? command.
quickstart
This command launches a series of prompts that lead you through a quick configuration of the minimum elements required to start the virtual appliance. These include:
virtual appliance hostname. virtual appliance IP address. virtual appliance netmask default gateway IP address virtual appliance DNS server. You can specify multiple DNS servers, separating them with commas.
If the virtual appliance is a Network Station, you will be prompted for additional information that enables the Hub to automatically register the Station. The additional prompts are:
Hub address (the address of the Stratusphere Hub you want this Station to
register with)
Hub Admin account Hub Admin password (the admin account and passwordon the Hub that
the Station will use to register with the Hub)
Note: If you leave the center address prompt blank, Stratusphere cannot autoregister the Station, and the other prompts will not appear.
reboot
Reboots the operating system and restarts the virtual appliance. ssconsole returns a confirmation prompt before executing the command.
show
Displays information about the virtual appliance. The information ssconsole displays for a Network Station is slightly different that what it displays for a Stratusphere Hub. Type the command by itself for a complete list of information or filter it by adding one of five arguments:
info
The show info command displays information about the virtual appliances interfaces. You can add another argument to specify which interface you want information about:
running
The show running command displays all the values that are currently in effect. These include saved values and any values you have changed since you last executed the write command. The write command saves temporary values so they are persistent over a reboot. The show config command displays the permanent configuration values (those that have been saved using the write command). The show mac command displays the learned MAC addresses for the bridge. The show disk command displays all the disk drives available for use as the Stratusphere Hub database drive. The show quickstart command displays the current quickstart settings. See the quickstart command on page 4.
add disk
You can add drives to the virtual appliance, and then inform the Stratusphere Hub about them by using the add drives command. Complete instructions for the process of adding a drive are located later in this book. add disk <disk name> <where> You can use the show disk command (above) to obtain the disk name if necessary.
software
Use the software commands to control the software release running on the virtual appliance (including upgrades). The software commands include: install To install a software component from a remote site via http, ftp, or scp, type: software install latest:<type>:<location> if you use software install latest the virtual appliance will communicate with Liquidware Labs software distribution site and automatically upgrade to the latest release. The format for <type> is one of the following:
httpthe http URL where the software component can be downloaded from ftpthe ftp URL where the software component can be downloaded from ssha URL that can be used to use SSH to copy software components to
the appliance. The format for <location> is: //<user>:<password>@<host>:<port>/<url-path> (as defined in RFC1738). Example: software install http://download.example.com/upgrades/2.5.1_2.5.2.bin Example: software install http://admin:[email protected]:8080/upgrade s/2.5.1_2.5.2.bin uninstall To remove a software component, type: software uninstall <component> where <component> is the name of the software component you want to uninstall.
shutdown
This command shuts the virtual appliance down. ssconsole returns a confirmation prompt before executing the command.
write
Saves any unsaved configuration values so that they are persistent over a reboot. During a ssconsole session, you can use the assignment commands to assign values to configuration parameters. These values take effect immediately, but are not permanent until you use the write command.
ping
The ping command allows you to ping a device. By default, it will send 4 pings. ping <host> <count> where <host> is the host being pinged and <count> is an optional count of how many ping packets to send. If zero is given, the ping will run continuously. You can interrupt the ping by typing CTRL-C.
traceroute
The traceroute command allows you to do a traceroute to the device. traceroute <host> where <host> is the host to traceroute to. You can interrupt the traceroute by typing CTRL-C.
rescan nic
The rescan nic determines what network interfaces are on the appliance and configures the appliance to use those NICs. Execute the following command to rescan the network interfaces: rescan nic
restart services
The restart services command restarts the backend services needed by the virtual appliance. Execute the following command to restart services: restart services The restart services command prompts you with the prompt You are about to restart the system services. Continue? [yes/no]. Yes and No are the allowed responses to this prompt.
diag
The diag command displays basic diagnostic information and provides you with an easy way to send extensive diagnostic information to customer support, if needed. Comprehensive diagnostic information can be sent via email, FTPed, SSHed, or put on a USB stick. diag The diag command displays basic diagnostic information. The output might look like this:
Adding an email address to the diag command causes it to send extensive diagnostic information to the email account. A password can be given after the email address. This password is used to encrypt the data before it is sent. The recipient of the email must use this password to decrypt the diagnostic data. diag [email protected] secretpassword
ftp
Giving an FTP URL to the diag command causes it to send extensive diagnostic information using FTP. A password can be given after the URL. This password is used to encrypt the data before it is sent. diag ftp://admin:[email protected]/diag.tar.enc.gz secretpassword
8
ssh Giving a SSH URL to the diag command, cause it to send extensive diagnostic information using SSH. A password can be given after the URL. This password is used to encrypt the data before it is sent. diag ssh://admin:[email protected]/diag.tar.enc.gz secretpassword usb Indicating to the diag command that it should use USB causes it to copy extensive diagnostic information to the plugged in usb memory stick. A password can be given after the URL.This password is used to encrypt the data before it is sent. diag usb://diag.tar.enc.gz secretpassword
push policy
You can push policy from the command line. This command is useful after you perform command line tasks that require you to update policy, such as changing policy mode from monitoring to enforcement. push policy
At the ssconsole prompt, type the command as shown in the left column
below. Some commands have arguments that give you additional control. These are shown in smaller print in the left column, below the command they are used with. Assignment commands take effect as soon as you enter them, but they are not permanent until you execute a write command (see above). Commands that return confirmation prompts are noted below. ssconsole reports any errors it encounters.
management
Overview ip Use the management commands to configure the virtual appliances management interface. To set the IP address of the management interface, type: set management ip <IPv4 address> Example: 10.10.3.3 netmask To set the netmask of the management interface, type: set management netmask <IPv4 netmask> Example: 255.255.255.0 default gateway To set the default gateway of the management interface, type: set management default gateway <IPv4 address of the default gateway> Example: 10.10.3.1
Port
The port subcomponent is used to configure the external and internal interfaces. Port number external The port commands require the port number. To see a list of port numbers, type show port Execute the following command to indicate that the interface is an external port: set port <port number> type external Where <port number> is a integer representing the physical port.
10
internal Execute the following command to indicate that the interface is an internal port: set port <port number> type internal Where <port number> is a integer representing the physical port. vlan Execute the following command to set vlan tags for a particular port: set port <port number> vlan <tag1,tag2> Where <port> is an integer representing the physical port and <tag1,tag2> is a list of numbers between 0 and 65536 representing a vlan tag. Once the vlan tag is set, all packets for that vlan are routed from the external interface to this port. All packets coming in on this port are tagged with that particular vlan tag. If you have multiple vlans, repeat this command for each vlan. Adding the command off at the end of the vlan command causes the vlan tag to be removed. set port <port number> vlan <number> off
bridge
Bridge commands are used in enforcement mode only. Every virtual appliance has three interfaces: management, external, and internal. The external and internal interfaces are bridged together. The following commands let you control the operation of the bridge. enabled To enable or disable the bridge port, type: set bridge <on or off> priority The bridge priority controls which virtual appliance is primary and which is secondary. The bridge with the lowest priority is the primary (root) bridge. Type: set bridge priority <number> where <number> is a number between 0 and 65535. mtu To set the bridge mtu, type: set bridge mtu <number> where <number> is a number between 0 and the maximum Ethernet frame size. aging time The bridge keeps track of Ethernet addresses seen on each port. When it needs to forward a frame, and it knows which port the destination Ethernet address is located on, it can forward the frame to that port only. However, the Ethernet address is not static, so it is removed after it has not been seen for some amount of time. You can set this amount of time by typing: set bridge aging time <number seconds> After <number seconds> passes without the virtual appliance seeing a given Ethernet address, it deletes the address from its tracking database. forward delay time To set the bridges forward delay time, type: set bridge forward delay time <number seconds > where <number seconds> is the forward delay time in seconds.
11
hello time To set the bridge hello time, type: set bridge hello time <number seconds > where <number seconds> is the number of seconds the hello time should be set to. maximum message age To set the bridge maximum message age, type: set bridge max age <number seconds > where <number seconds> is the number of seconds the maximum message age should be set to. stp To enable Spanning Tree Protocol (STP) on the bridges, type: set stp <parameter> where <parameter> can be:
SNMP
These commands allow SNMP to be configured to be queried. At this time, Stratusphere does not support setting SNMP traps on system events. snmp To enable SNMP on the virtual appliance, type: set snmp <parameter> where <parameter> can be:
12
contact information Contact information identifies the person who monitors this Station Group at your company. To set the contact information, type: set snmp contact <string> where <string> string is string of characters.
password
The password command is used to set the password of the three accounts on the virtual appliance: root, friend, and ssconsole. root To set the root password, type: set password root <password> where <password> is the password for root. friend To set the friend password, type: set password friend <password> where <password> is the password for friend. ssconsole To set the ssconsole password, type: set password ssconsole <password> where <password> is the password for ssconsole.
ssh
ssh The SSH daemon is turned OFF by default. To turn the SSH daemon ON or OFF, type: set ssh <parameter> where <parameter> can be:
onallow users to use SSH to access ssconsole offprevent users from using SSH to access ssconsole
It is OFF by default.
13
system
System commands affect the entire virtual appliance. type hostname The type command is a read-only value that indicates the appliance type: Network Station or Hub. To set the host name of the virtual appliance, type: set system hostname <parameter> where <parameter> is the FQDN of this virtual appliance. mail relay To set the mail relay on the virtual appliance, type: set system mail relay <parameter> where <parameter> is the hostname of the mail relay. Update client address To set parameters to update the client IP address, type: set system update client address <parameter> where <parameter> can be: the client offthe Stratusphere Hub is not able to update the asset record's IP address hub address
onturn on the ability for the Stratusphere Hub to update the IP address of
For Network Stations only, this command sets the IP address of the remote Stratusphere Hub that manages this virtual appliance is required. To set the IP address of the Stratusphere Hub, type: set system hub address <IPv4 address of the Stratusphere Hub>
hub admin
For Network Stations only, this command specifies the admin account on the Stratusphere Hub, which the Station can use to automatically register itself with the Center. set system hub admin <admin account username>
hub password
For Network Stations only, this command specifies the password of the admin account on the Stratusphere Hub, which the Station can use to automatically register itself with the Center. set system hub admin <admin account username>
For Stratusphere Hubs, the Stratusphere Hubs DNS name is required. To set the DNS name for this Stratusphere Hub, type: set system hub dns name <dns name>
timezone
Set the time zone for this virtual appliance. You can also use the timezone command to display the currently set time zone to help when youre setting the time.
14
set system timezone <time zone> time Set the local time (based on previously set time zone) for this virtual appliance. Use the format YYYYMMDDHHmm. Use zeros if you dont need both digits. For example, indicate January by typing 01 for the first MM. set system time <time> dhcp This command turns the embedding of Connector ID Key information in the DHCP protocol on or off. set system dhcp <on|off>
15
dns
dns commands configure the domain name system, which resolves hostnames to IP addresses. server To set the list of DNS servers to be used by this virtual appliance, type: set dns server <hostname> where <parameter> is a comma separated list of DNS servers. search When a domain is not specified, append these domains when querying for an IP Address: set dns search <domain> where <domain> is a comma separated list of domains.
16
ntp
The NTP server is turned OFF by default. To turn the NTP daemon ON or OFF, type: set ntp <parameter> where <parameter> can be:
prompt
To change the ssconsole prompt, type: set prompt <parameter> where <parameter> can be any string. The default prompt is VS
audit
Audit data is delivered to the Stratusphere Hub at intervals based on time as defined by the audit command. time To set the audit interval delivery time, type: set audit time <numberparameter> where number is the number of minutes or hours and parameter is m (minutes) or h (hours). Example: set audit time 1m would set the audit time to one minute. interval time To set the amount of time that elapses between interval record collection events, type: set audit interval time <numberparameter> where number is the number of minutes or hours and parameter is m (minutes) or h (hours). Example: set audit interval time 1m would set the audit time to one minute. The default is 60 minutes.
17
log
The log command allows you to set up logging to a remote syslog server. host This command allows you to set the remote host that syslog messages should be send to: set log host <hostname> where <hostname> can be an IP address or a hostname. selector This command allows you to set what should be sent to the syslog server: set log selector <sel1,sel2,...> where <sel1> is of the format facility.priority. The facility specifies what type of program is logging the message. It can be one of the following: kern, mail, syslog, user, local0, local1, local2, local3, local4, local5, local6, local7 The priority determines the importance of the message. The priority can be (in order of decreasing importance): emert, alert, crit, error, warning, notice, info, debug
conntrack
The conntrack command controls some of the connection tracking parameters. irc This command sets the ports that IRC protocol is running on: set conntrack irc ports <port-list> where <port-list> is a comma separated list of port numbers. ftp This command sets the ports that FTP protocol is running on: set conntrack ftp ports <port-list> where <port-list> is a comma separated list of port numbers. tftp This command sets the ports that TFTP protocol is running on: set conntrack tftp ports <port-list> where <port-list> is a comma separated list of port numbers. tcp timeout established This command sets the connection tracking timeout for the established connections. set conntrack tcp timeout established <seconds> where <seconds> is number of seconds before we timeout. The default is 432,000 seconds (5 days). tcp timeout syn sent This command sets the connection tracking timeout for how long the appliance stays in the SYN sent state. set conntrack tcp timeout syn sent <seconds> where <seconds> is number of seconds before timeout. The default is 120 seconds (2 minutes).
18
udp timeout stream This command sets the connection tracking timeout for the udp stream. set conntrack udp timeout stream <seconds> where <seconds> is number of seconds before timeout. The default is 30 seconds (2 minutes). udp timeout stream sent This command sets the connection tracking timeout for the udp stream sent. set conntrack udp timeout stream sent <seconds> where <seconds> is number of seconds before timeout. The default is 30 seconds (2 minutes). tcp timeout syn recv This command sets the connection tracking timeout for how long the appliance stays in the SYN received state. set conntrack tcp timeout syn recv <seconds> where <seconds> is number of seconds before we timeout. The default is 60 seconds. tcp timeout fin wait This command sets the connection tracking timeout for how long the appliance stays in the FIN wait state. set conntrack tcp timeout fin wait <seconds> where <seconds> is number of seconds before we timeout. The default is 120 seconds (2 minutes). tcp timeout time wait This command sets the connection tracking timeout for how long the appliance stays in the time wait state. set conntrack tcp timeout time wait <seconds> where <seconds> is number of seconds before we timeout. The default is 120 seconds (2 minutes). tcp timeout close This command sets the connection tracking timeout for how long the appliance stays in the close state. set conntrack tcp timeout close <seconds> where <seconds> is number of seconds before we timeout. The default is 10 seconds. tcp timeout close wait This command sets the connection tracking timeout for how long the appliance stays in the close wait state. set conntrack tcp timeout close wait <seconds> where <seconds> is number of seconds before we timeout. The default is 43,200 seconds (12 hours). tcp timeout last ack This command sets the connection tracking timeout for how long the appliance stays in the last ACK state. set conntrack tcp timeout last ack <seconds> where <seconds> is number of seconds before we timeout. The default is 30 seconds.
19
max connections This command sets the maximum connections that can be tracked by the connection tracking subsystem. set conntrack max connections <count> where <count> is number of connections that can be tracked. The default is 500,000 connections.
netdiag
The netdiag command is used to control the line test daemon. Starting or stopping the test daemon This command starts or stops the line test daemon on the alliance: set netdiag <on/off> The test daemon is off by default.
bypass
The bypass command is available on physical appliances only. The bypass command controls the 2-port bypass adapter. The bypass command is off by default. on This command puts the adapter in bypass mode from power start until the kernel controls the adapter. At any time during its operation, if a failure occurs that results in the kernel relinquishing control of the adapter for more than two seconds, the adapter will revert to its bypass mode. set bypass on off This command puts the adapter in non-bypass mode, and the NIC behaves like a standard NIC. It will not pass traffic if the system hangs or if the kernel is not controlling the hardware. set bypass off
route
The route command is used to add static routes. The command can be executed as follows: set route [net|host] <target> [netmask <mask>] [gw gateway] [metric N] [mss M] [window W] [irtt I]
Where [net|host] are optional and <target> is the destination network or host
in IP format. The <target> option is not optional.
The netmask option takes a network mask as an option. The gw options takes an IP address of a host that routes packets for the virtual appliance.
The metric option sets the metric field in the routing table. The TCP Maximum Segment Size option, mms, takes an integer as its
parameter.
20 The window options sets the TCP window size for connections over this
route. The initial round trip time option can be set using the irtt option. The following are some examples: set route net 192.168.1.0 netmask 255.255.255.0 gw 192.168.1.1 set route net 192.168.1.0 netmask 255.255.255.0 gw 192.168.1.1 metric 2
To remove a route, set the route you want to remove to off. For example: set route net 192.168.1.0 netmask 255.255.255.0 gw 192.168.1.1 off
policy
The policy command determines which policy mode is in effect. The appliance can be in enforcement mode, blocking packets based on policy, or it can be in monitor mode, in which it records the packets without blocking. mode This command sets the mode of operation: set policy mode <mode> where <mode> is either monitor or enforce. The default is monitor. monitor This command sets the type of monitoring. The appliance can be in inline monitor mode, which monitors the packets as they pass through the appliance, or it can be in out-of-band monitor mode, in which case the packets are monitored off the switch. set policy monitor <mode> where <mode> is either inline or not inline (for out-of-band monitoring). The default is not inline.
Note: This command is only available when the policy mode is monitor.
enforcement This command sets the policy enforcement to use stateful inspection (connection tracking) when evaluating packets or no stateful inspection (no connection tracking): set policy enforcement <state> where <state> is either stateful or not stateful. The default is stateful. Note that this command is only available when the policy mode is enforce.
21
Note: One gigabyte of disk space can hold approximately one month of data for 200 virtual desktops.
Process Adding disk space to your Stratusphere virtual appliances is a two-stage process:
Add the disk to the virtual appliance in your virtualization management system (for example VMware vCenter and Virtual Infrastructure Client).
22
23
2 On the Hardware tab, click the Add button.
The Add Hardware wizard appears. 3 Choose Hard Disk, and then click Next.
24
4 Select the Create a new virtual disk radio button, and then click Next.
5 Specify the Disk Size and units, and leave Store with the virtual machine selected for Location. Click Next.
25
6 Click Next to accept the default Advanced Options.
7 Click Finish.
26
27
Chapter 3: Upgrade
Overview Back up your Stratusphere Hub This chapter provides instructions for upgrading Stratusphere. We recommend that you review this document before installing the software. Before you begin the upgrade procedure, back up the Stratusphere Hub virtual machine. Any time you upgrade, its important to have a backup. You may want to use VMwares snapshot functionality to create your backup. Snapshots let you preserve the state of a virtual machine so you can return to the same state repeatedly. The Stratusphere Hub virtual appliance is just another virtual machine in your environment, so you can use your preferred method to backup. Licensed partners and users can find support contact information in the welcome materials emailed to them by Liquidware Labs, or on the Liquidware Labs web site at http://www.liquidwarelabs.com.
Customer Support
28
If you want to be certain that there is enough disk space, go ahead and add
29
30
31
Auto-update
32
33
34
The following is the example command line to run the network version of the Windows Connector ID Key for assessments, along with details on the optional parameters. In this case the Connector ID Key package is installed in a shared network folder, and is launched via AD GPO on each desktop machine.
netcid start | stop cid_folder_path [-ha hub-ip-or-dns] [-mg machine-group-name] [-ug user-group-name]
-ha -- optional parameter specifies the IP address or DNS name of the Stratusphere Hub (if not provided then the Connector ID Key will attempt to discover its Hub through a broadcast - response mechanism)
36 -mg -- specifies the name of machine group defined in the Stratusphere Hub
that the machine will be automatically assigned to -ug -- specifies the name of user group defined in the Stratusphere Hub that any logged on users will be automatically assigned to
37
Index
A N
netmask 9 ntp 15
O
Overview 9
P
backup 2 bridge 10
C
quickstart 3
R
enabled 10 exit 2
F
search 14 server 14; 15 show 4 show quickstart 4 shutdown 5 SNMP 11 software 5 speed 9 ssh 12 stp 11 Support 1 system 13
T
info 4 install 5 ip 9
L
location 11
M
vsconsole 1; 12
W
write 6
38