0

VMware Horizon View: App Volumes Part 2

Posted on by Sandeep Kumar & Shaswati Mukherjee

Registering App Volumes Manager Server

Register App Volumes Manager Server

In a multi-App Volumes Manager environment, after you upgrade App Volumes to the latest version, the first App Volumes Manager is automatically registered. You must then register other manager servers that are already in this environment. Any new manager servers that you add must also be registered.

Prerequisites

You must know the address of the registered and unregistered managers.

From the registered App Volumes Manager, go to CONFIGURATION > Managers to identify the unregistered managers.

Procedure

  1. Enter the IP address of the unregistered manager server https://<unregistered-avm- server-ip-address>/register in a browser.
  • Log in to the unregistered manager with the username and password of the registered manager, and enter the following information:
OptionDescription
Registered Manager AddressAddress of the registered manager which also has the latest file encryption version.   Note If the first App Volumes Manager is using an IPv6 connection, then you must enter the DNS of the App Volumes Manager.
  
UsernameUser name
PasswordPassword
DomainSelect a domain name from the drop-down menu.

If you added a manager server after upgrading App Volumes to the latest version, then you are automatically taken to the Register App Volumes Manager Server window.

  • Click Register.
  • Verify the certificate information and click Accept to accept the certificate.

You might see a Untrusted Certificate window, if the security certificate of the manager cannot not be verified. If you reject the certificate, you cannot proceed with the registration.

What to do next

Activate registration security for the App Volumes Manager instance that you just registered. Go to CONFIGURATION > Managers to see the updated status of the managers.

Remove an App Volumes Manager Server

Remove the record of an App Volumes Manager server that has become obsolete and is not in use.

You may want to remove an App Volumes Manager server if it has not been used for a while or if you are not sure if it is part of the manager servers cluster.

Prerequisites

You must have upgraded to or installed the latest version of App Volumes.

Procedure

  1. From App Volumes Manager, go to CONFIGURATION > Managers. A list of managers seen by this App Volumes instance is displayed.
  2. Select the manager you want to remove and click Remove.
  3. Confirm the action on the Confirm Remove window and click Remove.

Results

The record of the manager server is removed and is not seen under CONFIGURATION > Managers.

What to do next

You can retrieve the instance of the manager you removed. To do so, restart the App Volumes Manager service.

View Status of App Volumes Manager Servers

View the registration status of theApp Volumes Manager servers.

Prerequisites

You must have upgraded to or installed the latest version of App Volumes.

Procedure

  • From App Volumes Manager, go to CONFIGURATION > Managers.

Results

A list of manager servers with their registration status is displayed.

Activate Registration Security

After upgrading to the latest version, you can activate registration security for all servers known to this instance of App Volumes Manager.

Note Activating registration security is a one-time activity and applicable only to users upgrading from App Volumes 2.15 or earlier. This action is not required for a fresh installation of the latest version of App Volumes. You also do not need to perform this action after every App Volumes upgrade.

Prerequisites

You must have completed registration of all the manager servers for which you want to activate registration security.

Procedure

  1. From App Volumes Manager, go to CONFIGURATION > Managers.

A list of App Volumes Manager servers visible to this instance of App Volumes is displayed.

  • Select the desired manager and click Activate Registration Security.
  • Confirm the activation and click Activate.

3   Using SSL Certificates with App Volumes Manager

App Volumes Manager uses SSL to communicate with Active Directory, Machine Managers, and App Volumes agents.

Using App Volumes Manager, you can perform a variety of tasks to configure and use SSL certificates. You can replace, import, disable, and manage the SSL certificates used for SSL communication and validation.

  • You can configure Active Directory to reject connection with App Volumes Manager if SSL certificate validation fails. See Configuring and Using Active Directory .
  • You can add and upload trusted SSL certificates from the App Volumes Manager console to establish a secure connection to the vCenter Server and the remote SQL server.
  • You can also replace the default App Volumes Manager certificates that are used for communication with App Volumes agents, disable SSL and SSL certificate validation, and enable an HTTP connection.

This chapter includes the following topics:

Configuring SSL Certificates for Machine Managers

You can establish secure connections from App Volumes Manager to SQL Server and vCenter Server.

Establishing a Secure SQL Server Connection

If the instance of App Volumes Manager that you have installed connects to an SQL server, you can change the default Windows ODBC settings and connect securely to App Volumes Manager.

Ensure that you have downloaded the SSL certificate on the SQL server instance and imported the certificate as a Trusted Certificate on to the machine where App Volumes Manager is installed . Change the ODBC settings on this machine.

For detailed instructions, see https://support.microsoft.com/en-us/kb/316898.

Establish a Secure vCenter Server Connection

You can securely connect to a vCenter Server from App Volumes using an SSL certificate.

Prerequisites

  • Register a vCenter Server machine manager. See Configure and Register the Machine Manager.
  • Ensure that the vCenter Server you are connecting to has a domain SSL certificate. The certificate must be verified and accepted by App Volumes.

Procedure

  1. After you register a vCenter Server as a machine manager, verify the certificate details. If the certificate is not trusted or verified, the following messages are seen:
    1. A window with details of the certificate (SHA1 fingerprint, period of validity) that is present in the vCenter Server.
    1. A message at the top right corner:
  • Click Accept to accept the certificate.

You can also log in to the vCenter Server as an administrator and verify the SHA1 code. The Machine Manager is successfully added after the certificate is verified.

  • Click Certificate to view the certificate you added.

If the certificate is changed on the vCenter Server after it has established a connection with App Volumes Manager, the Certificate not valid message is displayed when you log in to App Volumes Manager.

Note You also see this message when you upgrade App Volumes to the latest version.

  • To validate the certificate again, select the vCenter Server under Machine Managers, click

Certificate, and accept the certificate.

Results

You now have a trusted SSL certificate to connect to the vCenter Server.

What to do next

When you upgrade App Volumes from an older version to the latest version, you might have to manually accept the certificates to retain the connection to vCenter Server.

Managing SSL Between App Volumes Manager and Agent

A default self-signed certificate is installed when you install App Volumes Manager. App Volumes agents use SSL to communicate with the App Volumes Manager and validate the certificate.

Replace the Self-Signed Certificate with CA-signed Certificate

A self-signed certificate is installed when you install App Volumes Manager. You can replace the default self-signed certificate by modifying the Nginx configuration file.

Note The self-signed certificate is installed in the same location as the Nginx configuration file:

C:\Program Files (x86)\CloudVolumes\Manager\nginx\conf.

Prerequisites

  • Obtain an SSL certificate from a trusted Certificate Authority (CA).
  • Download the CA-signed certificate that you obtained and the corresponding key to the machine where the App Volumes Manager is installed. Note down the location where the files are downloaded.
  • If you provide a passphrase while generating the private key during the Certificate Signing Request (CSR), note down the passphrase.
  • Verify that the common name on the CA-signed certificate is the same as the host name or the IP address of App Volumes Manager that you configured while installing the agent.
  • Verify that the SSL key and certificate are both in PEM (Base64 encoded) format.
  • Verify that the certificate and key are Nginx compliant.

Procedure

  1. Log in as administrator to the machine where the App Volumes Manager is installed.
  2. Navigate to C:\Program   Files   (x86)\CloudVolumes\Manager\nginx\conf  and make a copy    of the existing Nginx configuration file, nginx.conf.
  3. Open the Nginx configuration file.
  4. Edit the ssl_certificate and ssl_certificate_key variables in the Nginx configuration file to point to the path of the certificate and key files that you downloaded.
  5. (Optional) If you had provided a passphrase for the CA-signed certificate, enter the passphrase for your certificate in the Nginx configuration file.
  6. Save the configuration file.
  7. Restart the App Volumes Manager service.

Example: Nginx Configuration File

In this example, the appvol_ca1_vmware.com.crt and appvol_ca1_vmware.com.key are the default self-signed certificates.

What to do next

You can download and add the CA-signed certificate to the trust store of the App Volumes agent directly.

Import Default Self-Signed Certificate

If you do not want to replace the default self-signed certificate in the App Volumes Manager, you can import the certificate and add it to the local trust store of the machine where the App Volumes agent is installed.

If you have installed and configured multiple App Volumes Manager instances for use in all agent machines, then the self-signed certificates have to be imported from each App Volumes Manager instance to the agent machines.

Prerequisites

Obtain the IP address of the App Volumes Manager instance whose certificate you want to import.

Procedure

  1. Log in as an administrator to the machine where the App Volumes agent is installed.
  2. In a Web browser, enter the host name or IP address of the App Volumes Manager in the form of https://hostname.

A warning message that the SSL certificate is not validated is displayed.

  • Click the warning message and follow instructions to download the SSL certificate displayed in the browser.
  • Open the Microsoft Management Console (MMC) and import the downloaded SSL certificate.

See https://technet.microsoft.com/en-us/library/cc754841(v=ws.11).aspx#BKMK_addlocal for detailed instructions to import the SSL certificate after downloading it.

Disable SSL Certificate Validation in App Volumes Agent

SSL certificate validation is enabled by default when you install the App Volumes agent.

You can disable SSL certificate validation in the agent, either when you are installing the agent or after you have installed the agent.

Note When you disable certificate validation, untrusted App Volumes Manager certificates are not validated , but communication between App Volumes Manager and agent still occurs over SSL. If you want to disable SSL completely, see Disable SSL in App Volumes Agent.

Disable SSL Certificate Validation When Installing App Volumes Agent

The App Volumes agent validates the SSL certificate of the App Volumes Manager during communication with the manager. You can disable the certificate validation when you are installing the agent.

Procedure

  • When you install the App Volumes agent, select the Disable Certificate Validation with App Volumes Manager box on the App Volumes Agent window.

Results

Certificate validation is disabled but communication with the manager still occurs over SSL.

Disable SSL Certificate Validation in App Volumes Agent After Installation

You can disable SSL certificate validation after you have installed the agent.

Procedure

  1. Log in as administrator on the machine where the App Volumes agent is installed.
  2. Click the Start menu in Windows and enter regedit to open the Registry editor.
  3. In the Registry Editor, go to HKLM\System\CurrentControlSet\Services\svservice

\Parameters.

  • Locate and set the EnforceSSlCertificateValidation key to 0. The SSL certificate is no longer validated.
  • Restart the App Volumes service.

Results

SSL certificate validation is disabled in App Volumes agent.

Enable HTTP in App Volumes Manager

You can enable an HTTP connection in App Volumes Manager, either when you are installing the manager or after installation.

You might want to enable an HTTP communication, for example, when you upgrade App Volumes to the latest version, and want to install and test App Volumes immediately without configuring SSL certificates.

Note Enable HTTP only in a non-production environment or if you are running App Volumes Manager behind a load balancer.

Enable an HTTP Connection in App Volumes Manager During Installation

You can enable an HTTP connection when you are installing App Volumes Manager.

Procedure

  1. When you choose networks ports during App Volumes Manager installation, select the Allow Connections Over HTTP (insecure) option.
  2. Enter a value for the HTTP port or retain the default value of 80.

Results

HTTP is enabled in App Volumes Manager and you can now disable SSL in the agent and configure the agent to communicate over HTTP. See Disable SSL in App Volumes Agent.

Enable HTTP in App Volumes Manager After Installation

You can modify the Nginx configuration file in App Volumes Manager if you want to enable HTTP in the manager after it has been installed.

Important This server block is not present in the Nginx file by default; add this server block only if you have not enabled HTTP when installing App Volumes Manager.

Prerequisites

Navigate to C:\Program  Files   (x86)\CloudVolumes\Manager\nginx\conf  and take a back up of   the existing Nginx configuration file, nginx.conf.

Procedure

  1. Log in as administrator to the machine where App Volumes Manager is installed.

Navigate to C:\Program Files (x86)\CloudVolumes\Manager\nginx\conf, open the Nginx configuration file, and copy the following block in the Nginx file after include proxy/ vcenter*.conf;.

root      ../public;

rewrite ^/(.*)/$ /$1 permanent;

access_log logs/access_http.log main; error_log      logs/error_http.log info;

charset utf-8; override_charset on;

gzip on;

gzip_types application/json application/javascript;

error_page  404                               /404.html;

error_page  502                               /502.html;

#error_page        504 /500.html;

location ~* ^.+\.(jpg|jpeg|gif|png|ico)$ { expires max;

break;

}

location ~* ^.+\.(css|js|htm|html|json)$ { #expires 0; # expire immediately expires 5m;

break;

}

location / {

try_files /index.html @manager;

}

location ^~ /ngvc/ {

access_log logs/access_ngvc_http.log main; error_log logs/error_ngvc_http.log info; proxy_connect_timeout 10; #proxy_next_upstream off; proxy_next_upstream timeout; proxy_read_timeout 600;

proxy_send_timeout 30;

send_timeout 30; proxy_redirect off; server_name_in_redirect off; proxy_pass_header Cookie; proxy_pass_header Set-Cookie;

proxy_pass_header X-Accel-Redirect; proxy_set_header Host $host:80; proxy_set_header X-Real-IP $remote_addr;

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; add_header X-Backend $upstream_addr;

proxy_pass http://ngvc;

}

location @manager {

  • Restart the App Volumes service.

Results

App Volumes Manager now communicates over HTTP.

Disable SSL in App Volumes Agent

You can disable SSL in App Volumes agent after you have installed the agent.

Prerequisites

Verify that you have enabled HTTP connection in App Volumes Manager. See Enable an HTTP Connection in App Volumes Manager During Installation.

Procedure

  1. Log in as administrator on the machine where the App Volumes agent is installed.
  2. Click the Start menu in Windows and enter regedit to open the Registry editor.
  3. In the Registry Editor, go to HKLM\System\CurrentControlSet\Services\svservice

\Parameters.

  • Set the SSL key in the HKLM\System\CurrentControlSet\Services\svservice\Parameters

path to 0.

  • Restart the App Volumes service.

Results

SSL is disabled in the App Volumes agent and all agent communication with the App Volumes Manager occurs over HTTP.

Check for SSL Certificate Revocation

You can configure the App Volumes agent to check if the SSL certificate used by a server to communicate with the agent is revoked or not.

App Volumes agents use SSL to communicate with App Volumes Manager and validate the certificate. By default, the App Volumes agent does not check if the SSL certificate that is used by the server to communicate with the agent is revoked or not. This can lead to decreased security in the form of persistent MITM attacks against the App Volumes agent.

Prerequisites

  • You must have administrator privileges to the machine where the App Volumes agent is installed.
  • SSL and SSL certificate validation must be enabled on the agent. If you have enabled HTTP on the manager, and disabled SSL on the agent, you cannot check for certificate revocation on the server.

Procedure

  1. Log in as administrator to the machine where App Volumes agent is installed.
  2. Run regedit to open the Windows registry settings, and select HKEY_LOCAL_MACHINE\SYSTEM

\CurrentControlSet\Services\svservice\Parameters.

  • Select and set the EnforceSSLCertificateRevocation DWORD key to 1.

Note The EnforceSSLCertificateRevocation variable can be set only if the


EnforceSSLCertificateValidation key is already enabled.

Results

If the SSL certificate is revoked on the server and SSL certificate revocation checking is enabled on the agent, the SSL connection between agent and manager is immediately terminated.

Working with Applications                 

You can use the Applications tab for assigning and managing the applications to your team. Some of the tasks that you can perform are as follows: create an Application, assign an Application to an entity, create a Package for an Application, and edit and delete an Application.

On the Applications page, you can view the list of Applications and Application details such as the status of an Application, entities assigned to an Application, and the Packages added to an Application.

This chapter includes the following topics:

Create an Application

By creating an Application, you can manage the lifecycle of the packages added to the Application.

Procedure

  1. From App Volumes Manager, go to INVENTORY > Applications and click Create.
  2. Provide the following information and click Create:
OptionDescription
NameName of the Application.
DescriptionInclude the name of the packages or programs the Application contains.
OwnerIf you want to change the default option, search and select the owner from the available domains in the Active Directory.
Package (optional)The App Volumes Manager displays the Packages tab after the Application is created. If this box is deselected, you must create a Package later.
  • If you want to create a package for the Application immediately after the Application is created, select the Create a Package box.

By default, the Create a Package box is selected.

  • Click Create.
  • On the Confirm Create Application window, click Create.

If you have selected the Create a Package box, App Volumes Manager displays the

Packages tab after the Application is created.

What to do next

Create a Package for an Application.

Import an Application to App Volumes

If you have already created an Application Package in another App Volumes Manager deployment, you can import the VMDK files of that Application Package to the current App Volumes Manager deployment. You can use the Import functionality to reuse pre-configured third-party Application Packages.

After importing the Application Package to the current App Volumes Manager deployment, you can perform the assign and attach activities.

Prerequisites

Using the vCenter Server datastore browser, select a datastore, create a folder, and upload the Application Package to this folder.

Procedure

  1. From the App Volumes Manager console, navigate to INVENTORY > Applications.
  2. Click Import.
  3. Select the datastore where you have uploaded the Application Package and enter the path of the Application Package.
  4. Click Import.

Results

The current App Volumes Manager deployment lists the imported Application Package.

Rescan Applications

You can use the Rescan functionality to verify the existence and current state of each Application Package on the datastore.

The rescan operation only checks for Application Packages that are already known by the current App Volumes Manager deployment.

For new Application Packages added to the datastore from a different App Volumes Manager deployment, you can import the Application Packages to the current App Volumes Manager deployment. To import an Application Package, see Import an Application to App Volumes.

Procedure

  1. From the App Volumes Manager console, navigate to INVENTORY > Applications.
  2. Click Rescan.

A list of available Application Packages is displayed with its current state.

Assign an Application to an Entity

You can assign an Application to a single entity or multiple entities.

  • If you select the assignment type as Marker and the Application package is not yet marked CURRENT, the Application is assigned to the entity and the assignment type is inactive until the Package is marked CURRENT.
  • In an Application, a Package set with the CURRENT marker can be assigned to multiple entities. For information about assignment types, see Understanding Assignment Types.

Prerequisites

  • Ensure that the status of the entity, to which the Application must be assigned, is Available.
  • For the Assignment Type, Package, an Application must have at least one Package.

Procedure

  1. From App Volumes Manager, go to INVENTORY > Applications.
  2. Select the Application to which needs to be assigned to an entity.
  3. Click Assign.
  4. Search the Active Directory for an entity.
  5. Select the entity.

The Status of the entity must be Available.

  • Select Assignment Type.
OptionAction
MarkerClick Assign.If the Application has no Package or if the Package is not yet set with CURRENT marker, Application is assigned to the entity, but marker is inactive until the Package is set.If the Package has the CURRENT marker, entity receives the CURRENT Package version. Click Assign.
Packagea Select the Package that needs to be assigned to the entity. b Click Assign.
  • On the Confirm Assign window, click Assign.

Results

On the Applications page, assignment details are updated.

Understanding Assignment Types

An entity can be assigned to an Application. There are two types of assignments: Marker and Package. In an Application, an entity can be assigned to only one Application package, with the assignment type as either Marker or Package.

Marker

The entity is assigned the Application Package version, which is set as CURRENT.

Package

The entity is assigned a specific Application Package version and the entity receives only the assigned version.

Unassign an Application from an Entity

You can remove an Application assigned to an entity or entities.

Procedure

  1. From App Volumes Manager, go to INVENTORY > Applications.
  2. Select an Application that needs to be unassigned from an entity or entities.
  3. Click Unassign.

List of entities assigned to the Application are displayed.

  • Select the entity or entities.
  • Click Unassign.
  • On the Confirm Unassign window, click Unassign.

Create a Package for an Application

You can create a Package for an Application either immediately after creating the Application or at a later point in time.

When you create a Package, you only provide the metadata such as name, storage, path, template, and description of the Package from the App Volumes Manager.

For information about life cycle of a Package, see Lifecycle of a Package.

Prerequisites

Procedure

  1. From App Volumes Manager, go to INVENTORY > Applications.
  2. Select an Application and click Create Package.
  3. On the Create Package page, provide the Package details such as Name, Base Package, Storage, Path, Template, Stage, and Description.

Base Package acts as reference when you opt to create a new version of a Package by using an existing version as base.

  • Click Create.
  • On the Confirm Create Package window, select one of the options and click Create.
OptionAction
Perform in the backgroundThe Package gets created for the Application in the background and you can perform other tasks. Note Status of the Package is Creating.
Wait for completionYou must wait until the Package is created for the Application. You cannot perform any other tasks until the Package gets created.

Results

The newly created Package details are displayed in the Packages tab.

What to do next

Package the Application.

Lifecycle of a Package

Each Package has different stages. These stages provide information about the state of delivery of the Package. You can choose a Package stage while creating a Package.

The following are the different stages of a Package:

New

Package is ready to be tested. Users who are signed up for testing this Package are assigned this stage.

Tested

Package is ready to be published. Users have tested this Package.

Published

Package is published for assigned users.

Retired

Packages that are no longer required or updated. Entities can still be assigned to Applications with retired Packages.

To create a package, see Create a Package for an Application.

Edit an Application

You can edit an Application to change the name, description, and owner details.

Procedure

  1. From App Volumes Manager, go to INVENTORY > Applications.
  2. Select the Application you want to edit and click Edit.
  3. Enter the new values and click Save.

The updated Application details are displayed.

Delete an Application

Depending on your requirements, you can delete an Application. When you delete an Application, the associated Packages and Assignments are also deleted.

Procedure

  1. From App Volumes Manager, go to INVENTORY > Applications.
  2. Select an Application and click Delete.
  3. On the Confirm Delete window, click Delete.

Status of the Application is displayed as Pending Delete until the action is completed.

Results

The Application is removed from the Applications page.

Sandeep Kumar & Shaswati Mukherjee

More Posts

Leave a Reply

Your email address will not be published. Required fields are marked *