control the devices The Administrator can also set up new users and specify each user’s individual access and control privileges.
3. If a user is set up with pptd, dialin, ftp or pmshell group membership they will have restricted user shell access to the nominated managed devices but they will not have any direct access to the console server
4.6.4 Managing the slaves
The Master is in control of the Slave serial ports. So for example if change a User access privileges or edit any serial port setting on the Master, the updated configuration files will be sent out to each Slave in parallel. Each Slave will then automatically make changes to their local configurations (and only make those changes that relate to its particular serial ports).
You can still use the local Slave Management Console to change the settings on any Slave serial port (such as alter the baud rates). However these changes will be overwritten next time the Master sends out a configuration file update. Also while the Master is in control of all Slave serial port related functions, it is not master over the Slave network host connections or over the Slave console server system itself.
So Slave functions such as IP, SMTP & SNMP Settings, Date &Time, DHCP server must be managed by accessing each Slave directly and these functions are not over written when configuration changes are propagated from the Master. Similarly the Slaves Network Host and IPMI settings have to be configured at each Slave.
Also the Master’s Management Console provides a consolidated view of the settings for its own and the entire Slave’s serial ports, however the Master does not provide a fully consolidated view. For example if you want to find out who's logged in to cascaded serial ports from the master, you’ll see that Status: Active Users only displays those users active on the Master’s ports, so you may need to write custom scripts to provide this view. This is covered in Chapter 11.
4.7
Serial Port Redirection (PortShare)
Opengear’s Port Share software delivers the virtual serial port technology your Windows and Linux applications need to open remote serial ports and read the data from serial devices that are connected to your console server.
User Manual
79
Data Center and Remote Site Management - User ManualPortShare is supplied free with each console server and you are licensed to install PortShare on one or more
computers for accessing any serial device connected to a console server port.
PortShare for Windows
The portshare_setup.exe program is included on the CD supplied with your console server. A copy can be freely downloaded from the ftp site. Refer to the PortShare User Manual and Quick Start for details on installation and operation
PortShare for Linux
The PortShare driver for Linux maps the console server serial port to a host try port. Opengear has released the
portshare-serial-client as an open source utility for Linux, AIX, HPUX, SCO, Solaris and UnixWare. This utility can
be freely downloaded from the ftp site.
This PortShare serial port redirector allows you to use a serial device connected to the remote console server as if it were connected to your local serial port. The portshare-serial-client creates a pseudo tty port, connects the serial application to the pseudo tty port, receives data from the pseudo tty port, transmits it to the console server through network and receives data from the console server through network and transmits it to the pseudo-tty port.
The .tar file can be freely downloaded from the ftp site. Refer to the PortShare User Manual and Quick Start for details on installation and operation.
4.8
Managed Devices
Managed Devices presents a consolidated view of all the connections to a device that can be accessed and monitored through the console server. To view the connections to the devices:
This screen displays all the Managed Device with their Description/Notes and lists of all the configured Connections: - Serial Port # (if serially connected) or
- USB (if USB connected)
- IP Address (if network connected)
- Power PDU/outlet details (if applicable) and any UPS connections
Devices such as servers will commonly have more than one power connections (e.g. dual power supplied) and more than one network connection (e.g. for BMC/service processor).
All users can view (but not edit) these Managed Device connections by selecting Manage: Devices. Whereas the
Administrator can edit and add/delete these Managed Devices and their connections.
To edit an existing device and add a new connection:
Select Edit on the Serial&Network: Managed Devices and click Add Connection
Select the connection type for the new connection (Serial, Network Host, UPS or RPC) and then select the specific connection from the presented list of configured unallocated hosts/ports/outlets
To add a new network connected Managed Device:
The Administrator adds a new network connected Managed Device using Add Host on the Serial&Network:
Network Host menu. This automatically creates a corresponding new Managed Device (as covered in Section 4.4 - Network Hosts)
When adding a new network connected RPC or UPS power device, you set up a Network Host, designate it as RPC or UPS, then go to RPC Connections (or UPS Connections) to configure the relevant connection. Again
User Manual
81
Data Center and Remote Site Management - User Manualcorresponding new Managed Device (with the same Name /Description as the RPC/UPS Host) is not created until this connection step is completed (refer Chapter8 - Power and Environment)
Note The outlet names on this newly created PDU will by default be “Outlet 1” “Outlet 2”. When you connect an
particular Managed Device (that draws power from the outlet) they the outlet will then take up the name of the powered Managed Device
To add a new serially connected Managed Device:
Configure the serial port using the Serial&Network: Serial Port menu (refer Section 4.1 -Configure Serial Port ) Select Serial&Network: Managed Devices and click Add Device
Enter a Device Name and Description for the Managed Device
Click Add Connection and select Serial and the Port that connects to the Managed Device
To add a UPS/RPC power connection or network connection or another serial connection click Add Connection Click Apply
Note To set up a new serially connected RPC UPS or EMD device, you configure the serial port, designate it as a Device then enter a Name and Description for that device in the Serial & Network: RPC Connections (or UPS
Connections or Environmental). When applied, this will automatically create a corresponding new Managed
Device with the same Name /Description as the RPC/UPS Host (refer Chapter8 - Power and Environment) Also all the outlet names on the PDU will by default be “Outlet 1” “Outlet 2”. When you connect a particular Managed Device (that draws power from the outlet) then the outlet will then take up the name of the powered Managed Device
4.9
IPsec VPN
The ACM7000, ACM5500, ACM5000, CM7100, IM7200 and IM4200 family of advanced console servers include
Openswan, a Linux implementation of the IPsec (IP Security) protocols, which can be used to configure a Virtual Private Network (VPN). The VPN allows multiple sites or remote administrators to access the Opengear advanced console server (and Managed Devices) securely over the Internet.
The administrator can establish an encrypted authenticated VPN connections between advanced console serves distributed at remote sites and a VPN gateway (such as Cisco router running IOS IPsec) on their central office network:
Users and administrators at the central office can then securely access the remote console servers and connected serial console devices and machines on the Management LAN subnet at the remote location as though they were local
All these remote console servers can then be monitored with a CMS6000 on the central network
With serial bridging, serial data from controller at the central office machine can be securely connected to the serially controlled devices at the remote sites (refer Chapter 4.1)
The road warrior administrator can use a VPN IPsec software client such as TheGreenBow
(www.thegreenbow.com/vpn_gateway.html) or Shrew Soft (www.shrew.net/support ) to remotely access the advanced
console server and every machine on the Management LAN subnet at the remote location
Configuration of IPsec is quite complex so Opengear provides a simple GUI interface for basic set up as described below. However for more detailed information on configuring Openswan IPsec at the command line and interconnecting with other IPsec VPN gateways and road warrior IPsec software refer http://wiki.openswan.org and
http://opengear.com/faq.html 4.9.1 Enable the VPN gateway
Select IPsec VPN on the Serial & Networks menu
Click Add and complete the Add IPsec Tunnel screen
User Manual
83
Data Center and Remote Site Management - User Manual Select the Authentication Method to be used, either RSA digital signatures or a Shared secret (PSK)
o If you select RSA you will asked to click here to generate keys. This will generate an RSA public key for the console server (the Left Public Key). You will need to find out the key to be used on the remote gateway, then cut and paste it into the Right Public Key
o If you select Shared secret you will need to enter aPre-shared secret (PSK). The PSK must match the PSK configured at the other end of the tunnel
In Authentication Protocol select the authentication protocol to be used. Either authenticate as part of ESP (Encapsulating Security Payload) encryption or separately using the AH (Authentication Header) protocol. Enter a Left ID and Right ID. This is the identifier that the Local host/gateway and remote host/gateway use for
IPsec negotiation and authentication. Each ID must include an ‘@’ and can include a fully qualified domain name preceded by ‘@’ ( e.g. [email protected])
Enter the public IP or DNS address of this Opengear VPN gateway as the Left Address. You can leave this blank to use the interface of the default route
In Right Address enter the public IP or DNS address of the remote end of the tunnel (only if the remote end has a static or dyndns address). Otherwise leave this blank
If the Opengear VPN gateway is serving as a VPN gateway to a local subnet (e.g. the console server has a Management LAN configured) enter the private subnet details in Left Subnet. Use the CIDR notation (where the IP address number is followed by a slash and the number of ‘one’ bits in the binary notation of the netmask). For example 192.168.0.0/24 indicates an IP address where the first 24 bits are used as the network address. This is the same as 255.255.255.0. If the VPN access is only to the console server itself and to its attached serial console devices then leave Left Subnet blank
If there is a VPN gateway at the remote end, enter the private subnet details in Right Subnet. Again use the CIDR notation and leave blank if there is only a remote host
Select Initiate Tunnel if the tunnel connection is to be initiated from the Left console server end. This can only be initiated from the VPN gateway (Left) if the remote end was configured with a static (or dyndns) IP address Click Apply to save changes
Note It is essential the configuration details set up on the advanced console server (referred to as the Left or Local host) exactly matches the set up entered when configuring the Remote (Right) host/gateway or software client. Refer to the http://www.opengear.com/faq.html for details on configuring these remote ends
4.10 OpenVPN
The ACM7000, ACM5500, ACM5000, CM7100, IM7200 and IM4200 family of advanced console servers with Firmware V3.2 and later, include OpenVPN. OpenVPN uses the OpenSSL library for encryption, authentication, and certification, which means it uses SSL/TSL (Secure Socket Layer/Transport Layer Security) for key exchange and can encrypt both data and control channels. Using OpenVPN allows for the building of cross-platform, point-to-point VPNs using either X.509 PKI (Public Key Infrastructure) or custom configuration files.
OpenVPN allows secure tunneling of data through a single TCP/UDP port over an unsecured network, thus providing secure access to multiple sites and secure remote administration to a console server over the Internet.
OpenVPN also allows the use of Dynamic IP addresses by both the server and client thus providing client mobility. For example, an OpenVPN tunnel may be established between a roaming windows client and an Opengear advanced
console server within a data center.
Configuration of OpenVPN can be complex so Opengear provides a simple GUI interface for basic set up as described below. However for more detailed information on configuring OpenVPN Access server or client refer to the HOW TO and FAQs at http://www.openvpn.net