Citrix
How to Change the Default Administrator for the Citrix Licensing Server Version 11.10
http://support.citrix.com/article/CTX135841
How to reset the admin password for Citrix Licensing Server
Sometimes the Citrix licensing server doesn’t get accessed for a long time, maybe the admin leaves and is replaced and no-one made a note of the password. Suddenly, you can’t access the licensing server any more. What to do ?
If you have access to the disk sub system (ie.. the files) on the licensing server then it is possible to reset the admin password.
1. Open the “server.xml” file in C:\Program Files\Citrix\Licensing\LS\conf. If on Win2k8 you will need to open your editor as an admin. (Take a copy of the file first – if anything goes wrong you can simply copy the file back to restore the original settings).
2. Find the entry that looks something like this:
3. Erase the contents between the double quotes after “password=”
4. Enter a plain text password , for example password=”TemporaryPassword”
5. Change the passwordExpired value to be “true” and save the server.xml file.
6. Restart the licensing services or, at a push, reboot the server.
7. Log into the licensing console using user name “admin” and the password set above.
8. You will be prompted to change your password. The new password will be encrypted in the server.xml file.
Active FTP vs. Passive FTP, a Explanation
Introduction
One of the most commonly seen questions when dealing with firewalls and other Internet connectivity issues is the difference between active and passive FTP and how best to support either or both of them. Hopefully the following text will help to clear up some of the confusion over how to support FTP in a firewalled environment.This may not be the definitive explanation, as the title claims, however, I've heard enough good feedback and seen this document linked in enough places to know that quite a few people have found it to be useful. I am always looking for ways to improve things though, and if you find something that is not quite clear or needs more explanation, please let me know! Recent additions to this document include the examples of both active and passive command line FTP sessions. These session examples should help make things a bit clearer. They also provide a nice picture into what goes on behind the scenes during an FTP session. Now, on to the information...
The Basics
FTP is a TCP based service exclusively. There is no UDP component to FTP. FTP is an unusual service in that it utilizes two ports, a 'data' port and a 'command' port (also known as the control port). Traditionally these are port 21 for the command port and port 20 for the data port. The confusion begins however, when we find that depending on the mode, the data port is not always on port 20.Active FTP
In active mode FTP the client connects from a random unprivileged port (N > 1023) to the FTP server's command port, port 21. Then, the client starts listening to port N+1 and sends the FTP commandPORT N+1 to the FTP server. The server will then connect back to the client's specified data port from its local data port, which is port 20. From the server-side firewall's standpoint, to support active mode FTP the following communication channels need to be opened:
- FTP server's port 21 from anywhere (Client initiates connection)
- FTP server's port 21 to ports > 1023 (Server responds to client's control port)
- FTP server's port 20 to ports > 1023 (Server initiates data connection to client's data port)
- FTP server's port 20 from ports > 1023 (Client sends ACKs to server's data port)
PORT 1027. The server then sends an ACK back to the client's command port in step 2. In step 3 the server initiates a connection on its local data port to the data port the client specified earlier. Finally, the client sends an ACK back as shown in step 4. The main problem with active mode FTP actually falls on the client side. The FTP client doesn't make the actual connection to the data port of the server--it simply tells the server what port it is listening on and the server connects back to the specified port on the client. From the client side firewall this appears to be an outside system initiating a connection to an internal client--something that is usually blocked.
Active FTP Example
Below is an actual example of an active FTP session. The only things that have been changed are the server names, IP addresses, and user names. In this example an FTP session is initiated from testbox1.slacksite.com (192.168.150.80), a linux box running the standard FTP command line client, to testbox2.slacksite.com (192.168.150.90), a linux box running ProFTPd 1.2.2RC2. The debugging (-d) flag is used with the FTP client to show what is going on behind the scenes. Everything in red is the debugging output which shows the actual FTP commands being sent to the server and the responses generated from those commands. Normal server output is shown in black, and user input is in bold. There are a few interesting things to consider about this dialog. Notice that when the
PORT command is issued, it specifies a port on the client (192.168.150.80) system, rather than the server. We will see the opposite behavior when we use passive FTP. While we are on the subject, a quick note about the format of the PORT command. As you can see in the example below it is formatted as a series of six numbers separated by commas. The first four octets are the IP address while the last two octets comprise the port that will be used for the data connection. To find the actual port multiply the fifth octet by 256 and then add the sixth octet to the total. Thus in the example below the port number is ( (14*256) + 178), or 3762. A quick check with netstat should confirm this information. testbox1: {/home/p-t/slacker/public_html} % ftp -d testbox2
Connected to testbox2.slacksite.com.
220 testbox2.slacksite.com FTP server ready.
Name (testbox2:slacker): slacker
---> USER slacker
331 Password required for slacker.
Password: TmpPass
---> PASS XXXX
230 User slacker logged in.
---> SYST
215 UNIX Type: L8
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
ftp: setsockopt (ignored): Permission denied
---> PORT 192,168,150,80,14,178
200 PORT command successful.
---> LIST
150 Opening ASCII mode data connection for file list.
drwx------ 3 slacker users 104 Jul 27 01:45 public_html
226 Transfer complete.
ftp> quit
---> QUIT
221 Goodbye.
Passive FTP
In order to resolve the issue of the server initiating the connection to the client a different method for FTP connections was developed. This was known as passive mode, orPASV, after the command used by the client to tell the server it is in passive mode. In passive mode FTP the client initiates both connections to the server, solving the problem of firewalls filtering the incoming data port connection to the client from the server. When opening an FTP connection, the client opens two random unprivileged ports locally (N > 1023 and N+1). The first port contacts the server on port 21, but instead of then issuing a
PORT command and allowing the server to connect back to its data port, the client will issue the PASV command. The result of this is that the server then opens a random unprivileged port (P > 1023) and sends the PORT P command back to the client. The client then initiates the connection from port N+1 to port P on the server to transfer data. From the server-side firewall's standpoint, to support passive mode FTP the following communication channels need to be opened:
- FTP server's port 21 from anywhere (Client initiates connection)
- FTP server's port 21 to ports > 1023 (Server responds to client's control port)
- FTP server's ports > 1023 from anywhere (Client initiates data connection to random port specified by server)
- FTP server's ports > 1023 to remote ports > 1023 (Server sends ACKs (and data) to client's data port)
PASV command. The server then replies in step 2 with PORT 2024, telling the client which port it is listening to for the data connection. In step 3 the client then initiates the data connection from its data port to the specified server data port. Finally, the server sends back an ACK in step 4 to the client's data port. While passive mode FTP solves many of the problems from the client side, it opens up a whole range of problems on the server side. The biggest issue is the need to allow any remote connection to high numbered ports on the server. Fortunately, many FTP daemons, including the popular WU-FTPD allow the administrator to specify a range of ports which the FTP server will use.
The second issue involves supporting and troubleshooting clients which do (or do not) support passive mode. As an example, the command line FTP utility provided with Solaris does not support passive mode, necessitating a third-party FTP client, such as ncftp.
With the massive popularity of the World Wide Web, many people prefer to use their web browser as an FTP client. Most browsers only support passive mode when accessing ftp:// URLs. This can either be good or bad depending on what the servers and firewalls are configured to support.
Passive FTP Example
Below is an actual example of a passive FTP session. The only things that have been changed are the server names, IP addresses, and user names. In this example an FTP session is initiated from testbox1.slacksite.com (192.168.150.80), a linux box running the standard FTP command line client, to testbox2.slacksite.com (192.168.150.90), a linux box running ProFTPd 1.2.2RC2. The debugging (-d) flag is used with the FTP client to show what is going on behind the scenes. Everything in red is the debugging output which shows the actual FTP commands being sent to the server and the responses generated from those commands. Normal server output is shown in black, and user input is in bold. Notice the difference in the
PORT command in this example as opposed to the active FTP example. Here, we see a port being opened on the server (192.168.150.90) system, rather than the client. See the discussion about the format of the PORT command above, in the Active FTP Example sectiontestbox1: {/home/p-t/slacker/public_html} % ftp -d testbox2
Connected to testbox2.slacksite.com.
220 testbox2.slacksite.com FTP server ready.
Name (testbox2:slacker): slacker
---> USER slacker
331 Password required for slacker.
Password: TmpPass
---> PASS XXXX
230 User slacker logged in.
---> SYST
215 UNIX Type: L8
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> passive
Passive mode on.
ftp> ls
ftp: setsockopt (ignored): Permission denied
---> PASV
227 Entering Passive Mode (192,168,150,90,195,149).
---> LIST
150 Opening ASCII mode data connection for file list
drwx------ 3 slacker users 104 Jul 27 01:45 public_html
226 Transfer complete.
ftp> quit
---> QUIT
221 Goodbye.
Other Notes
A reader, pointed out that active FTP will not function when used in conjunction with a client-side NAT (Network Address Translation) device which is not smart enough to alter the IP address info in FTP packets.Summary
The following chart should help admins remember how each FTP mode works:Active FTP : command : client >1023 -> server 21 data : client >1023 <- 20="" :="" client="" command="" ftp="" passive="" server="">1023 -> server 21 data : client >1023 -> server >1023A quick summary of the pros and cons of active vs. passive FTP is also in order:
Active FTP is beneficial to the FTP server admin, but detrimental to the client side admin. The FTP server attempts to make connections to random high ports on the client, which would almost certainly be blocked by a firewall on the client side. Passive FTP is beneficial to the client, but detrimental to the FTP server admin. The client will make both connections to the server, but one of them will be to a random high port, which would almost certainly be blocked by a firewall on the server side.
Luckily, there is somewhat of a compromise. Since admins running FTP servers will need to make their servers accessible to the greatest number of clients, they will almost certainly need to support passive FTP. The exposure of high level ports on the server can be minimized by specifying a limited port range for the FTP server to use. Thus, everything except for this range of ports can be firewalled on the server side. While this doesn't eliminate all risk to the server, it decreases it tremendously.
Terminal Services get a makeover in Windows Server 2008 R2
Microsoft will be the third major virtualization vendor to release a virtual desktop infrastructure (VDI) product by the end of 2009, following the lead of VMware Inc. and Citrix Systems Inc. With the impending release of Windows Server 2008 R2, Microsoft will add the necessary orchestration and management components to its Terminal Services and Hyper-V hypervisor to make low-cost VDI a reality.With the R2 release, Microsoft's VDI play involves the integration of several components with which you're likely already familiar. The most notable of these components are Hyper-V and Terminal Services or, as it is now known, Remote Desktop Services (RDS). This tip examines how familiar components of Terminal Services have been integrated into Windows Server 2008 R2 to better orchestrate and manage Microsoft VDI deployments.
Hyper-V and RDS: Two critical components of hosted desktops
In Windows Server 2008 R2, Hyper-V provides the virtualization platform for hosting desktops. As a result, the first step in any Microsoft VDI deployment is to determine -- and then deploy -- the number of Hyper-V servers you'll need to support your virtual machines (VMs). The second necessary component is Microsoft's Remote Desktop Services. The re-named RDS expands on Terminal Services by supporting connections to traditional presentation virtualization servers while also supporting hosted desktops.
RDS accomplishes this through augmentation of what was previously known as the Terminal Services Session Broker (or TS Session Broker). In Windows Server 2008's RTM version, TS Session Broker directed users to the correct terminal server in a farm of similarly configured servers. With R2, the RDS Session Broker service can also direct users to their assigned Hyper-V VM. The result is that RDS Session Broker plays a critical role in your environment.
Remote Desktop Gateway and Remote Desktop Web Access
Windows Server 2008 R2 contains other Terminal Services featuers. Terminal Services Gateway and Terminal Services Web Access have now been re-named as Remote Desktop Gateway (RD Gateway) and Remote Desktop Web Access (RD Web Access), respectively. The combination of these two services provides a Web-based mechanism for presenting a list of assigned applications and hosted desktops to users. As previously, adding the RD Gateway to an environment enables you to traffic applications and desktops across the Web through an encrypted connection.For end users, the result is a relatively unchanged experience from the RTM version of Windows Server 2008. To connect to an application, users log on to an RD Web Access server and then select an application. Hosted desktops are presented as clickable icons in the interface, providing a seamless mechanism for users to connect. The RD Web Access server itself has been augmented with new features that change its appearance. The most obvious of these changes is the new Silverlight-based user interface, which sports a much "sleeker" look. In addition, it supports greater numbers of extensibility points for unique branding.
Provisioning virtual machines in Microsoft VDI deployments
In data centers, changes have occurred in how VMs are provisioned to users. Administratively speaking, VMs can be made available to users in one of two ways. The first is through a direct assignment called a personal virtual desktop. Using this mechanism, the administrator can create a VM on a Hyper-V host. That VM is then directly assigned to a user through the RemoteApp and Desktop (RAD) Connection Manager console. Once a VM is created, the user assigned to it will then see his personal desktop available as a link in RD Web Access.
This one-to-one mapping between users and desktops is useful if you plan on having users work with their desktops over time. But the creation of a desktop that is tagged to a specific user doesn't fulfill Microsoft's mission of providing legacy application support. To fully enable this capability, Microsoft decouples users from specific desktops and instead creates an available VM from among a pool of resources. The result is a pooled virtual desktop, which provides a place for users to interact with their applications without the administrative overhead of managing user-tagged VMs.
A pooled virtual desktop makes life easier for admins because it allows them to take entire pools of VMs offline for updates as they become necessary. Pooled virtual desktops are designed to be implemented as clones of one another, creating a set of VMs with a common basis. If these clones need to be updated after creation, they can be individually modified through a configuration control mechanism (such as Group Policy, ConfigMgr, etc.). Alternatively, because VMs in a pool are intended to be stateless, clones can be thrown away. Doing this enables an administrator to make changes to the original-source VMs and re-create the clones as needed. For larger environments, Microsoft suggests Application Virtualization (or App-V) as a mechanism for timely delivery of applications to clones.
In both cases, user profiles are abstracted from individual VM instances through the use of Remote Desktop Services roaming profiles. These roaming profiles are similar to the traditional Terminal Services roaming profiles that have been used with Terminal Services for years.
Much like Citrix's recent move to VDI with XenDesktop, Microsoft's foray into the VDI space is brilliant in how it takes mature technologies and repurposes them for a more advanced use. In the next article of this series, I'll give you click-by-click instructions on how to begin building a VDI deployment with Windows Server 2008 R2, Hyper-V and RDS.
Citrix Synergy 2009
The information-packed days of Citrix Synergy 2009 are over. Synergy brimmed with informational keynotes and breakout sessions, peer-to-peer networking and a busy Solutions Expo Hall. Attendees walked away armed with actionable information that they can use to solve organizational issues, lower costs and deliver more business value. We're sorry you missed it, but don't want you to miss out.Videos: http://www.citrix.com/tv/#video/403
Remote display protocol advances will usher in a new era of VDI
Gartner is predicting that there will be 49 million VDI users in five years. Since VDI is a "single user" form of server-based computing, it uses the same remote display protocols and techniques that have been in place for years.
When people think of remote display protocols, the first things that pop into their minds are Microsoft RDP or Citrix ICA. Unfortunately, most people think of these with negative thoughts. I'm happy to report that if you haven't looked at these remote protocols for a while, there have been a lot of changes, and there are a lot of new players in the market too.
Most people consider Microsoft's RDP protocol to be "just" the low-end free option. "Sure, RDP is fine for occasional remote server access," they think, "but I'd never use it for daily computing tasks like VDI." The reality is that RDP has been slowly improving over the years.
Not only does today's version of RDP offer audio, high-resolution sessions, fall-back printer drivers, drive mapping and a whole host of other capabilities, the next version of RDP that will be built-in to Windows 7 looks like it will be an absolute killer. RDP 7 will offer multimedia stream remoting, "true" multi-monitor support and several other features that put it right up there with any remote display protocol on the market. And the best part of RDP 7 -- It will be free, built-in to Windows!
The other protocol that immediately pops into peoples' heads is Citrix's ICA protocol. Long-known as the "better performing version of RDP," ICA is still going strong in 2009. Recent improvements include the ability to perform dynamic variable compression, which lets administrators configure a trade-off between performance and quality. So a user grabs and spins a 3-D object on the screen. As it's spinning, the object loses visual quality so that it can spin in real-time with the user's commands, but as soon as the spinning stops the object "pops" back to full quality.
Citrix and Microsoft aren't the only newsmakers in the remote display protocol space anymore, however. Perhaps the most interesting, and novel, approach comes in the form of the "PC-over-IP" protocol from Canadian startup Teradici. PC-over-IP leverages special hardware -- in this case, a card you plug-in to your remote host and a chip which thin client makers built-in to their devices.
Then the two PC-over-IP chips communicate over the network to produce a remote computing experience that is indistinguishable from a local experience. PC-over-IP works at the "DVI level" of the graphics stack, so it supports everything, including video, 3-D and Windows Aero glass.
There are a whole host of lesser-known, yet equally impressive solutions on the market today, including the following:
- Wyse has a set of extensions to RDP known as "TCX," which add capabilities like multi-monitor support, USB device support and multimedia remoting to RDP today.
- Quest Software's "Experience Optimization Pack" enhances the today's version of RDP to make it very usable for day-in, day-out VDI users.
- HP has opened up their "RGS" remote display protocol so that it can be used on non-HP devices.
Users complain that Citrix is slow?
Are you always blamed for issues, yet Citrix servers seem to be working fine?
Wish you could prove where the real problem is - Network? Database? Citrix? Application? VM?
The Citrix Monitor can put an end to the endless blame storms and ensure high operational efficiency, improved user satisfaction, and significant cost-savings. Two key factors that accomplish this:
|
This means you can identify the source of performance issues quickly and with reduced expertise.
Enterprise Citrix Training Environment
This is a collection Windows 2K3sp1 server appliances with various Citrix installation environments built in vmware.
OS3 is PS4.5 Beta for any interested people.
All servers in ECTE start with the same base 2k3sp1 install. From there they are customised to suit the various TE's required. The bonus in doing this is that the 2Gig's required for a base install is only required once. When a new server is required, you just copy the template files (only 2.25Mb's) and rename them, then open the new *.vmx file and rename it in vmware (These are technically post Snapshot files). Then 1st thing that runs after the OS boots is newsid where you give the new server instance a new name and SID to make it unique. Then install whatever software you require.
OS1 is a domain controller with exchange 2k3sp2 and a SQL2k5 Express Citrix Database and ISA2k6 for practice with citrix firewall configurations. This has 2 virtual network cards, one for internal and one for external network segments. Active directory is configured with domain citrix.45 .Being a TE, only basic install configurations have been done with exchange and ISA, so it's up to you to set these up correctly.
OS2 is a standard install of the Citrix Access Essentials pack. It needs a farm to connect to before it is useful.
OS3 is the BETA of Presentation Server 4.5 release. It has been installed with an access database and can be standalone. It is not yet part of the domain. No applications have been installed; this part is all up to you.
OS4 is the current release of Presentation Server 4.0 with Password Manager 4.0. It has been installed with an access database and can be standalone. It not yet part of the domain. No applications have been installed and PM4 needs configuration, this part is all up to you.
OS5 (Advanced) is a SQL2k5 Enterprise Edition basic install. This is intended for use with enterprise farm database storage and configuration and low level understanding of the structure of the enterprise farm database. Again, SQL2k5 is installed but the citrix database is not - that's your homework.
OS6 is from which all other's cometh. As said above, if you need a new server, copy and past these files, rename them and then use newsid to make it unique on the network. When you start a new instance from the template vmware will ask you if you would like to create a new uuid, select .
Notes -
- The virtual network adapter is set to communicate with , which means an adapter created by the vmware installer so virtual machines only talk to each other and Host PC and are not part of your LAN. If you distribute the virtual machines over a few pc's then you will need to change this to - See next note
- OS1 has a DHCP server; this may cause trouble with your local network if you don't know what you are doing.
- There is a very useful and potentially destructive little app on the desktop, use with caution.
- OS2,3,4,5,6 are all configured with 196Mb of ram but will be more responsive the more ram you allocate.
- OS1 is configured with 256Mb ram which simply isn't enough for a server running AD, exchange and ISA (It does work but very slowly). It would be much happier with more than 500Mb.
- Don't defrag the VM's hard drives as this will increase the amount of space taken up on your pc's hard drive without improving performance.
- If you have 2 processors or a dual core processor change your virtual processors to 2 on the vmware console to increase performance
- There are no citrix license files, but as an admin user you get full access to citrix anyway.
- After the creation of a new server the virtual hard drive files will increase to about 600Mb because the clear pagefileatshutdown option is set, so make sure you have space for this.
- www.brianmadden.com is a good place for info about citrix
- File system config example
c:\Virtual Machines\ECTE - base virtual hard drive files citrix.vmdk and Citrix-s00*.vmdk
c:\Virtual Machines\ECTE\a - Citrix-A.vmx, Citrix-000001.vmdk and Citrix-000001-s00*.vmdk
c:\Virtual Machines\ECTE\b - Citrix-B.vmx, Citrix-000001.vmdk and Citrix-000001-s00*.vmdk
etc
ISO's -
I have made a separate "Citrix ISO's" torrent which has all the Citrix Install ISO's i used + some i didn't.
This is required to install -
- Citrix Licensing Server
- Citrix PS4.5 Streaming Server
- New installs from scratch (without cloning existing machines)
See torrent for more details
Requirements -
VMware-server-installer-1.0.1-29996.exe - Free from www.vmware.com
CPU - as fast as possible and as many as possible
Memory - Heaps (The more you have the more OS's can run simultaneously)
Hard drive space - 11 Gigs extracted (plus more as OS's grow)
2 Network cards - preferred but not required
--OR--
A few computers to share the load - you will have to have a copy of the base files on each pc of course.
Preconfigured Operating Systems' configurations -
OS1 -
2k3 sp1 - Domain Controller
Domain - citrix.45
Hostname - Citrix-DC
ISA 2k6
Exchange 2k3 sp2
SQL2k5 Express Citrix Database
DNS
DHCP 1.0.0.0/8
OS2 -
2k3 sp1
Workgroup - citrix
Hostname - Citrix-A
Citrix Access Essentials
OS3 -
2k3 sp1
Workgroup - citrix
Hostname - Citrix-B
Presentation Server 4.5 Beta
- Local access database
- Farm Citrix
OS4 -
2k3 sp1
Workgroup - citrix
Hostname - Citrix-C
Presentation Server 4
- Local access database
- Farm Citrix-C
Password Manager 4
OS5 -
2k3 sp1
SQL2k5 Enterprise Edition
Intended use for enterprise farm database storage and configuration
Not required for simple farm configurations - use access db or SQL2k5express
OS6 - Template
2k3 sp1
IIS
Terminal Services
Homework Challenges -
Basic -
- Open all management consoles and find out what they are for.
- Install and publish applications
- Configure AD with a logical structure for user accounts and resource access.
- Install terminal server licensing server
- Install and configure Citrix licensing server - needs iso - get Citrix ISO's torrent for this
- Access citrix through all three interfaces - ICA, PN, PNA
Intermediate -
- Join all servers to domain
- Migrate all Citrix servers to use SQL2k5 express on Citrix-DC
- Using group policy deploy msi applications and publish.
- Using Citrix package manager to deploy applications.
- Set up a Citrix policy to allow shadowing for admins.
- Configure printing policies and driver distribution to other citrix servers.
- Install the client components for the web interface
- Configure Password Manager with and without AD integration
Advanced -
- Configure ISA with firewall exceptions for citrix to simulate internet access.
- Clone OS4 and create a load balanced application server (newsid is in root of c:\)
- Create Citrix farm database on OS5 SQL server
- Optimise SQL server for this implementation
- Migrate all Citrix servers to use this SQL server
- Create a CSG (Citrix Secure Gateway) and configure ISA to suit (don't have the media, maybe some1 can upload it).
Pioneering -
- Install and configure PS4.5 Streaming extensions - get Citrix ISO's torrent for this
(I have no idea how this works - someone else can make an appliance from the template files and upload the Snapshot files when they get it working)
PS - Maybe a few citrix gurus can put a walk thru (or link to) in the comments to help others learn something useful about Citrix :)
Comments