BenutzerhandbuchInhaltsverzeichnisINTRODUCTION13This User’s Manual walks you through installing and configuring your Black Box Console Server (LES1108A, LES1116A, LES1132A, LES1148A, LES1508A) or Advanced Console Server (LES1208A-R2, LES1216A-R2, LES1232A, LES1248A-R2, LES1308A, LES1316A, LES1332A,...13The latest update of this manual can be found online at www.blackbox.com14INSTALLATION18Introduction182.1 Models182.1.1 Kit components LES1508A Console Server192.1.2 Kit components LES1308A- LES1348A and LES1408A - LES1448A Advanced Console Servers192.1.3 Kit components LES1208A-R2, LES1216A-R2, LES1232A and LES1248A-R2 Advanced Console Servers202.1.4 Kit components LES1116A, LES1132A and LES1148A Console Servers212.1.5 Kit components LES1108A Console Server212.2 Power connection212.2.1 LES1508A power212.2.2 LES1408A - LES1448A, LES1308A- LES1348A and LES1208A - LES1248A power222.2.2 LES1116A, LES1132A and LES1148A power222.2.4 LES1108A power232.3 Network connection232.4 Serial Port connection232.5 USB Port Connection242.6 Antenna and SIM25SYSTEM CONFIGURATION26Introduction263.1 Management console connection263.1.1 Connected PC/workstation set up26o IP address: 192.168.0.10026o Subnet mask: 255.255.255.0273.1.2 Browser connection273.2 Administrator Password293.2.1 Set up new administrator303.2.2 Name the console server303.3 Network IP address303.3.1 IPv6 configuration323.3.2 Dynamic DNS (DDNS) configuration323.4 System Services333.4.1 Service Access33Message Changes to configuration succeeded.353.4.2 Service Settings353.5 Communications Software363.5.1 SDT Connector373.5.2 PuTTY373.5.3 SSHTerm383.6 Management network configuration383.6.1 Enable the Management LAN393.6.2 Configure the DHCP server403.6.3 Select Failover or broadband OOB413.6.4 Aggregating the network ports433.6.5 Static routes44SERIAL PORT AND NETWORK HOST46Introduction464.1 Configure Serial Ports464.1.1 Common Settings474.1.2 Console Server Mode484.1.3 SDT Mode534.1.4 Device (RPC, UPS, EMD) Mode544.1.5 Terminal Server Mode544.1.6 Serial Bridging Mode554.1.7 Syslog554.1.8 Cisco USB console connection564.2 Add/ Edit Users564.3 Authentication604.4 Network Hosts604.5 Trusted Networks614.6 Serial Port Cascading624.6.1 Automatically generate and upload SSH keys624.6.2 Manually generate and upload SSH keys634.6.3 Configure the slaves and their serial ports654.6.4 Managing the Slaves664.7 Serial Port Redirection664.8 Managed Devices674.9 IPsec VPN694.9.1 Enable the VPN gateway704.10 OpenVPN714.10.1 Enable the OpenVPN714.10.2 Configure as Server or Client724.10.3 Windows OpenVPN Client and Server set up734.11 PPTP VPN774.11.1 Enable the PPTP VPN server774.11.2 Add a PPTP user794.11.3 Set up a remote PPTP client79FIREWALL, FAILOVER AND OoB DIAL-IN81Introduction815.1 OoB Dial-In Access815.1.1 Configure Dial-In PPP825.1.2 Using SDT Connector client845.1.3 Set up Windows XP/ 2003/Vista/7 client845.1.4 Set up earlier Windows clients855.1.5 Set up Linux clients for dial-in855.2 OoB broadband access855.3 Broadband Ethernet Failover865.4 Dial-Out Failover875.4.1 Always-on dial-out875.4.2 Failover dial-out895.5 Cellular Modem Connection895.6.1 Connect to the GSM HSUPA/UMTS carrier network895.6.2 Connect to the CDMA EV-DO carrier network915.6.3 Verify cellular connection925.6.4 Cellular modem watchdog925.7 Cellular Operation935.7.1 OOB access set up935.7.2 Cellular failover setup935.7.3 Cellular routing945.7.4 Cellular CSD dial-in setup945.8 Firewall & Forwarding955.8.1 Configuring network forwarding and IP masquerading965.8.2 Configuring client devices975.8.3 Port forwarding985.8.4 Firewall rules99SECURE SSH TUNNELING AND SDT CONNECTOR102Introduction1026.1 Configuring for SSH Tunneling to Hosts1036.2 SDT Connector Client Configuration1036.2.1 SDT Connector installation1046.2.2 Configuring a new console server gateway in the SDT Connector client1056.2.3 Auto-configure SDT Connector client with the user’s access privileges1066.2.4 Make an SDT connection through the gateway to a host1076.2.5 Manually adding hosts to the SDT Connector gateway1086.2.6 Manually adding new services to the new hosts1096.2.7 Adding a client program to be started for the new service1116.2.8 Dial in configuration1136.3 SDT Connector to Management Console1136.4 SDT Connector - telnet or SSH connect to serially attached devices1146.5 Using SDT Connector for out-of-band connection to the gateway1166.6 Importing (and exporting) preferences1176.7 SDT Connector Public Key Authentication1186.8 Setting up SDT for Remote Desktop access1196.8.1 Enable Remote Desktop on the target Windows computer to be accessed1196.8.2 Configure the Remote Desktop Connection client1206.9 SDT SSH Tunnel for VNC1246.9.1 Install and configure the VNC Server on the computer to be accessed124o Set a password using vncpasswd1256.9.2 Install, configure and connect the VNC Viewer1256.10 Using SDT to IP connect to hosts that are serially attached to the gateway1276.10.1 Establish a PPP connection between the host COM port and console server1276.10.2 Set up SDT Serial Ports on console server1316.10.3 Set up SDT Connector to SSH port forward over the console server Serial Port1326.11 SSH Tunneling using other SSH clients (e.g. PuTTY)132ALERTS AND LOGGING135Introduction1357.1 Configure Auto-Response1357.2 Check Conditions1377.2.1 UPS / Power Supply1377.2.1 UPS / Power Supply1377.2.2 UPS Status1377.2.3 Serial Login/Logout1387.2.4 ICMP Ping1387.2.5 Cellular Data1387.2.6 Custom Check1387.2.7 SMS Command1397.3 Trigger Actions1407.3.1 Send Email1407.3.2 Send SMS1417.3.3 Perform RPC Action1417.3.4 Run Custom Script1417.3.5 Send SNMP Trap1417.3.6 Send Nagios Event1417.4 Resolve Actions1427.5 Configure SMTP, SMS, SNMP and/or Nagios service for alert notifications1427.5.1 Send Email alerts1427.5.2 Send SMS alerts1437.5.3 Send SNMP trap alerts1457.5.4 Nagios alerts1467.6 Logging1467.6.1 Log storage1467.6.2 Serial port logging1477.6.3 Network TCP and UDP port logging1487.6.4 Auto-Response event logging1487.6.5 Power device logging148POWER & ENVIRONMENTAL MANAGEMENT149Introduction1498.1 Remote Power Control (RPC)1498.1.1 RPC connection1498.1.2 RPC access privileges and alerts1528.1.3 User power management1528.1.4 RPC status1538.2 Uninterruptible Power Supply Control (UPS)1538.2.1 Managed UPS connections1548.2.2 Remote UPS management1578.2.3 Controlling UPS powered computers1588.2.4 UPS alerts1598.2.5 UPS status1598.2.6 Overview of Network UPS Tools (NUT)1608.3 Environmental Monitoring1628.3.1 Connecting the EMD1638.3.2 Environmental alerts1658.3.3 Environmental status165AUTHENTICATION166Introduction1669.1 Authentication Configuration1669.1.1 Local authentication1679.1.2 TACACS authentication1679.1.3 RADIUS authentication1689.1.4 LDAP authentication1699.1.5 RADIUS/TACACS User Configuration1719.1.6 Group support with remote authentication1719.1.7 Remote groups with RADIUS authentication1729.1.8 Remote groups with LDAP authentication1729.1.9 Remote groups with TACACS+ authentication1749.1.10 Idle timeout1749.1.11 Kerberos authentication1749.1.12 Authentication testing1759.2 PAM (Pluggable Authentication Modules)175Further modules can be added as required.1769.3 SSL Certificate177NAGIOS INTEGRATION18010.1 Nagios Overview18110.2 Central management and setting up SDT for Nagios18110.2.1 Set up central Nagios server18210.2.2 Set up distributed console servers18310.3 Configuring Nagios distributed monitoring18510.3.1 Enable Nagios on the console server18510.3.2 Enable NRPE monitoring18610.3.3 Enable NSCA monitoring18610.3.4 Configure Selected Serial Ports for Nagios Monitoring18710.3.5 Configure Selected Network Hosts for Nagios Monitoring18710.3.6 Configure the upstream Nagios monitoring host18810.4 Advanced Distributed Monitoring Configuration18810.4.1 Sample Nagios configuration18810.4.2 Basic Nagios plug-ins19110.4.3 Additional plug-ins19210.4.4 Number of supported devices19210.4.5 Distributed Monitoring Usage Scenarios193SYSTEM MANAGEMENT196Introduction19611.1 System Administration and Reset19611.2 Upgrade Firmware19711.3 Configure Date and Time19711.4 Configuration Backup19811.5 Delayed Configuration Commit20111.6 FIPS Mode202STATUS REPORTS203Introduction20312.1 Port Access and Active Users20312.2 Statistics20312.3 Support Reports20412.4 Syslog20412.5 Dashboard20512.5.1 Configuring the Dashboard20512.5.2 Creating custom widgets for the Dashboard208MANAGEMENT209Introduction20913.1 Device Management20913.2 Port and Host Logs21013.3 Serial Port Terminal Connection21013.3.1 Web Terminal21013.3.2 SDT Connector access21113.4 Power Management212CONFIGURATION FROM THE COMMAND LINE213Introduction21314.1 Accessing config from the command line213Syntax214Description21414.2 Serial Port configuration21614.3 Adding and Removing Users21914.4 Adding and removing user Groups22014.5 Authentication22114.6 Network Hosts22214.7 Trusted Networks22314.8 Cascaded Ports22314.9 UPS Connections22414.10 RPC Connections22514.11 Environmental22614.12 Managed Devices22714.13 Port Log22714.14 Alerts22814.15 SMTP & SMS23014.16 SNMP23114.17 Administration23114.18 IP settings23114.19 Date & Time Settings23214.20 Dial-in settings23314.21 DHCP server23314.22 Services23414.23 NAGIOS235ADVANCED CONFIGURATION236Introduction23615.1 Custom Scripting23615.1.1 Custom script to run when booting23615.1.2 Running custom scripts when alerts are triggered23715.1.3 Example script - Power Cycling on Pattern Match23815.1.4 Example script - Multiple email notifications on each alert23815.1.5 Deleting Configuration Values from the CLI23815.1.6 Power Cycle any device when a ping request fails24115.1.8 Backing-up the configuration and restoring using a local USB stick24315.1.9 Backing-up the configuration off-box24415.2 Advanced Portmanager24515.2.1 Portmanager commands245The pmusers command is used to query the portmanager for active user sessions.246Example: To detect which users are currently active on which serial ports:246portmanager daemon246There is normally no need to stop and restart the daemon. To restart the daemon normally, just run the command:246# portmanager246Signals24615.2.2 External Scripts and Alerts246PORT="$1"247USER="$2"247PORT="$1"247USER="$2"24715.3 Raw Access to Serial Ports24715.3.1 Access to serial ports24715.3.2 Accessing the console/modem port24815.4 IP- Filtering248/etc/config/ipfilter248#/bin/sh249# 192.168.10.0/2424915.5 Modifying SNMP Configuration24915.5.1 /etc/config/snmpd.conf24915.5.2 Adding more than one SNMP server25015.6 Secure Shell (SSH) Public Key Authentication25115.6.1 SSH Overview25115.6.2 Generating Public Keys (Linux)252To generate new SSH key pairs use the Linux ssh-keygen command. This will produce an RSA or DSA public/private key pair and you will be prompted for a path to store the two key files, for example, id_dsa.pub (the public key) and id_dsa (the private ke...25228:aa:29:38:ba:40:f4:11:5e:3f:d4:fa:e5:36:14:d6 user@server252Your identification has been saved in /home/user/keys/control_room25228:aa:29:38:ba:40:f4:11:5e:3f:d4:fa:e5:36:14:d6 user@server25215.6.3 Installing the SSH Public/Private Keys (Clustering)25215.6.4 Installing SSH Public Key Authentication (Linux)253Alternately, the public key can be installed on the unit remotely from the linux host with the scp utility as follows.25315.6.5 Generating public/private keys for SSH (Windows)255This section describes how to generate and configure SSH keys using Windows.255First create a new user from the Black Box Management (the following example uses a user called "testuser") making sure it is a member of the "users" group.255To generate a SSH key using PuTTY http://sourceforge.net/docs/F02/#clients:255- Execute the PUTTYGEN.EXE program.256- Select the desired key type SSH2 DSA (you may use RSA or DSA) within the Parameters section.256- It is important that you leave the passphrase field blank.256- Click on the Generate button.256- Follow the instruction to move the mouse over the blank area of the program in order to create random data used by PUTTYGEN to generate secure keys. Key generation will occur once PUTTYGEN has collected sufficient random data.256#!/bin/sh257This will run the tunnel redirecting local port 9001 to the server port 4001.25715.6.6 Fingerprinting25715.6.7 SSH tunneled serial bridging258Client Keys:25828:aa:29:38:ba:40:f4:11:5e:3f:d4:fa:e5:36:14:d6 user@server259Your identification has been saved in /home/user/keys/control_room25928:aa:29:38:ba:40:f4:11:5e:3f:d4:fa:e5:36:14:d6 user@server259Authorized Keys:259$ ls /home/user/keys260$ cat /home/user/keys/control_room.pub260Uploading Keys:26015.6.8 SDT Connector Public Key Authentication260If you have a host behind the console server that you connect to by clicking the SSH button in SDT Connector, you can also configure it for public key authentication. Essentially what you are using is SSH over SSH, and the two SSH connections are enti...26015.7 Secure Sockets Layer (SSL) Support26015.8 HTTPS261The HTTP server provided is a slightly modified version of the fnord-httpd from http://www.fefe.de/fnord/26115.8.1 Generating an encryption key261To create a 1024 bit RSA key with a password, issue the following command on the command line of a linux host with the openssl utility installed:26115.8.2 Generating a self-signed certificate with OpenSSL26115.8.3 Installing the key and certificate262PuTTY and the PSCP utility can be downloaded from: http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html26215.8.4 Launching the HTTPS Server262Save the file and signal inetd of the configuration change.262The HTTPS server should be accessible from a web client at a URL similar to this: https://<common name of unit>262More detailed documentation about the openssl utility can be found at the website: http://www.openssl.org/26215.9 Power Strip Control26215.9.1 The PowerMan tool26315.9.2 The pmpower tool26415.9.3 Adding new RPC devices264<outlet port="port-id-2">Display Port 2 in menu</outlet>265The id appears on the web page in the list of available devices types to configure.265The outlets describe targets that the scripts can control. For example, a power control board may control several different outlets. The port-id is the native name for identifying the outlet. This value will be passed to the scripts in the environment...265There are four possible scripts: on, off, cycle and status.265When a script is run, its standard input and output is redirected to the appropriate serial port. The script receives the outlet and port in the outlet and port environment variables respectively.265The script can be anything that can be executed within the shell.265All of the existing scripts in /etc/powerstrips.xml use the pmchat utility.265pmchat works just like the standard unix "chat" program, only it ensures interoperation with the port manager.265The final options, speed, charsize, stop and parity define the recommended or default settings for the attached device.26515.10 IPMItool26615.11 Custom Development Kit (CDK)26915.12 Scripts for Managing Slaves269READ BEFORE USING THE ACCOMPANYING SOFTWARE279Größe: 8,32 MBSeiten: 286Language: EnglishHandbuch öffnen
