用户手册 — Black Box LES1216A-R2

目录

• INTRODUCTION

  13
• This User’s Manual walks you through installing and configuring your Black Box Console Server (LES1108A, LES1116A, LES1132A, LES1148A, LES1508A) or Advanced Console Server (LES1208A-R2, LES1216A-R2, LES1232A, LES1248A-R2, LES1308A, LES1316A, LES1332A,...

  13
• The latest update of this manual can be found online at www.blackbox.com

  14
• INSTALLATION

  18
• Introduction

  18
• 2.1 Models

  18
  • 2.1.1 Kit components LES1508A Console Server

    19
  • 2.1.2 Kit components LES1308A- LES1348A and LES1408A - LES1448A Advanced Console Servers

    19
  • 2.1.3 Kit components LES1208A-R2, LES1216A-R2, LES1232A and LES1248A-R2 Advanced Console Servers

    20
  • 2.1.4 Kit components LES1116A, LES1132A and LES1148A Console Servers

    21
  • 2.1.5 Kit components LES1108A Console Server

    21
• 2.2 Power connection

  21
  • 2.2.1 LES1508A power

    21
  • 2.2.2 LES1408A - LES1448A, LES1308A- LES1348A and LES1208A - LES1248A power

    22
  • 2.2.2 LES1116A, LES1132A and LES1148A power

    22
  • 2.2.4 LES1108A power

    23
• 2.3 Network connection

  23
• 2.4 Serial Port connection

  23
• 2.5 USB Port Connection

  24
• 2.6 Antenna and SIM

  25
• SYSTEM CONFIGURATION

  26
• Introduction

  26
• 3.1 Management console connection

  26
  • 3.1.1 Connected PC/workstation set up

    26
• o IP address: 192.168.0.100

  26
• o Subnet mask: 255.255.255.0

  27
  • 3.1.2 Browser connection

    27
• 3.2 Administrator Password

  29
  • 3.2.1 Set up new administrator

    30
  • 3.2.2 Name the console server

    30
• 3.3 Network IP address

  30
  • 3.3.1 IPv6 configuration

    32
  • 3.3.2 Dynamic DNS (DDNS) configuration

    32
• 3.4 System Services

  33
  • 3.4.1 Service Access

    33
• Message Changes to configuration succeeded.

  35
  • 3.4.2 Service Settings

    35
• 3.5 Communications Software

  36
  • 3.5.1 SDT Connector

    37
  • 3.5.2 PuTTY

    37
  • 3.5.3 SSHTerm

    38
• 3.6 Management network configuration

  38
  • 3.6.1 Enable the Management LAN

    39
  • 3.6.2 Configure the DHCP server

    40
  • 3.6.3 Select Failover or broadband OOB

    41
  • 3.6.4 Aggregating the network ports

    43
  • 3.6.5 Static routes

    44
• SERIAL PORT AND NETWORK HOST

  46
• Introduction

  46
• 4.1 Configure Serial Ports

  46
  • 4.1.1 Common Settings

    47
  • 4.1.2 Console Server Mode

    48
  • 4.1.3 SDT Mode

    53
  • 4.1.4 Device (RPC, UPS, EMD) Mode

    54
  • 4.1.5 Terminal Server Mode

    54
  • 4.1.6 Serial Bridging Mode

    55
  • 4.1.7 Syslog

    55
  • 4.1.8 Cisco USB console connection

    56
• 4.2 Add/ Edit Users

  56
• 4.3 Authentication

  60
• 4.4 Network Hosts

  60
• 4.5 Trusted Networks

  61
• 4.6 Serial Port Cascading

  62
  • 4.6.1 Automatically generate and upload SSH keys

    62
  • 4.6.2 Manually generate and upload SSH keys

    63
  • 4.6.3 Configure the slaves and their serial ports

    65
  • 4.6.4 Managing the Slaves

    66
• 4.7 Serial Port Redirection

  66
• 4.8 Managed Devices

  67
• 4.9 IPsec VPN

  69
  • 4.9.1 Enable the VPN gateway

    70
• 4.10 OpenVPN

  71
  • 4.10.1 Enable the OpenVPN

    71
  • 4.10.2 Configure as Server or Client

    72
  • 4.10.3 Windows OpenVPN Client and Server set up

    73
• 4.11 PPTP VPN

  77
  • 4.11.1 Enable the PPTP VPN server

    77
  • 4.11.2 Add a PPTP user

    79
  • 4.11.3 Set up a remote PPTP client

    79
• FIREWALL, FAILOVER AND OoB DIAL-IN

  81
• Introduction

  81
• 5.1 OoB Dial-In Access

  81
  • 5.1.1 Configure Dial-In PPP

    82
  • 5.1.2 Using SDT Connector client

    84
  • 5.1.3 Set up Windows XP/ 2003/Vista/7 client

    84
  • 5.1.4 Set up earlier Windows clients

    85
  • 5.1.5 Set up Linux clients for dial-in

    85
• 5.2 OoB broadband access

  85
• 5.3 Broadband Ethernet Failover

  86
• 5.4 Dial-Out Failover

  87
  • 5.4.1 Always-on dial-out

    87
  • 5.4.2 Failover dial-out

    89
• 5.5 Cellular Modem Connection

  89
  • 5.6.1 Connect to the GSM HSUPA/UMTS carrier network

    89
  • 5.6.2 Connect to the CDMA EV-DO carrier network

    91
  • 5.6.3 Verify cellular connection

    92
  • 5.6.4 Cellular modem watchdog

    92
• 5.7 Cellular Operation

  93
  • 5.7.1 OOB access set up

    93
  • 5.7.2 Cellular failover setup

    93
  • 5.7.3 Cellular routing

    94
  • 5.7.4 Cellular CSD dial-in setup

    94
• 5.8 Firewall & Forwarding

  95
  • 5.8.1 Configuring network forwarding and IP masquerading

    96
  • 5.8.2 Configuring client devices

    97
  • 5.8.3 Port forwarding

    98
  • 5.8.4 Firewall rules

    99
• SECURE SSH TUNNELING AND SDT CONNECTOR

  102
• Introduction

  102
• 6.1 Configuring for SSH Tunneling to Hosts

  103
• 6.2 SDT Connector Client Configuration

  103
  • 6.2.1 SDT Connector installation

    104
  • 6.2.2 Configuring a new console server gateway in the SDT Connector client

    105
  • 6.2.3 Auto-configure SDT Connector client with the user’s access privileges

    106
  • 6.2.4 Make an SDT connection through the gateway to a host

    107
  • 6.2.5 Manually adding hosts to the SDT Connector gateway

    108
  • 6.2.6 Manually adding new services to the new hosts

    109
  • 6.2.7 Adding a client program to be started for the new service

    111
  • 6.2.8 Dial in configuration

    113
• 6.3 SDT Connector to Management Console

  113
• 6.4 SDT Connector - telnet or SSH connect to serially attached devices

  114
• 6.5 Using SDT Connector for out-of-band connection to the gateway

  116
• 6.6 Importing (and exporting) preferences

  117
• 6.7 SDT Connector Public Key Authentication

  118
• 6.8 Setting up SDT for Remote Desktop access

  119
  • 6.8.1 Enable Remote Desktop on the target Windows computer to be accessed

    119
  • 6.8.2 Configure the Remote Desktop Connection client

    120
• 6.9 SDT SSH Tunnel for VNC

  124
  • 6.9.1 Install and configure the VNC Server on the computer to be accessed

    124
• o Set a password using vncpasswd

  125
  • 6.9.2 Install, configure and connect the VNC Viewer

    125
• 6.10 Using SDT to IP connect to hosts that are serially attached to the gateway

  127
  • 6.10.1 Establish a PPP connection between the host COM port and console server

    127
  • 6.10.2 Set up SDT Serial Ports on console server

    131
  • 6.10.3 Set up SDT Connector to SSH port forward over the console server Serial Port

    132
• 6.11 SSH Tunneling using other SSH clients (e.g. PuTTY)

  132
• ALERTS AND LOGGING

  135
• Introduction

  135
• 7.1 Configure Auto-Response

  135
• 7.2 Check Conditions

  137
  • 7.2.1 UPS / Power Supply

    137
  • 7.2.1 UPS / Power Supply

    137
  • 7.2.2 UPS Status

    137
  • 7.2.3 Serial Login/Logout

    138
  • 7.2.4 ICMP Ping

    138
  • 7.2.5 Cellular Data

    138
  • 7.2.6 Custom Check

    138
  • 7.2.7 SMS Command

    139
• 7.3 Trigger Actions

  140
  • 7.3.1 Send Email

    140
  • 7.3.2 Send SMS

    141
  • 7.3.3 Perform RPC Action

    141
  • 7.3.4 Run Custom Script

    141
  • 7.3.5 Send SNMP Trap

    141
  • 7.3.6 Send Nagios Event

    141
• 7.4 Resolve Actions

  142
• 7.5 Configure SMTP, SMS, SNMP and/or Nagios service for alert notifications

  142
  • 7.5.1 Send Email alerts

    142
  • 7.5.2 Send SMS alerts

    143
  • 7.5.3 Send SNMP trap alerts

    145
  • 7.5.4 Nagios alerts

    146
• 7.6 Logging

  146
  • 7.6.1 Log storage

    146
  • 7.6.2 Serial port logging

    147
  • 7.6.3 Network TCP and UDP port logging

    148
  • 7.6.4 Auto-Response event logging

    148
  • 7.6.5 Power device logging

    148
• POWER & ENVIRONMENTAL MANAGEMENT

  149
• Introduction

  149
• 8.1 Remote Power Control (RPC)

  149
  • 8.1.1 RPC connection

    149
  • 8.1.2 RPC access privileges and alerts

    152
  • 8.1.3 User power management

    152
  • 8.1.4 RPC status

    153
• 8.2 Uninterruptible Power Supply Control (UPS)

  153
  • 8.2.1 Managed UPS connections

    154
  • 8.2.2 Remote UPS management

    157
  • 8.2.3 Controlling UPS powered computers

    158
  • 8.2.4 UPS alerts

    159
  • 8.2.5 UPS status

    159
  • 8.2.6 Overview of Network UPS Tools (NUT)

    160
• 8.3 Environmental Monitoring

  162
  • 8.3.1 Connecting the EMD

    163
  • 8.3.2 Environmental alerts

    165
  • 8.3.3 Environmental status

    165
• AUTHENTICATION

  166
• Introduction

  166
• 9.1 Authentication Configuration

  166
  • 9.1.1 Local authentication

    167
  • 9.1.2 TACACS authentication

    167
  • 9.1.3 RADIUS authentication

    168
  • 9.1.4 LDAP authentication

    169
  • 9.1.5 RADIUS/TACACS User Configuration

    171
  • 9.1.6 Group support with remote authentication

    171
  • 9.1.7 Remote groups with RADIUS authentication

    172
  • 9.1.8 Remote groups with LDAP authentication

    172
  • 9.1.9 Remote groups with TACACS+ authentication

    174
  • 9.1.10 Idle timeout

    174
  • 9.1.11 Kerberos authentication

    174
  • 9.1.12 Authentication testing

    175
• 9.2 PAM (Pluggable Authentication Modules)

  175
• Further modules can be added as required.

  176
• 9.3 SSL Certificate

  177
• NAGIOS INTEGRATION

  180
• 10.1 Nagios Overview

  181
• 10.2 Central management and setting up SDT for Nagios

  181
  • 10.2.1 Set up central Nagios server

    182
  • 10.2.2 Set up distributed console servers

    183
• 10.3 Configuring Nagios distributed monitoring

  185
  • 10.3.1 Enable Nagios on the console server

    185
  • 10.3.2 Enable NRPE monitoring

    186
  • 10.3.3 Enable NSCA monitoring

    186
  • 10.3.4 Configure Selected Serial Ports for Nagios Monitoring

    187
  • 10.3.5 Configure Selected Network Hosts for Nagios Monitoring

    187
  • 10.3.6 Configure the upstream Nagios monitoring host

    188
• 10.4 Advanced Distributed Monitoring Configuration

  188
  • 10.4.1 Sample Nagios configuration

    188
  • 10.4.2 Basic Nagios plug-ins

    191
  • 10.4.3 Additional plug-ins

    192
  • 10.4.4 Number of supported devices

    192
  • 10.4.5 Distributed Monitoring Usage Scenarios

    193
• SYSTEM MANAGEMENT

  196
• Introduction

  196
• 11.1 System Administration and Reset

  196
• 11.2 Upgrade Firmware

  197
• 11.3 Configure Date and Time

  197
• 11.4 Configuration Backup

  198
• 11.5 Delayed Configuration Commit

  201
• 11.6 FIPS Mode

  202
• STATUS REPORTS

  203
• Introduction

  203
• 12.1 Port Access and Active Users

  203
• 12.2 Statistics

  203
• 12.3 Support Reports

  204
• 12.4 Syslog

  204
• 12.5 Dashboard

  205
  • 12.5.1 Configuring the Dashboard

    205
  • 12.5.2 Creating custom widgets for the Dashboard

    208
• MANAGEMENT

  209
• Introduction

  209
• 13.1 Device Management

  209
• 13.2 Port and Host Logs

  210
• 13.3 Serial Port Terminal Connection

  210
  • 13.3.1 Web Terminal

    210
  • 13.3.2 SDT Connector access

    211
• 13.4 Power Management

  212
• CONFIGURATION FROM THE COMMAND LINE

  213
• Introduction

  213
• 14.1 Accessing config from the command line

  213
• Syntax

  214
• Description

  214
• 14.2 Serial Port configuration

  216
• 14.3 Adding and Removing Users

  219
• 14.4 Adding and removing user Groups

  220
• 14.5 Authentication

  221
• 14.6 Network Hosts

  222
• 14.7 Trusted Networks

  223
• 14.8 Cascaded Ports

  223
• 14.9 UPS Connections

  224
• 14.10 RPC Connections

  225
• 14.11 Environmental

  226
• 14.12 Managed Devices

  227
• 14.13 Port Log

  227
• 14.14 Alerts

  228
• 14.15 SMTP & SMS

  230
• 14.16 SNMP

  231
• 14.17 Administration

  231
• 14.18 IP settings

  231
• 14.19 Date & Time Settings

  232
• 14.20 Dial-in settings

  233
• 14.21 DHCP server

  233
• 14.22 Services

  234
• 14.23 NAGIOS

  235
• ADVANCED CONFIGURATION

  236
• Introduction

  236
• 15.1 Custom Scripting

  236
  • 15.1.1 Custom script to run when booting

    236
  • 15.1.2 Running custom scripts when alerts are triggered

    237
  • 15.1.3 Example script - Power Cycling on Pattern Match

    238
  • 15.1.4 Example script - Multiple email notifications on each alert

    238
  • 15.1.5 Deleting Configuration Values from the CLI

    238
  • 15.1.6 Power Cycle any device when a ping request fails

    241
  • 15.1.8 Backing-up the configuration and restoring using a local USB stick

    243
  • 15.1.9 Backing-up the configuration off-box

    244
• 15.2 Advanced Portmanager

  245
  • 15.2.1 Portmanager commands

    245
• The pmusers command is used to query the portmanager for active user sessions.

  246
• Example: To detect which users are currently active on which serial ports:

  246
• portmanager daemon

  246
• There is normally no need to stop and restart the daemon. To restart the daemon normally, just run the command:

  246
• # portmanager

  246
• Signals

  246
  • 15.2.2 External Scripts and Alerts

    246
• PORT="$1"

  247
• USER="$2"

  247
• PORT="$1"

  247
• USER="$2"

  247
• 15.3 Raw Access to Serial Ports

  247
  • 15.3.1 Access to serial ports

    247
  • 15.3.2 Accessing the console/modem port

    248
• 15.4 IP- Filtering

  248
• /etc/config/ipfilter

  248
• #/bin/sh

  249
• # 192.168.10.0/24

  249
• 15.5 Modifying SNMP Configuration

  249
  • 15.5.1 /etc/config/snmpd.conf

    249
  • 15.5.2 Adding more than one SNMP server

    250
• 15.6 Secure Shell (SSH) Public Key Authentication

  251
  • 15.6.1 SSH Overview

    251
  • 15.6.2 Generating Public Keys (Linux)

    252
• To generate new SSH key pairs use the Linux ssh-keygen command. This will produce an RSA or DSA public/private key pair and you will be prompted for a path to store the two key files, for example, id_dsa.pub (the public key) and id_dsa (the private ke...

  252
• 28:aa:29:38:ba:40:f4:11:5e:3f:d4:fa:e5:36:14:d6 user@server

  252
• Your identification has been saved in /home/user/keys/control_room

  252
• 28:aa:29:38:ba:40:f4:11:5e:3f:d4:fa:e5:36:14:d6 user@server

  252
  • 15.6.3 Installing the SSH Public/Private Keys (Clustering)

    252
  • 15.6.4 Installing SSH Public Key Authentication (Linux)

    253
• Alternately, the public key can be installed on the unit remotely from the linux host with the scp utility as follows.

  253
  • 15.6.5 Generating public/private keys for SSH (Windows)

    255
• This section describes how to generate and configure SSH keys using Windows.

  255
• First create a new user from the Black Box Management (the following example uses a user called "testuser") making sure it is a member of the "users" group.

  255
• To generate a SSH key using PuTTY http://sourceforge.net/docs/F02/#clients:

  255
• - Execute the PUTTYGEN.EXE program.

  256
• - Select the desired key type SSH2 DSA (you may use RSA or DSA) within the Parameters section.

  256
• - It is important that you leave the passphrase field blank.

  256
• - Click on the Generate button.

  256
• - Follow the instruction to move the mouse over the blank area of the program in order to create random data used by PUTTYGEN to generate secure keys. Key generation will occur once PUTTYGEN has collected sufficient random data.

  256
• #!/bin/sh

  257
• This will run the tunnel redirecting local port 9001 to the server port 4001.

  257
  • 15.6.6 Fingerprinting

    257
  • 15.6.7 SSH tunneled serial bridging

    258
• Client Keys:

  258
• 28:aa:29:38:ba:40:f4:11:5e:3f:d4:fa:e5:36:14:d6 user@server

  259
• Your identification has been saved in /home/user/keys/control_room

  259
• 28:aa:29:38:ba:40:f4:11:5e:3f:d4:fa:e5:36:14:d6 user@server

  259
• Authorized Keys:

  259
• $ ls /home/user/keys

  260
• $ cat /home/user/keys/control_room.pub

  260
• Uploading Keys:

  260
  • 15.6.8 SDT Connector Public Key Authentication

    260
• If you have a host behind the console server that you connect to by clicking the SSH button in SDT Connector, you can also configure it for public key authentication. Essentially what you are using is SSH over SSH, and the two SSH connections are enti...

  260
• 15.7 Secure Sockets Layer (SSL) Support

  260
• 15.8 HTTPS

  261
• The HTTP server provided is a slightly modified version of the fnord-httpd from http://www.fefe.de/fnord/

  261
  • 15.8.1 Generating an encryption key

    261
• To create a 1024 bit RSA key with a password, issue the following command on the command line of a linux host with the openssl utility installed:

  261
  • 15.8.2 Generating a self-signed certificate with OpenSSL

    261
  • 15.8.3 Installing the key and certificate

    262
• PuTTY and the PSCP utility can be downloaded from: http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html

  262
  • 15.8.4 Launching the HTTPS Server

    262
• Save the file and signal inetd of the configuration change.

  262
• The HTTPS server should be accessible from a web client at a URL similar to this: https://<common name of unit>

  262
• More detailed documentation about the openssl utility can be found at the website: http://www.openssl.org/

  262
• 15.9 Power Strip Control

  262
  • 15.9.1 The PowerMan tool

    263
  • 15.9.2 The pmpower tool

    264
  • 15.9.3 Adding new RPC devices

    264
• <outlet port="port-id-2">Display Port 2 in menu</outlet>

  265
• The id appears on the web page in the list of available devices types to configure.

  265
• The outlets describe targets that the scripts can control. For example, a power control board may control several different outlets. The port-id is the native name for identifying the outlet. This value will be passed to the scripts in the environment...

  265
• There are four possible scripts: on, off, cycle and status.

  265
• When a script is run, its standard input and output is redirected to the appropriate serial port. The script receives the outlet and port in the outlet and port environment variables respectively.

  265
• The script can be anything that can be executed within the shell.

  265
• All of the existing scripts in /etc/powerstrips.xml use the pmchat utility.

  265
• pmchat works just like the standard unix "chat" program, only it ensures interoperation with the port manager.

  265
• The final options, speed, charsize, stop and parity define the recommended or default settings for the attached device.

  265
• 15.10 IPMItool

  266
• 15.11 Custom Development Kit (CDK)

  269
• 15.12 Scripts for Managing Slaves

  269
• READ BEFORE USING THE ACCOMPANYING SOFTWARE

  279