XenApp Unix

XenApp for UNIX 4.0 with Feature Pack 1
on SUN Solarix 10 (X86)
Helmut Hauser
Consulting Enterprise Services
visionapp AG

Agenda

16.05.09 © visionapp 3

Agenda



https://www.citrix.com/English/ss/downloads/details.asp?downloadId=1681191&productId=186

Actual Hotfix for Solaris X86(as time of writing)
CTX119833, created 21-Jan-2009, PSE400SOLX056.tar
http://support.citrix.com/article/CTX119833
[There is a limited PSE400SOL058 Fix out for the SPARC Platform]
Documentation can be found at
https://support.citrix.com/product/xa/unix_v4.0fp1/#tab-doc
Note: A single machine can now handle up to impressive 1024 Clients
[The default value is 256 Clients/Server]
Add -maxclients xxx to the XTW_OPTS line in opt/CTXSmf/slib/ctxXtw.sh



Why use Citrix ICA ?

X11 is a display protocol used within Unix.
http://www.x.org/wiki/
X11 does not perform very well if the network
infrastructure is not fast enough.
Think of WAN, remote offices etc.
X11 is not usable with a delay/RTT of 10 ms.
XenApp for Unix is a wrapper for X11
Citrix converts X11 to the ICA [HDX] Protocol =
"Harder, better, faster, stronger"


Citrix support matrix
A huge customer located in the USA uses this product.
There is a good chance that it never goes out of maintenance/support
Presentation Server Version/ Language NSC EOS EOM EOL
Model

Presentation Server All EN, DE, FR, ES, JA 12-Feb-07 15-May-07 30-Jun-09 31-Dec-09
Standard Edition

Presentation Server for 4.0 EN, DE, FR, ES, JA 12-Feb-07 N/A 30-Jun-09 31-Dec-09
Windows

Presentation 4.0 EN 16-Jul-08 N/A Not Not
Server for Announced at Announced at
Unix** this time this time
Presentation Server for 4.5 EN, DE, FR, ES, JA 16-Jul-08 N/A 31-Mar-11 30-Sep-11
Windows***


Agenda



Unix Operating Systems supported by Citrix
XenApp for UNIX is supported on following UNIX flavours:

•Sun Microsystems’ Solaris™ 8, 9, and 10
•Hewlett-Packard’s HP-UX® 11 and 11i;
•IBM’s AIX® 5.1, 5.2, and 5.3.

Focus in this presentation is SUN Solaris (X86):
Superior file system (ZFS), very good integration in the enterprise etc.
Side note:

A new Solaris 10 release could be different (paths, startup scripts, etc.)



SUN and Oracle
As you might know …
Oracle and SUN Microsystems
On April 20, 2009, Sun and Oracle announced a definitive agreement
under which Oracle will acquire Sun common stock for $9.50 per share in
cash. The transaction is valued at approximately $7.4 billion, or $5.6
billion net of Sun's cash and debt. The proposed transaction is subject to
Sun stockholder approval, certain regulatory approvals and customary
closing conditions. Until the deal closes, each company will continue to
operate independently, and it is business as usual.
The acquisition combines best-in-class enterprise software and mission-
critical computing systems. Oracle plans to engineer and deliver an
integrated system—applications to disk—where all the pieces fit and work
together so customers do not have to do it themselves. Customers
benefit as their system integration costs go down while system
performance, reliability and security go up.

16.05.09 © visionapp 10


SUN Solaris (X86)
– obtaining and download Sources
The history of Unix
http://www.levenez.com/unix/unix_a4.pdf

Two flavors of SUN Solaris are available for no charge.
The community edition OPEN Solaris
http://www.opensolaris.com/get/index.jsp

The enterprise Edition SUN Solaris 10 [SPARC and X86 platforms]
http://www.sun.com/software/solaris/10/
http://www.sun.com/software/solaris/get.jsp#download

16.05.09 © visionapp 11


SUN Solaris X86 Download from web

16.05.09 © visionapp 12


Do not use the compressed image,
use the iso image instead.
Otherwise you may be stunned as the
extracting may take 3 hours or more to
uncompress…

16.05.09 © visionapp 13


Installing SUN Solaris X86

16.05.09 © visionapp 14



16.05.09 © visionapp 15


– Booting after installation

16.05.09 © visionapp 16


Installing SUN Solaris X86– Configuring
If not desired do NOT use the CDE, chose Java
desktop (formally known as GNOME)

16.05.09 © visionapp 17


Configuring SUN Solaris – NIC interface
Login as root, open a shell, type in /bin/bash, use vi to change your
IP Address

/etc/hosts
/etc/inetd/ipnodes

softlink to hosts can be found here:
/etc/inetd/
Now cd to etc, type in „ls hostname*“

The network interface resembles as following:
Hostname.DriverNameNIC_ID
The driver_id can be obtained here:
/Boot/Solaris/devicedb/master and /etc/Driver alias

In a vmware driven environment the device could be pcn0.

16.05.09 © visionapp 18


Configuring SUN Solaris – Network/NIC IP

Ifconfig pcn0 down
Ifconfig pcn0 192.168.175.160 netmask 255.255.255.0 up

Now change the IP and update the device
Similar action if IPV6 is involved

16.05.09 © visionapp 19


Installing SUN Solaris X86 – Configuring
continued
You might now add Solaris to the infrastructure, install the
latest (security) patches, integrate Solaris to your
LDAP/Kerberos environment, etc.

Prerequisites:
Assumed super user/root user rights

If the Licenseserver is not installed on Solaris [recommended],
use telnet to port 27000 to verify if Solaris can connect to the
server.

Side note –
there is a Citrix License Server - Version 11.5 for UNIX
available on citrix.com - if you need a standalone License
server.

16.05.09 © visionapp 20


Installing XenApp for UNIX 4.0 with Feature
Pack 1 - Prerequisites
Create a directoty „ctx_install“ in /opt or /tmp.

Download or copy the Citrix installation sources.

Create a directory „hotfix“ within the ctx_install directory.
Download the actual hotfix(es), use gunzip and tar -xf (patch) to
uncompress the hotfix(es) into the “hotfix” directory.

Now create an user "ctxssl“ with group membership „ctxadm"
and an user „ctxsrvr“ with group membership „ctxadm" without
a login shell (/bin/false)

The Citrix installer may fail if these users are not created.

16.05.09 © visionapp 21


Pack 1 - Prerequisites
Creation of group ctxadm with Group-Id 100

groupadd –g 100 ctxadm

useradd -u 100 -d /export/home/ctxsrvr -m -s
/bin/none ctxsrvr
useradd -u 102 -d /export/home/ctxssl -m -s
/bin/none ctxssl

Setting the password: Passwd ctxsrvr Passwd ctxssl

Verifying:
cat /etc/passwd

ctxsrvr:x:100:100::/export/home/ctxsrvr:/bin/false
ctxssl:x:102:100::/export/home/ctxssl:/bin/false

16.05.09 © visionapp 22


Pack 1 - Installation

Open a rootshell,
type in
./installcpsu

Agree to
the License
Agreement with 1

16.05.09 © visionapp 23


The interactive install script asks for the following parameters

•Creation of a new Citrix Farm or joining an existing farm
- Choices (C ) or (J ) [Create or Join]
•Licenseserver IP - Licenseserver Port (27000)
•Enterprise or Platinum Edition

16.05.09 © visionapp 24


Configure the XML Port
[(80) is default]
and the SSL relay feature

16.05.09 © visionapp 25


The installation script asks for
Citrix deamon autostart
(y )
Manual Pages installation
(y )
Creation of 15 anonymous users
(y )
Setup/Install of Setuid files.
Side note: Security impact (!) – XenApp won´t run without.
Recheck this with your security department.
(y)
Continue the installation
(y )

16.05.09 © visionapp 26



16.05.09 © visionapp 27



16.05.09 © visionapp 28


Pack 1 - Patching
Verify if the
patching was
successful.
The installer has
kind of amnesia
[won´t sometimes
execute patching]

Use a shell,
/bin/bash – cd to
/opt/CTXSmf/sbin,
stop the citrix
daemon with
./ctxshutdown.

16.05.09 © visionapp 29


Pack 1 - Patching
Change to your hotfix
directory and execute

Patchadd –M .
PSE400SOLXXX

Important here is
the „.“

You do not need to
reboot the system
after patching.

16.05.09 © visionapp 30


Pack 1 - Configuration

The most important Citrix related commands can be found in /opt/CTXSmf/bin
and /opt/CTXSmf/sbin.

16.05.09 © visionapp 31


Pack 1 – Licenseserver configuration

As the installer sometimes loses settings at install time.
Reconfigure the Licenseserver
with ./ctxlsdcfg

License Server configuration is stored here: /var/CTXSmf/ctxxmld.cfg
License information is stored here: MPSU-LSD_MPSU-LSD.ini

Recheck settings with „list“

16.05.09 © visionapp 32


Pack 1 – Farm Creation
If you want to create a new unique farm,
use this command: ./ctxfarm -c

16.05.09 © visionapp 33


Pack 1 – manual application publishing
Use : ./ctxappcfg to publish an application.
Side note here:
Use CMC/AMC or visionapp tools for publishing in the enterprise.

16.05.09 © visionapp 34


Installing XenApp for UNIX 4.0 with Feature Pack 1 – application
publishing with visionapp – XenApp for Unix Server integration

Add your XenApp Unix Servers in the infrastructure and/or create a
ITIL compliant virtual Farm. Check connection within „Servers“
16.05.09 © visionapp 35


Installing XenApp for UNIX 4.0 with Feature Pack 1 –
application publishing with visionapp– vAC portal
integration. Publishing Unix X11 Applications

16.05.09 © visionapp 36


Pack 1 – sample ICA aka HDX Receiver ;-) file
[WFClient]
Version=2
TcpBrowserAddress=192.168.175.160
[ApplicationServers]
Firefox=
[Firefox]
Address=Firefox
InitialProgram=#Firefox
ClientAudio=On
AudioBandwidthLimit=2
Compress=On
TWIMode=On
DesiredColor=8
TransportDriver=TCP/IP
WinStationDriver=ICA 3.0
ScreenPercent=0

16.05.09 © visionapp 37


ICA (HDX) Connection Check

16.05.09 © visionapp 38


ICA Session Sharing

XAU method of disabling session sharing is via the
/opt/CTXSmf/data/C/system.ctxwmrc
NoSeamlessSessionSharing option.

If you enable this in this file then all session sharing on
that server will be disabled. Its also possible to have individual
user .ctswmrc files so that
you can set things up so that some individual users session share
and some don't.

To do this you need to copy the system .ctxwmrc file into the
user's home directory and name it .ctxwmrc.
As to the TWIDisableSessionSharing option:

following XAU user forum thread (from 2003) implies its an
WI/Client option:
http://forums.citrix.com/thread.jspa?threadID=45909&tstart=0
16.05.09 © visionapp 39

Agenda

16.05.09 © visionapp 40


Troubleshooting – Citrix daemons

List running Citrix XenApp/Unix deamons

ps -ef |grep /opt/CTXSmf and/or ps -ef |grep ctxsrvr

root 10063 9659 0 Apr 30 ? 0:00 /opt/CTXSmf/slib//ctxxmldssup
-- run-as-root
ctxsrvr 9659 1 0 Apr 30 ? 30:01 /opt/CTXSmf/slib/ctxxmld
ctxsrvr 13237 1 0 Apr 30 ? 0:13 /opt/CTXSmf/slib/ctxfm
ctxsrvr 11316 1 0 Apr 30 ? 0:00 /opt/CTXSmf/slib/ctxlsd
ctxsrvr 28440 1 0 Apr 30 ? 0:48 /opt/CTXSmf/slib/ctxibrowser
ctxsrvr 14274 1 0 Apr 30 ? 0:00 /opt/CTXSmf/slib/ctxcdmd

16.05.09 © visionapp 41


Troubleshooting – XML and Licensing daemons
The XML and licensing daemons.
XML communicates on TCP Port 2897

•XML service [ctxxmld]
•License service deamon [ctxlsd]

ctxsrvr 21120 1 0 Sep 19 ? 678:48 opt/CTXSmf/slib/ctxxmld
ctxsrvr 21130 1 0 Sep 19 ? 0:18 /opt/CTXSmf/slib/ctxlsd

XML daemon configuration:
/etc
-rw-r----- 1 root ctxadm 85 Aug 14 2008 ctxxmld.conf

If any of these services are down,
XenApp/Unix likely may fail.

16.05.09 © visionapp 42


Troubleshooting – Logfiles /var/adm/messages

Usually the log path is /var/adm/messages

/var/adm|> ls -la

-rw-r--r-- 1 root root 2621 Apr 30 16:36 messages
-rw-r--r-- 1 root root 2319 Apr 28 18:27 messages.0

16.05.09 © visionapp 43


No Citrix License Server reachable

MetaFrame(License_Service)[11431]: [ID 444507 user.error] 8300107:
CTX1306E The License Service daemon is unable to communicate with the
License Server.

Server 1 could not connect to Server 2 in a Farm – possible (NTP)
timing issues, check time with “date”

MetaFrame(XML_Service)[21122]: [ID 310629 user.error] An inter-server
communication error occurred when server with address xxx.xxx.xxx.xxx
attempted to contact server with address “xxx.xxx.xxx.xxx".
Underlying cause was "Failure unspecified at GSS-API level
(Mechanism level: Clock skew too great (37))".

Pam (Pluggable Authentification Moduler) Errors: C2 security audit
http://forums.citrix.com/thread.jspa?threadID=103765&tstart=0

MetaFrame(Login)[12721]: [ID 469250 auth.error] pam_unix_cred: cannot
load hostname
16.05.09 © visionapp 44


XML Ticket issue – Check time or network (could be Kerberos)

MetaFrame(XML_Service)[21122]: [ID 604053 user.error] An inter-server
communication error occurred when server with address “xxx.xxx.xxx.xxx"
attempted to contact server with address “xxx.xxx.xxx.xxx". Underlying
cause was "Failure unspecified at GSS-API level
(Mechanism level: Integrity check on decrypted field failed (31))".

Citrix Session died

MetaFrame [27324]: [ID 495210 user.error]
400500: CTX0547I BROKEN session 4

Connection to Farmserver lost – check server

MetaFrame(XML_Service)[21122]: [ID 373765 user.error] An error
occurred connecting to server “xxx" on port "2897". Please check that the
server is available and that the network is functioning correctly.

16.05.09 © visionapp 45


Troubleshooting – <Defunct> Processes

Use as root “ps –ef” to watch the processes.
[Note for Linux gents, ps –aux will not work on Solaris]
You may see some load with top.

Defunct processes are processes that have become
corrupted where they can't talk with the parent or child
process. You may have issues if you try to kill these
“zombies” with kill -9.

In the actual Solaris incarnation it looks like that the
<defunct> “zombies” are disconnected or status unclear
Citrix sessions.

If you encounter [way too] much <defunct> “zombies”:
Stop and Restart the Citrix daemon. A reboot is not
necessary.

16.05.09 © visionapp 46


Troubleshooting – <Defunct> Processes check
Regularly check if there are any <defunct> processes

/var/log $ ps -ef |grep defunct
(or) ps –aZ

ZONE PID TTY TIME CMD
global 3294 ? 0:01 <defunct>
(…)
16.05.09 © visionapp 47


Troubleshooting – <Defunct> Processes- kill -9

If you encounter this scenario, try to kill the amok user process
(here 29652)
with „kill-9“

16.05.09 © visionapp 48


Troubleshooting – Known Issues
ICA Application start delay

There is an known issue
with the XenApp Plugin for
hosted applications formally
known as ICA Client 11.

Applications sometimes
have a delayed startup
time, this may occur if you
start up more than one X11
app [simultaneously]

This should be fixed with a
private build of the 11.X
wfcrun32.exe available [at]
Citrix support.

16.05.09 © visionapp 49


Troubleshooting – Known Issues - Seamless
Screen corruption with seamless X11 Sessions

You may encounter some graphical corruption
in seamless mode – Mostly Login screens are affected.

Another known issue is:
Minimize buttons are missing/not displayed within some
X11 Applications (OpenMotif styled).
Citrix call was engaged.
16.05.09 © visionapp 50


Troubleshooting – Known Issues - Failover
If you create a sole XenApp for Unix farm (e.g. 2 servers)
and configure server 1 as master and server 2 as backup,
the failover process could be -kindly speaking- slow.
[up to 15 minutes]

Possible workaround here:
Join XenApp for Unix to a XenApp for Windows Farm.
Use Citrix Windows 2003 based Servers with actual OS
Service Pack and Citrix Hotfix rollup level as master
browser/XML Gateway

16.05.09 © visionapp 51


The other side

•Linux Terminal Server Project

•NX

•Aqua (MAC OS X)

•(Open) VNC

Web-Sources:
http://www.ltsp.org/
http://www.nomachine.com
http://www.aquaconnect.net/
www.realvnc.com/

16.05.09 © visionapp 53


A quick look at NX - Installation

Installation:

Be careful: NX WON´T run on every Linux distribution –
Fedora Core for example has issues. Tested here on Debian/Ubuntu.
Installation:

pkg –I nxclient_3.1.0-6_i386.deb
dpkg –I nxnode_3.1.0-6_i386.deb
dpkg –I nxserver_3.1.0-5_i386.deb

16.05.09 © visionapp 54


A quick look at NX - Configuration

The NX files can be found at:

/usr/NX

bin
etc
home
lib
scripts
share
var

16.05.09 © visionapp 56



If a secure connection is desired
export /usr/NX/etc/keys and import at the Clients
as:
node.localhost.id_dsa.pub

Configure the SSH Port at Node.cfg

Warning:
Preconfigure the SSHD

https://help.ubuntu.com/7.10/server/C/openssh-server.html

16.05.09 © visionapp 59


Security:

Configure the Node.cfg

# Specify the TCP port where the NX node SSHD daemon is running.
#SSHDPort = "22"
SSHDPort = “newport"

#SSHDCheckIP = "0"
SSHDCheckIP = "1“

# Run the nxsensor daemon in the background. This daemon can be used
# to produce statistics about the node machine. Produced data is to
# be queried and elaborated by the nxstat daemon running on the NX
# server host machine.

EnableSensor = "1"
16.05.09 © visionapp 60


A quick look at NX- Summary

NX is not bad on Linux

Advantages:
+ Installation
+ Configuration

Disadvantages:

- Login speed

Establishing the connection could take a long time
(above 1 minute)

16.05.09 © visionapp 63


The others

VNC

- It is open source and already widespread used

Disadvantage: Performs not very well in a WAN environment
Well known as insecure
Many security issues/exploits out there ...
Example
http://www.securityfocus.com/bid/33568

Linux Terminal Server Project

Good for education, schools, etc.

Disadvantage:
Own Linux distribution, kernel is different, seldom patches
16.05.09 © visionapp 64


Apple Mac OS X

There are several solutions out there in the cloud.

The enterprise ready solution is Aqua Connect

http://www.aquaconnect.net/

It just works. Fine.

Not really cheep, indeed.

16.05.09 © visionapp 65


Outlook - Lookout

Hello Citrix - YES you can.
You have the superior technology and you did this on Apple:

Please do create a Citrix Terminal Server/XenApp
Edition for Mac OS X (Snow Leopard)

16.05.09 © visionapp 66


Apple and Citrix

– just good friends

Copyrights and Trademarks.
All rights reserved.
© by Microsoft, Apple, Canonical, Debian, SUN/Oracle, Citrix,
NoMachine, X11 consortium, Augustiner Braeu Munich, visionapp
16.05.09 © visionapp 67

Thank you very much for your attention.

Do you have any questions?

Additional information can be found at:
visionapp Ltd.
Office London
http://www.visionapp.com (United Kingdom)
107-111 Fleet Street
London EC4A 2AB
phone: +44-20-7936-9112
fax: +44-870-385-0936

XenApp Unix

More Related Content

What's hot (18)

Similar to XenApp Unix (20)

Recently uploaded (20)

XenApp Unix

Editor's Notes