APPX Login Manager For Unix/Linux

The APPX Login Manager command is used to configure and manage APPX Login Services.

• • O/S Authentication
  • HT Authentication
  • APPX Authentication

• SSL Support
  • Anonymous
  • Server Certficates

• • Service configuration
  • Client request

In the event that it is necessary to reset the permissions on the appxLoginMgr command, the following commands can be run by the root user to set the necessary owner and group permissions for the appxLoginMgr command.

Creating and Configuring an APPX Connection Service

Creating a Connection Service

TCP/IP Port Number

Changing a Connection Service

Method 1 - The APPX Login Manager Command (appxLoginMgr)

Method 2 - O/S Services

In addition to creating the service configuration file and the environment configuration file, the -install command also creates an operating system service that will be automatically started when the computer system is started.

Note that when specifying variables on the command line, you must prefix them with a dash if you are referring to settings such as SSLmode, or without a dash if you are referring to environment variables, such as APPX_KEYMAP.

The -replace command is used to replace an existing Connection Service with a new Connection Service with the same name. The -replace command is effectively the same as a -remove command followed by an -install command. After updating the configuration files, the -replace command restarts the service. Note that when specifying variables on the command line, you must prefix them with a dash if you are referring to settings such as SSLmode, or without a dash if you are referring to environment variables, such as APPX_KEYMAP.

Configuration - Options

Options - General

The DisplayName is a "user-friendly" descriptive name for a connection service. The DISPLAYNAME value will appear in your system's Services control panel and will be displayed by the ps command. If you don't specify a DISPLAYNAME when a connection service is being created, the connection service will be created with a DISPLAYNAME based on the SERVICENAME.

This option identifies the PATHNAME of the APPX engine that is to be run when initiating an APPX session. The specified PATHNAME may be alsolute or it may be relative to directory in which the service configuration file (ini) for the connection service is located. If this option is not specified, the default PATHNAME of "../appx" is used to initiate an APPX session.

When the service is started, two log files are created in the LOGDIR directory - a connection service log file (.log) and a status file (.stat). Both log files have the same name as the ServiceName but one has a file extension of .log and the other has a file extension of .stat. If the LogDirectory option is not specified, the log files are created in the /tmp directory.

This option can be used to temporarily disable or "turn off" the connection service. If set to true, the connection service will still run but it will not accept login requests.

This option can be used to disable or "turn off" processing of login requests from interactive clients. If set to true, login requests from interactive clients will not be processed.

This option can be used to disable or "turn off" processing of connection requests from APPX/Net connections including the Windows APPX/ODBC driver. If set to true, connection requests from APPX/Net clients will not be processed.

This option can be used to disable the ability to define an APPX keymap. If set to true, those interactive clients which support the ability to define an APPX keymap will not be allowed to do so.

-initScript={lsb, RedHat}

Used with -install option to specify the type of operating system that the service script is to be created for. If this option is not specified, appxLoginMgr will determine which type of service script to install.

Options - Session Identity/Permissions

This option determines which O/S user the APPX session should impersonate (run as).

If LogonUser is specified, the user ID of the APPX session will be set to the user ID that was provided by the client login. This user ID must be a valid O/S user. The connection service must be running with the permissions of the root user if the LogonUser option is specified.

If NamedUser is specified, the user ID of the APPX session will be set to the specified USERID. This USERID must be a valid O/S user. The connection service must be running with the permissions of the root user if the NamedUser option is specified.

If this value is set to false, an APPX session which is initiated by the connection service will run with the group permissions of the connection ServiceOwner. Set this value to true if you want the APPX session to have group permissions based on the ImpersonateGroup option.

This option determines which group permissions the APPX session should run with.

If User is specified, the APPX session will run with the group permissions of the user that the session is running as (impersonating).

When a file is created, the default permissions set by Unix/Linux are 666 (-rw-rw-rw-). When a directory is created, the default permissions set by Unix/Linux are 777 (drwxrwxrwx). If the umask option is specified, the FILECREATIONMASK value will modify the default permissions of files or directories that are created by the APPX session. The value of FILECREATIONMASK must be a decimal, hex, or octal number whose bits will be used to mask or turn off the corresonding bits of the default file creation permissions. For example, if you want files to be created with permissions of 644, the appropriate FILECREATIONMASK value would be 022 (octal). If you want files to be created with the default permissions of 666, the appropriate FILECREATIONMASK value would be 000 (octal). For more information on umask values, please refer to your Unix/Linux system documentation.

Options - Startup Process

This option must be specified if the connection service is being configured to invoke a specific startup process when a client session is initiated. If specified, the DATABASEID must be valid, i.e. it must be defined in the Databases file in APPX System Administration.

This option must be specified if the connection service is being configured to invoke a specific startup process when a client session is initiated. This option identifies the name of the process that is to be invoked when a client session is initiated. The PROCESSNAME must be of the type specified and must be defined in the specified APPX Application.

Options - TCP/IP

This option is used to tune the network performance of the APPX session. When set to true, TCP will send partially filled packets of data rather than wait for a packet to fill before sending it. This can result in improved interactive response time for the APPX session but will likely increase the number of data packets being transmitted over the network.

Set this option to true if you want an APPX session to be able to detect that the connection between an APPX session and an APPX client has been lost. If this option is set to true and an APPX session has been waiting for a response from an APPX client for the length of time specified by TCPKeepIdle, then the APPX session will attempt to contact the APPX client to see if it can still be reached. If the APPX client cannot be contacted, then the APPX session will attempt to contact the APPX client every TCPKeepInterval seconds up to TCPKeepCount times. After TCPKeepCount attempts, if the APPX client is unable to be contacted, then the APPX session terminates.

This option is used to set the number of seconds that an APPX session is to wait for a response from an APPX client before checking to see if the client can still be contacted.

This option is used to set the number of times that an APPX session is to attempt to contact a non-responsive APPX client before the APPX session should terminate.

This option is used to set the number of seconds that an APPX session is to wait between attemps to contact a non-responsive APPX client.

Options - SSL

This option identifies the pathname of the file that identifies which client certificates to trust (leave blank if client certificates are not required).

This option idenfies the pathname of server's private key file (unlocks the ServerCertificateFile).

This option is not needed and has not been implemented.

This option is not needed and has not been implemented.

-ServerPrivateKeyPassphrase=PASSPHRASE

This option is not needed and has not been implemented.

Configuration - Environment Variables

Synopsis - Service Management

appxLoginMgr [-start | -stop | -restart | -status] {SERVICENAME | -serviceName=SERVICENAME}

MANAGEMENT OPTIONS

Example 1: Configure and start a new instance of the Connection Service that will listen for connection requests on port 8060:

appxLoginMgr -install -port=8060

The name of the configuration file and the location of the configuration file should not be changed. The service that is created will not work correctly if the name or the location of the configuration file is changed.

The Environment File (env)

The -install option of the appxLoginMgr command creates the environment file when the service is created.

The name of the environment file and the location of the environment file should not be changed. The service that is created will not work correctly if the name or the location of the environment file is changed.

The Status File (stat)

The name of the status file is the concatenation of the service name and ".stat". For example, if the service name is "appxd-8430", the name of the status file will be "appxd-8430.stat".

The status file can be viewed to see the actual context within which the service is running.

The Log File (log)

The name of the log file is the concatenation of the service name and ".log". For example, if the service name is "appxd-8430", the name of the log file will be "appxd-8430.log".

When the connection service is started, the log file is initialized with the configuration of the connection service. The configuration information is followed by a dialog of messages relating to actions performed by the connection service. Each time the connection service processes a connection request, messages relating to the connection request are appended to the log file.

Red Hat service command.

Synopsis - service Command

Examples:

How to create private/public-keys without passphrase for server

Examples:

How to create private/public-keys without passphrase for server

Example of openssl command to create private key:

Example of openssl command to create SSL certificate:

Warnings:

"the engine that you named has the setuid bit enabled"

Warnings:

"the engine that you named has the setuid bit enabled"

Issues:

1. The setuid warning indicates that it is triggered by the OSUser AuthenticationMethod. AuthenticationMethod is not influenced by the setuid bit being turned on. However, ImpersonateUser is impacted.

Enhancement Suggestons:

1. To match the Windows platform, he following should be valid syntax: "appxLoginMgr -install". It should default to port 8060, or the Windows platform should not default to port 8060.

1. appxLoginMgr should create .ini and .env files in the tools subdirectory, and not in the current working directory.
2. The appxLoginMgr -replace argument should require the -ServiceName option, and not assume ServiceName =appxd-8060.
3. The requirements for use of -name argument seem inconsistant. Below are examples where + works, and - does not.

1. 1. (+) ./appxLoginMgr -modify -name=appxd-8060 -TCPNodelay=false
   2. (-)./appxLoginMgr -status
   3. (+)./appxLoginMgr -status -name=appxd-8060

1. 1. (-) ./appxLoginMgr -status
   2. (+) ./appxLoginMgr -status appxd-8060
   3. (+) ./appxLoginMgr -status -name=8060

Comments: