APPX Login Manager For Unix/Linux

This page describes how to install the APPX Login Manager command and how to use it to install, configure, and manage APPX Login Services on Unix/Linux systems.

The APPX Login Manager command is used to configure and manage APPX Login Services.

An APPX Login Service (daemon) listens for and processes login requests from various types of APPX clients.

The following types of remote APPX clients are supported:

• APPX Desktop Client (Java)
• Windows Client (Win32)
• Character mode client (Unix/Linux Curses)
• APPX ODBC connections (Windows Desktop)
• APPX/Net connections

Options and Features Include:

• User Authentication
  • O/S Authentication
  • HT Authentication
  • APPX Authentication
• User & Group Impersonation (Unix/Linux only)
• SSL Support
  • Anonymous
  • Server Certificates
  • Client Certificates
• Environment Specification
  • Inherit from service
  • Explicitly specified
• umask Specification
• APPX Startup Process
  • Service configuration
  • Client request

Installing the APPX Login Manager Command ( appxLoginMgr)

The APPX Login Manager ( appxLoginMgr) command is installed automatically when you install APPX on your system. The installer sets the necessary owner and group permissions for the appxLoginMgr command. So, there is nothing additional that you need to do to install the appxLoginMgr command. As part of installing APPX, you are given the opportunity to start the connection service. If you did not do this, then you will need to run the appxLoginMgr command to configure and start an instance of the APPX Connection Service before any remote client connections may be established.

The appxLoginMgr command is installed into the "services" subdirectory of the directory where you installed APPX. So, if you installed APPX in "/usr/local/appx", the full pathname of the appxLoginMgr command will be "/usr/local/appx/services/appxLoginMgr".

The appxLoginMgr command must run with the permissions of the root user because it will be spawning appx processes running as each logged in user. Therefore, the owner of the appxLoginMgr command should be the root user and the SUID bit should be set so that the appxLoginMgr command can be run by users other than root but still be run with the permissions of root.

In the event that it is necessary to reset the permissions on the appxLoginMgr command, the following commands can be run by the root user to set the necessary owner and group permissions for the appxLoginMgr command.

cd /usr/local/appx/tools chown root appxLoginMgr chgrp appxgrp appxLoginMgr chmod 4775 appxLoginMgr

You can check the permissions of the appxLoginMgr command by running the following command:

ls -l appxLoginMgr

The recommended permissions should be as follows:

-rwsrwxr-x 1 root root    636843 Jul 11 07:31 appxLoginMgr

Creating and Configuring an APPX Connection Service

On Unix/Linux systems, an instance of the APPX Connection Service is initially created, configured, and started by running the appxLoginMgr command with the -install option. At least one appropriately configured instance of the APPX Connection Service must be created, configured, and started before a remote APPX Client can initiate an APPX session. You may create, configure, and start as many different instances of the APPX Connection Service as you desire. However, each concurrently running instance must be configured to listen for connection requests on a different TCP/IP port.

Creating a Connection Service

Before remote clients can connect to an APPX system, at least one instance of an APPX Connection Service must be configured and started.

The -install option of the appxLoginMgr command is used to initially create, configure, and start an instance of the APPX Connection Service. The following steps are performed:

1. A configuration file (ini) is created
2. An environment file (env) is created
3. A service is created, including required init files and links. ( On Red Hat, /etc/init.d/ )
4. The service is started

For compete information on using the -install option of the appxLoginMgr command, please refer to the usage section of this page.

The Name of the Service

Each instance of an APPX Connection Service must have a unique name. When creating an instance of a service, the -name option may be used to specify the name that you want the service to have. If you do not specify a name, a name will be assigned for you for example, appx-8060.

TCP/IP Port Number

When creating an instance of an APPX Connection Service, the -SockPort option must be used to specify the TCP/IP port number on which the service is to listen for connection requests. Any available TCP/IP port number may be specified when installing an instance of the APPX Login Manager Service. However, as a matter of convention, most APPX administrators configure the APPX Connection Service to listen for connections on port 8060. If additional instances of the APPX Login Manager are configured, each instance is typically assigned the next available port number after 8060.

Changing a Connection Service

Two methods are available for modifying an existing instance of an APPX Connection Service.

Method 1 - The APPX Login Manager Command (appxLoginMgr)

The -modify command and the - replace command of the appxLoginMgr tool can be used to modify or replace a previously configured instance of the APPX Login Manager. These options update the existing APPX Login Manager daemon configuration files (ini and env) with the options specified. If you use this technique, the service will be automatically restarted for you, using the new settings. Note that when specifying variables on the command line, you must prefix them with a dash if you are referring to settings such as SSLmode, or without a dash if you are referring to environment variables, such as APPX_KEYMAP.

Method 2 - Text Editor

A text editor can be used to directly edit the APPX Login Manager daemon configuration files (ini and env). The configuration files include comments to help you make the desired changes. If you use this method to modify an existing configuration, you should exercise care to ensure that the syntax is correct. The preferred method for modifying an APPX Login Manager daemon is with Method 1 above.

Managing an APPX Login Manager Daemon

Two methods are available for managing an existing instance of the APPX Connection Service.

Method 1 - appxLoginMgr command

The appxLoginMgr command can be used to manage an instance of the APPX Connection Service. The appxLoginMgr command can be used to start, stop, restart, or display the status of an instance of an APPX Connection Service.

Method 2 - O/S Services

Your operating system includes commands or programs that can be used to manage services. APPX Connection Services can be managed with these tools. The actual commands and programs vary depending on your operating system. Red Hat uses the command line tool service

.

[root@tubes tools]# service appx-8060 status
up and running (process 13893 servicing port 8060)

Usage (appxLoginMgr)

Synopsis - Service Configuration

The appxLoginMgr service configuration commands are used to create, configure, and remove an instance of an APPX Connection Service.

appxLoginMgr -install -SockPort=[TCP-Port] [options]... [VARIABLE=VALUE]...

appxLoginMgr -modify -serviceName=SERVICENAME [options]... [VARIABLE=VALUE]...

appxLoginMgr -replace -serviceName=SERVICENAME [options]... [VARIABLE=VALUE]...

appxLoginMgr -remove -serviceName=SERVICENAME

Configuration - Commands

-install -name=SERVICENAME [options]... [VARIABLE=VALUE]...

-install -port=PORT [options]... [VARIABLE=VALUE]...

The -install command is used to configure a new instance of an APPX Connection Service. Either form of the install command may be used.

The first form of the -install command requires only that a service name be specified. All other options are optional including the TCP/IP port. Any option not specified will be configured with an appropriate default value.

The second form of the -install command requires only that a TCP/IP port be specified. All other options are optional including the <nop>ServiceName. Any option not specified will be configured with an appropriate default value.

Both forms of the -install command allow additional configuration options to be specified. The configuration options specified are stored in the service configuration file (ini).

Both forms of the -install command optionally allow values to be specified for environment variables. If specified, the environment variables and their values are stored in the environment configuration file (env). The environment variables in the environment configuration file will be set for any APPX sessions which are started by the connection service.

In addition to creating the service configuration file and the environment configuration file, the -install command also creates an operating system service that will be automatically started when the computer system is started.

After creating the configuration files and the operating system service, the -install command starts the service.

-modify -name=SERVICENAME [options]... [VARIABLE=VALUE]...

The -modify command is used to modify the configuration of an existing Connection Service. The specified options will be updated in the service configuration files. Any options not specified will not be changed. After updating the configuration files, the -modify command restarts the service.

Note that when specifying variables on the command line, you must prefix them with a dash if you are referring to settings such as SSLmode, or without a dash if you are referring to environment variables, such as APPX_KEYMAP.

Note that the -modify command updates the service configuration file and the environment configuration file by removing the old files and creating new files with the updated options and environment variables. Any comments that may have been manually added to these configuration files are not preserved.

-replace -name=SERVICENAME [options]... [VARIABLE=VALUE]...

The -replace command is used to replace an existing Connection Service with a new Connection Service with the same name. The -replace command is effectively the same as a -remove command followed by an -install command. After updating the configuration files, the -replace command restarts the service. Note that when specifying variables on the command line, you must prefix them with a dash if you are referring to settings such as SSLmode, or without a dash if you are referring to environment variables, such as APPX_KEYMAP.

-remove -name=SERVICENAME

The -remove command is used to remove an existing Connection Service. The -remove command will remove the configuration files (ini and env) and the corresponding operating system service. If the service is running when the -remove command is executed, the -remove command will first stop the service and then remove the service.

Configuration - Options

Options - General

-name, -ServiceName=SERVICENAME

The <nop>ServiceName uniquely identifies an APPX connection service. When creating (installing) a connection service, the SERVICENAME value may be any string value that conforms to the rules for valid filenames on your server. If this option is omitted when a connection service is being created, the connection service will be created with a default <nop>ServiceName based on the following template: "appxd-" followed by the specified TCP/IP port number, e.g. "appx-8060".

-DisplayName=DISPLAYNAME

The <nop>DisplayName is a "user-friendly" descriptive name for a connection service. The DISPLAYNAME value will appear in your system's Services control panel and will be displayed by the ps command. If you don't specify a DISPLAYNAME when a connection service is being created, the connection service will be created with a DISPLAYNAME based on the SERVICENAME.

-engine, -AppxExecutable={../appx, PATHNAME}

This option identifies the PATHNAME of the APPX engine that is to be run when initiating an APPX session. The specified PATHNAME may be absolute or it may be relative to directory in which the service configuration file (ini) for the connection service is located. If this option is not specified, the default PATHNAME of "../appx" is used to initiate an APPX session.

-LogDirectory={/tmp, LOGDIR}

When the service is started, two log files are created in the LOGDIR directory - a connection service log file (.log) and a status file (.stat). Both log files have the same name as the <nop>ServiceName but one has a file extension of .log and the other has a file extension of .stat. If the <nop>LogDirectory option is not specified, the log files are created in the /tmp directory.

-AM, -AuthenticationMethod={OS-User, Appx-User, HT-User(HTFILENAME)}

This option identifies the method by which the user ID and the password are to be validated when a connection request is received. If 'OS-User' authentication is specified, the user ID and the password are validated by the connection service using the operating system's authentication service. If 'Appx-User' authentication is specified, the user ID and the password are validated by APPX using the user file and auxiliary password which is maintained in APPX System Administration. If 'HT-User(HTFILENAME)' authentication is specified, the user ID and the password are validated by the connection service using the HTFILENAME file is maintained with the htpasswd utility. If you specify 'Appx-User' authentication or HT-User authentication, the user being validated does not need an OS user account. If no authentication method is specified, the default authentication method is OS-User.

-ServiceType=Login

The only valid value when configuring a Connection Service is "Login". If this option is not specified, the default value is Login.

-ServiceDisable={true, false}

This option can be used to temporarily disable or "turn off" the connection service. If set to true, the connection service will still run but it will not accept login requests.

-ServiceDisableLogin={true, false}

This option can be used to disable or "turn off" processing of login requests from interactive clients. If set to true, login requests from interactive clients will not be processed.

-ServiceDisableFMS={true, false}

This option can be used to disable or "turn off" processing of connection requests from APPX/Net connections including the Windows APPX/ODBC driver. If set to true, connection requests from APPX/Net clients will not be processed.

-ServiceDisableAppxKeys={true, false}

This option can be used to disable the ability to define an APPX keymap. If set to true, those interactive clients which support the ability to define an APPX keymap will not be allowed to do so.

-initScript={lsb, <nop>RedHat}

Used with -install option to specify the type of operating system that the service script is to be created for. If this option is not specified, appxLoginMgr will determine which type of service script to install.

serverEnableHTTPdebug={true, false}

Normally you can point a browser at the login port & it will display a configuration page. This might be considered a security risk, setting this to a value of 'false' will cause the listener to immediately hang up and recycle to a listening state on an HTTP request without displaying the configuration information.

Options - Session Identity/Permissions

-ImpersonateUID={true, false}

If this value is set to false, an APPX session which is initiated by the connection service will run as the user of the connection <nop>ServiceOwner. Set this value to true if you want the APPX session to run with the permissions of a user (impersonate) other than the user of the connection service. If this value is set to true, then the <nop>ImpersonateUser option determines which user the APPX session should impersonate.

-ImpersonateUser={LogonUser, <nop>NamedUser(USERID), <nop>ServiceOwner}

This option determines which O/S user the APPX session should impersonate (run as).

If <nop>LogonUser is specified, the user ID of the APPX session will be set to the user ID that was provided by the client login. This user ID must be a valid O/S user. The connection service must be running with the permissions of the root user if the <nop>LogonUser option is specified.

If <nop>NamedUser is specified, the user ID of the APPX session will be set to the specified USERID. This USERID must be a valid O/S user. The connection service must be running with the permissions of the root user if the <nop>NamedUser option is specified.

If <nop>ServiceOwner is specified, the user ID of the APPX session will be the user ID that the connection service is running as.

-ImpersonateGID={true, false}

If this value is set to false, an APPX session which is initiated by the connection service will run with the group permissions of the connection <nop>ServiceOwner. Set this value to true if you want the APPX session to have group permissions based on the <nop>ImpersonateGroup option.

-ImpersonateGroup={User, <nop>LogonUser, <nop>LogonGroup, <nop>NamedGroup(GROUPNAME), <nop>ServiceOwner, <nop>ServiceGroup}

This option determines which group permissions the APPX session should run with.

If User is specified, the APPX session will run with the group permissions of the user that the session is running as (impersonating).

If <nop>LogonUser or <nop>LogonGroup is specified, the APPX session will run with the group permissions of the user ID that the client provided in conjunction with the connection request. The user ID must be a valid O/S user.

If <nop>NamedGroup is specified, the group permissions of the APPX session will be set to the specified GROUPNAME. This GROUPNAME must be a valid O/S group.

If <nop>ServiceOwner or <nop>ServiceGroup is specified.

-Umask=FILECREATIONMASK

When a file is created, the default permissions set by Unix/Linux are 666 (-rw-rw-rw-). When a directory is created, the default permissions set by Unix/Linux are 777 (drwxrwxrwx). If the umask option is specified, the FILECREATIONMASK value will modify the default permissions of files or directories that are created by the APPX session. The value of FILECREATIONMASK must be a decimal, hex, or octal number whose bits will be used to mask or turn off the corresponding bits of the default file creation permissions. For example, if you want files to be created with permissions of 644, the appropriate FILECREATIONMASK value would be 022 (octal). If you want files to be created with the default permissions of 666, the appropriate FILECREATIONMASK value would be 000 (octal). For more information on umask values, please refer to your Unix/Linux system documentation.

If the umask option is not set, files and directories that are created by the APPX session will be given the default permissions of the Service Owner.

-IncludeSystemEnv={true, false}

Set this option to true if you want the APPX sessions which are initiated by the connection service to inherit the environment of the connection service.

Options - Startup Process

-ServiceEnableCmds={true, false}

Set this option to true if you want to allow the client to specify a startup process. Set this option to false if you do not want to allow the client to specify a startup process. If set to true, then any APPX startup process that may have been specified by the client will be invoked when the connection with the APPX session is established. If set to true, then any startup process that is specified by the client will take precedence over any startup process that may have been specified in the connection service configuration. If the option is not specified, the default value is true.

-AppxDatabase=DATABASEID

This option must be specified if the connection service is being configured to invoke a specific startup process when a client session is initiated. If specified, the DATABASEID must be valid, i.e. it must be defined in the Databases file in APPX System Administration.

-AppxApplication=APPLICATIONID

This option must be specified if the connection service is being configured to invoke a specific startup process when a client session is initiated. If specified, the APPLICATIONID must be valid, i.e. it must be defined in the Applications file in APPX System Administration. The specified APPLICATIONID must also be identified in APPX System Administration as a related application for the specified DATABASEID.

-AppxProcessType={Menu, Job, Input, Output, Update, Action, Inquiry, Query, Status, Subroutine}

This option must be specified if the connection service is being configured to invoke a specific startup process when a client session is initiated. This option identifies the type of process that is to be invoked when a client session is initiated.

-AppxProcessName=PROCESSNAME

This option must be specified if the connection service is being configured to invoke a specific startup process when a client session is initiated. This option identifies the name of the process that is to be invoked when a client session is initiated. The PROCESSNAME must be of the type specified and must be defined in the specified APPX Application.

Options - TCP/IP

-port, -SockPort={8060, PORT}

Configure the service to listen for connection requests on the specified TCP/IP PORT number. This option is required with the -install option. You may choose any TCP/IP PORT number that is not reserved or already being used on your system.

-TCPNoDelay={true, false}

This option is used to tune the network performance of the APPX session. When set to true, TCP will send partially filled packets of data rather than wait for a packet to fill before sending it. This can result in improved interactive response time for the APPX session but will likely increase the number of data packets being transmitted over the network.

-TCPEnableKeepAlive={true, false}

Set this option to true if you want an APPX session to be able to detect that the connection between an APPX session and an APPX client has been lost. If this option is set to true and an APPX session has been waiting for a response from an APPX client for the length of time specified by <nop>TCPKeepIdle, then the APPX session will attempt to contact the APPX client to see if it can still be reached. If the APPX client cannot be contacted, then the APPX session will attempt to contact the APPX client every <nop>TCPKeepInterval seconds up to <nop>TCPKeepCount times. After <nop>TCPKeepCount attempts, if the APPX client is unable to be contacted, then the APPX session terminates.

-TCPKeepIdle={300, SECONDS}

This option is used to set the number of seconds that an APPX session is to wait for a response from an APPX client before checking to see if the client can still be contacted.

-TCPKeepCount={8, COUNT}

This option is used to set the number of times that an APPX session is to attempt to contact a non-responsive APPX client before the APPX session should terminate.

-TCPKeepInterval={60, SECONDS}

This option is used to set the number of seconds that an APPX session is to wait between attempts to contact a non-responsive APPX client.

Options - SSL

-SSLMode={optional, required, disabled}

This option is used to control whether or not APPX clients must use SSL connections.

optional - APPX clients may request either an SSL connection or a plain text connection

required - APPX clients must request an SSL connection

disabled - APPX clients may only request a plain text connection

-TrustedCAFile=CAFILENAME

This option identifies the pathname of the file that identifies which client certificates to trust (leave blank if client certificates are not required).

-ServerCertificateFile=CERTFILENAME

This option identifies the pathname of the server's X509 certificate (leave blank for anonymous connections).

-ServerPrivateKeyFile=KEYFILENAME

This option identifies the pathname of server's private key file (unlocks the <nop>ServerCertificateFile).

-RequireSSL={true, false}

This option is not needed and has not been implemented.

-RequireSSLClientCertificates={true, false}

This option is not needed and has not been implemented.

-ServerPrivateKeyPassphrase=PASSPHRASE

This option is not needed and has not been implemented.

-UseOldSSLcert={true,false}

Forces the login manager to use pre 5.4.4 certificates. This allows older clients to connect to 5.4.4 and up (5.4.4 & up login manager only).

Configuration - Environment Variables

VARIABLE=VALUE

You can include a space-separated list of environment variables at the end of the command line when you use the -install option. These environment variables will be saved in the env file that is created and will be given to the environment of the appx sessions that are started by the Login Manager. Note that when specifying variables on the command line, you do not prefix them with a dash if you are referring to environment variables.

Synopsis - Service Management

appxLoginMgr [-start | -stop | -restart | -status] {SERVICENAME | -serviceName=SERVICENAME}

MANAGEMENT OPTIONS

-start | < blank >

Start an instance of the Login Manager service using the configuration information in the SERVICENAME.ini and the SERVICENAME.env files.

-stop

Stop the instance of the Login Manager service that was started with the SERVICENAME.ini file.

-restart

Restart (stop and then start) the instance of the Login Manager that was started with the SERVICENAME.ini file.

-status

Report the status of the instance of the Login Manager that was started with the SERVICENAME.ini file.

EXAMPLES

Example 1: Configure and start a new instance of the Connection Service that will listen for connection requests on port 8060:

appxLoginMgr -install -port=8060

Warning - the engine that you named has the setuid bit enabled
you may not want that bit set for the authentication method that you have chosen (OS-User)
To turn off the setuid bit, chmod u-s
../appx Configuration written to: appx-8060.ini
Environment written to: appx-8060.envtten to: /etc/rc.d/init.d/appx-8060

appxLoginMgr -install -port=8060 -name=appx8060 -displayName="Appx-Production(8060)" -engine=/usr/local/appx/appx APPXPATH=c:\appx\data APPX_KEYMAP=WINDOWS

Display the status of an instance of the Connection Service:

appxLoginMgr -status appx8060

Shutdown a running instance of the Connection Service:

appxLoginMgr -stop appx8060

Start a previously configured instance of the Connection Service:

appxLoginMgr -start appx8060

Modify a setting and an environment variable of an existing service

appxLoginMgr -modify -name=appx8060 -SSLMode=required APPX_KEYMAP=Windows

The Configuration File (ini)

Each instance of an APPX Connection Service has a configuration file that is used to store the various parameters relating to that specific instance of the connection service.

The -install option of the appxLoginMgr command creates the configuration file when the service is created.

The name of the configuration file is the concatenation of the service name and ".ini". For example, if the service name is "appxd-8430", the name of the configuration file will be "appxd-8430.ini".

The configuration file is created in whichever directory is your current directory at the time that the appxLoginMgr command is run to create the service. Therefore, before you run the appxLoginMgr command to create a service, you must first change to the directory where you want the configuration file to reside. For example, if you want the configuration file to be created in the APPX tools directory, you should change to the tools directory before you run the appxLoginMgr command.

The name of the configuration file and the location of the configuration file should not be changed. The service that is created will not work correctly if the name or the location of the configuration file is changed.

# Appx connection manager configuration file
#
#   You can change this file by hand, or
#   use the uappxd program for better results
#
#   blank lines are ignored
#
#   anything following a '#' is treated as a comment
#
#   case is not important on the left-hand side
#   properties whose descriptions end in a '?' are
#   boolean and should be set to true or false
# --------------------------------------------------
# AppxApplication         =                     #startup application for spawned engines
# AppxDatabase            =                     #startup database for spawned engines
AppxExecutable            = /usr/local/appx/appx    #pathname to Appx engine
# AppxProcessName         =                     #startup process name for spawned engines
# AppxProcessType         =                     #startup process type for spawned engines
AuthenticationMethod      = OS-User             #authentication method (OS-User, Appx-User, HT-User(filename))
DisplayName               = Login-8430          #descriptive name
ImpersonateGID            = true                #change effective group ID for spawned engines?
ImpersonateGroup          = NamedGroup(appxgrp) #[LogonUser, NamedGroup(groupname), ServiceOwner]
ImpersonateUID            = true                #change effective user ID for spawned engines?
ImpersonateUser           = NamedUser(appx)     #[LogonUser, NamedUser(username), ServiceOwner]
# IncludeSystemEnv        = true                #include service environment variables in spawned engines?
# LogDirectory            = /tmp                #directory where log file should reside
# LogNamePattern          = /tmp/appxlog%N.xml  #audit log filename pattern (see man strftime for details
# LogRotationInterval     = 86400               #number of seconds between audit log rotations
# LogRotationSize         = 1G                  #maximum audit log file size
# RequireSSL              = false               #Require SSL-secured connections?
# RequireSSLClientCertificates = false          #require SSL-client certificates?
# ServerCertificateFile   =                     #pathname of server's X509 certificate (leave blank for anonymous connections
# ServerPrivateKeyFile    =                     #pathname of server's private key file (unlocks the ServerCertificateFile)
# ServerPrivateKeyPassphrase =                  #passphrase that unlocks ServerPrivateKeyFile
# ServiceDisable          = false               #disable this service?
# ServiceDisableAppxKeys  = false               #disable keyboard mapping?
# ServiceDisableFMS       = false               #disable AppxNET connections?
# ServiceDisableLogins    = false               #disable interactive logins?
# ServiceEnableCmds       = true                #allow client-side startup options?
ServiceName               = appxd-8430          #name of service
ServiceType               = login               #service type (login or logmonitor)
SockPort                  = 8430                #port number to service
# SSLMode                 = optional            #SSL connection type (optional, required, disabled)
# TCPEnableKeepAlive      = true                #Enable TCP dead-connection detection
# TCPKeepCount            = 8                   #Maximum number of keep-alive pings
# TCPKeepIdle             = 300                 #Idle time before ping sent to client (in seconds)
# TCPKeepInterval         = 60                  #Interval between keep-alive pings
# TCPNoDelay              = true                #disable TCP packet filling delay?
# TrustedCAFile           =                     #determines which client certificates to trust
# Umask                   =                     #umask (file creation mask) given to spawned engines

The Environment File (env)

Each instance of an APPX Connection Service has an environment file that is used to store the environment variables relating to that specific instance of the connection service. The environment variables in the environment file are inherited by each APPX session that is started by the APPX Connection Service.

The -install option of the appxLoginMgr command creates the environment file when the service is created.

The name of the environment file is the concatenation of the service name and ".env". For example, if the service name is "appxd-8430", the name of the environment file will be "appxd-8430.env".

The environment file is created in whichever directory is your current directory at the time that the appxLoginMgr command is run to create the service. Therefore, before you run the appxLoginMgr command to create a service, you must first change to the directory where you want the environment file to reside. For example, if you want the environment file to be created in the APPX tools directory, you should change to the tools directory before you run the appxLoginMgr command.

The name of the environment file and the location of the environment file should not be changed. The service that is created will not work correctly if the name or the location of the environment file is changed.

# Appx connection manager environment variables
#
#   The entries in this file will become
#   environment variables in the engines
#   spawned by this service
#
#   blank lines are ignored
#
#   anything following a '#' is treated as a comment
#
#   letter case IS important in this file
# --------------------------------------------------
APPX_KEYMAP=WINDOWS

The Status File (stat)

When an APPX Connection Service is started, a status file is created in the specified <nop>LogDirectory. If a <nop>LogDirectory was not specified, then the status file is created in the /tmp directory.

The name of the status file is the concatenation of the service name and ".stat". For example, if the service name is "appxd-8430", the name of the status file will be "appxd-8430.stat".

The status file can be viewed to see the actual context within which the service is running.

appxd-8430 running as process 28192
Effective User ID 0
Real User ID      0
Configuration values follow
*Daemonize = true
*DontForkEngine = false
*InitScriptStyle = 
*SleepAfterFork = 
AppxApplication = 
AppxDatabase = 
AppxExecutable = ../appx
AppxProcessName = 
AppxProcessType = 
AuthenticationMethod = OS-User
DisplayName = appxd-8430
ImpersonateGID = true
ImpersonateGroup = User
ImpersonateUID = true
ImpersonateUser = LogonUser
IncludeSystemEnv = true
LogDirectory = /tmp
LogNamePattern = /tmp/appxlog%N.xml
LogRotationInterval = 86400
LogRotationSize = 1G
RequireSSL = false
RequireSSLClientCertificates = false
ServerCertificateFile = 
ServerPrivateKeyFile = 
ServerPrivateKeyPassphrase = 
ServiceDisable = false
ServiceDisableAppxKeys = false
ServiceDisableFMS = false
ServiceDisableLogins = false
ServiceDisableODBC = 
ServiceEnableCmds = true
ServiceName = appxd-8430
ServiceType = login
SockPort = 8430
SSLMode = Optional
TCPEnableKeepAlive = true
TCPKeepCount = 8
TCPKeepIdle = 300
TCPKeepInterval = 60
TCPNoDelay = true
TrustedCAFile = 
Umask = 
Environment variables follow
APPX_KEYMAP = WINDOWS

The Log File (log)

When an APPX Connection Service is started, a log file is created in the specified <nop>LogDirectory. If a <nop>LogDirectory was not specified, then the log file is created in the /tmp directory.

The name of the log file is the concatenation of the service name and ".log". For example, if the service name is "appxd-8430", the name of the log file will be "appxd-8430.log".

When the connection service is started, the log file is initialized with the configuration of the connection service. The configuration information is followed by a dialog of messages relating to actions performed by the connection service. Each time the connection service processes a connection request, messages relating to the connection request are appended to the log file.

*Daemonize = true
*DontForkEngine = false
*InitScriptStyle = 
*SleepAfterFork = 
AppxApplication = 
AppxDatabase = 
AppxExecutable = ../appx
AppxProcessName = 
AppxProcessType = 
AuthenticationMethod = OS-User
DisplayName = appxd-8430
ImpersonateGID = true
ImpersonateGroup = User
ImpersonateUID = true
ImpersonateUser = LogonUser
IncludeSystemEnv = true
LogDirectory = /tmp
LogNamePattern = /tmp/appxlog%N.xml
LogRotationInterval = 86400
LogRotationSize = 1G
RequireSSL = false
RequireSSLClientCertificates = false
ServerCertificateFile = 
ServerPrivateKeyFile = 
ServerPrivateKeyPassphrase = 
ServiceDisable = false
ServiceDisableAppxKeys = false
ServiceDisableFMS = false
ServiceDisableLogins = false
ServiceDisableODBC = 
ServiceEnableCmds = true
ServiceName = appxd-8430
ServiceType = login
SockPort = 8430
SSLMode = Optional
TCPEnableKeepAlive = true
TCPKeepCount = 8
TCPKeepIdle = 300
TCPKeepInterval = 60
TCPNoDelay = true
TrustedCAFile = 
Umask = 
createListener complete - listening on port 8430
CAppxD::Run starting
handleClients - starting
handleClients - waiting

#RedHatServiceCommand

Red Hat service command.

Usage (service)

Synopsis - service Command

service [serviceName] [start|stop|restart|status]

Examples:

How to create private/public-keys without passphrase for server

Example of appxLoginMgr parameter to identify private key:

ServerPrivateKeyFile =/usr/local/appx/tools/tubes.internal.appx.com.private.key

Example of openssl command to create private key:

openssl genrsa -out tubes.internal.appx.com.private.key 1024

How to create public SSL certificate for server

Example of appxLoginMgr parameter to identify SSL certificate:

ServerCertificateFile =/usr/local/appx/tools/tubes.internal.appx.com.crt

Example of openssl command to create SSL certificate:

openssl req -new -days 365 -key tubes.internal.appx.com.private.key -x509 -out tubes.internal.appx.com.crt

Warnings:

"the engine that you named has the setuid bit enabled"

This warning message is displayed when you start a service and the engine specified for AppxExecutable has the setuid bit set.

When launching an APPX session, the APPX Login Manager sets the real user ID and the effective user ID of the APPX session based on the value specified for the <nop>ImpersonateUser parameter. If the engine has the setuid bit set, then the effective user of the APPX session will be changed by the operating system to be the owner of the APPX engine and the APPX session will run with the permissions of that user.

Warning - the engine that you named has the setuid bit enabled, 
you may not want that bit set for the authentication 
method that you have chosen (OS-User) 
To turn off the setuid bit, chmod u-s ../appx

Reconnect Feature (5.3 & up)

A new connection manager allows a user to reconnect to dropped sessions.

Overview:

A new connection manager allows a user to reconnect to dropped sessions. This capability will be especially useful after the new HTML client is released and users are connecting from mobile devices.

Usage:

The new connection manager is controlled by the following settings in the service .ini file:

To use the new connection manager, set AppxInterface to 'Pipe'. The normal, default, method is 'Socket', which does not have a reconnect capability. The 'Pipe' connection type creates a Named Pipe connection between the server and the new connection manager. The new connection manager then creates a Socket connection between itself and the client. If the connection is dropped, the new connection manager will end. The server will detect this and go into a 'reconnect' mode and will hold Named Pipes connection open for 'AppxPipeTimeout' minutes. If the user reconnects to the same session id within that time limit, a new connection manager will re-establish the connection to the client. Since the server has been holding the Socket connection open, the user will be able to continue their session.

AppxPipeDir is the folder where the new connection manager will keep the named pipes and other connection related files. This is relative to the 'services' directory.

AppxPipeExe is the name of the new connection manager (appxcomm). On Linux/Unix servers this is relative to the 'services' directory. On Windows servers, this must be the complete path to the 'appxcomm.exe' program (usually found in the 'services' directory).

AppxPipeTimeout is the length of time (in minutes) the new connection manager should hold the session open. After this time has expired, the session will be closed and the user will not be able to reconnect.

Note that even though the new connection manager holds the connection open, any data typed in a field before the user pressed Enter or clicked a button will be lost. For example, if they were entering a name and the connection was lost before they pressed Enter or clicked a button, when they reconnect those characters would be lost.

Reconnecting to a session

The login dialog box has a 'Reconnect Id' field:

To reconnect to a lost sesssion, enter the process id (PID) of the lost session. The PID is normally displayed in the title bar of the client, however, most of us don't pay any attention to it so it's unlikely we'll remember it to reconnect. You can check the client preferences to see what the last PID was. To do this, click the 'Options' tab, then the 'Advanced' button, and look for 'lastPid' in the [LastLogin] section:

An Appx System administrator can connect to another users disconnected session, if they know the PID of the lost session.

In Release 5.4.4, a list of dropped sessions can be displayed, eliminating the need to remember PID's.

PAM Capable (5.3 & Up)

In Release 5.3, PAM capability was added. See Login Manager PAM Capable for more information.

Reconnect Revisited (5.4.4)

To make managing reconnects easier, in 5.4.4 a 'Sessions' button was added to the login dialog box for both APPX Desktop Client and the HTML client. To access the 'Sessions' list, enter your login information as usual and click the 'Sessions' button instead of 'Login'. You can use this even if you have not set up your login manager for reconnections. You won't be able to reconnect to a session, but you will be able to manage other sessions.

You will get a display similar to the following:

The display automatically refreshes every 30 seconds, or you can click 'Refresh' to manually refresh the display. The information on the process currently running is only shown if you have enabled the APPX Monitor (See APPX Monitor for details). If not enabled, those columns will be blank.

If you are an APPX System Administrator, you will see all APPX sessions. If you are not an Administrator, you will only see your own sessions.

New - Starts a new session using your current login information (user, password, server & port).

Attach - This button is only enabled if your login manager has been configured to allow reconnections, in which case the Workstation IDs will be 'PIPE' as in the example above. The second session (on /dev/pts/1) is a character mode session, which you cannot Attach to. If your login manager is not configured for reconnections, then the Workstation ID will be either an IP address (for GUI connections) or a /dev/ address for a character mode connection. Since an APPX System Administrator will see all running sessions, they can Attach to any user's session. A new window will open on the Administrators desktop, and the client window on the users desktop will close (when they attempt to use their session). A non Administrator will only see their own sessions, and therefore can only Attach to their own session.

Kill - This will attempt to cancel the selected session. This will only be successful if you have sufficient O/S permissions to allow it, i.e., you have Administrator level or you are cancelling one of your own sessions. See .UTIL KILL SESSION for more information.

Exit - This will exit the session manager without logging in to APPX.

Issues:

1. The stop option of the Red Hat service command has a problem. It does seem to remove the running process; however, it produces errors. Further, it fails to remove the PID from the (/var/run/appx-8060.pid)

   /etc/init.d/appx-8060: line 39: success: command not found
   /etc/init.d/appx-8060: line 39: failure: command not found
   /etc/init.d/appx-8060: line 43: failure: command not found

2. The setuid warning message is displayed every time a configuration is loaded or saved. This results in the message being displayed up to three times depending on the command being executed. Perhaps it should only be displayed when a configuration is saved.
3. The setuid warning indicates that it is triggered by the OSUser AuthenticationMethod. AuthenticationMethod is not influenced by the setuid bit being turned on. However, ImpersonateUser is impacted.

Comments:

Read what other users have said about this page or add your own comments.

-- Page added by: Steve - 17 Jul 2007