System Requirements

Connector is software that runs within an Ubuntu server and enables secure connectivity between users and the remote workstations. Connector runs in the customer environment such as on-premises, AWS and Google Cloud. The Connector communicates with the CAS Manager which orchestrates and manages Cloud Access deployments.

Creating the Connector Server¶

The Connector runs on an Ubuntu server (called the Connector server).

Create a dedicated Ubuntu server with the following specifications:

• Ubuntu Server 18.04.
• At least 4GB RAM.
• 30GB available storage or more.
• 2 vCPUs or more.

Once you have setup a dedicated virtual machine for the Connector, please ensure the following environment conditions are met:

• You must have access to the internet.
• You must have an Active Directory (AD) user account located in the designated Connector domain admins group, in order to log into the Admin Console.
• The server must be able to resolve the AD domain.
• You must be able to access the server using SSH.
• You must have superuser (sudo) privileges on the server.
• The networking information of the server (including the IP address) must not change while the Connector is operational.
• The server must have a single network interface and IP address. If the server has multiple network interfaces, the Connector will fail to install.
• If you are deploying Ubuntu on ESXi, you must install open-vm-tools to enable the ESXi host to communicate with the Connector server.
• The Connector runs on the following supported domain controller servers:
  • Windows 2016 Server with secure LDAP (LDAPS) enabled.
  • Windows 2012 R2 Server with secure LDAP (LDAPS) enabled.
  • Windows 2019 Server with secure LDAP (LDAPS) enabled.

For information on the session establishment and session bandwidth limits when working with external connections, see here.

Verifying the Connector Server¶

To verify your Connector server network configuration, SSH into the machine and ping the domain and a remote workstation in the domain. You should get a positive response from both attempts:

ping <domain FQDN>
ping <remote workstation FQDN>

If any of your attempts to verify these components fails, the DNS settings on the Connector server might be misconfigured. For more information on DNS configuration, see Configuring Network Settings in Ubuntu 18.04.

The following section outlines how to download and install the Connector. There are three steps involved in this process:

• Downloading the Connector installer files.
• Obtaining an authorization token.
• Installing the Connector.

Prerequisite Steps¶

For instructions and documentation on the Connector prerequisite steps, see Connector System Requirements.

It is important to read and address all the prerequisites outlined.

1. Downloading the Connector¶

The following section outlines how to download the installer files for the Connector. First, connect to the machine and download the Connector files. The commands below will download the Connector archive, and extract it.

You need to ensure that you have a customer account created on teradici.com to access the download information.

Downloading the Installer from teradici.com¶

The following steps outline the current process that enables you to download the installer directly from teradici.com as a tar.gz file or else run the shell script from teradici.com:

1. SSH into the machine:

   ssh <username>@<server-ip-address>
   

2. Download the installer from Teradici:
   • Open a web browser and navigate to the Downloads and Scripts tab on the Teradici support site.
   • Download the installer and upload it to the machine or run the shell script provided to download the installer to the machine.
3. Unpackage the installer:
   • Previously the installer was extracted into the ~/v2connector directory. This location has now changed. Run the following command to extract the installer to /usr/sbin/:

     sudo tar xzvf <PATH TO FILE>/cloud-access-connector_<version>_Linux.tar.gz -C /
     

2. Obtaining the Connector Token¶

You are required to have a Connector token when installing the Connector. You need to create or have created a deployment prior to obtaining a token. For information on how to log into the Admin Console, see Admin Console Connection. The following section outlines how to obtain a Connector token using the Admin Console:

1. Click Connectors from the console sidebar.
2. Click the add connector button (+ sign located beside Connectors heading) to display the connector creation panel.
3. Enter the following information:
   • Select the deployment you want to add the Connector to. If you do not have an existing deployment you need to create one.
   • Enter the name of the Connector.
   • Follow the step by step instructions outlined below. 
     
4. Click GENERATE.
5. Copy the Connector token by click the copy icon.
6. Click CLOSE the exit the panel.

You can now use this Connector token when prompted during installation.

3. Installing the Connector¶

Once the files are downloaded and the access token is set, you can install the Connector. If you are not already connected, connect to the machine via SSH and navigate to the /usr/sbin directory.

3.1 Installing the Connector for CAS Manager¶

Once you have downloaded the Connector installer and have obtained a Connector token, run the following command to install Connector to the CAS Manager instance you have just installed. The first line of this command maps the Connector token to a variable in the shell:

export token=<token from CAS Manager admin console>
sudo cloud-access-connector install \
-t $token \
--casm-url=https://ip-address-of-cas-manager \
--external-pcoip-ip public.ipv4.clients.connect.to \
--casm-insecure

• When you are installing the Connector for CAS Manager you need to ensure that you enable and specify the --casm-url flag. This flag specifies the CAS Manager URL that the Connector connects to. If it is not specified by default it will point to https://cas.teradici.com.
• The --external-pcoip-ip flag is highly recommended to use in order to explicitly set the public IP that PCoIP Clients will connect to during PCoIP sessions. This is the public IP that the Connector is listening to on port 4172. The installer will reach out to cas.teradici.com and first try to automatically resolve the external IP; if this fails, or is not able to resolve the correct IP, this flag is required. In the case that the Connector machine doesn’t have an internet connection, for example in a dark site environment, or the ingress and egress internet traffic are running through different public IPs, this flag is required.
• The --casm-insecure flag is only required when the Connector is connecting to a CAS Manager that is using self-signed certificates. If CAS Manager is using trusted TLS certificates signed by a public CA, then users will not need to use the --casm-insecure command. For more information on configuring custom trusted certificates for CAS Manager, see TLS Certificates.
• The -casm-ca-cert flag can used to provide the PEM formatted public certificate for the private CA used to sign the CAS Manager certificate. This flag is useful if the Connector fails to fetch a certificate from the CAS Manager.

Ensure that you use the options and flags that best suit your system architecture and requirements. If required values are not provided on the command line, you will be prompted for them. For additional flags and options, see Installation Flags and Options.

3.2 Installing the Connector for CAS Manager as a Service¶

Install the Connector for CAS Manager as a Service by running the following command:

cd /usr/sbin
sudo ./cloud-access-connector install

Ensure that you use the options and flags that best suit your system architecture and requirements. If required values are not provided on the command line, you will be prompted for them. For additional flags and options, see Installation Flags and Options.

Installing the Connector for Testing with CAS Manager¶

To install the Connector with MFA enabled and in insecure mode for testing, you would run this command (note that we are providing the --enable-mfa flag but not the RADIUS server information, so prompts will appear to collect it):

sudo ./cloud-access-connector install -t $token --enable-mfa --self-signed

When the installer completes, the IP address of the Connector will be displayed and you will be directed to go to https://cas.teradici.com to begin managing your deployments, connectors and remote workstations.

Installation Flags and Options¶

The following flags can be used to provide values at the command line. If they are omitted from the command and are required, you will be prompted for them:

4. Connecting to a Remote Workstation with a PCoIP Client¶

After successfully installing a Connector, you can initiate a session to connect to a remote workstation with a PCoIP Software Client. Teradici enables customers to use multi-factor authentication for these PCoIP Client sessions. The following steps outline how to connect to a remote workstation using the PCoIP Software Client:

1. Double-click the PCoIP Client desktop icon or program file PCoIPClient to launch the application.
2. In the Host Address or Code field, enter one of the following:
   • For direct connections, provide the address of the host machine.
   • For managed connections, provide the address of the connection manager.
3. Click NEXT.
4. Select your domain and enter the credentials for the remote workstation. If you have enabled MFA then you will be prompted for the 2^nd factor passcode. The method of how this passcode is communicated depends on the provider you used. It is usually either a One Time Password or push notification.
5. Click LOGIN.
6. If your login is successful you should be able to select the remote workstation and connect to it. Please note that if you have a single remote workstation, that remote workstation is automatically selected and the connection is initiated immeadiately. In this case you will not be presented with a remote workstation selection screen.

Scaling and PCoIP Session Limits

When using CAS Manager there are certain session establishment and session bandwidth limits when dealing with external connections.

The following table outlines the RAM, vCPU and correlated estimated bandwidth support: