Opsi Manual Stable En

opsi manual opsi version 4.0.1

Stand: 17.06.2011

uib gmbh Bonifaziusplatz 1b 55118 Mainz Tel.:+49 6131 275610 www.uib.de [email protected]

opsi manual opsi version 4.0.1 i

Contents1 Copyright 2 Introduction 2.1 2.2 Who should read this manual? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Notations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 1 1 1 2 2 2 2 3 3 6 8 8 9 9 9 10 10 11 12 13 13 14 14 15 15 15 16 17 17 18 20 21 22 22

3 Overview of opsi 3.1 3.2 3.3 Experience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . opsi features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . opsi Extensions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

4 opsi conguration and tools 4.1 4.2 4.3 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Tool: opsi-setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Tool: Management Interface: opsi-conged . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.3.1 4.3.2 4.3.3 4.3.4 4.3.5 4.3.6 Requirements and operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Login . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Copy & Paste, Drag & Drop . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Client conguration / server conguration / license management . . . . . . . . . . . . . . . . . Depot selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Single client selection and group conguration . . . . . . . . . . . . . . . . . . . . . . . . . . . . The clients list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Selecting clients . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.3.7 Client selection and hierarchical groups using the treeview . . . . . . . . . . . . . . . . . . . . . Basic concepts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . How to . . . 4.3.8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Client processing / Client actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . WakeOnLan (Wake selected clients) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Fire on_demand event (Push Installation) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Sending messages (Show popup message) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Call external remote control tools for selected clients . . . . . . . . . . . . . . . . . . . . . . . . Shutdown / reboot of selected clients . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Delete, create, rename and move clients . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.3.9 Product conguration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.3.10 Property tables with list editor windows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.3.11 Netboot products . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.3.12 Hardware information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.3.13 Software inventory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

opsi manual opsi version 4.0.1 ii

4.3.14 Logles: Logs from client and server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.3.15 Host parameters at client and server conguration . . . . . . . . . . . . . . . . . . . . . . . . . 4.3.16 Depot conguration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.4 4.5 Tool: opsi-package-manager: (de-)installs opsi-packages . . . . . . . . . . . . . . . . . . . . . . . . . . Tool: opsi-product-updater . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.5.1 4.5.2 4.6 4.6.1 4.6.2 congurable repositories . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . congurable actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Typical use cases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Set a product to setup for all clients which have this product installed . . . . . . . . . . . . . . List of all clients . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Client delete . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Client create . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Set action request . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Attach client description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . set pcpatch password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.6.3 Web service / API methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Methods since opsi 4.0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . opsi3-Methoden . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Backend extensions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.7 Server processes: opsiconfd and opsipxeconfd . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.7.1 opsiconfd monitoring: opsiconfd info . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

23 23 24 25 26 27 27 28 28 29 29 29 29 29 30 30 30 30 30 32 39 39 39 41 42 42 42 43 43 43 44 45 45 49 49 50 55

Tools: opsi-admin / opsi cong interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

5 Activation of non free modules 6 opsi-client-agent 6.1 6.2 6.3 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Directories of the opsi-client-agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The service: opsiclientd . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.3.1 6.3.2 6.3.3 6.3.4 6.3.5 6.3.6 Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . opsiclientd . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . opsiclientd notier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . opsi-login-blocker . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Processing sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Conguration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Conguration of dierent events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Conguration via conguration le . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Conguration via web service (Host Parameter) . . . . . . . . . . . . . . . . . . . . . . . . . . .

opsi manual opsi version 4.0.1 iii

6.3.7 6.3.8 6.3.9

Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . opsiclientd infopage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . opsi-client-agent remote control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Sending popup messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Push installations: start the event on demand . . . . . . . . . . . . . . . . . . . . . . . . . . . . Additional maintenance tasks (shutdown, reboot,. . . ..) . . . . . . . . . . . . . . . . . . . . . . .

57 58 59 60 60 60 61 61 61 62 62 62 62 62 62 62 62 62 62 63 63 63 65 65 65 65 66 66 66 66 67 67 68 69 69 70 70

6.4

Blocking the user login with the opsi-Loginblocker . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.4.1 6.4.2 opsi loginblocker at Windows 2000 to XP (NT 5) . . . . . . . . . . . . . . . . . . . . . . . . . . opsi loginblocker at NT 6 (Win 7 & Co) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Installation of the opsi-client-agent from a master image or as exe . . . . . . . . . . . . . . . .

6.5

Subsequent installation of the opsi-client-agents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.5.1

7 Localboot products: automatic software distribution with opsi 7.1 opsi standard products . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.1.1 7.1.2 7.1.3 7.1.4 7.1.5 7.1.6 7.1.7 7.1.8 7.2 7.2.1 7.2.2 7.2.3 7.3 opsi-client-agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . opsi-winst . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . javavm: Java Runtime Environment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . opsi-adminutils . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . jedit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Swaudit and hwaudit: Products for hardware and software inventories . . . . . . . . . . . . . . opsi-template . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xpcong . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Algorithm1: product dependency above priority (default) . . . . . . . . . . . . . . . . . . . . . Algorithm2: product priority above dependency . . . . . . . . . . . . . . . . . . . . . . . . . . Dening product priorities and dependencies . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Manipulating the installation sequence by product priorities . . . . . . . . . . . . . . . . . . . . . . . .

Integration of new software packets into the opsi software deployment. . . . . . . . . . . . . . . . . . .

8 Netboot products 8.1 8.2 Parameteters for the opsi linux boot image . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Unattended automated OS installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.2.1 8.2.2 8.2.3 8.2.4 8.2.5 8.2.6 8.2.7 8.2.8 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Preconditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . PC-client boots via the network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Loading pxelinux . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Boot from CD . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The linux bootimage prepares for reinstallation . . . . . . . . . . . . . . . . . . . . . . . . . . . Installation of OS and opsi-client-agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . How the patcha program works . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

opsi manual opsi version 4.0.1 iv

8.2.9 8.3 8.4 8.5 8.6 8.7

Structure of the unattended installation products . . . . . . . . . . . . . . . . . . . . . . . . . .

71 72 72 74 74 74 75 75 75 75 75 75 75 76 76 77 77 77 78 78 78 79 79 80 80 80 81 81 81 81 81 82 82 82 82 83 83

8.2.10 Simplied driver integration with symlinks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Some hints to the NT6 netboot products (Vista / Win7 / 2008) . . . . . . . . . . . . . . . . . . . . . . Ntfs image (write and restore) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . memtest . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . hwinvent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . wipedisk . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

9 opsi-server 9.1 9.2 9.3 9.4 9.5 9.6 9.7 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Installation and initial operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Samba Conguration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The daemon opsiconfd . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Required administrative user accounts and groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . needed shares . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . problem management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

10 Security 10.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.2 Stay tuned . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.3 General server security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.4 Read Only depot share . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.5 Client authentication at the server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.6 Server authentication at the client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.6.1 Variant 1: verify_server_cert . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.6.2 Variant 2: verify_server_cert_by_ca . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.7 Authentication at the control server of the client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.8 Admin network conguration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.9 The user pcpatch . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 opsi-backup 11.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.2 Preconditions for a backup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.3 Quick Start . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.4 Basic parts of opsi . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.4.1 Opsi conguration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.4.2 Opsi backends . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.4.3 opsi depot share . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.4.4 opsi work bench . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.4.5 opsi repository . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

opsi manual opsi version 4.0.1 v

11.5 The program opsi-backup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.5.1 Create a backup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.5.2 Archive your backup les . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.5.3 Verify a backup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.5.4 Restore from a backup le . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 opsi license management 12.1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12.1.1 Main features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12.1.2 Invoking the license management from the opsi-conged . . . . . . . . . . . . . . . . . . . . . . 12.2 license pools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12.2.1 What is a license pool? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12.2.2 Administration of license pools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12.2.3 license pools and opsi-products . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12.2.4 license pools and Windows software IDs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12.3 Setting up licenses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12.3.1 Some aspects and terms of the license concept . . . . . . . . . . . . . . . . . . . . . . . . . . . 12.3.2 Registering the license contract . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12.3.3 Conguring the license model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12.3.4 Saving the data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12.4 Editing licenses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12.4.1 Example downgrade option . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12.5 Assignment and release of licenses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12.5.1 opsi service calls for requesting and releasing a license . . . . . . . . . . . . . . . . . . . . . . . 12.5.2 opsi-winst script calls for requesting and releasing of licenses . . . . . . . . . . . . . . . . . . . 12.5.3 License contracts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12.5.4 Manual administration of license use . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12.5.5 Preservation and deletion of license usages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12.6 Reconciliation with the software inventory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12.7 Licenses usage overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12.7.1 In case of downgrade option . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12.8 Service methods for license management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12.9 Example products and templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 opsi WAN/VPN extension 13.1 Preconditions for using the WAN/VPN extension . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

83 83 85 85 85 86 86 86 87 87 87 88 89 89 89 90 90 91 91 91 92 93 93 94 94 95 96 96 97 97 98 99 99 99

13.2 General overview of the WAN/VPN extension . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100 13.3 Caching of opsi-products . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 13.3.1 Communication Protocol for accessing an opsi-depot . . . . . . . . . . . . . . . . . . . . . . . . 101

opsi manual opsi version 4.0.1 vi

13.3.2 Using the .files le for Synchronization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102 13.3.3 Internal processing of opsi-product caching . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102 13.3.4 Conguring the opsi-product caching . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 13.4 Caching of congurations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 13.4.1 The local client-cache-backend . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 13.4.2 Internal processing of conguration synchronizing . . . . . . . . . . . . . . . . . . . . . . . . . . 104 13.4.3 Conguration of cong caching . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104 13.5 Recommended conguration when using the WAN/VPN extension module . . . . . . . . . . . . . . . . 105 13.5.1 Setting the protocol for caching of opsi-products . . . . . . . . . . . . . . . . . . . . . . . . . . 106 13.5.2 Verifying the server certicates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107 14 opsi-server with multiple depots 107

14.1 Concept . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107 14.2 Creating a (slave) depot-servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 14.3 package management with multiple depots . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111 15 Dynamic Depot Assignment 112

15.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112 15.2 Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112 15.3 Conguration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 15.4 Editing the depot properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 15.5 Synchronizing the depots . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115 15.6 Processing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116 15.7 Template of the assignment script . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116 15.8 Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118 16 opsi Software On Demand (Kiosk-Mode) 119

16.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119 16.2 Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119 16.3 conguration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119 16.3.1 Managing product-groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120 16.3.2 congure the module Software-On-Demand . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120 Conguration for the whole system . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 Conguration for a single client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 16.3.3 opsiclientd event-conguration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 16.3.4 Customize to corporate identity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 16.4 Usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 16.5 Specialities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124

opsi manual opsi version 4.0.1 vii

17 opsi extension User Prole Management

124

17.1 Preconditions for the extension . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124 17.2 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125 17.3 Concept . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125 17.4 New and extended opsi-winst functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126 17.5 Examples of userLoginScripts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127 17.6 Conguration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131 17.7 Notication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131 18 opsi data storage (backends) 131

18.1 le backend . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131 18.2 ldap-Backend . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131 18.3 mysql backend . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 18.3.1 mysql backend for inventory data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 18.3.2 mysql backend for conguration data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136 18.3.3 Initializing the MySQL-Backend . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137 18.3.4 Congure the mysql database for access from outside the server . . . . . . . . . . . . . . . . . . 139 18.4 HostControl backend . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139 18.5 Conversion between dierent backends . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139 18.6 Boot les . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140 18.7 Securing the shares with encrypted passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140 19 Adapting the opsi-client-agent to your Corporate Identity (CI) 20 Important les on the depot servers 140 143

20.1 Conguration les in /etc . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143 20.1.1 /etc/hosts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143 20.1.2 /etc/group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143 20.1.3 /etc/opsi/backends/ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143 20.1.4 /etc/opsi/backendManager/ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143 20.1.5 /etc/opsi/hwaudit/* . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144 20.1.6 /etc/opsi/modules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144 20.1.7 /etc/opsi/opsiconfd.conf . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144 20.1.8 /etc/opsi/opsiconfd.pem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144 20.1.9 /etc/opsi/opsipxeconfd.conf . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144 20.1.10 /etc/opsi/opsi-product-updater.conf . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144 20.1.11 /etc/opsi/version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144 20.1.12 /etc/init.d/ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144 20.2 Boot les . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144 20.2.1 Boot les in /tftpboot/linux . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144

opsi manual opsi version 4.0.1 viii

20.2.2 Boot les in /tftpboot/linux/pxelinux.cfg . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145 20.3 Files in /var/lib/opsi . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145 20.3.1 /var/lib/opsi/repository . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145 20.3.2 /var/lib/opsi/depot . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145 20.3.3 /var/lib/opsi/ntfs-images . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145 20.3.4 Other directories . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145 20.4 Files of the le backend . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145 20.4.1 /etc/opsi/pckeys . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145 20.4.2 /etc/opsi/passwd . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145 20.4.3 Overview /var/lib/opsi . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146 20.4.4 Conguration les in detail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146 ./clientgroups.ini . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146 ./cong.ini . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146 ./clients/.ini . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146 /var/lib/opsi/cong/templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147 /var/lib/opsi/cong/depots/ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147 Product control les in /var/lib/opsi/cong/products/ . . . . . . . . . . . . . . . . . . . . . . . 148 20.4.5 Inventory data /var/lib/opsi/audit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150 20.5 Files of the LDAP backend . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150 20.6 opsi programs and libraries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150 20.6.1 Python library . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150 20.6.2 Programs in /usr/bin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150 20.7 opsi log les . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151 20.7.1 /var/log/opsi/bootimage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151 20.7.2 /var/log/opsi/clientconnect . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152 20.7.3 /var/log/opsi/instlog . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152 20.7.4 /var/log/opsi/opsiconfd . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152 20.7.5 /var/log/opsi/opsipxeconfd.log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152 20.7.6 /var/log/opsi/package.log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152 20.7.7 /var/log/opsi/opsi-product-updater.log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152 20.7.8 tftp log in /var/log/syslog . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152 20.7.9 c:\tmp\opsiloginblocker.txt . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152 20.7.10 c:\tmp\opsiclientd.log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152 20.7.11 c:\tmp\instlog.txt . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153 21 Registry Entries 21.1.1 opsi.org/general 153 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153 . . . . . . . . . . . . . . . . . . . . . . . 153

21.1 Registry entries for the opsiclientd . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153 21.1.2 opsi.org/opsi-client-agent and opsi.org/preloginloader

21.1.3 opsi.org/shareinfo . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153 21.2 Registry entries of the opsi-winst . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154 21.2.1 opsi.org/winst . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154 21.2.2 Controlling the logging via syslog protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154

opsi manual opsi version 4.0.1 ix

22 Upgrade of a opsi-server

154

opsi manual opsi version 4.0.1 1 / 154

1

Copyright

The Copyright of this manual holds the uib gmbh in Mainz, Germany. This manual is published under the creative commons license Attribution - ShareAlike (by-sa).

A German description you will nd here: http://creativecommons.org/licenses/by-sa/3.0/de/ The German legally binding license: http://creativecommons.org/licenses/by-sa/3.0/de/legalcode The English description: http://creativecommons.org/licenses/by-sa/3.0/ The English license: http://creativecommons.org/licenses/by-sa/3.0/legalcode The opsi software is in most parts open source. Not open source are only this new parts which are still under cofunding. see: http://uib.de/en/opsi_cofunding/index.html All the rest of the source code is published under the GPLv3:

The legally binding GPLv3 license: http://www.gnu.org/licenses/gpl.html The name opsi is a registered trade mark of the uib gmbh. The opsi-logo is owned by the uib gmbh and may be used only with explicit permission.

22.1

IntroductionWho should read this manual?

This manual is written for all who want to gain a deeper insight into the mechanisms and the tools of the client management system opsi ("open pc server integration"). It presents a complete HOWTO for the use of opsi while emphasizing the understanding of the technical background. The decision maker who decides on using opsi as well as the system administrator who works with it will get a solid foundation for their tasks.

2.2

Notations

Angle brackets < > mark abstract names. In a concrete context any marked must be replaced by some real name. Example: The le share, where opsi places the software packets, may abstractly be noted as . If the real leshare is /opt/pcbin/install, then you have to replace the abstract name by exactly this string. The location of the packet /ooffice becomes /opt/pcbin/install/ooffice. Example snippets from program code or conguration les use a Courier font, with a background color:depoturl=smb://smbhost/sharename/path


3

Overview of opsi

Tools for automated software distribution and operating system installation are important and necessary tools for standardization, maintainability and cost saving of larger PC networks. Normally the application of such tools comes along with substantial royalties, whereas opsi as an open source tool aords explicit economics. Expenses thereby arise only from performed services like consulting, training and maintenance, and perhaps from low Co-funding rates if you like to use some of the non free modules. Although the software itself and the handbooks are free of charge, the process of introducing any software distribution tool is still an investment. To get the benet without throwbacks and without a long learning curve consulting and education of the system administrators by a professional partner is recommended. uib oers all these services around opsi. The opsi system as developed by uib depends on Linux-servers. They are used for remote installation and maintenance of the client OS and the client software packets ("PC-Server-Integration"). It is based as far as possible on free available tools (GNUtools, SAMBA etc.). The complete system all together is named opsi (Open PC-Server-Integration) and with its congurability is a very interesting solution for the administration challenges of a large computer park.

3.1

Experience

opsi is derived from a system, which is in use since the middle of the 90s with more than 2000 Client-PCs in dierent locations of a state authority. Since that time it has continuously been adapted to the changing Microsoft operating system world. As a product opsi is now accessible for a broad range of interested users. You can nd an geographical overview of the registered opsi-installations at: http://www.opsi.org/map/.

3.2

opsi features

The core features of opsi are: automatic software distribution automatic operating system installation hard- and software inventory with history comfortable control via the opsi management interface support of multiple depot-servers

3.3

opsi Extensions

Management of licenses MySQL-Backend Use of hierarchical client groups (Treeview) Dynamical depot server selection Software on Demand Support for clients behind slow connections (WAN Extension)


44.1

opsi conguration and toolsOverview

The conguration of opsi requires some data management. All non-server components are using a web service for data exchange with the opsi server. They exchange data via the opsiconfd, and the opsiconfd forwards the data to the backend manager which passes the data into the selected backend. opsi supports dierent backends: Backends: File based LDAP based MySQL based Using the le backend the data are stored in ini like text les.

Figure 1: Scheme: opsi with le backend Using the mysql or ldap backend the data are stored in specic data objects.


Figure 2: Scheme: opsi with SQL / LDAP backend More details you will nd at


Figure 3: Scheme: backend layers and access control The in opsi 3 used directory /etc/opsi/backendManager.d isnt used in opsi 4 anymore. The conguration les in /etc/opsi/backends dene the backends. Which backend is used for which data, is congured in the le /etc/opsi/backendManager/dispatch.conf. The le /etc/opsi/backendManager/acl.conf denes who has access to which methods. Below the directory /etc/opsi/backendManager/extend.d there could be les which denes extended opsi methods. So you will nd here for example the les which dene the old opsi 3 legacy methods by mapping them to the new opsi 4 methods (/etc/opsi/backendManager/extend.d/20_legacy.conf). A more detailed reference of these conguration les you will nd at


4.2

Tool: opsi-setup

This program is something like the swiss army knife of the opsi conguration. It is used by the opsi installation scripts and can be also called separately for maintanace and repair purpose. The tasks of opsi-setup are: register a opsi-server as depot server correct le access rights initialize data storage backends upgrade backend (from 3.4 to 4.0) setup of the MySQL-backend edit the default congurations cleanup the current backend(s) congure the essential samba shares congure the essential dhcp entries The command opsi-setup --help shows the program options:opsi-setup --help Usage: opsi-setup [options] Options: -h, --help -l

show this help log-level 0..9 path to log file force to this ip address (do not lookup by name) register depot at config server set default rights on opsi files (in [path] only) init current backend configuration update mysql backend update ldap backend update file backend configure mysql backend edit global config defaults cleanup backend patch smb.conf patch dhcpd.conf

--log-file --ip-address --register-depot --set-rights [path] --init-current-config --update-mysql --update-ldap --update-file --configure-mysql --edit-config-defaults --cleanup-backend --auto-configure-samba --auto-configure-dhcpd

The functions and options in detail: --ip-address Sets the ip-address for opsi-server and do not resolve by name. --register-depot This option is used to register a opsi-server as depot server to a other opsi-server (opsi-cong-server). For details see --set-rights [path] Sets the le access rights in all opsi directories: /tftpboot/linux /home/opsiproducts


/var/log/opsi /var/lib/opsi /opt/pcbin/install /etc/opsi You may give a directory name as argument to set only the access rights below this directory. e.g. opsi-setup --set-rights /opt/pcbin/install/winxppro/drivers --init-current-config initialize the congured backend. Should be always called after changing the le /etc/opsi/backendManager/dispatch.conf The three commands: --update-mysql --update-ldap --update-file are used to upgrade the backends from one opsi release to the next one. For details see the releasenotes-upgrade-manual. --configure-mysql does the rst time database setup.

--edit-config-defaults To edit the default values of some conguration data like in the server conguration of the opsi-conged. --edit-config-defaults To edit the default values of some conguration data like in the server conguration of the opsi-conged.

Figure 4: Dialog: opsi-setup --edit-config-defaults e.g.: clientcong.depot.id The name of the default depot server. license-management.use Denes if netboot products should get license keys from license management or from product properties.


product_sort_algorithm Denes the algorithm which is used to calculate the product installation sequence. --cleanup-backend Check the current backend(s) for entries which are not needed anymore and referential integrity --auto-configure-samba Creates the opsi share entries in the /etc/samba/smb.conf conguration le --auto-configure-dhcpd Creates the by opsi needed entries in the `/etc/dhcp3/dhcpd.conf. Dont use this if you not plan to use the dhcpd on the opsi server. More details in the opsi-getting-started manual

4.34.3.1

Tool: Management Interface: opsi-congedRequirements and operation

The opsi-conged requires Java 1.6 and a running opsiconfd on the server. If you are running the opsi-conged on a Linux based machine, so make sure that your Java is the Sun Java Version. The often installed OpenJDK or other versions may lead to subtil errors. So you have to install the Sun Java and congure it as the default Java:update-alternatives config java

The commandjava -version

should lead to the following output:java version "1.6.... Java(TM) SE Runtime Environment ...

Most times the opsi-conged will be called as applet in the browser via: https://:4447/configed The opsi-conged as application is also part of the opsi product opsi-adminutils and may then be started via the windows start menue. At the server the opsi-conged is installed as part of the opsi-server installation. It may be started using the menue entry or with the command /usr/bin/opsi-configed. If you in the correct directory, it also can be started with java -jar configed.jar. The help option java -jar configed.jar --help shows the available command line options.P:\install\opsi-adminutils>java -jar configed.jar --help starting configed default charset is windows-1252 server charset is configured as UTF-8 configed [OPTIONS]... Options: -l, -h, -u, -p, -d,

--locale Set locale (format: _) --host Configuration server to connect to --user Username for authentication --password Password for authentication --logdirectory Directory for the log files --help Show this text


4.3.2

Login

Figure 5: opsi-conged: login mask At login time the opsi-conged tries to connect the opsi server via https. The login is done with the given parameters opsi server[:Port] (default port 4447 opsiconfd) and the User/Password of the opsi-cong-server account. For a successful login the provided user has to be a member of the unix-group opsiadmin. 4.3.3 Copy & Paste, Drag & Drop

You may copy the selected entries from nearly every section of the opsi-conged to the clipboard using the standard key combinations (Strg-Insert, Strg-C ). This may be used to transfer interesting data to other programs. For the most tables you may also use Drag & Drop to copy the data to programs like Excel. Note Since Java version 1.6.24 Oracle has deactivated the Copy & Paste to and from the system clipboard from a not signed Java Applet for security reasons. The opsi conged applet is delivered with signature since version 4.0.1.11, and has now full system access.

4.3.4

Client conguration / server conguration / license management

To switch between the dierent views of the opsi-conged, use the buttons in the upper right corner.

Figure 6: opsi-conged: Buttons for (from left to right): Client conguration, Server conguration, License management


4.3.5

Depot selection

Figure 7: opsi-conged: depot selection 4.3.6 Single client selection and group conguration

After a successful login the main window pops up and shows the tab Client selection. This tab shows a list of known clients from the selected opsi-depot resp. the clients which are selected using the treeview control on the left side of the opsi-conged.

Figure 8: opsi-conged: client selection mask You may select a line of the list not only by manual scrolling and selecting but also by a String search. This requires that you enter a String into the search eld at the top of the list In der Liste kann eine Zeile auch ber die Suche nach einem Stringwert ausgewhlt werden. How the search works is determined by the selected elements in two drop down lists: Via eld selection you decides if all elds (more precisely, all elds that are occuring as columns) are searched (default), or


only one eld (and which one) is searched. Concerning the method of search you have to choose if a hit is dened as occurrence of the search string anywhere in a eld value (partial String search, default), as occurrence of the search string at the beginning of a eld value as a pattern match in a regular expression search where the search string serves as the pattern (for experts, based on the java pattern matching). The enter key leads to the next search hit. More selection functions based on String search are shown in the context menu of the search eld. opsi-conged: Client search Figure 9: opsi-conged: Search function in the client selection list The clients list The clients list has per default the columns client name, description, on, IP address and last seen. client name is the full qualied hostname which is the client name including the domain name description is a free selectable description which you can edit in the right top part of the window On shows after clicking the button Check wich clients are connected the result of this query.

Figure 10: opsi-conged: Button Check which clients are connected IP address shows the IP number to which the opsi server resolves the client name. last seen shows the date and a time of the last client connect to the opsiconfd web service Some columns are deactivated by default: session infos (data as retrieved from the operating system running on the specic client) Inventory No (displaying some optionally entered data) created (date and time of client creation) opsi mac address (hardware address of the client as used by opsi) You may activate these columns using the context menu. The conguration which columns are activated may be changed using the entry conged.host_displayelds in the server conguration.


Figure 11: opsi-conged: change the default for visible columns in the clients list Adding the column session infos enables the button "request session infos from all clients" in the button panel.

Figure 12: opsi-conged: Button Sessioninfo? When this button is clicked the opsiconfd tries to connect to all clients and to retrieve data of the active user sessions. From the result, the account names are shown in the column session infos. Instead of using the button you may start the request only for the selected clients via the context menu or the main menu entry OpsiClient. By this, waiting for the network timeouts is avoided. Since the search function for the client list works (if not congured otherwise) on all displayed columns you may now nd out which is the client belonging to a logged in user (with known account name). To sort the clients by a certain column click on the top header of that column. Selecting clients You can select one or multiple clients to work with. The client view can be restricted to the selected clients by clicking the funnel icon or from the menu by Grouping / Show only selected clients. A selected client group can be saved with the icon Save grouping or from the menu by Grouping / save group with a free selectable name. With the icon Set client group or Grouping / set client group saved groups can be loaded.


Figure 13: opsi-conged: mask: group setting With the function Set client group you can build client groups by certain criteria (e.g.: all clients which have the product refox with the installation status installed). 4.3.7 Client selection and hierarchical groups using the treeview

Since opsi 4.0 it is possible to manage groups and clients using a tree view control on the left side of the opsi-conged. A second enhancement is the possibility of hierarchical groups (groups in groups). This tree view feature is part of a co-funding project and runs only with a valid activation le. A activation costs 500 . For evaluation please contact [email protected]. The tree view control has base node ALL with all groups and clients beyond.. Basic concepts The tree view control has base node ALL with all groups and clients beyond. Ther is a other node Groups which is the bas group for all other self dened groups.

Figure 14: opsi-conged: Treeview with clients and groups There is a additional group REPORTED_FAILURES which contains all clients, which have a action result failed. Every known client is alwas in the group ALL. Add itionally a client may be in one or more other groups. You may build up dierent group trees which represent dierent order critiras like administrative structure, hardware or typical software inventory. If you select a client, all groups where the selected client belog to get colored marked icons.


How to . . . By a click one a node (or a group) all clients beyond this node will be shown in the Clients tab, but none of these clients is selected for processing. By a click one a client, this client will be shown in the Clients tab and selected for processing. You may also use this way to change the selected client while you are in a other tab like product conguration without coming back to the clients tab. You may use Ctrl-click and Shift-click to select multiple clients. This tree view control show the groups which are created according the chapter You may also create groups by using the context menu above ALL or any existing group.

Figure 15: opsi-conged: Using the context menu to create a new subgroup You will be asked for the new groups name.

Figure 16: opsi-conged: Dialog: Group name A group can be populated with clients using Drag&Drop by copying clients from the Clients tab to the group in the tree view (left mouse button) copying clients from the tree view control below the node ALL to group in the tree view (left mouse button) moving clients from a group in the tree view control to a other group in the tree view (left mouse button) copying clients from a group in the tree view control to a other group in the tree view (Ctrl-left mouse button) 4.3.8 Client processing / Client actions

Using the menu OpsiClient or the context menu in the Clients tab you may choose from a lot of client specic operations


Figure 17: opsi-conged: : context menu Clients Tab WakeOnLan (Wake selected clients) Choosing this menu entry, you will send the selected clients a WakeOnLan signal. Fire on_demand event (Push Installation) This menu entry is used to send to the opsi-client-agent on the selected clients a command to re the event on_demand. This event will start the processing of the current set action request immediately. All messages will be shown on the active desktop. If the client isnt reachable, you will get a message. What happens exactly if you re the event on_demand can be congured in the event on_demand conguration. Sending messages (Show popup message) Choosing the menu entry Show popup message you will get a small edit window where you can type in your message.

Figure 18: opsi-conged: opsi message edit mask By clicking on the red tick you will send the message to the selected clients. At the selected clients a message window will appear.


Figure 19: opsi-conged: opsi message display dialog Call external remote control tools for selected clients The option Remote Control Software call in the client context menu as well as the client main menu (since opsi-conged version 4.0.1.11) is very powerful. It can be used to use any command that the operating system oers, parametrized e.g. by the client name. As an example there are congurations automatically generated which can be used to send a ping to the selected client: one ping command that works in Windows environment and one command that requires a Linux X environment. Please observe: opsi-conged calls obviously the command in its environment, i.e., we need the Linux command when the opsi-conged is running in Linux.

Figure 20: opsi-conged: Choice of Remote Control call The selection window has three parts. The upper part lists the names of the existing commands. It follows a line, which shows the selected command and oers the chance to edit it (if this is allowed). Additionally, the line contains the buttons to execute or abandon the action. The third text area of the window captures any messages that are returned by the operating system when calling the command. These calls oer a quasi innite range of opportunities. For example, a command can be congured to open a Remote Desktop connection to the selected client (if it allows such connections). On a Windows system, such a command is cmd.exe /c start mstsc /v:%host% In a Linux environment the following command can be used: rdesktop -a 16 %host% In these examples serves %host% as a variable, which opsi-conged automatically replaces by the value for the selected host. Other variables that can analogously used in the commands are %ipaddress% and %inventorynumber%. If the command is marked by the additional server conguration entry editable as true, then the command line allows ad hoc editing. For example, you may add a requested password or vary the command as needed. If more than one client is selected the command will be executed in a own thread for each client.


The list of remote control commands is editable via server conguration entries (cf. Section 4.3.15). To dene a command example, at minimum an entry configed.remote_control.example (or configed.remote_control.example.command) must be generated. The value of property has to be the command (in which the variables %host%, %ipaddress% etc. can be used). Additionally, an entry configed.remote_control.example.description can be dened. The value of this entry will be shown as tooltip (if not existing, the command itself will serve as tooltip content). Furthermore, a Boolean entry configed.remote_control.example.editable can be added. If its value is set to false the command cannot be edited in the selection window.

Figure 21: opsi-conged: Editing of remote control commands in the server properties editor Shutdown / reboot of selected clients You may send the selected clients a shutdown or reboot signal. You have to conrm this command at the opsi-conged.

Caution If the client received the signal, it will going down with out any more questions.

Delete, create, rename and move clients You may delete the selected clients from the opsi-server. If you choose to create a client, an input mask opens. There you enter or conrm the required data client name without domain specication, domain name, depot server name. You may add a textual description for this client and notes on this client.


Figure 22: opsi-conged: creating a client The mask also contains elds for an optional declaration of the IP-number and the ethernet (MAC) address of a client. If the backend is activated for the conguration of a local dhcp-server (which is not the default setting), this information will be used to make the new client known to the dhcp-server. Otherwise the MAC address will be saved in the backend and the IP-number will be discarded. You may rename a selected client, you will be asked for the new name. Moving a client to a dierent depot-server. If clicked the following windows appears with a list of existing depot-servers

Figure 23: opsi-conged: change the depot of a client 4.3.9 Product conguration

Switching to the tab Product conguration you get a list of available software packets with its installation status and action status for the selected clients.


Figure 24: opsi-conged: product conguration mask If there is a dierent status for the selected clients this will be marked grey (undened). The list of the selected clients is shown at right on top. You can also sort the product list by clicking at the column header. This are the columns: Status is the last announced state of the product and can hold the values installed, not_installed, unknown. The table shows an empty cell if the value is not_installed to improve the usability of the view. The cell becomes grey if a multitude of selected clients is selected and does not share a common value (grey coloring represents the pseudo value mixed). Report informs about the progress or the result of the last action using the pattern (). During an installation process there may be indicated installing, afterward e. g. failed(setup) or success (uninstall). The column Requested action holds the information which action is to be executed. Possible values are none (shown by an empty cell) and the action types for which scripts are dened in the product package (possible values are setup, uninstall, update, once, always, custom). The eld Version displays the software version number combined with the opsi package number of the software package installed on the client. There are two more columns which can be activated via the context menu: Priority class displays a priority value that is assigned to the product (highest priority +100, lowest priority -100). It inuences the product order when products are installed (by virtue of the product_sort_algorithm) The position column displays the product ordering forecast for installation sequences. Choose a software product to get more product information in the right part of the window like: Complete product name: full product name of that software package.


Software/package version: software version-version of the opsi package of the software package (specied in the opsi installation package). Product description: free text to describe the software. Hints: free text with advices and caveats for handling the package. Requirements: A list of other products which the selected product (say A) depends on combined with the type of dependency: required means that A requires the other product (B), but it doesnt matter whether B is installed before or after A. pre-required means B has to be installed before A. post-required means B needs to be installed A. on deinstall means this action should take place if A be de-installed. Conguration for client: It is possible to dene additional properties for a product. Their values can be evaluated in a setup script to congure the product per client. Because of the intrinsic complexity of a property denition there is a specic GUI element for displaying and editing the table of properties: 4.3.10 Property tables with list editor windows

A property table is a two-column table. In each row, the rst column contains a property name, the second column displays the assigned property value(s). It may be congured that a tool tip is displayed showing some information on the meaning of the property and the default value.

Figure 25: opsi-conged: property table with tooltip If you click at a value a window pops up: the list editor for this property. It shows a value resp. a list of precongured values with the current value as selected.

Figure 26: opsi-conged: list editor, selection list Clicking a new value changes the selection. If the property value list is editable (new values may be added to the existing list resp. existing values changed) the window comes up with an edit eld for the new or modied values.


Figure 27: opsi-conged: list editor, edit eld The most comfortable way to get a new value that is a variant of an existing one is double clicking the existing value in the list. This copies it into the edit eld where it can be modied. As soon as the edit eld contains a new value not yet occuring in the value list the plus button is activated by which the new value can be added to the list of values. If multiple values are allowed as it should be e.g. for the property additional drivers a value may be added to the set of selected values by Strg-Click . The very same action removes the value from the set. The minus button (since opsi-conged version 4.0.2) clears the selection completely. When the list has been edited the green check mark turns to red as usual in the opsi-conged. Clicking it takes the new selection as new property value (and nishes editing). Clicking the blue cancel button stops editing and resets the original value. 4.3.11 Netboot products

The products on tab Netboot products are mainly used to install the client OS (operating system) and are listed and congured like the products on tab Product conguration. If for the selected client(s) a netboot product is set to setup, the correspondent bootimage will be loaded and executed at the next client reboot.

Figure 28: opsi-conged: mask to start the bootimage This is usually done to initiate an OS installation or any other bootimage task (like a memory test etc.)


4.3.12

Hardware information

With this tab you get the last detected hardware information for this client (only available if a single client is selected).

Figure 29: opsi-conged: Hardware informations for the selected client 4.3.13 Software inventory

With this tab you get the last known software information for this client (only available if a single client is selected).

Figure 30: opsi-conged: Software information for the selected client


4.3.14

Logles: Logs from client and server

The client specic log les are stored on the server and visible with the opsi-conged via the Tab log les. Its also possible to search in the log le (to continue the search press F3 or n).

Figure 31: opsi-conged: Display of the log le in the opsi-conged 4.3.15 Host parameters at client and server conguration

There are many conguration options for the opsi server and the opsi clients that may be set or changed via the tab Host parameters. Theryby, server defaults are set in the mode server conguration, client specic values in the mode client conguration plus manual selection of the Host parameters tab (see also Section 4.3.4). On principle, these conguration entries (cong objects of the opsi-server) are conceived as lists of values. Therefore they are edited via the list editor tool (cf. Section 4.3.10). Depending on the specic denition of a conguration object the values of a list can be of type text (Unicode) or of type Boolean (i.e. true/false); the list may have only one element or may be a true list with several members; the set of values from which list elements are selected may be xed or extendible. New conguration entries of types unicode (extendible) and boolean (xed) may be created via the context menu. It oers also the option to remove existing entries. The relationship of server and client entries is complicated. Server entries hold the defaults for client entries. When a server entry (a cong object) is deleted the depending client entries (cong states) vanish as well. Creation of a client entry via opsi-conged entails the automatic creation of an adequate server default.


Deletion of a client entry via opsi-conged removes only the client specic value (if existing) but leaves the server default (which will be valid for the client). In the moment the opsi-conged does not indicate if a specic client value exists or if the server default is used for the client. There are congurations objects for which client values may be created and edited but only the server objects are used (e.g. the entries for the opsi-conged, starting with conged.).

Figure 32: opsi-conged: Tab Host parameters (Server- and Client conguration) 4.3.16 Depot conguration

In the mode Properties of depots you will see the tab Depots. There is a drop down menu to select the depot. After selecting the depot you may change the properties of the opsi-depot. see also:


Figure 33: opsi-conged: Tab Depot conguration

4.4

Tool: opsi-package-manager: (de-)installs opsi-packages

The opsi-package-manager is used for (de-)installing opsi-product-packages on an opsi-server. In order to install a opsi-product-package, this opsi-product-package must be readable for the opsi system user opsiconfd. Therefore it is strongly recommended to install those packages from the directory /home/opsiproducts (or a sub directory). The log le of the opsi-package-managers you will nd at /var/log/opsi/package.log. Install a package (asking no questions):opsi-package-manager -i softprod_1.0-5.opsi

Install a package (asking questions):opsi-package-manager -p ask -i softprod_1.0-5.opsi

Install a package (and switch required action to setup where installed):opsi-package-manager -S -i softprod_1.0-5.opsi

Deinstall a package (asking no questions):opsi-package-manager -r softprod

Extract and rename a package:opsi-package-manager -x opsi-template_.opsi --new-product-id myprod


Calling opsi-package-manager with option --help gives a listing of possible options. Please note: The option -d or --depots are reserved for the use in a multi-depot-server environment. Using option -d the opsi-package will be copied to the /var/lib/opsi/repository directory of the target server before installing. Please make sure that there is enough free space on this le system. see also:#opsi-package-manager --help usage: opsi-package-manager [options] Manage opsi packages Commands: -i, --install -u, --upload -l, --list -D, --differences -r, --remove -x, --extract -V, --version -h, --help Options: -v, --verbose -q, --quiet --log-file -d, --depots -p, --properties

... ... ... ...

install opsi packages upload opsi packages to repositories list opsi packages matching regex show depot differences of opsi packages matching regex uninstall opsi packages extract opsi packages to local directory show programs version info and exit show this help message and exit

--purge-client-properties -f, --force -U, --update -S, --setup -o, --overwrite -k, --keep-files -t, --temp-dir --max-transfers --max-bandwidth --new-product-id

increase verbosity (can be used multiple times) do not display any messages path to debug log file comma separated list of depot ids to process all = all known depots mode for default product property values ask = display dialog package = use defaults from package keep = keep depot defaults (default) remove product property states of the installed product(s) force install/uninstall (use with extreme caution) set action "update" on hosts where installation status is "installed" set action "setup" on hosts where installation status is "installed" overwrite existing package on upload even if size matches do not delete client data dir on uninstall tempory directory for package install maximum number of simultaneous uploads 0 = unlimited (default) maximum transfer rate for each transfer (in kilobytes per second) 0 = unlimited (default) set a new product id when extracting opsi package

4.5

Tool: opsi-product-updater

The command line utility opsi-product-updater is designed to download and install comfortable opsi packages from a repository or a other opsi server. Using the opsi-product-updater make it easy to keep the opsi server up to date. It may be also used in a cronjob to keep depot server in sync with the cong server.# opsi-product-updater --help Usage: opsi-product-updater [options] Options: -h Show this help text -v Increase verbosity (can be used multiple times) -V Show version information and exit -c Location of config file


The main features are: congurable repositories congurable actions All conguration will be done at the conguration le /etc/opsi/opsi-product-updater.conf. 4.5.1 congurable repositories

Repositories are the sources which will be used by the opsi-product-update to fetch new opsi packages There are two kinds of repostories: Internet Repositories Example: download.uib.de This are repositories which are congured by: baseURL (z.B. http://download.uib.de) dirs ( A list of directories e.g.. opsi4.0/produkte/essential) and if needed username and password for password protected repositories (e.g. for the opsi patch management subscriptions) You may also congure a proxy here. opsi-server This is (using a opsi-depot-server) the central opsi-cong-server will be used to fetch the opsi-packages. The central conguration item is here: opsiDepotId This in most cases on a a opsi-depot-server the central opsi-cong-server. So on any call of the opsi-product-updater the opsi-product-packages wil be fechted from the opsi-cong-server. This can be done for example by a cronjob. 4.5.2 congurable actions

For each repository you have to congure which actions to run: autoupdate: Newer versions of installed packages will be downloaded and installed autoinstall: Also packages which are not installed yet, will be downloaded and installed autoinstall: For all new installed packages and all clients on which these pacakages are installed the action request will be set to setup. In addition it is possible to send all these clients a Wake-On-LAN signal to install the new software to the clients. Using the opsi-product shutdownwanted you can make shure that the clients will be powered o after the installation. time window for autosetup: You can give time window which may be used to that client action requests to setup. Automatic WakeOnLan with shutdown: If there is new software Clients could be waked up and shutdown after installation automatically


4.64.6.1

Tools: opsi-admin / opsi cong interfaceOverview

opsi V3 introduced an opsi owned python library which provides an API for opsi conguration. The opsiconfd provides this API as a web service, whereas opsi-admin is the command line interface for this API. Calling https://:4447/interface in your browser gives you agraphical interface to the opsi web service. You have to login as a member of the unix group opsiadmin.

Figure 34: opsi cong interface: Access to the web service via browser At the command line opsi-admin provides an interface to the opsi-API. There is a interactive mode and a non interactive mode for batch processing from within scripts. The help option opsi-admin --help shows a list of available command line options:# opsi-admin --help Usage: opsi-admin [options] [command] [args...] Options: -h, --help Display this text -V, --version Display this text -u, --username Username (default: current user)


-p, --password -a, --address -d, --direct --no-depot -l, --loglevel

-f, -i, -c, -S, -s,

--log-file --interactive --colorize --simple-output --shell-output

Password (default: prompt for password) URL of opsiconfd (default: https://localhost:4447/rpc) Do not use opsiconfd Do not use depotserver backend Set log level (default: 3) 0=nothing, 1=essential, 2=critical, 3=error, 4=warning 5=notice, 6=info, 7=debug, 8=debug2, 9=confidential Path to log file Start in interactive mode Colorize output Simple output (only for scalars, lists) Shell output

opsi-admin can use the opsi web service or directly operate on the data backend. To work with the web service you have to provide the URL and also an username and password. Due to security reasons you probably wouldnt like to do this from within a script. In that case youd prefer direct access to the data base using the -d option: opsi-admin -d. In interactive mode (start with opsi-admin -d or opsi-admin -d -i -c or short opsi-admin -dic) you get input support with the TAB-key. After some input, with the TAB-button you get a list or details of the data type of the next expected input. The option -s or -S generates an output format which can be easily parsed by scripts. There are some methods which are directly based on API-requests, and there are some tasks, which are a collection of function calls to do a more complex special job. 4.6.2 Typical use cases

Set a product to setup for all clients which have this product installedopsi-admin -d task setupWhereInstalled "softprod"

List of all clientsopsi-admin -d method host_getIdents

Client deleteopsi-admin -d method host_delete

e.g..:opsi-admin -d method host_delete "pxevm.uib.local"

Client createopsi-admin -d method host_createOpsiClient

e.g.:opsi-admin -d method host_createOpsiClient "pxevm.uib.local"


Set action requestopsi-admin -d method setProductActionRequest

e.g.:opsi-admin -d method setProductActionRequest win7 pxevm setup

Attach client descriptionopsi-admin -d method setHostDescription "dpvm02.uib.local" , "Client unter VMware"

set pcpatch passwordopsi-admin -d task setPcpatchPassword

Set the password of user pcpatch for Unix, samba and opsi. 4.6.3 Web service / API methods

Methods since opsi 4.0 In opsi 4 the data structure of all backends and the web service methods are completely new designed. The new design is object / database oriented. A Object has some properties. As a example let us have a look at the object product. A object of the type product which describes the product javavm may look like this:"ident": "javavm;1.6.0.20;2" "id": "javavm" "description": "Java1.6" "changelog": "" "advice": "" "userLoginScript": "" "name": "SunJavaRuntimeEnvironment" "priority": 0 "packageVersion": "2" "productVersion": "1.6.0.20" "windowsSoftwareIds": None "productClassIds": None "type": "LocalbootProduct" "licenseRequired": False "setupScript": "javavm.ins" "updateScript": "" "uninstallScript": "deljvm.ins" "alwaysScript": "" "onceScript": "" "customScript": ""

Every object has a set of operators which an be used to work with this obect. Most time these operators are: getObjects (returns the objects) getHashes (Variant, which delivers for performance reasons the backend objects readonly. For a large count of objects this method is much faster then calling getObjects) create (create one object comfortable) createObjects (create one or more objects)


delete (delete one object) deleteObjects (delete one or more objects) getIdents (returns the object ids) insertObject (create a new object) updateObject (update a object, if the object doesnt exists it will be created) updateObjects (update a bundle of objects) The method names are concatenated: _ According to this naming rule, these new methods are easily to dierence from the old legacy opsi 3 methods, which almost start with get, set or create. The getObjects methods have two optional parameters: attributes lter The attributes parameter is used query only for some properties of an object. If you are using attributes the returned object has all attribute keys, but only values the attribute you asked for and for all attributes which are used to identify this object. All other attributes have the value none. For Example you will get by calling the method product_getObjects with attributes:["name"] for the product javavm:"onceScript": None, "ident": "javavm;1.6.0.20;2", "windowsSoftwareIds": None, "description": None, "setupScript": None, "changelog": None, "customScript": None, "advice": None, "uninstallScript": None, "userLoginScript": None, "name": "Sun Java Runtime Environment", "priority": None, "packageVersion": "2", "productVersion": "1.6.0.20", "updateScript": None, "productClassIds": None, "alwaysScript": None, "type": "LocalbootProduct", "id": "javavm", "licenseRequired": None

If you like to not ask for attributes but want to use the second parameter lter you have to give as attribute parameter []. The parameter lter is used to dene which objects you want to get. For example if you are using the lter { "id":"javavm" } on the method product_getObjects you will get only the object(s) which describe the product javavm. If you are using methods which expecting one ore more objects, these objects have to be given as JSON objects or as array of JSON objects. The most important objects are: auditHardwareOnHost (client specic hardware information) auditHardware (client independent hardware information)


auditSoftwareOnClient (client specic software information) auditSoftware (client independent software information) auditSoftwareToLicensePool (license management) congState (administration of client host parameters) cong (administration of host parameter defaults) group (group administration) host (server and clients) licenseContract (license management) licenseOnClient (license management) licensePool (license management) objectToGroup (group administration) productDependency (product dependencies) productOnClient (client specic information to a product e.g. installation state) productOnDepot (depot specic information to a product) productPropertyState (depot or client specic product property settings) productProperty (denition of product properties) product (product meta data) softwareLicenseToLicensePool (license management) softwareLicense (license management) In addition to the described objects and methods there are some more for special operations. This design: is created for fast transmitting information about a lot of clients lter data by a unied syntax allows to check all input for correct synatx According to these facts we get a increased stability and performance. opsi3-Methoden These methods are still available as legacy methods, which means that calls to these methods are mapped to the new methods internally. Here comes a short list of some methods with a short description. This is meant mainly for orientation and not as a complete reference. The short description does not necessarily provide all information you need to use this method.method addHardwareInformation hostId, info

Adds hardware information for the computer . The hash is passed. Existing information will be overwritten for matching keys. Applicable for special keys only.method authenticated


Prove whether the authentication on the server was successful.method checkForErrors

Test the backend for consistency (only available for le backend by now).method createClient clientName, domain, description=None, notes=None

Creates a new client.method createGroup groupId, members = [], description = ""

Creates a group of clients (as used by the opsi-Conged).method createLicenseKey productId, licenseKey

Assigns an (additional) license key to the product .method createLocalBootProduct productId, name, productVersion, packageVersion, licenseRequired=0, setupScript="", \ uninstallScript="", updateScript="", alwaysScript="", onceScript="", priority=10, description="", advice="", \ productClassNames=(localBoot)

Creates a new localBoot product (opsi-winst product).method createNetBootProduct productId, name, productVersion, packageVersion, licenseRequired=0, setupScript="", \ uninstallScript="", updateScript="", alwaysScript="", onceScript="", priority=10, description="", advice="", \ productClassNames=(netboot)

Creates a new netBoot (boot image) product.method createOpsiBase

For internal use with the LDAP-backend only.method createProduct productType, productId, name, productVersion, packageVersion, licenseRequired=0,setupScript="", \ uninstallScript="", updateScript="", alwaysScript="", onceScript="", priority=10, description="", advice="", \ productClassNames=""

Creates a new product.method createProductDependency productId, action, requiredProductId="", requiredProductClassId="", requiredAction="", \ requiredInstallationStatus="", requirementType=""

Creates product dependencies.method createProductPropertyDefinition productId, name, description=None, defaultValue=None, possibleValues=[]

Creates product properties.method createServer serverName, domain, description=None

Creates a new server in the LDAP-backend.method createServerProduct productId, name, productVersion, packageVersion, licenseRequired=0,setupScript="", \ uninstallScript="", updateScript="", alwaysScript="", onceScript="", priority=10, description="", advice="", \ productClassNames=(server)

Not implemented yet for future use.method deleteClient clientId

Deletes a client.


method deleteGeneralConfig objectId

Deletes a client conguration or domain conguration.method deleteGroup groupId

Deletes a client group.method deleteHardwareInformation hostId

Deletes all hardware information for the computer .method deleteLicenseKey productId, licenseKey

Deletes a license key for product .method deleteNetworkConfig objectId

Deletes network conguration (for example depot share entry) for a client or domain.method deleteOpsiHostKey hostId

Deletes a pckey from the pckey data base.method deleteProduct productId

Deletes a product from the data base.method deleteProductDependency productId, action, requiredProductId="", requiredProductClassId="", requirementType=""

Deletes product dependencies.method deleteProductProperties productId *objectId

Deletes all properties of a product.method deleteProductProperty productId property *objectId

Deletes a single product property.method deleteProductPropertyDefinition productId, name method deleteProductPropertyDefinitions productId

Deletes a single property or all properties from the product .method deleteServer serverId

Deletes a server congurationmethod exit

Quit the opsi-admin.method getBackendInfos_listOfHashes

Supplies information about the available backends of the opsi depot server and which of them are activated.method getBootimages_list

Supplies the list of the available boot images.


method getClientIds_list serverId = None, groupId = None, productId = None, installationStatus = None, actionRequest = \ None

Supplies a list of clients which meet the assigned criteria.method getClients_listOfHashes serverId = None, groupId = None, productId = None, installationStatus = None, \ actionRequest = No

Supplies an extended list of clients which meet the assigned criteria (with description, notes and last seen for each client).method getDefaultNetBootProductId clientId

Supplies the netboot product (for example: system software) which will be installed when the boot image install is assigned.method getDomain hostId

Supplies the computer domain.method getGeneralConfig_hash objectId

Supplies the general conguration of a client or a domain.method getGroupIds_list

Supplies the list of saved client groups.opsi-admin -d -S method auditHardwareOnHost_getObjects [] {"hostId":":4447/info you will get a graphical chart of opsiconfd load and cpu/memory usage in the last hour/day/month/year. This information is completed by tabulary information to the actual tasks and sessions.


Figure 35: opsiconfd info: opsiconfd values from the last hour

Figure 36: opsiconfd info: opsiconfd values from the last day


5

Activation of non free modules

Even opsi is open source, there are some components which are not free at the moment. At this time (May 2011) the following components of opsi are not free: license management the MySQL backend for conguration data the support for hierarchical client groups WAN/VPN extension high availability and load balancing (not implemented yet) Software on Demand These components are developed in a co-funding project which means that until the complete development costs are payed by co-funders, they are only allowed to use by the co-funders or for evaluation purposes. If we have earned the development cost we will give these modules for everybody for free. To control the use of these components until they are free there is a activation le /etc/opsi/modules, which is protected against changes via electronic signature. If this activation le doesnt exist, only the free parts of opsi will work. If you need for evaluation a temporary valid activation le please contact [email protected]. If you become a co-funder, you will get a unlimited activation le. Copy this le as root to /etc/opsi/modules. If this is done, execute:opsi-setup --set-rights /etc/opsi

You may check your activation state with one of the following methods: Using the opsi-conged choose the menu entry Help/opsi-Module which shows a window with the activation state.

Figure 37: Display of activation state in opsi-conged At the command line you may use the command opsi-admin with the method backend_info. (Remark: Never give your activation le or the output of this command to third people without deleting the signature).opsi-admin -d method backend_info { "opsiVersion" : "3.99.0.0", "modules" : {


"customer" : "uib GmbH", "vista" : true, "vpn" : true, "license_management" : true, "expires" : "never", "valid" : true, "multiplex" : true, "signature" : "DIES-IST-KEINE-ECHTE-SIGNATUR", "treeview" : true, "mysql_backend" : true } }

66.1

opsi-client-agentOverview

To make Software distribution manageable for the system administrator, a client computer has to notice that new software-packets or updates are available and install them without user interaction. It is important to make userinteraction completely obsolete as the installation can run unattended this way and a user cannot stop the installation during the installation process. These requirements are implemented in opsi by the opsi-client-agent: On the client side the service opsiclientd examines usually at boot time, before the user logs in, whether an update has to be installed for this client. If there are software packets to be installed on the client, the script processing program opsi-winst is being started to do the installation job. The server provides all the installation scripts and software les on a le share. At this time the user has no chance to interfere with the installation process. As an additional option the module loginblocker can be installed to prevent a user login before the end of the installation process is reached. Before any software can be installed with the opsi-winst program, it has to be prepared as opsi-product-package. For details see Chapter Integration of new software packets into the opsi software deployment from the getting started manual.

6.2

Directories of the opsi-client-agent

The opsi-client-agent is installed at %ProgramFiles%\opsi.org\opsi-client-agent. This directory contains all programs of the opsi-client-agent like e.g. the opsiclientd, the opsiclientd notier, the opsi-winst and some required libraries. Also we will nd here the conguration les and graphical templates (

Opsi Manual Stable En

Documents

Transcript of Opsi Manual Stable En