10 KiB
NoMachine - Administration
NOTE: All nx.psi.ch related administration and debugging instructions are located at https://gitea.psi.ch/nomachine
Good to Know
- All nx related central servers are within this hiera class: https://gitea.psi.ch/puppet/data-lx
- /etc/NX/nxserver and /usr/NX/bin/nxserver is the same (one should be link to another). The standard place is /usr/NX/bin/nxserver.
Useful Commands
Status of the nx processes:
/etc/NX/nxserver --status
Manually restart nxserver (without systemd):
/etc/NX/nxserver --restart
Enable and disabling debugging on certain processes:
# Get debug level of the different processes
/etc/NX/nxserver --debug
NX> 900 Debug mode for server is: disabled
NX> 900 Debug mode for node is: disabled
NX> 500 ERROR: Cannot retrieve debug mode for: webplayer.
NX> 500 ERROR: Key WebSessionLogLevel does not exist in /usr/NX/etc/server.cfg.
NX> 900 Debug mode for agent is: disabled
# enable debug mode
/etc/NX/nxserver --debug --enable daemon
/etc/NX/nxserver --debug --enable server
/etc/NX/nxserver --debug --enable node
# disable debug mode
/etc/NX/nxserver --debug --disable daemon
/etc/NX/nxserver --debug --disable server
/etc/NX/nxserver --debug --disable node
Manually rotate logs (e.g. to send the logs to nomachine):
/etc/NX/nxserver --logrotate
Show disconnected sessions:
nxserver --history | grep Disconnected
References
NoMachine8 Installation and Configuration Guide Enterprise Desktop: https://kb.nomachine.com/DT07S00246
Useful Commands (nx.psi.ch)
The nxserver logs are located in:
tail -f /usr/NX/var/log/nxserver.log
Show status of nxserver
systemctl status nxserver
Restart nxserver
nxserver --restart
# or (if you want to be on the safe side)
systemctl start nxserver
List all license states on nx.psi.ch:
nxserver --subscriptionlist --all
Show all configured nodes:
nxserver --nodelist --extended
Get detailed info about a specific node
nxserver --nodeinfo 67301fd0-fc51-4ca0-a512-53916da8fab7
# or
nxserver --nodeinfo pc10603.psi.ch:4000
Get access rules:
# all rules
nxserver --rulelist
# rules for a specific user
### IMPORTANT ### If access for a user is granted through some group, the nxserver command will not show this !!!!
nxserver --rulelist --user ebner
# or
nxserver --rulelist | grep ebner
# rules for a group
nxserver --rulelist --group unx-MXgroup
Get all users:
nxserver --userlist
List all active sessions:
nxserver --list
# List all active session of that user
nxserver --list <user>
Send announcement (works only on proxy - not yet verified):
nxserver --broadcast "BLA\nBLA"
Send message to an individual session (not yet verified):
nxserver --message ID "message\nnew line"
Update node name:
nxserver --nodeedit pc14742.psi.ch --node-name pc14742.psi.ch
Push configuration changes to the other node (nx.psi.ch)
nxserver --clusterupdate
# this tells you that you need a cluster-restart to apply the changes to both nodes - usually Dima does not restart
Session list on nx-proxy
[root@nx-proxy-1 ~]# nxserver --list | wc -l
128
Unique user sessions:
[root@nx-proxy-1 ~]# nxserver --list | awk '{print $2}' | sort | uniq | wc -l
94
Installation
Linux
Packages
The NoMachine Linux RPMs are located in the following repository: https://repos.psi.ch/rhel8/latest/nxserver/
THERE IS A .htaccess file in there that restricts the access to this repo to only the listed nodes !!!! (also see: https://gitea.psi.ch/nomachine/nomachine_licenses)
NoMachine only releases RPM for current version (older ones are removed!).
Packages in this repository are manually downloaded from the NoMachine.com webside and the yum repository is manually created via the createrepo . command.
When downloading the packages make sure to check the MD5 sum!
Installation
To deploy NoMachine on a machine following Hiera settings need to be applied.
Enable nomachine:
base::enable_nomachine: true
Set version and profile (profile is the name of the nomachine product that should be used on that machine):
nomachine::version: '8.4.2-1'
nomachine::profile: 'enterprise-terminal-server-cluster'
Specify the license:
nomachine::license::<hostname>:
# an old way to specify the license wasL
nomachine::license::server::<hostname>:
nomachine::license::node::<hostname>:
The <hostname> is the simple hostname without the domain name psi.ch.
The effective license String is the encrypted, assigned license for that particular machine. More details about the license management can be found here: https://gitea.psi.ch/nomachine/nomachine_licenses
Example:
nomachine::license::lx-nx-dmz-01: >
ENC[PKCS7 MIIEvQYJKoZIhvcNAQcDoIIErjCCBKoCAQAxggEhMIIBHQIBAD
AFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAJdz2nVg63VHY97d4+8ai8EQnjB
If more people should be able to login via NX than that can login via ssh following parameter needs to be specified:
aaa::nx_users: []
There are two more dictionary variables to modify/adapt the server/node configuration of a machine. This can be done by nomachine::params::server and nomachine::params::node. The exact keys supported within the dict need to be checked here: https://gitea.psi.ch/puppet/puppet/-/blob/preprod/code/modules/profile/manifests/nomachine/config.pp
nomachine::params::server:
ConnectionsLimit: 500
VirtualDesktopsLimit: 500
ConnectionsUserLimit: '2'
VirtualDesktopsUserLimit: '2'
EnableNXKerberosForwardingToRemote: '1'
SystemLogFile: '/usr/NX/var/log/nxserver.log'
nomachine::params::node:
SystemLogFile: '/usr/NX/var/log/nxserver.log'
To enable direct connections for a node define (to disable set 0):
nomachine::params::server:
EnableDirectConnections: 1
Windows
Installation
To install NoMachine on a Windows one need to assign a License to the Windows machine (see: https://gitea.psi.ch/nomachine/nomachine_licenses#windows)
Afterwards trigger the Install NX Desktop job within Baramundi.
As this will trigger/require a reboot this job has to be manually acknowledged on the Windows PC.
Debugging
Remote Shell
From the administration machine winadmin.psi.ch one can connect to all Windows nodes with NoMachine installed via remote Shell. For this, open a powershell and issue the following commands:
Note, the nxserver is not in the PATH by default. Therefore it is necessary to switch into the folder cd c: \Program Files (x86) \NoMachine\bin first.
nx.psi.ch
All administration tasks are more or less automated in: https://gitea.psi.ch/nomachine/nomachine_ansible. Please refer to the documentation there to add/remove rules/nodes, etc.
SSH access to nx.psi.ch is only possible via mgt-gw.psi.ch
Following things are good to know regarding nx.psi.ch:
- If a node gets reinstalled it needs to be removed / re-added to nx.psi.ch
- If there is no rule for a node everybody that can login on that node can access this node! (therefore each node needs a no access default rule)
- Get members of a group:
getent group svc-nx | sed -e 's/^svc-nx:\*:35341://g' | tr ',' '\n' | sort - A node that is attached to a Cloud Server instance cannot be connected to another Cloud Server instance
- Whether a node can be connected directly (regardless whether it is attached to a Cloud/Terminal Server instance ) depends on the nodes configuration
- There is a notification mechanism inside NX Cloud Server (e.g. to inform users about upcoming downtimes)
nomachine-proxy
Troubleshooting
If a node is marked as unreachable try to use --nodeedit to bring it back again:
[root@nx-proxy-1 ~]# nxserver --nodelist --extended
NX> 167 Node list:
Node name Node Protocol Status Load-B Manual-S Weight Limit
--------- --------------------- -------- ----------- ------ -------- ------ -----
nx-node-3 nx-node-3.psi.ch:4000 NX unreachable yes no 300
nx-node-2 nx-node-2.psi.ch:4000 NX running yes no 300
nx-node-1 nx-node-1.psi.ch:4000 NX running yes no 300
nx-node-4 nx-node-4.psi.ch:4000 NX running yes no 300
[root@nx-proxy-1 ~]# nxserver --nodeedit nx-node-3.psi.ch
NX> 177 Modifying node: nx-node-3.psi.ch:4000
NX> 176 With connection type: encrypted
NX> 811 Nodeedit process finished.
NX> 190 Connected to NX Node.
NX> 188 Updating node: nx-node-3.psi.ch with port: 4000
NX> 192 With protocol: NX
NX> 176 With connection type: encrypted
NX> 175 With load balancing: yes
NX> 195 With manual selection: no
NX> 174 With type: NX
NX> 178 With distribution: Red Hat Enterprise Linux Server release 7.9 (Maipo)
NX> 179 With operation system: Linux
NX> 180 With product: NoMachine Enterprise Terminal Server Node - Version 8.4.2
NX> 181 With cpu: 8
NX> 182 With hardware: VMware Inc. VMware Virtual Platform
NX> 187 Session types available on node: shadow,unix-xsession-default
NX> 186 Services denied on node: audio,microphone
NX> 193 Node platform: linux
[root@nx-proxy-1 ~]# nxserver --nodelist --extended
NX> 167 Node list:
Node name Node Protocol Status Load-B Manual-S Weight Limit
--------- --------------------- -------- ------- ------ -------- ------ -----
nx-node-3 nx-node-3.psi.ch:4000 NX running yes no 300
nx-node-2 nx-node-2.psi.ch:4000 NX running yes no 300
nx-node-1 nx-node-1.psi.ch:4000 NX running yes no 300
nx-node-4 nx-node-4.psi.ch:4000 NX running yes no 300
[root@nx-proxy-1 ~]#
Desktop
Troubleshooting
Show local sessions:
/usr/NX/bin/nxserver --list
NX> 127 Available sessions:
Display Username Remote IP Session ID Node
------- -------- --------- -------------------------------- --------------
1001 ebner 127.0.0.1 769FC24C051F441941FD0BC251322397 localhost:4000
Testing
To be able to test the nomachine-enterprise-desktop package the system need to have the "Server with GUI" package group installed.
dnf groupinstall "Server with GUI"