Here’s how to enable SSH for the Horizon vApps.

Background:

I should note, SSH is actually already enabled but root login via SSH is not. So technically we are not enabling SSH but rather just enabling root login via SSH.

How to enable SSH root login on the Horizon Workspace Virtual Appliances:

1. There’s no way around it – you need to login to a Windows system to launch either the vSphere Infrastructure Client (VIC) or the vSphere Web Client in order to open the virtual console of each of the virtual appliances within the Horizon Workspace vApp.
2. Select LOGIN from the console Window and authenticate with the user “root” and the password you setup when installing the Horizon Workspace vApp.
3. Once logged in, we need to edit the SSHD_CONFIG file. Type in the below command to edit the file with VI.

vi /etc/ssh/sshd_config

4. The above command will open the SSHD_CONFIG file within VI and allow you to edit. To enable “Insert Mode” editing within VI, press “I“.
5. Scroll down to Line 41 (down arrow). This should be the PermitRootLogin no line.
6. Change PermitRootLogin no to PermitRootLogin yes



7. Press the “ESC” key to exit the “Insert Mode” editing.
8. Press “:” (colon) then “x” to save then exit.
9. You now need to restart SSH in order for changes to take affect. Type the below command to restart SSH.

/etc/rc.d/sshd restart

Conclusion and Recommendations:

You now have SSH and SCP enabled for the virtual appliance! Don’t forget to do this to the other virtual appliances within the Horizon Workspace vApp. It may also be wise to reverse these settings when done using SSH and SCP on the virtual appliances as well as ensuring strong passwords and security settings. To undo the above procedure, just change PermitRootLogin yes back to PermitRootLogin no and restart SSH.

Both the Horizon Workspace Installation Guide and the Horizon Workspace Reviewers Guide provide great checklists for walking through the prerequisites. Here are the items needed for installation and configuration of Horizon Workspace 1.0:

• Active Directory – Horizon Workspace currently requires at least Windows 2003 Active Directory infrastructure or higher.
• Static IP Addresses – Each of the 5 virtual appliances within the Horizon Workspace 1.0 vApp require an IPV4 static IP address.
• DNS – Per the Horizon Workspace Installation Guide, all of the virtual appliances refer to each other by their hostnames. As a result, each IP address must map to a hostname which you can search for from each system. This means both A Records and PTR Records are required.
• SMTP Server – In order to properly install the Horizon Workspace 1.0 vApp, there must be a valid SMTP service available for reference during installation. This is required for Horizon Workspace to be able to send messages and alerts. It should be noted, the Horizon Workspace Installation Guide provides reference to using a Microsoft Exchange server as well as a VMware Zimbra server.
• vCenter IP Pools – vCenter IP Pool configurations are a must. These are quite simple to setup and provide virtual appliances and vApps with the necessary information to communicate properly on the network in question.

  

• vCenter 5.x – vCenter must be running at least at version 5.0 or higher. It is important to note here, if you’re planning on running Horizon View 5.2, you’ll want vCenter 5.1.0a or higher.
• vSphere 4.1/5.x – The vSphere host(s) where the vApp lives must be at least 4.1 or higher. Again, it is important to note here, if you’re planning on running Horizon View 5.2, you’ll want vSphere 5.1.0a or higher.

Now this may differ slightly for a Proof of Concept vs. a Production environment. For a Proof of Concept, really the things needed are far less than for production.

• Proof of Concept:
• Users – Use of the Demo User Store built into Horizon Workspace is totally fine here, so Active Directory is really not needed at all.
• Internal Database – Use of the internal Postgres database is acceptable. Just keep in mind there is no fault tolerance or disaster recovery by default as this is something you would do for an external database. You could, of course, use built vCenter tools to provide some level of protection – but this is a POC we’re talking about here.
• Storage – Built in storage is fine for a Proof of Concept but it is recommended to take the time to setup some limitations so people don’t fill the storage on the POC environment. See the Horizon Workspace Installation Guide and the Horizon Workspace Reviewers Guide for more details on this.

• Production:

For production we should really stress the review of the the Horizon Workspace Installation Guide and the benefits this will bring you as these are the more official documentations with enterprise level recommendations.

One final recommendation; If you’re planning on rolling this into production, take the time to setup an external Postgres database as it is HIGHLY recommended to configure Horizon Workspace (for HA and Fault Tolerance) to utilize an external Postrgres database. We recommend VMware vFabric Postrgres!

First off, some things to work through…

1. Do you have a demo lab?

Having a Demo Lab is a great way to test anything. If you don’t have a demo lab environment which runs separate from your production environment, now might be a great time to set one up. Make sure you have a few things in it, such as…

• vSphere/vCenter (of course)
• Active Directory
• DNS
• DHCP
• WiFi (preferably secured)
2. Does your demo lab have Internet access?

While Internet access isn’t a necessity for everyone’s Demo Lab, it is nice to have. Just remember to protect the demo lab as you would the production network. It’s especially good to have the Demo Lab on a completely separate network segment to keep it separate from production.

So now on to the Horizon Mobile Proof of Concept.

Simple HMM POC Steps:

1. Decide upon a static IP and Fully Qualified Domain Name (FQDN). A static IP is required. If using a signed SSL Certificate (public or private), DNS is also required.
2. Setup DNS records. Both internal and external FQDN names (external is only necessary if external/over the Internet access is going to be tested). Make sure to setup a forward lookup (A Record) which resolves to the SSL Certificate if an SSL Certificate is used. Reverse lookup (Pointer) is not necessary but recommended.
3. Load Horizon Mobile Virtual Appliance OVA into vCenter/vSphere.
4. While you are waiting for the previous step to complete, go get your environment email settings – specifically the SMTP server settings, including the authentication settings. This is necessary for the setup of the appliance.
5. Configure the appliance. This will be the general settings in the console and the Web UI once the console boots up completely. These settings will include the IP configurations, and the Hostname
• If you DO NOT have email setup, you need to do that now. This is probably the most challenging part of the whole Horizon Mobile POC setup as this requires finding all of the SMTP settings of your environment (server, SSL, Port, User Authentication, a test email sent and received with activation code, and that code entered into the correct box). Once this is done, DO NOT DO ANY OTHER MODIFICATIONS – Just click SAVE AND RESTART.

If email is setup, continue on.

6. Attach the Horizon Mobile Appliance to your Active Directory.
7. SSL Certificates are not a necessity for a Proof of Concept (POC). However, for public or custom private SSL certs you’ll want to first obtain the certificates and convert them to PEM format, including the any intermediary and parent certificates as well as the private key. If you don’t have a certificate chain file, you’ll also want to create this in PEM format. To make this, simply text copy the PEM certificates from all PEM files into one PEM file starting with your certificate, any intermediate certificates, then the parent certificate as shown below.

SSL Key Chain:

—–BEGIN CERTIFICATE—– (your cert)
MIIGtzCCBZ+gAwIBAgIQBwPKfHC+TljzcsiAH1ob8zANBgkqhkiG9w0BAQUFADBm
…
—–END CERTIFICATE—–
—–BEGIN CERTIFICATE—– (sub/intermediate)
MIIGWDCCBUCgAwIBAgIQCl8RTQNbF5EX0u/UA4w/OzANBgkqhkiG9w0BAQUFADBs
…
—–END CERTIFICATE—–
—–BEGIN CERTIFICATE—– (root/parent)
MIIFBzCCA++gAwIBAgIETA6m2zANBgkqhkiG9w0BAQUFADCBtDEUMBIGA1UEChML
…
—–END CERTIFICATE—–
• Load your public or private SSL certificates into the Web UI.

Here you will login to the Web console of you Horizon Mobile appliance and select the Security section in the left-side pane. In the top Window of the Security section there is an Upload New Certificate link to load in your certificates. Remember to load in ALL certificates, including the child, any intermediate certificates, and the parent.
WARNING: Do this before loading in any phones!

• Load your public or private SSL certificates into the appliance console.

For this, you will need to enable SSH/SCP root login on the appliance (just modify line 41 of the /etc/ssh/sshd_config file and restart SSHD using the /etc/rc.d/sshd restart command. Once you can SCP/SSH into the Horizon Mobile appliance, you’ll need to load up the certificates. Here, it’s best to follow the Horizon Mobile Manager Installation and Configuration Guide – starting at page 23.

8. Load any other Android apps desired. It should be noted, many Android applications (APK files) can be downloaded directly from the respective software manufacturer’s web site.
9. Within the Web UI, create any Horizon Mobile Groups, Templates, and Policies. Following the on-screen steps here will greatly help. This step is not absolutely necessary but doing so shows additional options within the Horizon Mobile appliance which may provide solutions to current situations.



10. Import your users from your Active Directory and assign them to the Horizon Mobile groups. If no Active Directory is setup, then use internal LDAP (User01 – UserXX).
11. Now it’s time to load the VMware Switch application from Google play and test your setup!

VMware Switch Setup Instructions:

NOTE: It is strongly suggested VMware Switch setup on the Horizon Mobile device be done over Wifi.

1. Download the VMware Switch app from Google Play.  Search for “VMware Test” or “VMware Switch”. This should be the latest version.

NOTE:  You’ll need a Google Play account to do this.  I suggest setting up a Google account and using the email piece to “demo” the personal phone side of things.  Makes for a nice touch.

2. Once VMware Switch is installed onto the device, start the VMware Switch app.
3. Login with your Username, Password, and Horizon Mobile Server (a.k.a. the Appliance).

NOTE:  If you have any SSL Certificate issues when entering the HMM Server, then in order to disable the SSL certificate warning, on the Android mobile device go to HOME | SETTINGS | APPS | DOWNLOADED (scroll to ALL APPS) | VMware Switch | Manage Space and UNCHECK Authenticate Server. Then go back into VMware Switch and login with the configured User, Password and Server.

See the VMware Horizon Mobile web site for a list of Resources, including some “Getting Started” videos

There are many different ways you can accomplish this but this will get the job done..

How to enable SSL in Horizon Application Manager – wildcard v2

Horizon Service

• Service log file: /opt/vmware/horizon/horizoninstance/logs/horizon.log

Horizon Connector

• Connector service restart (tomcat): /etc/init.d/tcserver-c2 restart
• Connector log file (login/authentication details): /opt/vmware/c2/c2instance/logs/connector.log
• Connector log file (sync log details): /var/log/messages
• Connector repo db: /var/lib/vmware/tam/repo/repodb/opt/likewise/bin/lwsm
  NOTE: list – shows services and status

Horizon Connector/Service:

• Time Sync: sntp –P no –r pool.ntp.org
  NOTE: You can replace the listed time server with yours.
• Command to see the certificate details: openssl s_client -connect localhost:443
• Enable SSH: /etc/ssh/sshd_config
  NOTE: Change Permitrootlogin to yes then run the command /etc/init.d/sshd restart

Horizon Agent:

• Horizon agent logs folder: C:\ProgramData\HorizonAgentLogs
• ThinApp download folder: C:\ProgramData\ThinAppCache
• ThinApp shortcuts folder: C:\ProgramData\ThinAppIconCache
• Horizon/ThinApp Agent database lease DB:
• Win 7 32 bit – %windir%\System32\config\systemprofile\ThinAgentLease.db
• Win 7 64 bit – %windir%\SysWOW64\config\systemprofile\ThinAgentLease.db
• Win XP – C:\Documents and Settings\LocalService\ThinAgentLease.db

For further assistance, make sure you hit the Online Support Documentation for Horizon On-Prem and Hosted installs and Communities!

Procedure for adding Horizon Settings to ThinApp Factory for App Publishing to Horizon:

1. Login to Horizon as an Administrator.
2. Go into Settings under Admin.
3. Under Identity Provider, click Add Identity Provider.
4. Type in the Provider name and comments.
5. Remove the IP range so none exists!
6. Click save, then copy the Connector Activation Code.
   Note: You may also wish to set the priority of this connector low.
7. Open ThinApp Factory, login, and go into the Configuration tab under Settings.
8. Check the Enable publish to Horizon check box.
9. Type in the Horizon Organization URL and paste in the Connector Activation Code, then click Validate & Save in the box.
10. IMPORTANT – Scroll to the bottom of the configuration tab page and click the Save button!

Adding ThinApp Factory packages to Horizon:

Now, when editing, importing or creating projects, you will have the option to “Horizon enable” the ThinApp project/package. When it gets PUBLISHED from the ThinApp Factory Projects page, it will then show in the Horizon Manager Applications tab for Horizon Administrators to assign to users or groups.

Prerequisite Info:

To make ThinApp Factory “Horizon Enabled” one must add a new Horizon Org “Identity Provider”. This can be done under the Identity Provider settings when logged in as a Horizon ORG Administrator.

Tip:

When adding a new Horizon Org “Identity Provider” for use with ThinApp Factory, ensure there are NO IP Pools defined!!

By default a new Identity Provider will add a default IP Pool range of 0.0.0.0 – 255.255.255.255. Leaving this default setting may cause issues if none of the defined Horizon Connectors have an IP Pool of 0.0.0.0 – 255.255.255.255.

To remove the default IP Pool, simply move the mouse to the right of the right-hand block and you will see the RED “X”. Click this to remove the IP Range.

Symptoms Seen When Default IP Pool Range Settings are Set Incorrectly:

Error 1: Identity Provider does not have metadata specified

Error 2: The sign in page has not yet been configured. Contact your Administrator for help

The above errors can be seen with any non-user identity provider specified if IP ranges are improperly defined and the non-user identity providers are selected for user authentication.

1. Login as “root” to your HMM appliance (https://[your_hmm_appliance]:5480).
   NOTE: Default password is “vmware”. It is highly recommended to change this!

1. Navigate to the Settings sub-tab under the Horizon tab.

1. If you do not have email setup, you need to set this up now. This is probably the most challenging part of the whole Horizon Mobile Appliance setup as this requires finding all of the SMTP settings of your environment (server, SSL, Port, User Authentication, a test email sent and received with activation code, and the code entered into the correct box). Once this is done, DO NOT DO ANY OTHER MODIFICATIONS – Just click SAVE AND RESTART.

If email is setup, continue on.

1. Working from the bottom up, under the Naming Service section, select Active Directory from the drop down and type in the Active Directory Domain FQDN.

1. Under the Work Phone section, replace the “https://127.0.0.1” URLs with the actual Horizon Mobile appliance IP or FQDN name. In the example below, the FQDN was used.

1. Under the General section, replace Default Administrator name “admin” with the actual Active Directory Service account name for the HMM Administrator. In the example shown, “Administrator” is used.

1. Click the Save and Restart button.

1. Test the setup. You should be able to now open another tab/browser window and browse to “https://[your_hmm_appliance]” and login with the account configured in step 6.

Here is an example configuration snapshot with notes:

In this blog, we’re going to be sharing mainly technical information both in and around Horizon and it’s many components. Please make sure to visit often or subscribe to the RSS feed for keeping up to date on any technical tid-bits.

To put it simply, there are multiple locations for icon definitions within a ThinApp package (MSIARPProductIcon, InventoryIcon, and Entry Point Icon). Regarding Horizon, it only cares about seeing the Inventory Icon and the Entry Point icon.

It is important to know, Horizon has multiple areas where it shows the icon. The app upload screen, app deployment screen, and the user screen to name the most common. In most cases, we don’t really care about any of the others except the last one.

In order for the icon to appear properly for the user, I’ve always had to ensure both the Entry Point icon and the Inventory Icon are set correctly in the ThinApp package.

• Inventory Icon: Under [Build Options] in the PACKAGE.INI, look for an InventoryIcon= value. If one doesn’t exist, create it. Use a path internal to the project to define either an EXE or DLL with a numerical value or an ICO without a numerical value.

  Examples:
  This denotes use of the first ICON in the EXE.
  InventoryIcon=%ProgrameFilesDir%\AppFolder\program.exe,0

  This denotes use of the ICO file.
  InventoryIcon=%ProgrameFilesDir%\AppFolder\file.ico

• Entry Point Icon: Under each enabled Entry Point, you may need to define an Icon= value if the icon doesn’t properly appear from the defined executable in the Source= value. If manually defining the Icon= value, one must use a path internal to the project to define either an EXE or DLL with a numerical value or an ICO without a numerical value.

  Examples:
  This denotes use of the first ICON in the EXE.
  Icon=%ProgrameFilesDir%\AppFolder\program.exe,0

  This denotes use of the ICO file.
  Icon=%ProgrameFilesDir%\AppFolder\file.ico

The VMware KB “Handling the application suite icon when enabling a VMware ThinApp package for Horizon” goes into this in great detail.

]]> http://blogs.vmware.com/horizontech/2012/12/thinapp-icons-not-appearing-in-horizon.html/feed 0