Before installing agents, check your access credentials in the user portal. You can introduce your username and password at: https://switch.ehorus.com You can download Windows and Linux agents from the official eHorus website: http://ehorus.com/agent-download © 2017 Artica Soluciones Tecnológicas S.L 21th April 2017, version 11 http://ehorus.com 1 SECURITY ON EHORUS 5 INSTALLING EHORUS ON WINDOWS 6 Optional: Installing the Mirror driver 13 Unattended install on Windows 13 Updating the Windows agent 14 INSTALLING EHORUS ON MAC OS 17 Uninstalling eHorus on Mac OS: 21 INSTALLING EHORUS MANUALLY ON MAC OS 21 INSTALLING EHORUS ON LINUX (CENTOS/RHEL) 22 INSTALLING EHORUS ON LINUX (UBUNTU 16.X) 23 INSTALLING EHORUS ON LINUX (TARBALL) 23 EHORUS INTERFACE AND BASIC USE 24 SHARING A SESSION WITH A THIRD PARTY 28 ADVANCED CONFIGURATIONS 30 Agent password 30 Session Timeout 31 Agent connectivity settings 31 Sending information on the remote system 32 Use of proxies 32 Local connection against the agent 32 Configuring file transfers 35 Registry files 36 Agent re-provisioning 36 Activate/deactivate delete file 36 2 Hide application icon 37 Desktop pop-up alerts and access requests 37 Dual screen 39 3 How does eHorus work? Ehorus is a device management system (meant for Windows, Linux and Mac OS) which will allow users to access their devices, wherever they may be, using only a web browser, even if it doesn’t have a direct connection to such devices. Before being able to remotely access a device, you’ll first need to install the agent and provision it on eHorus’ main server. To be able to provision an agent and make it accessible, you’ll need to have a valid eHorus user account. Once the agent is paired with a user, when booted, it’ll perform the provisioning and it’ll keep running, ready to be accessed from the outside. Once provisioned, the agent will be shown in the user portal, along with its EKID (eHorus Key ID). It’s a unique ID on the system that is meant to single out your device, since it can have agents with the same hostname, and even the same IP address. Use this identifier to collaborate with other users that want to access that same device, or for your internal inventory systems. For stronger security, each agent, when configured, can have an individual password that isn’t stored on the main eHorus servers. Instead, each time the user needs to access a specific device (agent) he or she will have to enter interactively (with username and password). The password for this is specified during the installation, or it can be configured afterwards. The agent will then connect to an Internet server. If the agent cannot connect directly to the Internet, and needs a proxy, users will be able to configure it afterward (see the advanced configuration section). 4 SecurIty on EHorus eHorus is a tool meant for system administrators. This implies that it’s a very powerful tool that will allow you to access, with administration privileges, on to any of your registered devices. The basic security mechanism is the access to the portal. This means that once the portal is accessed, the user will be able to access all devices under his or her control. Once the password is configured, it’s stored as a hash, which means it’s really complicated to know which one it is, even having physical access to the file. For additional security, you should consider establishing an individual password for each agent. This password will not be stored in any centralized location, and the communication will be cyphered from your end (customer) to the agent, which means no one can intercept it. It’s the safest way to avoid third parties accessing your systems. All the traffic between you and your devices, or between you and the portal, is encrypted using standard SSL. The agent connects to the eHorus server using port 1080/tcp. If you happen to have a very restrictive outgoing connection policy, add this port to the registered outgoing connections. You can also use an HTTP proxy in order to set outgoing connections. Apart from conventional security measures, such as the portal entry password, and the agent access password, you can use a double authentication protocol (based on Google Auth) which will install an app (Android and iOS) on your mobile device and will request a code every time you wish to access the portal. 5 Installing eHorus on WIndows Download the Windows agent (32 or 64 bit) from our webpage: http://ehorus.com/agent-download/ You’ll need to provide administrator permissions in order to install the eHorus agent. Once downloaded, run the installer. This agent has been tested on all available versions of Windows (from Windows XP to Windows 10). Since the installer is unsigned, you may get an installation warning. It’s normal, ignore it and proceed with the installation. Accept the prompted dialogue box and proceed with the installation. The installation will be available in a variety of language. As of now you may choose to install in English or Spanish, although new languages will be included in the near future. 6 7 8 On this screen you’ll need to introduce the username that you have on the eHorus platform (in the screenshot it says ‘User’ but you’ll need to replace this for the user so that the agent can provision and be used correctly. Optionally you can insert a group (only if the group has been previously created, if not, leave it blank. It can be set up later). More importantly, you can set an agent password for this installation. This password can be added or modified afterwards. To establish a password at this point, introduce it on the textbox at the end of the page. 9 The installation is almost complete. You’ll be asked if you’d like to start up the eHorus agent on that device and add an icon to the desktop. If you’ve correctly configured the agent (by inserting the provisioning user) and the agent has an Internet connection, you can now boot and begin to use eHorus. When launching the agent for the first time, it’ll take a few seconds to load. Internally the agent will launch some command line windows (black screens) which will close by themselves in a matter of seconds. When this is over, you can see it on the installer itself. 10 You should be able to see the eHorus status icon on the Windows notification deck: The green icon means that the agent is running and is provisioned. If it's red it means that it could not be provisioned. Right click on the icon to view some options: 11 You will only be able to stop/reset eHorus subcomponents if you’ve launched the eHorus manager (Ehorus Agent Menu) with Administrator privileges. A user without these privileges will NOT be able to stop eHorus or change its configuration. If “show EKID” is pressed, you’ll be able to see the EKID corresponding to that device. The EKID is a unique number for each host managed by eHorus. 12 This device, already provisioned and connected, has to be visible on your eHorus portal, ready to be externally managed. The eHorus agent has been installed as a service. This means that the device, even if reset, will pull up eHorus’ services again, and will continue to remain available. Optional: Installing thE Mirror drivEr The mirror driver is a third party software application that can be installed on the host to accelerate data viewing. It improves performance by approximately 25%. It isn’t installed with eHorus by default because it is a third party tool, although its use is free and open. To use it, you only need to install it and reset the device. You can download it here: http://www.demoforge.com/dfmirage.htm This driver is compatible with the following versions of Windows: • Windows 2008 R2 • Windows 7 • Windows 2008 • Windows Vista • Windows 2003 • Windows XP • Windows 2000 Other untested versions (windows 10) http://www.driverscape.com/download/vnc-mirror-driver Unattended Install on Windows You need to execute the installer as administrator from the command line: 13 ehorus_installer.exe /S --user <user> --password <pass> --eh_key <EH_KEY> /D='<Path>' Where: • user: Mandatory, it refers to provisioning user. If it’s not provided, the agent will not start. • password: Optional. Local password protecting the agent access. • eh_key: If empty, the provision system assigns one automatically in the provisioning process. You can provide one manually if you have an alternative provisioning system. • path: Full pathname where you want to install eHorus agent. By default is placed in 'C:/Program FIles/ehorus_agent'. UpdatIng the WIndows agent Just like with the rest of platforms (Mac OS/Linux), the Windows agent can be updated in a centrally from the WEB console, but if you wish to update it manually, you can do so with the same installation package. The system will detect that you’re updating the software and won’t overwrite configuration files, automatically updating only the code. Unattended install on Windows (.MSI) There are various optional parameters, e.g. msiexec /i ehorus_agent_installer.msi EHUSER="userXXX" EHKEY="`d877cb3c-82de-4b27-8dbf-1761f3345e7c`" EHPASSWORD="5555" DIRECTORY="C:\path\to\install" Where: • EHUSER: eHorus user • EHKEY: unique key • EHPASSWORD: agent password • DIRECTORY: the file where the agent will be installed (by default: C\Program Files\ehorus_agent Remember: Hyphens and dashes are special characters reserved for MSI installers, and must be escaped. In the example EHKEY they are escaped, because in order to run the string literally it is necessary to include double quotation marks.