Installing Agents on Computers to be Managed
This chapter describes the recommended steps for deploying Server Suite software on the nonWindows computers that you want to add to Active Directory. The chapter also describes the alternatives you can use to install agent packages on non-Windows computers, including using native Linux installers to install Server Suite packages manually and automatically.
About the Deployment Process
The steps in this section, and in Preparing to migrate existing users and groups and Migrating existing users to hierarchical zones, are iterative in nature. In most cases, you will select a subset of computers for deployment, and repeat the steps for each target group until you have migrated all of the computers and users in the enterprise into Active Directory.
There is no technical requirement that you only work with a subset of computers at a time, but in practice the process of checking computers for potential problems and resolving open issues is more manageable when applied to a subset of computers. It is also more practical to migrate user populations in stages rather than all at once. After you step through the process a few times, you'll be able to anticipate and resolve potential issues more quickly and move into a more rapid deployment model.
Select a Target Set of Computers
As a first step in preparing to install Server Suite software, you should select a target set of computers on which to deploy. The target set can be based on any criteria you choose. In many organizations, new software must always be installed in the development environment first, then in the pre-production environment, before it can be deployed in the production environment. If your organization has this type of requirement, the first target set of computers would be the computers in the development environment.
Other possible candidates for the target set might be computers that:
- Have been identified for changes by an audit finding
- Are in the same physical location, such as a particular data center
- Share common attributes, such as all Red Hat Linux computers or all of the servers in a Web farm
- Are used by a particular department, project, or line of business
- Have a common set of users who need access to the computer resources
After you have identified a target set of computers, you are ready to begin the deployment. You should notify the user community that you are planning to install software on the target set of computers. For example, you may want to notify users by sending out an email message similar to the sample provided in Preliminary software delivery notification email template.
After you have identified a target set of computers to work with, you can use adcheck to check whether those computers have any issues that need to be resolved before you install new software on them. Checking the environment before you install helps to reduce change control issues.
Options for deploying Server Suite Agent Packages
You can:
- Run the agent installation script locally on any computer and respond to the prompts displayed.
- Create a configuration file and run the installation script remotely on any computer in silent mode.
- Use the install or update operations in the native package installer for your operating environment.
- Use a commercial or custom software distribution tool.
If you want to use one of these installation options and need more information, see the appropriate section.
Install Interactively on a Computer
The Server Suite Agent installation script, install.sh, automatically checks the operating system, disk space, DNS resolution, network connectivity, and other requirements on a target computer before installing. You can run this script interactively on any supported UNIX, Linux, or Mac OS X computer and respond to the prompts displayed.
To install Server Suite software packages on a computer interactively
-
Log on or switch to the root user if you are installing on a Linux or UNIX.
If you are installing on Mac OS X, you can log on with any valid user account.
On Mac OS X computers, you can install interactively using the graphical package installer or the install.sh script. For information about installing and joining an ActiveDirectory domain using the Mac OS X package installer, see the Mac-specific instructions in the Administrator's Guide for Mac. -
Mount the cdrom device using the appropriate command for the local computer's operating environment, if necessary. On most platforms, the CD drive is automatically mounted.
If you have downloaded the package from an FTP server or website, verify the location and go on to the next step.The instructions for mounting the CD drive are platform-specific. For example on Linux, you can use a command similar to the following:
mount /mnt/cdrom
To manually mount the CD drive on AIX, run a command similar to the following:
mount -v cdrfs -o ro /dev/cd0 /cdrom
To mount the CD drive on HP-UX, run a command similar to the following to display the long file names:
mount -F cdfs -o rr /dev/dsk/c0t0d0 /mnt/cdrom
-
Change to the appropriate directory that contains the Server Suite Agent package you want to install.
For example, to install an agent on a Linux computer from a downloaded Server Suite ISO or ZIP file, change to the Agent_Linux directory:
cd Agent_Linux
Similarly, if you are installing on a Solaris, HP-UX, AIX or other UNIX computer, change to the Agent_Unix directory. If installing on a Mac OS X computer, change to the Agent_Mac directory.
If you downloaded individual agent packages from the Delinea Download Center, unzip and extract the contents. For example:
gunzip -d centrify-infrastructure-services-VERSION-platform-arch.tgz
tar -xf centrify-infrastructure-services-VERSION-platform-arch.tar
-
Run the install.sh script to start the installation of the agent on the local computer's operating environment. For example:
./install.sh
-
Follow the prompts displayed to select the services you want to install and the tasks you want to perform. For example, you can choose whether you want to:
-
Perform a default installation.
-
Perform a custom installation by selecting the specific packages to install.
-
Join a domain automatically at the conclusion of the installation.
Depending on your selections, you may need to provide additional information, such as the user name and password for joining the domain.
-
Run the Bundle Installation from a Mounted Network Volume
You can install agents from a mounted network volume using the install-bundle.sh script. This script is available on the agent CD or ISO file that contains all of the supported agent platforms in compressed format. The bundle installation script automatically determines the platform required and extracts the contents of the appropriate TGZ file, then starts the normal installation process.
To use the install-bundle.sh script
-
Copy the install-bundle.sh script onto a network file system share and mount the shared directory.
-
Verify that the file is executable and that you have appropriate privileges to run it. For example:
chmod +x install-bundle.sh
chmod 755 install-bundle.sh
-
Run the script without command line options to start the installation or add command line options to install the agent silently.
For example, to start an interactive installation, type a command similar to this:
sudo ./install-bundle.sh
To install the agent silently, type a command similar to this:
./install-bundle.sh --std-suite --adjoin_opt="sidebet.org --password pa\$swd sudo ./install-bundle.sh
zone global --container sidebet.org/UNIX/Servers --server demo.sidebet.org"
To see complete usage information for the install-bundle.sh script, type:
./install-bundle.sh --help
Install Silently Using a Configuration File
Installing without user interaction enables you to automate software delivery and the management of remote computers. If you want to install files without any user interaction, you can run the install.sh script silently invoking the script with the appropriate command-line arguments. You can also customize the packages installed and other options by creating a custom configuration file for the installer to use.
-
To see the install.sh silent mode and other command line options, enter
install.sh -h
-
To install Authentication & Privilege default packages and configuration options silently, run:
install.sh --std-suite
-
To install Authentication & Privilege and Audit & Monitoring default packages and configuration options, run:
install.sh --ent-suite
-
To install a customized set of packages that all have the same version number, run:
install.sh -n
About the Sample Configuration Files Available
You can customize the install.sh execution script. There are two sample configuration files for installing software packages silently. These sample configuration files are located in the same directory as the install.sh script:
centrify-suite.cfg
centrifydc-install.cfg
If you want to customize the packages installed or other configuration options, you can
modify the sample centrify-suite.cfg
or centrifydc-install.cfg
file.
The centrify-suite.cfg
file is used when you run install.sh with the --std-suite
or --ent-suite
options. If you run install.sh --std-suite
or install.sh --ent-suite
with a customized version of
the centrify-suite.cfg
file, you can selectively install compatible add-on packages that do
not have the same version number as the core Server Suite Agent.
Alternatively, you can run install.sh -n
with a customized version of the centrifydc-install.cfg
file to install the agent and add-on packages if they all have the same version number.
If you run the install.sh script silently and it cannot locate the centrify-suite.cfg
or
centrifydc-install.cfg
file to use, default values defined directly in the script itself are used.
Setting the Parameters in a Custom Configuration File for the Installation Script
If you want to specify values for the install.sh script to use, you should edit the sample
centrify-suite.cfg
or centrifydc-install.cfg
file in its default location before invoking
the install.sh script in silent mode.
centrifydc-install.cfg
or centrify-suite.cfg
file are the same,
except that the centrify-suite.cfg
file is used when installing a set of services to allow packages
with different version numbers to be installed together. Because you should not modify the
compatibility defined in the centrify-suite.cfg
file, those parameters are not included in the table.To customize the installation using the centrifydc-install.cfg
or centrify-suite.cfg
file, you
can set the following parameters:
Parameter | Description |
---|---|
ADCHECK | Indicate whether you want to run the adcheck program to check the configuration of a local computer and its connectivity to Active Directory. Note that the install.sh script calls adcheck twice. After the first call, adcheck performs several required pre-installation steps to make sure you can install the Centrify Agent on the host computer. These steps are mandatory and cannot be skipped. However, the second call to adcheck is used to perform post-installation steps to make sure the agent has been installed successfully. The second set of checks is optional and can skipped. Set this parameter to Y if you want to run adcheck after installing. For non-interactive installations, the default is N. |
ADLICENSE | Indicate whether you want to install licensed features. Set this parameter to Y if you have purchased and installed license keys. If you downloaded and want to install unlicensed Server Suite Express agents, set this parameter to N. |
GLOBAL_ZONE_ONLY | Specify whether you want to install the agent in a Solaris 10 global zone and no other zones. Set this parameter to Y only if you are running the install.sh script on a Solaris 10 computer and want to install the agent in the Solaris 10 global zone and none of your non-global zones. In most cases, you only set this parameter to Y if you use sparse root zones. The default setting for this parameter is N so that the agent is installed in all Solaris zones. If the script is not running on a Solaris 10 computer, this parameter is ignored. |
ADJOIN | Indicate whether you want to attempt to join an Active Directory domain in non-interactive mode. Set this parameter to Y to attempt to join the domain automatically. Set this parameter to N to manually join the domain after installation. |
ADJ_FORCE | Overwrite the information stored in Active Directory for an existing computer account. Set this parameter to Y to replace the information for a computer previously joined to the domain. If there is already a computer account with the same name stored in Active Directory, you must use this option if you want to replace the stored information. You should only use this option when you know it is safe to force information from the local computer to overwrite existing information. |
ADJ_TRUST | Set the Trust for delegation option in Active Directory for the computer account. Trusting an account for delegation allows the account to perform operations on behalf of other accounts on the network. |
DOMAIN | Specify the domain to join, if you set the ADJOIN parameter to Y. Set this parameter to the name of a valid Active Directory domain. |
USERID | Specify the Active Directory user name to use when connecting to Active Directory to join the domain. Set this parameter to a valid Active Directory user name. |
PASSWD | Specify the password for the Active Directory user name you are using to connect to Active Directory. Set this parameter to the password for the Active Directory user name specified for the USERID parameter. |
COMPUTER | Specify the computer name to use for the local host in Active Directory. Set this parameter to the computer name you want to use in Active Directory if you don't want to use the default host name for the computer. |
CONTAINER | Specify the distinguished name (DN) of the container or Organizational Unit in which you want to place this computer account. The DN you specify does not need to include the domain suffix. The domain suffix is appended programmatically to provide the complete distinguished name for the object. If you do not specify a container, the computer account is created in the domain's default Computers container. Note that the container you specify must already exist in Active Directory, and you must have permission to add entries to the specified container. |
ZONE | Specify the zone to which you want to add this computer. |
SERVER | Specify the name of the domain controller to which you prefer to connect. You can use this option to override the automatic selection of a domain controller based on the Active Directory site information. |
DA_ENABLE | Indicate whether you want to automatically enable the auditing service on the local computer. The valid settings are: Y if you want to enable auditing with the default auditing configuration. N if you don't want to enable auditing. K if you are upgrading and want to keep your current auditing configuration unchanged. |
DA_X_ENABLE | Indicate whether you want to automatically enable the Linux desktop auditing service on the local computer. The valid settings are: Y if you want to desktop enable auditing with the default auditing configuration. N if you don't want to enable desktop auditing. K if you are upgrading and want to keep your current auditing configuration unchanged |
DA_INST_NAME | Specify the name of an auditing installation if you set the DA_ENABLE parameter to Y. |
REBOOT | Indicate whether you want to automatically restart the local computer after a successful installation. Set this parameter to Y if you want to automatically restart the local computer or to N if you don't want the computer restarted automatically. |
INSTALL | |
UNINSTALL | Specify whether you want to forcibly uninstall all installed packages. |
ADCHECK="N"
ADLICENSE="Y"
# Solaris 10 -G option, installation in global zone only
GLOBAL_ZONE_ONLY="N"
ADJOIN="Y"
ADJ_FORCE="N"
ADJ_TRUST="N"
DOMAIN="sample.company.com"
USERID=administrator
PASSWD="securepassword123"
# COMPUTER=my_host_name
# CONTAINER="my_computers"
ZONE="global_zone"
# SERVER=server_name
DA_ENABLE="N"
DA_INST_NAME=""
REBOOT="Y"
# Install the core agent package
INSTALL="Y"
# Skip installation for other packages
CentrifyDC_nis=
CentrifyDC_krb5=
CentrifyDC_ldapproxy=
CentrifyDC_openssh=
CentrifyDC_web=
CentrifyDC_apache=
CentrifyDC_idmap=
CentrifyDA=
This sample configuration file does not install any of the Server Suite add-on packages. You can also use the configuration file to silently install or update selected packages. For example, to update the LDAP proxy service and OpenSSH on a computer, you would modify the configuration file to indicate that you want to update those packages:
CentrifyDC_ldapproxy=”U”
CentrifyDC_openssh=”U”
Customizing the Return Codes for the Installation Script
Normally, when you run the install.sh script silently, the script returns an exit code of 0 if the operation is successful. If you want the script to return exit codes that indicate whether the operation performed was a successful new installation, a successful upgrade, a successful uninstall, or there were errors preventing installation, you can also use the custom_rc option. For example:
install.sh -n --custom_rc
When you specify this option, the following return codes that are defined in the install.sh script are used to provide more detailed information about the result:
Return code | Description |
---|---|
CODE_SIN=0 | Successful installation |
CODE_SUP=0 | Successful upgrade |
CODE_SUN=0 | Successful uninstallation |
CODE_NIN=24 | Did nothing during installation |
CODE_NUN=25 | Did nothing during uninstallation |
CODE_EIN=26 | Error during installation |
CODE_EUP=27 | Error during upgrade |
CODE_EUN=28 | Error during uninstallation |
CODE_ESU=29 | Error encountered during setup, for example, the UID is not the root user UID, the operating environment is not supported or not recognized, or the script is executed with invalid arguments |
Use Other Automated Software Distribution Utilities
You can also install Server Suite software using virtually any automated software distribution framework. For example, you can use software delivery offerings from HP OpsWare or IBM Tivoli, or features such as Apple Remote Desktop, or software distribution in the Casper Suite to deliver Server Suite software to remote computers. You can also use any custom software delivery tools you have developed specifically for your organization. If you use a commercial or custom software distribution mechanism, review the release notes text file included with agent package for platform-specific installation details.