Edit

Create users

Create installation users

Temporary installation users must be created on all Linux and Windows servers.

For successful installation, the user must meet the following requirements:

• The name of the installation user must be the same on all servers.
• The user must have the sudo permission without passwords.
• The SSH public key for the installation user must be placed in the authorized_keys file.

On the INT server

To create an installation user on the Integration server:

1. Connect to the Integration server as a user with the sudo privileges:

   $ ssh -i <path-to-private-key.pem> <root>@<hostname.example.com>
   

2. Create a Linux installation user:

   $ sudo useradd -m <username>
   

   Here, <username> is the login name of the Linux installation user. The user's name must be written in lowercase letters.

3. Provide the sudo privileges for the Linux installation user. For that:

   1. Make sure that the line #includedir /etc/sudoers.d exists in the sudoers file.

      $ sudo cat /etc/sudoers | grep includedir
      #includedir /etc/sudoers.d
      

   2. Run the command:

      $ sudo visudo -f /etc/sudoers.d/<username>
      

   3. In the end of the sudoers file, add the following line:

      <username> ALL=(ALL) NOPASSWD:/usr/bin/sh,/bin/bash,/usr/bin/su,/usr/bin/mkdir,/usr/bin/chmod,/usr/bin/chown
      

   Save and close the file.

4. Switch to the Linux installation user:

   $ sudo su - <username>
   

5. Generate the SSH pair key for the installation:

   $ ssh-keygen -t rsa -C 'inventory@workfusion.com' -f ~/.ssh/ansible_ssh_key -N ''
   

   In case of using a private SSH key that is protected by a passphrase, enter the passphrase, when prompted during the installation.

6. Open the generated public key and save it to clipboard:

   $ cat ~/.ssh/ansible_ssh_key.pub
   

After the above operation, proceed to other Linux and Windows servers to create the same user there. For the instructions, see the further sections.

important

If you setup Enterprise Edition in the HA mode, remember to add the same user on other INT server instances.

On other Linux servers

The same users must be present on all Linux servers, including those that are used for load balancing, if you decide to install Enterprise Edition in the HA mode.

To create an installation user on other Linux servers:

1. Connect to a Linux server as a user with the sudo privileges:

   $ ssh -i <path-to-private-key.pem> <root>@<vdsmaster1.workfusion.com>
   

2. Create a Linux installation user:

   $ sudo useradd -m <username>
   

   The user's name must be the same as on the Integration server and written in lowercase letters.

3. Provide the no-password sudo privileges for the Linux installation user. For that:

   1. Make sure that the line #includedir /etc/sudoers.d exists in the sudoers file.

      $ sudo cat /etc/sudoers | grep includedir
      #includedir /etc/sudoers.d
      

   2. Run the command:

      $ sudo visudo -f /etc/sudoers.d/<username>
      

   3. In the end of the sudoers file, add the following line:

      <username> ALL=(ALL) NOPASSWD:/usr/bin/sh,/usr/bin/su,/usr/bin/mkdir,/usr/bin/chmod,/usr/bin/chown
      

   Save and close the file.

4. Create the folder for the SSH keys and change its permissions:

   $ sudo mkdir /home/<username>/.ssh/
   
   $ sudo chmod 700 /home/<username>/.ssh/
   

5. In the new directory, create the SSH key file authorized_keys and paste the copied public key from the Integration server to it:

   $ sudo vi /home/<username>/.ssh/authorized_keys
   

6. Change permissions and the owner of the directory:

   $ sudo chown -R <username>:<username> /home/<username>/.ssh
   $ sudo chmod 600 /home/<username>/.ssh/authorized_keys
   

7. Make sure that SSH key-based authentication is enabled on all Linux servers. In this case, file /etc/ssh/sshd_config on these servers must contain the following line:

   PubkeyAuthentication yes
   

   If you use SSH password-based authentication instead, file /etc/ssh/sshd_config on all Linux servers must contain the following line:

   PasswordAuthentication yes
   

To check that you have done everything right, make the SSH connection from the Integration server to the current server as a Linux installation user:

[<username>@<integration server> ~]$ ssh -i ~/.ssh/ansible_ssh_key <username>@<current_server_host>

On Windows servers

For successful installation, the user must meet the following requirements:

• User's credentials must be the same on all Windows servers.
• The administrator permissions must be granted to the installation user.

To create an installation user on the Windows server:

1. Download Remote Desktop or any other software for connecting to Windows servers.

2. Open the software and specify:

   • server name
   • user's name
   • user's password

3. Connect to the remote Windows server as a user with the administrator's privileges.

4. Run PowerShell as Administrator.

5. In PowerShell, run the following commands:

   $ net user <username> <passwd> /add
   $ net localgroup administrators <username> /add
   

   Here,<username> is the name of the Windows installation user, and <passwd> is the password for the Windows installation user.

For future maintenance make sure that the Windows user is active, has all required administrator permissions, and the password is not expired.

Create RPA users

Before installation, the Bot Master and Bot Unit users must be created on each server that you plan to deploy and specified later in hosts.yml, in the rpa_hostnames list (see the Configure standard installation or Configure HA installation step). For the requirements to the RPA users, see System Requirements.

To create an RPA user on the Windows server:

1. Connect to the remote Windows server via Remote Desktop, or any other software, as a user with the Administrator privileges.

2. Run PowerShell as Administrator.

3. In PowerShell, run the following commands to create a Bot Master user and add it to groups:

   net user BotMaster <bot-master-pass> /add
   net localgroup "Administrators" BotMaster /add
   net localgroup "Remote Desktop Users" BotMaster /add
   

   Here, <bot-master-pass> is the password for the Bot Master user.

4. In PowerShell, run the following commands to create the Bot Unit users and add them to the group:

   net user BotUnit1 <bot-unit-pass> /add
   net localgroup "Remote Desktop Users" BotUnit1 /add
   

   Here, <bot-unit-pass> is the password for the Windows Bot Unit user.