10.2

Edit

Users and permissions

Create the following users on the corresponding servers before the installation.

Linux servers

Application user is a user for the installation process and running the IA Cloud services. By default, WFUSER.

  • The user must exist on each Linux server.
  • The user must have SSH access from the Master server to all other Linux servers via the SSH-key.
  • The user must have the sudo permissions on all Linux servers. The following privileged operations are required for this user: /usr/bin/sh, /usr/bin/su, /bin/bash, /usr/bin/mkdir, /usr/bin/chmod, /usr/bin/chown.
  • The user can be either a local Linux user or an LDAP user (for example, from ActiveDirectory).
  • The user (WFUSER) and the group it belongs to (WF_GROUP) must be the same for all Linux servers (including UID and GID).
  • The user and the group it belongs to must not contain any whitespace characters in the name.
warning

To install IA Cloud Enterprise most quickly, you will need SSH access and the sudo permissions. After the installation, you can revoke them if needed.

If your company's policies can't provide you with these requirements, the user with the root privileges must manually perform all the required operations. In this case, the installation takes longer.

Windows servers

  • BI installation user (BI_USER) must exist on the BI (Analytics) servers with the Administrator privileges. The user's credentials must be the same on all BI servers.

    The following password policies are applied for the BI installation user:

    • Allowed symbols: #*@/\+-=_}{][:,)(.;!?
    • Forbidden symbols: ^'|``<>"&%

  • RPA installation user (RPA_USER) must exist on RPA servers with Administrator privileges. The user's credentials must be the same on all RPA servers.

  • All usernames on Windows servers must not contain any whitespace characters.

Other requirements

  • WinRM (over HTTPS with CredSSP authentication) must be available from the Master server to all Windows servers for respective Windows installation users.
  • Domain and local policies must provide Administrator permissions for at least 60 minutes.
  • Time must be synchronized on all servers.

How to create users

On Master server

To create the application user on the server, required for the installation, do the following:

  1. Connect to the Master server as a user with the sudo privileges:

    $ ssh -i <path-to-private-key.pem> <root>@<hostname.example.com>

  2. Create an application user:

    $ sudo useradd -m USERNAME

    Here, USERNAME is the login name of the application user. Use the lowercase letters.

  3. Make sure that SSH key-based authentication is enabled on the installation server by checking that file /etc/ssh/sshd_config contains the following line:

    PubkeyAuthentication yes

    If you use SSH password-based authentication instead, file /etc/ssh/sshd_config must contain the following line:

    PasswordAuthentication yes

  4. Provide the sudo privileges to the application user. For that:

    1. Make sure that the line #includedir /etc/sudoers.d exists in the sudoers file.

      sudo cat /etc/sudoers | grep includedir
#includedir /etc/sudoers.d

    2. Run the command:

      $ sudo visudo -f /etc/sudoers.d/USERNAME

    3. At the end of the sudoers file, add the following line:

      USERNAME ALL=(ALL) NOPASSWD:/usr/bin/sh,/usr/bin/su,/bin/bash,/usr/bin/mkdir,/usr/bin/chmod,/usr/bin/chown

    4. Save and close the file.

  5. Switch to the application user:

    $ sudo su - USERNAME

  6. Generate the SSH pair key for the installation:

    $ ssh-keygen -t rsa -C 'inventory@workfusion.com' -f ~/.ssh/ansible_ssh_key -N ''

    If you use a private password-protected SSH key, enter the passphrase when prompted during the installation.

  7. Open the generated public key and save it to the clipboard:

    $ cat ~/.ssh/ansible_ssh_key.pub

  8. In the .ssh directory, create the SSH key file authorized_keys and paste the public key copied on the previous step to it:

    $ vi ~/.ssh/authorized_keys

  9. Change permissions of the created SSH key file:

    $ chmod 600 ~/.ssh/authorized_keys

After the above operation, proceed to other Linux and Windows servers to create the same user there. For the instructions, see the following sections.

warning

If you plan to set up Enterprise Edition in the HA mode, remember to create the same user on all Master servers.

On other Linux servers

The same user must be present on all Linux servers, including those used for load balancing, if you decide to install Enterprise Edition in the HA mode.

To create the application user on other Linux servers:

  1. Connect to a Linux server as a user with the sudo privileges:

    $ ssh -i <path-to-private-key.pem> <root>@<vdsmaster1.workfusion.com>

  2. Create the application user:

    $ sudo useradd -m USERNAME

    The user's name must be the same as on the Master server and be written in lowercase letters.

  3. Provide the no-password sudo privileges for the application user. For that:

    1. Make sure that the line #includedir /etc/sudoers.d exists in the sudoers file.

      $ sudo cat /etc/sudoers | grep includedir
#includedir /etc/sudoers.d

    2. Run the command:

      $ sudo visudo -f /etc/sudoers.d/USERNAME

    3. At the end of the sudoers file, add the following line:

      USERNAME ALL=(ALL) NOPASSWD:/usr/bin/sh,/usr/bin/su,/bin/bash,/usr/bin/mkdir,/usr/bin/chmod,/usr/bin/chown

    Save and close the file.

  4. Create the folder for the SSH keys and change its permissions:

    $ sudo mkdir /home/USERNAME/.ssh/

$ sudo chmod 700 /home/USERNAME/.ssh/

  5. In the new directory, create the SSH key file authorized_keys and paste the copied public key from the Master server to it:

    $ sudo vi /home/USERNAME/.ssh/authorized_keys

  6. Change permissions and the owner of the directory:

    $ sudo chown -R USERNAME:USERNAME /home/USERNAME/.ssh
$ sudo chmod 600 /home/USERNAME/.ssh/authorized_keys

  7. Make sure that SSH key-based authentication is enabled on all Linux servers. In this case, file /etc/ssh/sshd_config on these servers must contain the following line:

    PubkeyAuthentication yes

    If you use SSH password-based authentication instead, file /etc/ssh/sshd_config on all Linux servers must contain the following line:

    PasswordAuthentication yes

To check that you have done everything right, make the SSH connection from the Master server to the current server as the application user:

[USERNAME@<master-server> ~]$ ssh -i ~/.ssh/ansible_ssh_key USERNAME@<current_server_host>

On Windows servers

To create an installation user on the Windows server:

  1. Download Remote Desktop or any other software for connecting to Windows servers.

  2. Open the software and specify:

    • the server's name
    • the user's name
    • the user's password

  3. Connect to the remote Windows server as a user with the administrator's privileges.

  4. Run PowerShell as Administrator.

  5. In PowerShell, run the following commands:

    $ net user USERNAME PASSWORD /add
$ net localgroup administrators USERNAME /add

    Here, USERNAME is the Windows installation user's name, and PASSWORD is the password for the Windows installation user.

For future maintenance, ensure that the Windows user is active, has all required administrator permissions, and the password is not expired.

Checklist

To facilitate preparation for the IA Cloud installation, after you create the users on servers, in the checklist for the high-availability or basic setup, complete section Users, save and provide it to the WorkFusion deployment engineers.

← Plan infrastructure capacityDNS names →