Users and permissions

Create the following users on the corresponding servers before the installation.

Linux servers

Application user is a user for installation process and running the Work.AI services. By default, WFUSER.

• The user must exist on each Linux server.
• The user must have the SSH access from the Master server to all other Linux servers via the SSH-key.
• The user must have the sudo permissions on all Linux servers. The following privileged operations are required for this user: /usr/bin/sh, /usr/bin/su, /bin/bash, /usr/bin/mkdir, /usr/bin/chmod, /usr/bin/chown.
• The user can be either a local Linux user or an LDAP user (for example, from ActiveDirectory).
• The user (WFUSER) and the group it belongs to (WF_GROUP) must be the same for all Linux servers (including UID and GID).
• The user and the group it belongs to must not contain any whitespace characters in the name.

caution

To install Work.AI most quickly, you will need the SSH access and the sudo permissions. After the installation, you can revoke them, if needed.

If your company's policies can't provide you with these requirements, the user with the root privileges must perform all the required operations manually. In this case, the installation takes longer.

Windows servers

• BI installation user (BI_USER) must exist on the BI (Analytics) servers with the Administrator privileges. The user's credentials must be the same on all BI servers.

  The following password policies are applied for the BI installation user:

  • Allowed symbols: #*@/\+-=_}{][:,)(.;!?
  • Forbidden symbols: ^'|``><"&%

• RPA installation user (RPA_USER) must exist on RPA servers with the administrator privileges. The user's credentials must be the same on all RPA servers.

• All usernames on Windows servers must not contain any whitespace characters.

• The following password limitations apply for Windows installation users:

  • Allowed symbols: #*@/\+-=_$}{][:,)(.;!?
  • Forbidden symbols: ^'|``><"&%

Other requirements

• WinRM (over HTTPS with CredSSP authentication) must be available from the Master server to all Windows servers for respective Windows installation users.
• Domain and local policies must provide Administrator permissions for at least 60 minutes.
• Time must be synchronized on all servers.

How to create users

On Master server

To create the application user on the server, from which you are going to install the system:

1. Connect to the Master server as a user with the sudo privileges:

   $ ssh -i <path-to-private-key.pem> <root>@<hostname.example.com>

2. Create an application user:

   $ sudo useradd -m USERNAME

   Here, USERNAME is the login name of the application user. Use the lowercase letters.

3. Provide the sudo privileges for the application user. For that:

   1. Make sure that the line #includedir /etc/sudoers.d exists in the sudoers file.

      sudo cat /etc/sudoers | grep includedir
      #includedir /etc/sudoers.d

   2. Run the command:

      $ sudo visudo -f /etc/sudoers.d/USERNAME

   3. In the end of the sudoers file, add the following line:

      USERNAME ALL=(ALL) NOPASSWD:/usr/bin/sh,/usr/bin/su,/bin/bash,/usr/bin/mkdir,/usr/bin/chmod,/usr/bin/chown

   4. Save and close the file.

4. Switch to the application user:

   $ sudo su - USERNAME

5. Generate the SSH pair key for the installation:

   $ ssh-keygen -t rsa -C 'inventory@workfusion.com' -f ~/.ssh/ansible_ssh_key -N ''

   If using a private password-protected SSH key, enter the passphrase when prompted during the installation.

6. Open the generated public key and save it to clipboard:

   $ cat ~/.ssh/ansible_ssh_key.pub

After the above operation, proceed to other Linux and Windows servers to create the same user there. For the instructions, see the further sections.

caution

If you plan to set up the Work.AI platform in the HA mode, remember to add the same user on all Master servers.

On other Linux servers

The same user must be present on all Linux servers, including those that are used for load balancing, if you decide to install Work.AI in the HA mode.

To create the application user on other Linux servers:

1. Connect to a Linux server as a user with the sudo privileges:

   $ ssh -i <path-to-private-key.pem> <root>@<vdsmaster1.workfusion.com>

2. Create the application user:

   $ sudo useradd -m USERNAME

   The user's name must be the same as on the Master server and be written in lowercase letters.

3. Provide the no-password sudo privileges for the application user. For that:

   1. Make sure that the line #includedir /etc/sudoers.d exists in the sudoers file.

      $ sudo cat /etc/sudoers | grep includedir
      #includedir /etc/sudoers.d

   2. Run the command:

      $ sudo visudo -f /etc/sudoers.d/USERNAME

   3. In the end of the sudoers file, add the following line:

      USERNAME ALL=(ALL) NOPASSWD:/usr/bin/sh,/usr/bin/su,/bin/bash,/usr/bin/mkdir,/usr/bin/chmod,/usr/bin/chown

   Save and close the file.

4. Create the folder for the SSH keys and change its permissions:

   $ sudo mkdir /home/USERNAME/.ssh/
   
   $ sudo chmod 700 /home/USERNAME/.ssh/

5. In the new directory, create the authorized_keys SSH key file and paste the copied public key from the Master server to it:

   $ sudo vi /home/USERNAME/.ssh/authorized_keys

6. Change permissions and the owner of the directory:

   $ sudo chown -R USERNAME:USERNAME /home/USERNAME/.ssh
   $ sudo chmod 600 /home/USERNAME/.ssh/authorized_keys

7. Make sure that SSH key-based authentication is enabled on all Linux servers. In this case, the /etc/ssh/sshd_config file on these servers must contain the following line:

   PubkeyAuthentication yes

   If you use SSH password-based authentication instead, the /etc/ssh/sshd_config file on all Linux servers must contain the following line:

   PasswordAuthentication yes

To check that you have done everything right, make the SSH connection from the Master server to the current server as the application user:

[USERNAME@<master-server> ~]$ ssh -i ~/.ssh/ansible_ssh_key USERNAME@<current_server_host>

On Windows servers

To create an installation user on the Windows server:

1. Download Remote Desktop or any other software for connecting to Windows servers.

2. Open the software and specify:

   • Server name
   • Username
   • User password

3. Connect to the remote Windows server as a user with the administrator's privileges.

4. Run PowerShell as Administrator.

5. In PowerShell, run the following commands:

   $ net user USERNAME PASSWORD /add
   $ net localgroup administrators USERNAME /add

   Here, USERNAME is the name of the Windows installation user, and PASSWORD is the password for the Windows installation user.

For future maintenance, make sure that the Windows user is active, has all required administrator permissions, and the password is not expired.