With the Linux VDA set to drop very shortly as part of the XenApp & XenDesktop 7.6 FP2 release. It seems like a good time to share the high level, yet detailed, set-up process I followed when successfully carrying out internal testing.

Taken from various sources including the tech preview RHEL install guide, my colleague Lee Bushen’s detailed SLED based lab set-up guide and a tonne of Google searches and read-through’s, I

hope this collection of posts can save people some time and be used and referenced as one of the definitive Linux VDA setup guides for CentOS 6.6.

Although only officially supported on specific SUSE & Red Hat Enterprise Linux Distributions, CentOS 6.6 can also be used for reproduction and testing purposes due to its close code match to Red Hat, with the added bonus that it is easily accessible & free.

So, here it is, Part 1 of my step-by-step guide to help Windows aficionados & Linux newbies (myself included!) get the Linux VDA up and running on CentOS 6.6 without too much bother, for reference and testing purposes. Enjoy and sound off in the comments if you have any questions. 🙂

Pt. 1 Installing and preparing the Linux OS

1. Download and install CentOS 6.6 distribution using the following links:

http://wiki.centos.org/Download

http://isoredirect.centos.org/centos/6/isos/x86_64/

2. Install CentOS 6.6 distribution (Physical or Virtual):

For the purposes of this guide I installed CentOS 6.6 as a virtual machine using the built-in CentOS 6 (64-bit) template with default values on XenServer 6.5 SP1

3. Install XenTools:

– Select VM menu –> Install XenServer Tools

– Paste or type mount /dev/xvdd /mnt into the VM console window and hit return

– Paste or type /mnt/Linux/install.sh into the VM console window and hit return

– Type y and hit return to continue

– Type reboot and hit return to reboot the CentOS 6.6 VM

4. Configure specific networking requirements

Set the hostname to one of your choosing (hostname will default to localhost):

Example hostname: centosvda2

– Type hostname centosvda2 at the VM console and hit return

 Paste or type vi /etc/sysconfig/network into the VM console window and hit return

– Press Shift + a to enter edit mode

– Set the values as such, replacing hostname to the name of your choosing:

HOSTNAME=centosvda2.glover.com
NETWORKING=yes

– Press Esc

– Press Shift+z twice to exit and write changes to the configuration file

Set a Static IP by editing the required network config file as follows using network 0 (zero) as an example:

– Paste or type vi /etc/sysconfig/network-scripts/ifcfg-eth0 into the VM console window and hit return

– Press Shift + a to enter edit mode

– Set the values as such replacing the IP address details to match your own environment:

ONBOOT=yes
BOOTPROTO=Static
IPADDR=10.90.33.54
NETMASK=255.255.240.0
GATEWAY=10.90.32.1

– Press Esc

– Press Shift+z twice to exit and write changes to the configuration file:

Note: If you wish to assign IP details dynamically using DHCP then set the following values:

ONBOOT=yes
BOOTPROTO=Dynamic

Add DNS support allowing dynamic name resolution by editing the resolv.conf file and adding all required nameservers as follows:

– Paste or type vi /etc/resolv.conf into the VM console window and hit return

– Press Shift + a to enter edit mode

– Set the values as such replacing the Domain and nameserver details to match your own environment

search glover.com
nameserver 10.90.32.88

– Press Esc

– Press Shift+z twice to exit and write changes to the configuration file

Protect the /etc/resolv.conf from being modified on reboot by setting the write-protection attribute as follows:

chattr +i /etc/resolv.conf

Assign loopback address to hostname & validate hostname:

– Paste or type vi /etc/hosts and set as follows replacing details to match your own environment

– Press Shift + a to enter edit mode

– Set the values as such replacing the FQDN and hostname of the CentOS 6.6 VM to match your own environment:

127.0.0.1 CentOSvda2.glover.com CentOSvda2
127.0.0.1 localhost.glover.com localhost

Note: The 2nd localhost entry is required for the postgresql service to start successfully (covered in Pt.2 of the blog series…)

– Press Esc

– Press Shift+z twice to exit and write changes to the configuration file

– Type hostname -f to validate that the hostname is set correctly

Note: This should return the machine’s fully qualified domain name (FQDN):

– Type reboot and hit return to reboot the CentOS 6.6 VM

5. Install rpm packages:

Paste the following into the VM console and hit return to install the relevant packages:

yum -y groupinstall “Desktop” “Desktop Platform” “X Window System” “Fonts”
yum -y install authconfig krb5-workstation pam_krb5 samba-common oddjob-mkhomedir

Note: If you receive the following error: PYCURL ERROR 22 – “The requested URL returned error: 404”

Run yum clean all and try again

6. Install and Configure xRDP to access the GUI remotely:

Install EPEL repository

– Paste rpm -Uvh http://download.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm into the VM console and hit return

Install xrdp package

– Paste yum -y install xrdp tigervnc-server into the VM console and hit return

Configure xrdp service

– Once installed, run service xrdp start to start the xrdp service

– Run chkconfig xrdp on to ensure xrdp service starts on boot

Note: If you receive an error when running “service xrdp start“, type reboot and hit return to reboot the CentOS 6.6 VM

Select Quit to close the Text Mode Setup Utility:

7. Disable Firewall temporarily to allow remote access

Issue the following commands in turn:

– service iptables save
– service iptables stop
– chkconfig iptables off
– service iptables status

Note:  Once configuration of the CentOS VM is complete including the install and config or the Linux VDA itself, you should consider re-enabling the Firewall. It is also understood that the majority of people reading this blog series will be initially installing the Linux VDA in a purely test environment and will be well aware of the dangers associated with disabling the Firewall on a permanent basis. To re-enable the Firewall post configuration, issue the following commands in turn:

– service iptables save
– service iptables start
– chkconfig iptables on
– service iptables status

8. Configure NTP Service

Connect to the CentOS 6.6 VM using xRDP and the standard windows RDP client or Remote Desktop Manager Application and configure the Date and Time properties as follows:

Note: Click close to ignore the following warning if using the root user account to connect remotely:

1. Open the System menu > Administration > Date & Time
2. In the Date and Time tab, ensure Synchronize date and time over the network is checked
3. In the NTP Servers list, click Add
4. Enter the hostname or IP address of a local NTP Server and hit return. This is typically the hostname of the AD Domain Controller. The configuration tool will test for service reachability
5. Delete the other default NTP servers listed
6. Click OK. This will restart the NTP daemon

9. Join machine (CentOS 6.6 VM) to Domain

While connected to the CentOS VM over xRDP, click on the Applications menu > System Tools > Terminal

Paste or type authconfig-tui into the terminal window and hit return to bring up the GUI version of Autoconfig…

Configure as follows before clicking Next:

User Information:
-Use Winbind

Authentication:
-Use Shadow Passwords
-Use Kerberos
-Local authorization is enough

Set Kerberos settings as follows replacing the Realm, KDC and Admin Server values with those matching your own environment and click Next:

Realm: GLOVER.COM (Must be in caps)
KDC: dc.glover.com
Admin Server: glover.com

Set the Winbind settings as follows replacing the values with those that match your own environment and click Join Domain:

Security Model: ads
Domain: GLOVER
Domain Controllers: dc.glover.com
ADS Realm: GLOVER.COM (Caps required)
Template Shell: /bin/bash

Select Yes to save configuration changes when prompted:

Type the Domain administrator password and select OK:

Type the Domain administrator password again in the terminal window and hit return:

Click OK:

Note: the CentOS 6.6 VM should successfully join the specified DNS Domain with the Winbind service starting:

Run sudo chkconfig winbind on to ensure the winbind service starts on boot

Run sudo net ads testjoin

expected return value = Join is OK

10. Create Home Directories for Domain Users

Run the following commands in turn from within the console or terminal window

authconfig –winbindtemplatehomedir=/home/GLOVER/%U –enablemkhomedir –update 
mkdir /home/GLOVER 
chmod 751 /home/GLOVER

IMPORTANT: [authconfig parameters above should be prefixed by double en-dash’s as per the screenshot below and not a single em-dash as displayed above – WordPress related issue currently being investigated.]

Note: Replace GLOVER with the Domain name to match your testing environment and set the appropriate permissions as per your individual requirements – Example: 751

IMPORTANT: Disable and re-enable the following option through the UI:

1. Click on System > Administration > Authentication > Advanced Options and un-tick the option to “create home directories on the first login
2. Click on System > Administration > Authentication > Advanced Options and re-tick the option to “create home directories on the first login

Note: The above action of disabling and re-enabling home directory’s from within the UI seems to workaround what appears to be a bug when configuring Home Directory’s through the Command line.

11. Configure Kerberos for Winbind

By default, Winbind will not create the system keytab file /etc/krb5.keytab when joining the domain, which implies the Kerberos tools and libraries won’t be able to authenticate the machine account.

To force Winbind to create and maintain the system keytab file and automatically renew tickets, paste or type vi /etc/samba/smb.conf into the VM console window (or GUI terminal window) and hit return

– Press Shift + a to enter edit mode

– Add the following values under the Global Settings section (outside the authconfig section) of the samba configuration file:

kerberos method = secrets and keytab
winbind refresh tickets = true

– Press Esc

– Press Shift+z twice to exit and write changes to the configuration file

As the above settings will create the system keytab when the machine is joined to the domain (something we have already done in step 9 above), run sudo net ads changetrustpw and hit return to force the creation of the keytab file:

12. Configure PAM for Winbind

To enable Kerberos ticket caching and home directory creation for Winbind, paste or type vi /etc/security/pam_winbind.conf into the VM console window (or GUI terminal window) and hit return

– Press Shift + a to enter edit mode

– Add or change the following values under the Global section of the pam_winbind configuration file:

krb5_auth = yes

krb5_ccache_type = FILE

mkhomedir = yes

IMPORTANT: make sure to remove the semicolon preceding each of the above lines

– Press Esc

– Press Shift+z twice to exit and write changes to the configuration file

Run sudo service winbind restart to restart the Winbind daemon

Note: The winbind process will only continue to run if the machine is joined to a domain.

13. Verify Kerberos Configuration (Optional)

To verify Kerberos is configured correctly for use with the CentOS 6.6 VM, check that the system keytab file has been created and contains valid keys by running klist -ke at the console or terminal window:

Note: This should display the list of keys available for the various combinations of principal names and cipher suites.

14. Verify User Authentication (Optional)

Use the wbinfo tool to verify that domain users can authenticate with the domain

Run wbinfo –krb5auth=domain\\username%password

Note: The domain specified here is the AD domain name, not the Kerberos realm name. For the bash shell, the backslash (\) character must be escaped with another backslash. This command will return a message indicating success or failure.

Example: wbinfo –krb5auth=glover\\administrator%Citrix1

IMPORTANT: [the wbinfo parameter above should be prefixed by double en-dash’as per the screenshot below and not a single em-dash as displayed above – WordPress related issue currently being investigated.]

Logon locally with a domain user account that has not logged onto the machine previously to confirm that the Winbind PAM module has been configured correctly

Run ssh localhost -l domain\\username 

– Example: ssh localhost -l glover\\administrator)

Run id -u

Check that a corresponding Kerberos credential cache file was created for the uid returned when running the id -u command above

Run ls /tmp/krb5cc_uid and substitute uid with the value returned when running the id -u command above

– Example: ls /tmp/krb5cc_16777216

So that’s it for now…. part 1 done and dusted. If you’ve made it this far without incident then you should take a well-earned coffee break knowing you are ready for part 2. More than likely available by the time you read this, pt.2 will cover the installation and configuration of the Linux VDA.

Follow me on @XDtipster for up to the minute BLOG release announcements including Linux VDA setup on CentOS 6.6 pt.2 (Coming VERY SOON)

Best Regards,

Mick Glover (aka XD Tipster)
Senior Readiness Specialist,
Worldwide Support Readiness [EMEA]
Citrix Systems, Inc
Follow @xdtipster