order, test, and deploy remote KVM for GNAX

[stowler]

20140130 stowler email to Keith, Bruce, Joe, and Dan:

Hi guys,

Keith is aware of this, but if we are going to have servers somewhere that is hard to reach physically (e.g., NDB without access cards, or White Street's long drive from anywhere), we need to include a 1-pizza-box-thick item in the rack that allows us to remotely access keyboard, video, and mouse ports without being on-site. For example:

http://www.newegg.com/Product/Product.aspx?Item=N82E16817404066&ignorebbr=1

This "remote KVM" also provides the keyboard, video, and mouse for when we are physically in front of the equipment.

20140205 stowler response to Bruce's question about how frequently we'll need physical access to our off-campus equipment:

Physical access:

When there are no problems to troubleshoot access needs are just driven by PRN operations:

• equipment instal
• equipment removal
• equipment upgrade

When there are problems that require rebooting or off-network access we require constant and immediate access through the duration of the troubleshoot. Examples include:

• BIOS changes and diagnostics
• RAM testing
• loss of network
• loss of power
• intentional removal of network to Dx whether network is a source of trouble

The $1700 remotely accessible keyboard/video/monitor switch (KVM) I sent last week obviates need for physical access during all of those troubleshooting examples except for loss of power.

[stowler]

20140624 stowler email requesting KVM:

Keith, Dan, Bruce (cc: Rob and Lisa),

We or Emory need to buy a remote KVM for GNAX White Street. The decision about whether Emory should pay for that is above my pay grade, but I will point out that Marc Overcash decided that Emory can't meet the on-campus hosting commitments they made to our recruited PIs. As a result our investigators are now going to carry ~$1k/mo off-campus hosting costs, so at minimum there's an argument for Emory absorbing the non-recurring costs including GNAX's install fees and KVM+cabling.

Regardless of who pays, I don't need to be involved in the decision or equipment ordering. If Emory is going to pay for it, Keith can liaise with Dan for selection, ordering, and delivery. If our center/PIs are going to pay for it, Keith can order via Lisa.

Keith/Rob: please track via github issue: https://github.com/stowler/imagingcore/issues/28

(That github issue also has my original emails about this and a link to example equipment. Purchase will need to include cables for our five current hosts + additional as Keith anticipates growth.)

Thanks, Stephen

[stowler]

BC is going to ask Keith to order through Lisa (per BC verbal today ~4:30p).

[stowler]

Emailed Keith and Lisa: Any updates on the KVM? I think my last information was verbals from Keith and Bruce that Keith is ordering through Lisa.

[stowler]

Yesterday: Keith sent quote for KVM and PS/2 connectors. Today: I approved, but replied that we need the USB version of the connectors

[stowler]

W, 20140702: Keith sent corrected CDW-G equipment quote to Lisa for ordering.

[stowler]

W, 20140716: emailed @rrmm request to configure, test, document KVM before August 4.

[rrmm]

Status:

• Console access works with tested system.
• OSD KVM menu for setup can be accessed by hitting the shift key twice.
• No password is currently setup for physical console access. (Assume datacenter security enough...is this valid)? NB: physical console passwords and users are distinct from the remote credentials and must be set at the physical console.
• Original IP firmware requires Java 1.6 to run. Downloaded a legacy version and used to connect to admin interface.
• reset default admin password and added a second privileged account (credentials are with the kvm)
• flashed new IP firmware: Tripplite116IP_3_0_5_583
• did not flash new mainboard firmware
• new firmware allows a current Java 1.7 to connect to admin interface
• Java 1.7 will run from a browser (which otherwise blocks lower versions due to their security vulnerabilities).
• new firmware does not work with Java 1.8 because Java 1.8 will not allow the running of self-signed JARs (and a manifest issue seems to pop-up as well).
• remote config access is available
• remote console access hasn't yet worked: an error occurs telling me to check the environment and then exits.

[rrmm]

Status:

• able to view video from computer connected to the switch remotely
• appears to require 32-bit jvm to work
• still need to setup mouse to sync properly
• to do more extensive testing will require a bit extra setup:
  • another system to connect to kvm
  • windows computer
  • more cat5 b/w video/usb dongle and kvm

[rrmm]

status:

• got extra setup
• mouse syncs correctly with windows option: Enable enhanced accuracy unchecked
• flashed the mainboard firmware with: TrippLite_Package_Cirque_Touchpad_20100506.tfp
• No apparent way to use the console separately from the IP connected user
• after disconnection of the remote IP user, the console mouse appears inopperable
• windows client doesn't install as indicated in manual
• the same version windows jvm doesn't work: Manifest error; older ones might work (untried)

[rrmm]

status:

• jre 1.7 does seem to work on windows, but you must specify full path to the appropriate javaws.exe
• turning off the serial port option (in OSD on console) kills the mouse for remote client for whatever reason
• java client stores password in plaintext

[stowler]

T, 20140805:

Rob updated me yesterday: he's done with the KVM config and is now writing up the documentation (vendor docs were unreliable and it turns out there are poorly documented differences between old and new versions of the same model name)

[rrmm]

First draft of notes will update as more info, and put the finished into a prominent location in vcs

any comments on whether/how to keep track of pw's for stuff? a gpg encrypted file somewhere?

B070-016-19-IP

Manual and firmware (at current time):

NB: NOT this one: http://www.tripplite.com/shared/techdoc/Owners-Manual/9332D5.pdf

Be sure to look at the manaual for the appropriate series: Model: B070-016-19-IP Series: AGCB6533

http://www.tripplite.com/shared/software/Firmware/B070-016-19-IP_Firmware_3-29-13.zip

as recieved:

• Get Java 1.6 from oracle

  http://www.oracle.com/technetwork/java/javase/downloads/index.html

  From the archive:

  http://www.oracle.com/technetwork/java/javase/archive-139210.html

  http://www.oracle.com/technetwork/java/javase/downloads/java-archive-downloads-javase6-419409.html

  • Java SE Runtime Environment 6u45
  • Choose Windows x86 or Linux x86 (ie 32 bit versions)

  Requires free Oracle account

• After setting up:
• ensure you are using the correct jvm
• ensure your security settings are set low enough to allow self-signed applications to run
• using 'javaws -viewer' should bring up the settings options make sure the only java version selected is 1.6
• on linux make sure the java/javaws links point to the correct version of java as well

• Connect and Update IP Firmware

  javaws https:///ui.jnlp

  -Login to the configuration manager using the default credentials: admin/access -Unzip the firmware and upload the software contained in the IP subdir

• Change the default admin password -Add new account with admin privileges (if you cannot modify the password while logged in) -Login to new account and change the admin account's default password
• Get Java 1.7 [java 7 can be used at this point now which at time of writing was the lowest version that could still be run in a browser]
• Secure Console
  • use double left shift hot-key to enter the OSD menu
  • F2 to go settings
  • turn on security
  • set the passwords for all 6 users, supervisor, and admin account
  • DO NOT turn off the serial port update option as this seems to trigger a bug
• Update the mainboard firmware by installing the application in the mainboard directory of the firmware on a windows machine and connect the serial port using the supplied DB9 to RJ11 adapter. The mainboard firmware directory of the downloaded firmware contains a windows application to flash the
• Secure IP make sure snmp is turned off and temp banning is on (change admin password from default if you haven't done it in a previous step)

• After console security is installed the double-shift hotkey will always bring up a password prompt. Use one of the console pass.

  At the console, all key combinations seem to function properly.

  • Mouse/keyboard cannot be used while a remote connection is in progress; if necessary the KVM can be power-cycled to remove the remote user. (This can be done w/o affecting the connected hosts). -The mouse might freeze after a remote connection ends; the fix is the same as above

• Remote: Most key combinations work except those caught by the window manager of the computer you are at.

  -Mouse issues: on windows, the high-precision mouse mode must be turned off in the mouse settings menu of the headless system.

  -on linux, it may be necessary to turn off mouse acceleration of the headless system to keep the mouse in sync.

  -ctrl-M can be used to align the mouse. (the key combination still seems to be passed to the headless machine).

• Once the system is set to a static IP it may be advisable to create a valid self-signed certificate which can then be distributed to the users to add to their browser/java cert db