How to establish a Tether connection with KACE Technical Support (4267510)

KACE Engineers may need to access your KACE appliance remotely to access your web admin, server console, SMTP server, database, and log files to resolve technical issues based on your appliance settings.

Tether is an SSH connection back to a server in the KACE DMZ using an expiring SSL key that we provide. Each key can only be used once and will expire in a predetermined timeframe, with a maximum of 12 weeks.

The connection can only be opened from your appliance, by you by entering the key matching your appliance serial number that was provided when the tether request was initiated. The server it connects to is running FreeBSD with no services other than an inward facing apache. It allows us to use SSH to it from our internal network, and then port forwards 80/443 and SSH to your appliance as long as the tether is connected, and has proven invaluable in speeding up our support of configuration issues. 

You can terminate the connection at any time by disabling tether. Again, it is an outbound SSH connection from your appliance - we have no way of connecting in to your appliance unless it is connecting outbound on SSH (port 22) to tether.kace.com. If you want to prevent it, but leave the port enabled on the appliance, you can block the SSH port (22) on the outbound firewall.

Upon applying the tether, a user account kace_support is created with administrative privileges. Depending on the version of the SMA, the kace_support user may either have a password determined by you, or [preferably] a random password generated by the tether key (Use option to allow KACE to set password). With newer versions, the option to set the password has been removed and a random password will be generated for use with only with the tether in which it is issued.

Prerequisites:

• All KACE appliances MUST be able to connect on port 22 outbound to tether.kace.com for a connection to be successful.  This is an ssh tunnel to our tether server.
• If a firewall is blocking the KACE appliance from making an outbound connection, the tether will not connect. An exception may be necessary for tether.kace.com.
• [SMA] SSH MUST be enabled via Settings | Security Settings. With newer versions, when clicking on Enable Tether, SSH will be enabled automatically.

Applying the tether to the KACE Systems Management Appliance (SMA):

Note: These instructions are legacy (10.1 and below). For the new One-Click Tether instructions for 10.2 and above, please see How to One-Click Tether (316488)

1. Click on Settings.
2. Click on the Support tab.
3. Click on Troubleshooting Tools.
4. Check the Enable Tether under Quest/KACE Support tether.
5. Check the boxes for Enable KACE Support User and Allow KACE to set password. (Note: You Can uncheck the Allow Kace to set Password, and put your own PW in the password box. However, the Tether server creates a secure Password that is encrypted in the tether key.)
6. Copy and paste the tether key that you received from KACE Technical Support.  Make sure you do not copy any extra spaces at the end.
   1. if the tether is successful you will see the following:
      1. tether pid file exists... unclean shutdown?            
         [Mon, Jun 24 2013 10:30:12 EST] [ktether] Starting.    
         [Mon, Jun 24 2013 10:30:13 EST] [ktether] Starting ssh.
         [tether]                                               
   2. If you do not see this output please refer to the Prerequisites mentioned above.
7. Inform KACE Technical Support that you have applied the tether.

Applying the tether to the KACE Systems Deployment Appliance (SDA):

Note: These instructions are legacy (6.0 and below). For the new One-Click Tether instructions for 6.1 and above, please see Self initiating a tether for the SDA Appliance (268832)

1. Click on Support
2. Click on the Tether tab
3. Check the Enable Tether Box.
4. Copy and paste the tether key that you received from KACE Technical Support.  Make sure you do not copy any extra spaces or line returns at the beginning or end of the key.
5. Click Save
   1. If the tether connection is successful, you will see the following output:
      
      1. tether pid file exists... unclean shutdown?            
         [Mon, Jun 24 2013 10:30:12 EST] [ktether] Starting.    
         [Mon, Jun 24 2013 10:30:13 EST] [ktether] Starting ssh.
         [tether]                                               
   2. If successful, inform KACE technical support that you have applied the tether and provide them with administrator credentials to login to the web interface.
      1. If you are utilizing LDAP Authentication, you will need to either provide the credentials for the built-in admin account or provide LDAP credentials for a user that can login to the appliance as an administrator.

Note: If a technician asks that you "reset" the tether, just go to the tether page, click the edit button and then click the save button. This will help reestablish the connection.