KACE Asset Management Appliance 7.1

Configure local routing tables

Configure local routing tables to enable the K1000 to route traffic through multiple gateways on a network.

Local routing tables are useful when the physical appliance is located in one office, and managed devices are located in a different location. For example, if the appliance is located in Texas, and managed devices are located in California, the K1000 appliance would serve devices on the Texas subnet. Using the a local routing table, the appliance could be pointed to the network in California, so that it could host the California devices as well as the Texas devices.

Go to the appliance Control Panel:

◦

If the Organization component is not enabled on the appliance, log in to the K1000 Administrator Console, http://K1000_hostname/admin, then click Settings.

◦

If the Organization component is enabled on the appliance, log in to the K1000 System Administration Console, http://K1000_hostname/system, or select System in the drop-down list in the top-right corner of the page, then click Settings.

Click Local Routing Table to display the Local Routing Table Settings page.

Click the Add button to add an entry:

Specify the following settings:

Option	Description
Name	Enter a name for the route.
Destination	Enter the IP address or network for the destination with which you want your K1000 appliance to communicate.
Subnet Mask or CIDR	Enter the subnet mask of the specified network. For example: 24, 255.255.240.0. This is applied to the host.
Gateway	Enter the IP address of the router that routes traffic between the K1000 appliance and the destination network.

Click Save at the end of the row to save the entry.

Click Save and Reboot at the bottom of the page to save all changes.

A warning appears indicating that the Apache™ service needs to be restarted.

Click OK to continue.

Configure local web server settings and whitelist hosts

You can configure local web server settings to specify a whitelist of hosts that are allowed to access the Administrator Console, System Administration Console, and the User Console. After you create the whitelist, access is restricted to the hosts on the whitelist.

NOTE: After an IP address or domain name is whitelisted (added to the Allow List), only that IP address or domain has access. All others are blocked.

Go to the appliance Control Panel:

◦

If the Organization component is not enabled on the appliance, log in to the K1000 Administrator Console, http://K1000_hostname/admin, then click Settings.

◦

Click Access Control List to display the Access Control List Details page.

Specify the following options:

Option	Description
No access restrictions	Select this option to allow access from any web address.
Restrict access as specified below	Select this option to restrict access to web addresses on the Allow List. To whitelist IP addresses on the appliance’s subnet in addition to the specified destinations, select Allow all IP addresses in the same subnet as the appliance.

In the Allow List section, click the Add button to add an entry:

Specify the following options.

Option

Description

Destination

Specify the destination:

•

adminui: This is the Administrator Console, Admin level. A whitelist of users who can log in to http://K1000_hostname/admin.

•

userui: This is the User Console. A whitelist of users who can log in to http://K1000_hostname/user.

•

systemui: This is the System Administration Console (available only if the Organization component is enabled on the appliance). A whitelist of users who can log in to http://K1000_hostname/system.

IP Address/Domain Name

Provide the address to be allowed. This can be either:

•

A domain name (full or partial)

•

An IP address (full or partial)

Subnet Mask/CIDR

(Optional) Provide a subnet mask/CIDR (Classless Inter-Domain Routing) to be allowed. This enables a finer-grained subnet control.

Click Save at the end of the row to save the entry.

Click Save at the bottom of the page to save all changes.

A warning appears indicating that the Apache service needs to be restarted.

Click OK to continue.

NOTE: After an IP address or domain name is added to the Allow List, only that IP address or domain can access that page. All others are blocked.

Configure security settings for the appliance

You must configure appliance security settings to enable certain capabilities such as Samba share, SSL, SNMP, SSH, database access, and FTP access.

To enable SSL, you need to have the correct SSL private key file and a signed SSL certificate. If your private key has a password, the appliance cannot restart automatically. If you have this issue, contact Quest Support at https://support.quest.com/contact-support.

NOTE: Saving changes to security settings reboots the appliance.

NOTE: In some cases, the Firefox® browser does not display the Administrator Console login page correctly after you enable access to port 443 and restart the appliance. If that happens, clear the Firefox browser cache and cookies, then try again.

Go to the appliance Control Panel:

◦

If the Organization component is not enabled on the appliance, log in to the K1000 Administrator Console, http://K1000_hostname/admin, then click Settings.

◦

Click Security Settings to display the Security Settings page.

In the top section, specify the following settings:

Option

Description

Enable SSH

Permit SSH logins to the appliance. When SSH is enabled, SSH encrypted communications are permitted over port 22.

Enable webserver compression

Enable the appliance to compress web pages. This compression reduces the time it takes to load Administrator Console and User Console pages in the browser.

Enable inventory API access

Use API (application programming interface) commands to update inventory information. If you want to upload device information using the API, you must enable this setting. See Adding devices manually using the API.

API Password

The password for API (application programming interface) access to inventory information. This password is used only for API access and it does not need to match any other passwords.

Enable SNMP READ access

Enable unidirectional (read-only) SNMP access to managed devices on the network.

SNMP Community String

The SNMP community string that enables read-only SNMP access. The default value is public.

Enable SNMP Trap monitoring

Enable SNMP (Simple Network Management Protocol), a protocol for monitoring managed devices on a network. SNMP is supported by Dell Open Manage and many third-party products. If you do not want to receive SNMP traps from network devices, clear this option.

When you enable this feature on the appliance, and the related devices are also enabled for monitoring, the appliance can receive SNMP traps from the monitored network devices such as printers, projectors, and routers. This feature only applies to network devices managed through the SNMP-managed devices, such as agentless devices using SNMP connections.

For information on how to enable device monitoring, see Enable monitoring for one or more devices.

SNMP traps are messages initiated by network devices and sent to the trap receiver on the appliance. For example, a router can send a message when its power supply fails. Or, a printer initiates a message when it runs out of paper. The appliance receives these traps and generates alerts when certain pre-defined thresholds are reached.

•

SNMP version 1 or 2: This version only requires a valid community string. A community string is required to allow the appliance to receive SNMP trap messages from monitored network devices. The appliance supports multiple security strings. To add a community string, open the v1/v2 tab, click

, type the community string, and click Save.

•

SNMP version 3: This version implements enhanced security and remote configuration features and requires a valid user name and encryption information. To add a security name, open the v3 tab, click

, and provide the following information:

◦

Security Name: The name of the User-based Security Model (USM) account that sends the SNMP trap.

◦

Engine ID: The ID of the SNMP application engine that sends the SNMP trap.

◦

Authentication Password: The password associated with the Security Name.

◦

Authentication Protocol: The protocol used for authenticating the user: MD5 or SHA.

◦

Privacy Password: The encryption key for the data packet.

◦

Privacy Protocol: The encryption protocol: AES or DES.

◦

Security Level: Indicates the level of security:

▪

authPriv: The identity of the sender is verified and the information is encrypted.

▪

authNoPriv: The identity of the sender is verified, but the information is not.

▪

noAuthNoPriv: The identity of the sender is not verified and the information is not encrypted.

MIB Files

Upload vendor-specific MIB (management information base) files. A MIB file allows the trap receiver on the appliance to translate SNMP traps into human-readable messages. These files are optional.

•

To upload a MIB file, on the Security Settings page, under MIB Files, in the Upload MIB area, click Browse, and select a MIB file.

•

A MIB file must meet certain standards. The appliance validates every MIB file that you upload. If you upload an invalid MIB file, an error message appears along the top of the Security Settings page. If you do not want to validate the contents of the MIB file, select the Skip MIB validation check box.

Enable Secure backup files

Require username and password authentication for access to K1000 backup files, which are available by entering a URL in a browser.

Clear this option to enable access to backup files through a URL without username or password authentication. This is useful for external process that require access. See About appliance backups.

Enable backup via FTP

Enable access to the database backup files through a read-only FTP server. This enables you to create a process on another server to access the backup files.

If you do not need this access, clear this option.

Make FTP writable

Enable the upload of backup files using FTP. FTP is useful for backup files that are too large for the default HTTP mechanism and cause browser timeouts.

New FTP user password

Require a password for FTP access to the backup files.

Enable mDNS

Enable the appliance to respond to multicast Domain Name System (mDNS) and DNS Service Discovery (DNS-SD) requests. This option makes it easier for users and administrators to locate the Administrator Console and User Console. If you do not need the appliance to respond to these requests, clear this option.

Enable webserver diagnostic graphs

Enable the K1000 to display usage information for the appliance web server, such as Apache access and volume statistics. This information appears in graphs in the System Performance log. If this option is cleared, the graphs are not updated. See View appliance logs.

Enable database access

Enable users to run reports on the K1000 database using an external tool, such as Microsoft Access or Excel, over port 3306. If you do not need to expose the database in this way, clear this option.

Enable secure database access (SSL)

Enable SSL access to the database and access additional SSL options.

Optional: In the Appliance Encryption Key section, click Generate Key to generate a new encryption key. This key is used to enable Quest Support to access your appliance for troubleshooting using a tether. It is not necessary to generate a new key unless you believe that the current key has been compromised. See Enable a tether to Quest Support.

The time stamp shows the time the key was generated.

In the Single Sign On section, specify authentication settings:

Option	Description
Disabled	Prevent the K1000 from using single sign on. Single sign on enables users who are logged on to the domain to access the K1000 Administrator Console and User Console without having to re-enter their credentials on the K1000 login page.
Active Directory	Use Active Directory for authentication. Active Directory uses the domain to authenticate users on the network. See Using Active Directory for single sign on.
Quest Identity Broker	Use Quest Identity Broker (QIB) for authentication. QIB is a cloud-based single sign on (SSO) solution that allows users to securely authenticate using various identity providers. See Using Quest Identity Broker for single sign on.

In the Samba Share Settings section, specify the following settings:

Option

Description

For appliances with the Organization component enabled:

Enable Organization File Shares

For appliances without the Organization component:

Enable File Sharing

Use the appliance's client share to store files, such as files used to install applications on managed devices.

The appliance’s client share is a built-in Windows file server that can be used by the provisioning service to assist in distributing the Samba client on your network. Quest recommends that this file server only be enabled when you perform application installations on managed devices.

NOTE: If the Organization component is enabled on your appliance, you can select additional file sharing options for each organization. See Enable file sharing at the System level.

Require NTLMv2 to appliance file shares

Enable NTLMv2 authentication for the K1000 files shares. When this is enabled, managed devices connecting to the K1000 File Shares require support for NTLMv2 and they authenticate to the K1000 using NTLMv2. Although NTLMv2 is more secure than NTLM and LANMAN, non-NTLMv2 configurations are more common and this option is usually turned off. Enabling this option disables lanman auth and ntlm auth on the Samba server. NTLMv2 Levels 1-4 are supported. If you need NTLM v2 Level 5, consider manually provisioning the K1000 Agent. See Manually deploying the K1000 Agent.

Require NTLMv2 to off-board file shares

Force certain K1000 functions that are supported through the Samba client, such as Agent Provisioning, to authenticate to off-board network file shares using NTLMv2. Even though NTLMv2 is more secure than NTLM and LANMAN, non-NTLMv2 configurations are more common and this option is usually disabled. Enabling this option enables the client ntlmv2 auth option for Samba client functions.

Optional: In the SSL section, specify SSL settings:

IMPORTANT: Enabling SSL is a one-way automatic shift for managed devices. Devices must be reconfigured manually if you disable SSL.

Option	Description
Enable Port 80 access	Enable access to the appliance over port 80. Quest recommends that you enable port 80 access because, by default, the Agent installers contact the appliance using port 80. Agents switch to SSL over port 443 after they acquire the server configuration. If you disable port 80 access, contact Quest Support to adjust the Agent deployment scripts to handle SSL.
Enable SSL	Enable managed devices to connect to the appliance using SSL (HTTPS). Enable this setting only after you have properly deployed the appliance on your LAN in non-SSL mode. To enable SSL, you need to load an SSL certificate as described in 8.
Enable SSL v3	(Displayed only if Enable SSL is selected). Enable managed devices to connect to the appliance using SSLv3, which is an older version of SSL. Because of vulnerabilities associated with SSLv3, this setting should be enabled only if you have Agent-managed devices that are running version 6.3 or earlier of the K1000 Agent. SSLv3 is disabled by default on new K1000 appliances. For more information about SSLv3 vulnerabilities, see https://support.quest.com/kb/136510.

To load an SSL certificate, do one of the following:

◦

Click SSL Certificate Form to generate certificate requests or load self-signed certificates. See Generate an SSL certificate.

◦

If you have an SSL certificate and private key, click Browse or Choose File in the SSL Private Key File or SSL Certificate File fields to select them. These files must be in Privacy Enhance Mail (PEM) format, similar to those used by Apache-based web servers.

◦

Select Enable Intermediate SSL Certificate to enable and upload intermediate SSL certificates, which are signed certificates provided by certificate issuers as proxies for root certificates. Intermediate SSL certificates must be in PEM format.

◦

If your certificate is in PKCS-12 format, click Browse or Choose File in the PKCS-12 File field to select it, then enter the password for the file in the Password for PKCS-12 file field.

In the Secure Attachments in Service Desk section, choose whether to add security for files that are attached to Service Desk tickets:

◦

Select the check box to enable security for files attached to tickets. If you choose this option, users can access files attached to tickets only from within the K1000 Administrator Console or User Console.

◦

Clear the check box to enable users to access files by clicking ticket links from outside the Administrator Console or User Console.

10.

Click Save and Restart Services to save changes and restart the appliance.

NOTE: In some cases, the Firefox browser does not display the Administrator Console login page correctly after you enable access to port 443 and restart the appliance. If that happens, clear the Firefox browser cache and cookies, then try again.

Configure Active Directory as the single sign on method

Active Directory single sign on enables users who are logged on to the domain to access the K1000 Administrator Console and User Console without having to re-enter their logon credentials each time.

Before you connect the K1000 to an Active Directory server, verify that:

•

Network and DNS settings are configured to enable the K1000 appliance to access the Active Directory server. See Changing appliance network settings.

•

The time settings on the Active Directory server match the time settings on the K1000 appliance. For information on setting the time on the K1000 appliance, see Configure appliance date and time settings.

Go to the appliance Control Panel:

◦

If the Organization component is not enabled on the appliance, log in to the K1000 Administrator Console, http://K1000_hostname/admin, then click Settings.

◦

In the Single Sign On section of the Security Settings page, select Active Directory, then provide the following information:

Option	Description
Domain	The hostname of the domain of your Active Directory® server, such as example.com.
Username	The username of the administrator account on the Active Directory server. For example, username@example.com.
Password	The password of the administrator account on the Active Directory server.