FLEXnet Publisher on OS X - lagnese.melagnese.me/docs/netopts/FLEXnet_Publisher_on_OS_X.pdf ·...

FlexNet PublisherOS X Guide(LMAdmin on Mountain Lion)

Gregg Lagnese • 2012 Oct • Rev 1.0

Contents

About FlexNet Publisher 3

About This Guide 3

Getting Started 4Server Setup 4

Software 4

Security 5User Account Setup 5

Installation 6Firewall Con!guration 8

Loopback Setup 9

lmadmin Permissions 10

Startup Con!guration 10Permissions 12

Vendor Daemon Con!guration 13

lmadmin Initial Setup 14Securing The Web Service 15Adding Vendor Daemons 16

Testing 18Self-Start Test 18

Final Notes 19Daemons Failure After Sleep 19

Root Ownership and Launchd 19

Localizing the MAC Address 19

Document Revisions 20

About FlexNet PublisherFlexNet™ Publisher is used to provide a concurrent licensing framework for software manufacturers. There are two distinct versions of the product available. FlexLM, the original product name, uses a di!erent legacy (lmgrd) implementation from the current (lmadmin) version. FlexLM is administered via command line or a console interface, while LMAdmin is administered via command line or through a browser-based interface. This guide refers to the lmadmin variant.

About This GuideThis guide, while relatively fundamental, requires an understanding of networking and networking concepts, such as name resolution and port management. The guide also assumes an intermediate knowledge of Apple’s OS X operating system and a minimal understanding of UNIX. This guide makes use of UNIX commands to perform modi"cations to the operating system environment. It is possible to damage the system whilst performing these steps (albeit a remote possibility), therefore, whenever executing root changes to an operating system, caution should be exercised.

While every e!ort has been made to ensure accuracy, errors and omissions may be present. This guide may be updated or amended from time to time, to correct any such errors if found.

FlexNet Publisher for OS X | Gregg Lagnese • 2012-Oct. |

Getting StartedThis guide will describe how to setup lmadmin under OS X 10.8 (Mountain Lion). Note that there are many ways to implement daemon processes on OS X, and only one is preferred and recommended by Apple. Speci"cally, Apple recommends using launchd, however, launchd requires that the daemons operate with root ownership. When tested, lmadmin refused to start properly with root ownership of any kind. When this issue can be resolved, this guide will change to re#ect this method of implementation. Currently, this guide uses the Flexera recommended approach of a non-privileged startup item. There are many reasons why this is not as desirable when compared to using launchd. The notes at the end of this guide describe the launchd implementation and the current issues based on the research performed.

Server SetupWhen setting up the server, there are two distinct implementation options. One option is the traditional server implementation whereby the server operates in a manner which serves licenses to one or more client computers on a given network. In the second implementation, the server operates in a loopback con"guration providing licenses to the client on which the server resides. This latter option may seem counter-intuitive. The reason to run a loopback license server is for high availability when node-locked licensing is not an option. For example, consider a laptop being used in a physically rugged environment or in one which the laptop or computer may undergo base changes to boot sector information (dual boot, virtual machine manipulation, etc.). If the machine is disconnected from the internet, there would be no way to ‘re-lock’ the license to the machine in the event of a system change, physical or otherwise. Frequent activations may also cause the vendor to stop issuing activations thereby rendering the software inoperable.

When the server is used locally on the same client as the software, the server itself can be used to provide local licensing thereby removing the need to node lock while simultaneously providing the advantages of node locking. The server is tied to the local system by the internal ethernet address; however, this would not be a!ected by changes to boot blocks or even the replacement of the drive on which it resides. This makes the con"guration very fault tolerant.

This guide will explain how to implement both types of installations.

SoftwareTo begin, you will need the software for the license server. This will be comprised of two parts: the listener component, the broker component engine that handles the initial request, and the speci"c vendor daemon executables responsible for delivering the speci"c vendor’s licenses. The former is LMAdmin and can be obtained for free from Flexera at this URL:

http://www.globes.com/support/fnp_utilities_download.htm

Speci"cally, you should download lmadmin only. The lmgrd and lmutil downloads are not necessary; they are based on the older legacy licensing model.




SecurityWhen installing any software which can expose the computer to inbound requests, it is important to de"ne non-privileged accounts to execute the listeners and daemon processes. It is also important to understand that the process requires opening inbound ports through the OS X "rewall to allow remote requests. This only applies to traditional client-server con"gurations. Loopback con"gurations do not require any open ports on the client.

User Account SetupIn the event of a malicious attack, any compromise would be limited in scope to the permissions available to the non-privileged account. The installation should use a distinct user account under which the software will be installed. Use OS X to create a new user speci"cally for the installation:

Getting Started


InstallationLog in as the new user and install the software following the prompts. Accept the default location for the installation (Applications folder). You should note that this does not install the application into the core Applications folder. That is, the application should not reside in /Applications. Instead, ensure it is installed to /Users/[account name]/Applications. If you attempt to force the application to install into the root application folder, it will not run. Applications installed in the root folder need to have root privileges and lmadmin will not operate with root privileges. The recommended installation directory name is lmadmin.


Use port 8080 for the web server (a standard alternative http port):

Do not check the Start Server Now checkbox (it won’t start anyway) just prior to the last page.

After installing the software, rename the FNPLicenseServerManager directory to something shorter. In our examples, we use lmadmin.

Next, copy the vendor daemon to the root of the lmadmin install directory.

In these examples, we will be using the Autodesk vendor daemon to serve Autodesk licenses for Autodesk products. For more detailed instructions related to the Autodesk vendor daemon, see the section below entitled Vendor Daemon Con!guration.

For brevity, the installation directory may be stated as ~/Applications/lmadmin. The ~ symbol refers to the user’s home directory.

Installation


Firewall Con"gurationWhen setting up a traditional client-server con"guration, there must be an exception in the "rewall rules to allow inbound communication to the server. There are two ports that must be con"gured: the listener port and the vendor port. The listener port is the port under which lmadmin listens for the initial license request. The vendor port is the communication channel used to relay the speci"c license communication between the vendor daemon and the client.

To open the ports needed, it is easiest to select the application in the OS X "rewall System Preferences pane. Open the Security & Privacy application preference panel, Firewall, then login with administrator rights and click the ‘+’ to browse to the lmadmin administrator’s Applications directory where lmadmin resides. Select the executable and choose Allow incoming connections from the drop-down.

Repeat these steps for the vendor daemon. In these examples, our vendor daemon is adskflex.

Installation


Loopback SetupLoopback con"gurations do not require ‘holes’ in the "rewall. However, you may "nd it convenient to add the "rewall exceptions by selecting Block incoming connections instead. When con"guring the system in this manner, it becomes possible to switch between a localized personal license manager and one that can be used by other clients (a desktop system, for example).

A loopback con"guration does require a root level setting to redirect requests to the local interface thereby bypassing the network interface. In doing so, it prevents the request from going out over the network and obviates the need for any name resolution to reach the license server.

To con"gure the loopback, an entry for the host must be made to redirect requests to the local OS rather than the network. This is accomplished with the hosts "le found within the OS. Edit this "le as follows using vi in a terminal window. If you are unfamiliar with vi, you can use pico or any other text editor as long as you launch the editor as root:

sudo vi /etc/hosts

The host "le should contain something like this:

### Host Database## localhost is used to configure the loopback interface# when the system is booting. Do not change this entry.##127.0.0.1 localhost255.255.255.255 broadcasthost::1 localhost fe80::1%lo0 localhost

Modify the loopback IPv4 interface to use an alias for your license server. In these examples, the license server name will be osxnlm using the local domain.

127.0.0.1 localhost osxnlm.local osxnlm

Save the hosts "le and exit vi.

Installation


lmadmin PermissionsAs installed, lmadmin cannot be run properly by the installation user. In order to correct this issue, the permissions must be changed for the installation directory. Open a terminal window and execute the following commands to change the permissions as follows:

Directory: drwxrwxr-x (775 or 755 - drwxr-xr-x)

Executable Files: -rwxr-xr-x

The speci"c commands to do so are:

cd ~/Applicationssudo chown -R flexera:admin lmadminsudo chmod -R 775 lmadmincd lmadminsudo chmod 755 lmadminsudo chmod 755 adskflex

Startup Con"gurationCreate a startup item so lmadmin can run at startup without manual intervention. To do this, create a speci"c startup folder in the OS, then create a start parameter list and a shell script which handles the startup and shutdown of the license server daemon.

Startup Items

Create a folder called LMadmin in /Library/StartupItems.

Create two new text "les (on the desktop or elsewhere) called LMadmin and StartupParameters.plist. The LMadmin "le will become an executable shell script and should not have any extension.

Installation


Startup Parameters

Open StartupParameters.plist with your favorite text editor and add the following entries:

{ Description = "License Administration Service"; Provides = ("License Administration Service"); Requires = ("Resolver", "Disks"); OrderPreference = "None";}

Next, open LMadmin with your text editor and add the following entries:

#!/bin/sh

. /etc/rc.common

StartService (){ ConsoleMessage "Starting License Administration Service" su $lmadminUser -c "$lmadmin" > "$consoleLog" 2>&1 &}

StopService (){ ConsoleMessage "Stopping License Administration Service" read pid < $pidFile kill -TERM $pid}

RestartService (){ ConsoleMessage "Restarting License Administration Service" read pid < $pidFile kill -TERM $pid su $lmadminUser -c "$lmadmin" > "$consoleLog" 2>&1 &}

installDir="/Users/flexera/Applications/lmadmin"lmadminUser="flexera"pidFile=${PIDFILE-${installDir}/logs/lmadmin.pid}lmadmin="${installDir}/lmadmin -root $installDir"

# logfile for any output that doesn't end up in normal logfilesconsoleLog="${installDir}/logs/console.log"

RunService "$1"

Installation


Modify the LMadmin Shell Script

Modify the installDir entry to the exact path where the application was installed:

installDir="/Users/flexera/Applications/lmadmin"

Modify the lmadminUser entry to the username of the account which owns the installation:

lmadminUser="flexera"

Permissions

Startup programs must be owned by root with speci"c permissions or the application will not be launched at startup. Speci"cally, the owner must be root and the group must be wheel. There can be no write privileges for the group or everyone.

Begin by copying the newly created LMadmin and StartupParameters.plist "le into this directory:

/Library/StartupItems/LMadmin

To ensure the permissions are correct, use terminal and issue the following commands:

cd /Library/StartupItemssudo chown -R root:wheel LMadmincd LMadminsudo chmod 755 LMadminsudo chmod 644 StartupParameters.plist

List the directory contents to ensure your permissions look like this:

mbp-ub-r2:LMadmin flexera$ ls -acfltotal 16drwxr-xr-x 4 root wheel 136 Sep 24 18:04 .drwxr-xr-x 4 root wheel 136 Sep 24 18:03 ..-rwxr-xr-x 1 root wheel 1040 Sep 24 18:04 LMadmin-rw-r--r-- 1 root wheel 185 Sep 24 18:04 StartupParameters.plist

Installation


Vendor Daemon Con"gurationIn this example, the Autodesk vendor daemon will be used to serve licenses for Autodesk products. The Autodesk daemon is not available by itself. Rather, it is bundled with Autodesk’s license management software under the name ‘Autodesk Network License Manager.’ The standard Autodesk installation is based on lmgrd. In order to obtain this daemon, one must install the Autodesk software, retrieve the daemon, then remove the software.

The installation can be done from the Autodesk media and is not described herein.

Once installed, the software is located here:

/usr/local/flexnetserver

Installation


Use the Finder menu command Go -> Go To Folder... to open a Finder window to the above path and copy the adskflex binary to your lmadmin Application folder or issue the following terminal command:

sudo cp /usr/local/flexnetserver/adskflex /Users/flexera/Applications/lmadmincd ~/Applications/lmadminsudo chown flexera:admin adskflex

Afterwards, remove the lmgrd installation by using these commands:

cd /usr/localsudo rm -R flexnetserver

Remove the startup parameters for lmgrd by opening /Library/LaunchDaemons and deleting the "le com.autodesk.adlm.plist.

lmadmin Initial SetupWith everything installed, test the core listener functionality. To do so, manually start up the server by using terminal to issue the commands to start the lmadmin web server:

cd ~/Applications/lmadmin~/Applications/lmadmin/lmadmin &

If all goes well you should see the following output:

mbp-ub-r2:lmadmin flexera$ ~/Applications/lmadmin/lmadmin &[1] 2359mbp-ub-r2:lmadmin flexera$ lmadmin: Could not reliably determine the server's fully qualified domain name, using mbp-ub-r2.local for ServerName13:45:33 (adskflex) Unable to initialize access to trusted storage: 113:45:33 (adskflex) FLEXnet Licensing version v11.10.0.3 build 96515 x64_mac1013:45:33 (adskflex) lmgrd version 11.11, adskflex version 11.10

13:45:33 (adskflex) lmremove disabled

Connect to the web server on the port de"ned at install time:

http://localhost:8080

There will not be any licenses listed, because the vendor daemon is not con"gured. However, this test ensures that the administrative web interface (and therefore the lmadmin listener) is up.

Select the Administration link next to the Dashboard link at the top right. On "rst launch set the admin user password. The default logon is username admin with a password of admin. Change the password as desired.

Installation




Securing The Web Service

The default web service operates under the non-secure HTTP protocol. For added security, enable the encrypted HTTPS interface. Make the HTTPS interface the default interface so that requests to HTTP are automatically redirected to HTTPS.

To do this, go to server con"guration under Administration -> Server Configuration -> Secure Web Server Configuration.

Click the check box Enable HTTPS and also check the option to Redirect Non-Secure Web Access to Secure Web Access. Set the port to 8888 or 8443 (standard alternative HTTPS ports), and click the Save button.

Installation


Adding Vendor Daemons

The Autodesk vendor daemon uses a concurrent license model, and these examples will only show those licenses. As such, Activatable licenses are not used and are unnecessarily using Dashboard space. To turn these types o!, expand the User Interface section, select the Concurrent radio button, and click the Save button again.

To add the Vendor daemon, navigate to the Vendor Daemon Configuration and click on the Import License button. Select the license provided by the vendor (Autodesk in this example). This will add the vendor daemon entry to the list. If the daemon does not startup automatically, click the Administer link on the vendor daemon line.

From the vendor daemon page, click the Start button.

Check the vendor daemon log to ensure the daemon started without errors. Expand the Vendor Daemon Log section and click the link View file externally. Check the log for any errors.

Installation


Assuming the vendor daemon is now running, go back to the dashboard. All license entries should now be visible.

Installation


TestingInstall the vendor application and use the machine name alias which was added to the host "le during the setup as the license server (osxnlm). In this example, we are using AutoCAD for the test. Launch the AutoCAD product and check the license.

Self-Start TestReboot the system and after logon, check that the web service and vendor daemon are started by using the Event Monitor application. Look for adskflex (the vendor daemon) and lmadmin (the listener). Run the administrative web interface to ensure that the daemon and listener are working properly, then launch the test application again to ensure that licenses are being served as expected. Assuming these tests succeed, the server is now setup and operational.


Final NotesAs originally stated, there are a number of caveats when installing LMadmin under OS X. The known issues are documented below.

Daemons Failure After SleepWhen sleeping the computer, often the daemon will not start back up. To "x this, open the LMAdmin interface, login, and go to the Vendor Daemon Con"guration tab and click Start to restart it.

Note that the applications may still fail to connect to the daemon after a manual restart of the daemon. The only "x at this point is to reboot the system.

Root Ownership and LaunchdLMAdmin will not start if the process is owned by root. For this reason, you can’t add the listener (lmadmin) as a launchd daemon since launchd wants root to own the shell process. Ideally, by using launchd, the OS would monitor both the lmadmin listener and the adskflex daemon and start them as needed.

Localizing the MAC AddressBecause loopback licensing is self-contained, and thus, made very fault tolerant, it can also be transferred from one computer to another. The license "le provided from the vendor is typically tied to one of the physical addresses on the computer. If the computer fails and is serviced in the "eld, access to the internet to obtain another license may be impossible. To circumvent this problem, localize the physical address of the selected adapter to use the old MAC address. To do so, override the MAC (local address) using ifcon"g:

sudo ifconfig en0 ether xx:xx:xx:xx:xx:xx (where xx:... is the desired MAC)

To determine which adapter is being used by lmadmin, check the Ethernet Address in the System Information page of lmadmin’s web interface. The OS X Network Utility can show you which MAC conforms to which ethernet adapter. From tests performed, it appears the lmadmin prefers to use the WiFi adapter (en1) rather than the physical adapter (en0). However, even if WiFi is turned o!, the MAC check will still work, and lmadmin will work as expected.

Note that this technique cannot be used to operate a given license "le on more than one computer at the same time. That would cause a network con#ict and prevent both computers from accessing the network. Also, doing so would almost certainly violate the vendors license terms and conditions.


Document Revisions

This table describes the changes to FlexNet Publisher OS X Guide.

Date Notes

2012-10-13 New document outlining the process of how to con"gure lmadmin under OS 10.8 (Mountain Lion).


Gregg Lagnese© 2012 Gregg Lagnese. All rights reserved.

No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, mechanical, electronic, photocopying, recording, or otherwise, without prior written permission from Gregg Lagnese, with the following exceptions: Any person is hereby authorized to store documentation on a single computer for personal use only and to print copies of documentation for personal use provided that the documentation contains this copyright notice.

No licenses, express or implied, are granted with respect to any of the technology described in this document. This document is intended to assist administrators to implement Flexera technologies on Apple Computers.

Apple, and OS X are trademarks of Apple Inc., registered in the United States and other countries.

Flexera, FlexNet, FlexNet Publisher, FlexLM, and LMAdmin are trademarks of Flexera Software, registered in the United States and other countries.

Even though author has reviewed this document, THE AUTHOR MAKES NO WARRANTY OR REPRESENTATION, EITHER EXPRESS OR IMPLIED, WITH RESPECT TO THIS DOCUMENT, ITS QUALITY, ACCURACY, MERCHANTABILITY, OR FITNESS FOR A PARTICULAR PURPOSE. AS A RESULT, THIS DOCUMENT IS PROVIDED “AS IS,” AND YOU, THE READER, ARE ASSUMING THE ENTIRE RISK AS TO ITS QUALITY AND ACCURACY.

IN NO EVENT WILL THE AUTHOR BE LIABLE FOR DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES RESULTING FROM ANY DEFECT OR INACCURACY IN THIS DOCUMENT, even if advised of the possibility of such damages.

THE WARRANTY AND REMEDIES SET FORTH ABOVE ARE EXCLUSIVE AND IN LIEU OF ALL OTHERS, ORAL OR WRITTEN, EXPRESS OR IMPLIED.


FLEXnet Publisher on OS X - lagnese.melagnese.me/docs/netopts/FLEXnet_Publisher_on_OS_X.pdf ·...

Documents

Transcript of FLEXnet Publisher on OS X - lagnese.melagnese.me/docs/netopts/FLEXnet_Publisher_on_OS_X.pdf ·...