Differences
This shows you the differences between two versions of the page.
Next revision | Previous revisionNext revisionBoth sides next revision | ||
cloudappliance/applinstallation [2018_01_30 17:23] – external edit 127.0.0.1 | cloudappliance/applinstallation [2021_03_06 00:46] – steven | ||
---|---|---|---|
Line 1: | Line 1: | ||
+ | # Enterprise File Fabric Appliance Installation Guide version 2006 | ||
+ | ##### last updated March 5, 2021 | ||
+ | See Also: [[: | ||
+ | # Introduction | ||
- | ====== Storage Made Easy Cloud Appliance installation Guide ====== | + | The Enterprise File Fabric platform is shipped as a virtual appliance. Once you have deployed it into your environment you have to follow a few steps to get the product set up and ready for use. This document will walk you through the initial install steps needed to get started. |
+ | This document does not cover how to deploy the File Fabric in your virtual environment, | ||
+ | Images are provided for VMWare, KVM and Hyper V. For VMWare, vSphere 5.5 or above is required. | ||
- | ===== 1 Requirements ===== | + | The File Fabric virtual appliances can run on public and private clouds as well as in your data center. |
+ | * **Amazon Web Services (AWS)** platform see [[: | ||
+ | * **Google Cloud Platform** see [[: | ||
- | You will need VMWare software to run the virtual machine, | + | * **Microsoft Azure**, see [[azure-gettingstarted]] |
- | * - VMWare player | + | # Preparation |
- | * - VMWare Workstation 8.x | + | |
- | * - VMWare Fusion 4.x | + | |
- | * - VMWare ESX/i 4.x/5.x | + | |
- | Please note we provide | + | You need to prepare/ |
- | \\ **Hardware**\\ \\ For evaluation Purposes:\\ \\ | + | - Provided with trial email |
- | * - 2 GB RAM for the VM | + | |
- | | + | |
- | | + | * Appliance appladmin password |
+ | * File Fabric license key | ||
+ | - Access to request / update DNS names for appliance (recommended) | ||
+ | | ||
+ | | ||
+ | - Active Directory service account, for connecting to AD (optional) | ||
- | \\ For Production purposes:\\ \\ | + | # Part I - Configure Networking |
- | * - 4â8GB RAM | + | |
- | * - 2â4 Cores depending on the number of users | + | |
- | * - 20 GB Hard Disk space\\ \\ Please note we recommend tuning the appliance components in production | + | |
- | \\ **Configuration: | + | Out of the box, the File Fabric |
- | To configure | + | |
- | * - A Domain Name that is registered (required for production or internet access. Can be run internally | + | Once the File Fabric appliance |
- | * - A wildcard SSL certificate for your chosen domain name (required if you wish to test SSL but can be self generated) | + | |
- | * - You will need to register | + | |
- | \\ | + | Change |
- | (Please note webdav DNS entry should be webdav.DomainName e.g if the domain name is sme.yourdomain.com then the webdav url should be webdavsme.yourdomain.com.) | + | |
- | * - An IP address that configured to point to the domains | + | Update |
- | * - An email address | + | |
- | * - A catch all email address if you want to use filebox functionality. You will need IMAP server details for this email address | + | |
- | \\ **Firewall**\\ \\ | + | {{ : |
- | You will need to following ingress ports open\\ 80, 443, 21, 990 | + | |
+ | Then identify the IP addresses, type ifconfig and look for the IPv4 IP address. | ||
- | If you want to use FTP/S then you will need to configure | + | {{ : |
+ | \\ \\ | ||
+ | If ifconfig is not installed then please | ||
+ | < | ||
+ | \\ | ||
+ | to find the IP address. | ||
- | \\ **Storage**\\ \\ | ||
- | The appliance can attach to all the storage providers supported by SME. You can see a list at http:// | ||
- | \\ **Authentication details / License Key**\\ \\ | + | Note: If you do not have DHCP enabled on your network, you can run the smenetconf script |
- | You will require | + | |
+ | Leave root privilege and as the smeconfiguser start the configuration server by typing **smeconfigserver**. You should see a confirmation that the config server is running: \\ \\ | ||
+ | {{ : | ||
+ | |||
- | ===== 2 Configuring the SME Appliance ===== | + | Now open your browser and navigate to: \\ \\ |
+ | http://< | ||
+ | \\ \\ | ||
+ | Here you will be able to configure network details, including domain names, and you can apply a custom certificate for secure HTTPS traffic. \\ \\ | ||
+ | {{ : | ||
+ | |||
+ | Click “Configuration” to get started. | ||
- | The configuration server allows | + | Give the system a static IP address and enter the same hostname |
- | * - Static IP address | + | Then don’t forget to also create an A record in your DNS system for all 3 hostnames on this screen. |
- | * - Domain name | + | |
- | * - SSL certificate | + | |
- | \\ **Login**\\ | + | Follow |
- | Start the VMWare instance and login to the appliance. The IP address is displayed in the console.\\ \\ | + | |
- | {{:/ | + | |
- | \\ **Setting | + | |
- | \\ **Change Password**\\ | + | |
- | This will start the configuration server on port 8080. Please make sure that you shutdown | + | |
- | \\ | + | You can rerun the smeconfigserver at any time to go back and modify, or correct any information in your setup. i.e. you can go back and place a new certificate here at any time. |
- | Once the configuration server has been started, on your local machine, in the browser open the following URL: | + | |
- | **http: | ||
- | \\ | + | ## Let's Encrypt SSL Certificates |
- | You should see the Welcome Screen. To start configuration, | + | |
- | \\ | + | This section creates and configures SSL certificates from Let's Encrypt. If you are using your own certificates (or a different |
- | {{:/ | + | |
- | \\ | + | Elevate to the root user by typing the following command and entering the root password when prompted. |
- | {{:/ | + | |
- | \\ **Hostname Settings**\\ \\ | + | su - |
- | In the âSME Server Hostname Settingsâ options you set the domain names that will be used to access | + | Note: The appliance |
- | \\ | + | Run the following command: |
- | {{:/ | + | |
- | \\ **Network Settings**\\ | + | |
- | In âSME Server Network Settingsâ the Admin can set the static IP address, Gateway, IP Mask and DNS server to resolve hostnames. This change requires a reboot of the appliance. | + | |
- | \\ | + | certbot --authenticator standalone --installer apache --pre-hook " |
- | {{:/ | + | This command will prompt for an email address. |
- | \\ | + | Please also agree to the Terms of Service. It is not necessary to share the provided email with the Electronic Frontier Foundation. |
- | '' | + | |
- | \\ | + | Certbot |
- | {{:/ | + | |
- | This will set the configuration to default settings | + | |
- | \\ **SSL Certificates (recommended for production)**\\ \\ | + | Which names would you like to activate HTTPS for? |
- | The File Server uses https to communicate with the clients | + | - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - |
+ | 1: files.example.com | ||
+ | 2: files-s3.example.com | ||
+ | 3: files-webdav.example.com | ||
+ | - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - | ||
+ | Select the appropriate numbers separated by commas and/or spaces, or leave input | ||
+ | blank to select all options shown (Enter ' | ||
- | \\ | + | Lastly, Certbot |
- | {{:/ | + | |
- | \\ | + | |
- | This will require a reboot. | + | |
- | Please | + | |
+ | ------------------------------------------------------------------------------- | ||
+ | 1: No redirect - Make no further changes to the webserver configuration. | ||
+ | 2: Redirect - Make all requests redirect | ||
+ | new sites, or if you're confident your site works on HTTPS. You can undo this | ||
+ | change by editing your web server' | ||
+ | ------------------------------------------------------------------------------- | ||
+ | Select the appropriate number [1-2] then [enter] (press ' | ||
- | **Generating a Certificate Signing Request**\\ | + | After successful completion, the Enterprise File Fabric will automatically start using the new certificates. |
- | To generate a Certificate Signing Request(CSR) if you are applying for certificates | + | |
- | \\ **Setting up self-certified Certificates**\\ | + | ### Automatically renewing |
- | If you wish to use a self-signed certificate to test https then we suggest following steps 1 to 4 in [[http:// | + | |
- | \\ \\ **System Update**\\ | + | A Let’s Encrypt certificate is valid for 90 days, and can be automatically renewed within 30 days of expiration. A simple cron job will run daily and handle renewals. |
- | Here you can update the appliance with the latest release. You can check for a new version here. When the appliance is updated with the new version, the installed version is saved and allows you to rollback to the previous installed version. | + | |
- | {{:/ | + | Please Note: The File Fabric will be inaccessible during the renewal. Please ensure that the renewal time is during off hours. Downtime will only occur every 60 days when a renewal is required and may last up to one minute. |
- | {{:/ | + | |
- | \\ \\ **Rebooting**\\ | + | |
- | Smeconfiguser has permissions | + | |
- | Once you have configured and rebooted your appliance, open a browser at http: | + | While still logged in as root run the following command to add a cron job. |
- | \\ **Customizing the Appliance**\\ \\ | + | |
- | Using your browser login as **appladmin** . **Change the password after logging in for the first time**. You will see the home screen, on the right hand side you will see different options to customise the website. | + | |
- | The appladmin account is used to configure | + | In the example below the renewal attempt will process at 2:30AM in the timezone |
- | **Entering the License Key**\\ \\ | + | 30 2 * * * / |
- | Enter the license key and depending on the key new functionality will become available in the right hand side menu. If the key is expired or you have not entered a valid key then you will only be able to use clouduser account. | + | |
- | {{:/ | + | This will create a crontab entry for a cron job that will handle |
- | **Changing the look and feel**\\ | + | |
- | You can brand and change logos for the of the appliance including the default logos for the login screen | + | |
- | {{:/cloudappliance: | + | Use https://www.ssllabs.com/ to test the installation. |
- | {{:/cloudappliance: | + | |
- | \\ \\ **Email Templates (Optional)**\\ | + | |
- | The default email templates that are used with the Appliance for customer interactions can be changed here. | + | |
- | {{:/ | ||
- | \\ \\ **Site Wide Functionality**\\ | ||
- | This screen allows you enable/ | ||
- | \\ **Email and Filebox Settings**\\ \\ **SMTP Settings: | + | ## Configuring Antivirus (optional) |
- | The File Server uses an external email SMTP server | + | The File Fabric can use ClamAV antivirus software |
- | FileBox IMAP Settings (Optional): | + | # Part II - Configure Appliance |
- | The filebox feature provides each user and shared folder a dedicated email address. This is an optional feature. A user can send email with attachment to the firebox address. For this you will need a catch all email address and IMAP server.\\ \\ {{:/ | + | |
- | **Integration Settings (Optional)** | + | You must perform a few steps before you can get started with the File Fabric. |
- | SME appliance | + | |
- | \\ **Meta Data Backup**\\ | + | After the VM is restarted, log into %%https://< |
- | The only data that is stored | + | |
- | **Changing the Password**\\ | ||
- | You can change the ApplAdmin password.\\ \\ {{:/ | ||
- | You can see a list of all users and the packages that are assigned to them by clicking on **Users** on the left hand side. | + | ## 1. |
- | You can change a users password, activate or inactivate and delete users and also configure the functionality available to him. | + | {{ : |
- | \\ | + | A trial license key can be requested from https:// |
- | {{:/cloudappliance: | + | |
- | {{:/cloudappliance: | + | |
- | \\ \\ **Creating | + | |
- | To Add a user Click on âAdd Userâ and enter the details. A new user can also be added using the API.\\ \\ {{:/ | + | |
- | **User Packages** | + | Once you apply the key and save the change, you will see the features available |
- | You can edit and create User packages that are assigned | + | |
- | {{:/ | + | ## 2. Outbound Email (Recommended) |
- | {{:/ | + | |
- | \\ \\ | + | |
- | **Summary: | + | |
- | This is the end of the configuration guide for the SME Cloud Appliance.\\ \\ | + | An SMTP server |
+ | If you do not configure an email server remember not to use email notification when adding users. | ||
+ | ### Using Gmail for Outbound Email | ||
+ | Below is a sample what the configuration looks like, for an SMTP setup using a Gmail account. You will have to ask your email administrator for your specific details, or sign up for a free Gmail address: \\ \\ | ||
+ | |||
+ | {{ : | ||
+ | |||
+ | The “Notification Email” address will receive emails from the system warning of license expiration etc. You should enter your email here. | ||
+ | |||
+ | ### Change Appliance Admin Email | ||
+ | |||
+ | With an SMTP server configured you can change the email of the Appliance Admin. Go to the main menu (Hamburger icon) to Password/ | ||
+ | |||
+ | You can also set up Two Factor Authentication (2FA) for the Appliance Admin from this screen. | ||
+ | |||
+ | ### Server Notification Email | ||
+ | |||
+ | Server errors and a daily report are sent to a notification email that must be configured by the Appliance Administrator. The default is not to email reports. | ||
+ | |||
+ | The " | ||
+ | |||
+ | |||
+ | ## 3. Look & Feel | ||
+ | |||
+ | {{ : | ||
+ | |||
+ | Under Look & Feel is where you can upload your logos for the login page, and set a site title for the site. | ||
+ | |||
+ | ## 4. Site Functionality | ||
+ | |||
+ | Here you can enable or disable certain functionality or features. The default settings are generally good for the initial deployment, but please go through the options to familiarize yourself with advanced options. Examples are: Enable in browser editor for inline editing of office docuemnts, enable SFTP access, etc. | ||
+ | |||
+ | If you will be providing SFTP access through the File Fabric' | ||
+ | |||
+ | ## 5. | ||
+ | |||
+ | The File Fabric platform uses templates for organizations, | ||
+ | |||
+ | {{ : | ||
+ | |||
+ | Click “User Packages” and then click the pencil to modify “Organisation Cloud 20 Users” This is a good template to start from. | ||
+ | Scroll down to the “Extra options” section and add “Content Search Enabled” and Dropfolders. \\ \\ | ||
+ | |||
+ | {{ : | ||
+ | |||
+ | “Crtl-Click to add to the selection” | ||
+ | |||
+ | ## 6. | ||
+ | |||
+ | In the hamburger menu, click “Users” | ||
+ | |||
+ | {{ : | ||
+ | |||
+ | |||
+ | ## 7. | ||
+ | |||
+ | This can be done by clicking the red “X”. | ||
+ | |||
+ | ## 8. Click “Add a User” | ||
+ | |||
+ | On the Add a User screen create your Organization admin user. (This will also be your organization.) | ||
+ | |||
+ | 1. User Login: Admin user login and Organization short name | ||
+ | 1. E-mail: Email address of organizational admin, must be unique to the system, do not use your own. | ||
+ | 1. Password: | ||
+ | 1. Name (Company Name): Full organization name. | ||
+ | 1. Package: The template from step 5. | ||
+ | 1. We do not need to split the license between organizations, | ||
+ | |||
+ | Click Save. \\ \\ | ||
+ | |||
+ | {{ : | ||
+ | |||
+ | # Part III - Configure the organization | ||
+ | |||
+ | Log out from the Appliance Admin, appladmin user, and log back in as the user you just created. | ||
+ | |||
+ | You will first see the “Add Storage Provider” screen. You have to add storage before you can continue. Select your provider and follow the instructions on the next couple of screens. There are many providers to choose from, but a CIFS share, google drive or S3 bucket are easy examples to get started with. Do not use a storage location with existing production data for the initial trial. | ||
+ | |||
+ | Once you have added your storage, Select Options from Organization Menu: \\ \\ | ||
+ | |||
+ | |||
+ | {{ : | ||
+ | |||
+ | |||
+ | There are of course a lot of different was to configure your organization based on your specific use case(s). In this example I will set them to what I think are good starting points. | ||
+ | |||
+ | |||
+ | ## User Governance | ||
+ | |||
+ | Enable personal clouds by toggling “Private User Clouds”. Enabling this will allow for both a per user home folder (Admin managed) and for users to add a personal drop box, or google drive into the SME file manager. | ||
+ | |||
+ | ## File Sharing Policy | ||
+ | |||
+ | Here I like to turn on most of the options in order to get a feel for the SME sharing features. See screenshot below. \\ \\ | ||
+ | |||
+ | {{ : | ||
+ | |||
+ | |||
+ | ## Security | ||
+ | See screenshot below for how to toggle the options on this page: \\ \\ | ||
+ | {{ : | ||
+ | |||
+ | |||
+ | ## Encryption | ||
+ | |||
+ | You can provide a key here and enable encryption for all data at rest. Note, if you do, you will not be able to access your data from outside of SME. | ||
+ | |||
+ | ## Versioning/ | ||
+ | |||
+ | I enable versioning, it is a nice feature to have in case of conflicts or accidental end user overwrites and deletions. \\ \\ | ||
+ | |||
+ | {{ : | ||
+ | |||
+ | |||
+ | ## Data Classifications | ||
+ | |||
+ | Leave the defaults here. | ||
+ | |||
+ | ## User Interface | ||
+ | |||
+ | Leave the defaults here. | ||
+ | |||
+ | ## Notifications | ||
+ | |||
+ | Toggle “Send email notification for file comments: | ||
+ | |||
+ | ## Branding | ||
+ | |||
+ | Options for you to create your organizations specific here | ||
+ | |||
+ | At this stage you either create local users or you tie SME into your corporate directory. | ||
+ | |||
+ | |||
+ | ## Configure Active Directory | ||
+ | |||
+ | Under Organization, | ||
+ | |||
+ | {{ : | ||
+ | |||
+ | There are a many options to consider and there is the possibility to make the integration with a highly customized AD schema, but for the sake of evaluation the product, we don’t have to make it that complicated. Below I have listed the fields where you have to add site specific information. I will skip the lines you don’t have to configure, so when you follow this list below, make sure to match the names on the screen, as they are not sequential. | ||
+ | |||
+ | - Auth System: Toggle the dropdown to LDAP | ||
+ | |||
+ | - Auth System Name: Give it a friendly name | ||
+ | |||
+ | - LDAP Server host or IP: IP address or hostname of AD controller | ||
+ | |||
+ | - Base DN: Enter a base OU of your directory to limit searches to certain sub-OUs, or leave it as “DC=domain, | ||
+ | |||
+ | - Administrator User DN: The service account that can connect and validate AD info, should be an unprivileged service account. On the following format: “CN=LDAP Bind, | ||
+ | |||
+ | - Administrator User Password: Password of above user. | ||
+ | |||
+ | - Update user roles/ | ||
+ | |||
+ | - Login Field: What AD attribute is the login name, I suggest using sAMAccountName | ||
+ | |||
+ | - User Name Field: I switch this to displayName, | ||
+ | |||
+ | - Role Name Field: I prefer to switch this to “name” | ||
+ | |||
+ | |||
+ | |||
+ | These are the 10 fields you have to fill in to enable AD authentication, | ||
+ | |||
+ | |||
+ | |||
+ | Roles, in order to simplify management of ACLs for your data, we recommend that you assign permissions on a group – or role – level. Open up the configuration page: \\ \\ | ||
+ | |||
+ | {{ : | ||
+ | |||
+ | |||
+ | If you set up AD authentication in the above step, leave the two default roles, (“Administrator”, | ||
+ | |||
+ | {{ : | ||
+ | |||
+ | |||
+ | |||
+ | |||
+ | On the next page, you can select to put in a partial or full name in the “Role:” field, to act as a filter before clicking “Get roles” \\ \\ | ||
+ | |||
+ | {{ : | ||
+ | |||
+ | |||
+ | I chose to filter on “gs_” and can select all for import. \\ \\ | ||
+ | |||
+ | {{ : | ||
+ | |||
+ | |||
+ | This process can be done many times until all desired groups are imported. | ||
+ | |||
+ | |||
+ | If you are doing this without AD, simply click Add new role and add the different roles you need to provide adequate segregation for your users. \\ \\ | ||
+ | |||
+ | {{ : | ||
+ | |||
+ | |||
+ | When the roles are populated, proceed to importing / creating the users: \\ \\ | ||
+ | |||
+ | {{ : | ||
+ | |||
+ | |||
+ | |||
+ | |||
+ | |||
+ | This page is set up much the same way, select “Import users from a remote source” | ||
+ | \\ \\ | ||
+ | {{ : | ||
+ | |||
+ | |||
+ | |||
+ | |||
+ | The import screen works much like the Roles import screen with one important difference. \\ \\ | ||
+ | |||
+ | {{ : | ||
+ | |||
+ | |||
+ | |||
+ | As you can see in the Role section to the right we will show you what AD groups the user is a member of, so you can ensure the relevant groups are imported. | ||
+ | |||
+ | Repeat the user import until you have imported your users. | ||
+ | |||
+ | |||
+ | |||
+ | Once again, if you had skipped the AD setup, you can manually create local users. Simply click one of the Add new user buttons. Without confirmation will still give you the option to send the user a welcome email. \\ \\ | ||
+ | |||
+ | {{ : | ||
+ | |||
+ | |||
+ | |||
+ | ## Setting up shared storage and access. | ||
+ | |||
+ | Earlier we connected to our default storage, now let’s configure it. | ||
+ | |||
+ | Click File Manager \\ \\ | ||
+ | |||
+ | {{ : | ||
+ | |||
+ | |||
+ | And navigate into your default storage provider, in my case it is a bucket called “smestoragesme” \\ \\ | ||
+ | |||
+ | {{ : | ||
+ | |||
+ | Unless this is the name of the root share you want your end users to see, create a new folder inside the root. I created one called FinanceShare and one called EngineeringShare. \\ \\ | ||
+ | |||
+ | {{ : | ||
+ | |||
+ | |||
+ | |||
+ | Right click the first folder and select Convert to Shared Team Folder \\ \\ | ||
+ | |||
+ | {{ : | ||
+ | |||
+ | Then repeat for any other folder you have created and want to be a share root. By default, in SME, a shared folder is shared with no one (except the admins) so we have to modify permissions. | ||
+ | |||
+ | Go to the settings page for shared folders: \\ \\ | ||
+ | |||
+ | {{ : | ||
+ | |||
+ | |||
+ | |||
+ | The default tab should be the Permissions tab: \\ \\ | ||
+ | |||
+ | {{ : | ||
+ | |||
+ | Go ahead and select the permissions Icon (2) | ||
+ | |||
+ | |||
+ | |||
+ | In the popup windows (below) select the user or group from the dropdown (1), select the permissions (2), and click apply. (3) | ||
+ | |||
+ | When you are done with the permissions, | ||
+ | |||
+ | {{ : | ||
+ | |||
+ | |||
+ | Your initial setup is complete, now when a member of the Engineering group logs in, he or she will only see the EngineeringShare folder: \\ \\ | ||
+ | |||
+ | {{ : | ||
+ | |||
+ | |||
+ | While the members of the finance group will see only FinanceShare. \\ \\ | ||
+ | |||
+ | {{ : | ||
+ | |||
+ | For any questions or comments on this document, please contact support@storagemadeeasy.com | ||