Access

CTX-Blog

powered by Ecki's Place

18. March, 2018

XenDesktop – Publish desktop to IP address instead of a user group – the missing link

There are some situations where you want to publish a VDI desktop to a certain machine instead of a user group. The way to accomplish that is documented in the following article CTX128232 – How to Configure XenDesktop for a Teaching Lab or Classroom Environment

According to this article you only need to fire up PowerShell, load the Citrix.Broker.Admin.* commandlets, get the DesktopGroupUid of your delivery group and set some BrokerAccessPolicyRules and BrokerAssignmentPolicyRules. In a last step you have to assign an IP address to a domain machine.

Add-PSSnapin Citrix.Broker.Admin.*

Get-BrokerDesktopGroup …

Get-BrokerAccessPolicyRule –DesktopGroupUid <uid> | Set-BrokerAccessPolicyRule –AllowedUsers AnyAuthenticated

Get-BrokerAssignmentPolicyRule –DesktopGroupUid <uid> | Set-BrokerAssignmentPolicyRule –Enabled $false

Set-BrokerPrivateDesktop DOMAIN\MACHINE_A -AssignedIPAddress 10.1.1.100

A nice article but unfortunately it is incomplete 🙁

The following blog post helped me a little bit further XenDesktop – Assigning Private Desktops by Client IP or Hostname. It showed me some more options for the published desktops like a custom name for every single published desktop and how to view the configured settings afterwards:

Set-BrokerPrivateDesktop DOMAIN\MACHINE_A –AssignedIPAddress 10.1.1.100 –PublishedName “Desktop_A”

Get-BrokerPrivateDesktop | ft MachineName,AssignedIPAddress,AssignedClientName,PublishedName

But still the published desktops where not visible to the configured machines. They connected fine to StoreFront but showed no desktop to launch 🙁

So I started scratching my head and tried to understand how this “magic” could ever work…

The main question was how the Delivery Controller gets to see the real IP address of the client because the client never ever talks directly to the Delivery Controller. All communication is between StoreFront and Client only. This is where it made “click”.

In almost every environment I know StoreFront is load balanced behind some NetScaler or similar device. Therefore the StoreFront server only sees the IP address of the load balancer and not the real client IP. In case of a NetScaler it is the SNIP StoreFront sees as client IP address.

So the solution was as simple as that: Configure NetScaler to pass the real client IP address as “X-Forwarded-For” header to StoreFront which can be done easily on the Service or Service Group used for StoreFront load balancing. StoreFront then extracts the real client IP address from the HTTP header and passes it automatically to the Delivery Controller which finally knows which desktop to deliver.

Immediately after that configuration has been done the desktops appeared with their individual name in StoreFront 🙂

Regards

Ecki

06. March, 2018

NetScaler – WinSCP only access (command policies) – the missing link

NetScaler Command Policies are not extremely well documented and if you don’t know how to work with regular expressions you are doomed. Citrix gives you some ideas on how Command Policies work in this Citrix eDoc Article but there is no hint on how to limit shell and scp/sftp access.

Well the solution is easy if you know how to do it but it took me some time to figure out…

First create a new Command Policy and give it a name like “WinSCP”. Choose “ALLOW” as action and add the following regular expression in the Command Spec* panel.

(^sftp.*)|(^scp.*)

Second create a new local user like “WinSCP”, set a password and give him login privileges. The other options are optional. Then bind the new “WinSCP” Command Policy to that user.

You’re done 🙂 This command policy allows only access through SCP, or SFTP tools like WinSCP and all other access (GUI, shell) is blocked.

Regards
Ecki

05. March, 2018

The missing link

Nach langer Pause habe ich mich entschieden, wieder mehr Zeit in meinen Citrix Blog zu investieren und mich dabei den Themen anzunehmen, die eigentlich dokumentiert sind, bei denen aber einzelne, wichtige Details fehlen.

Um den zeitlichen Aufwand zu minimieren, habe ich mich ausserdem entschlossen, neue Beiträge nur noch auf englisch zu verfassen, da sie so einem grösseren Publikum zugänglich sind.

Ich hoffe, meinen Lesern mit dieser neuen Serie einige “Aha”-Momente zu verschaffen. Und nun viel Spass beim Lesen und Probleme lösen 🙂

Gruss
Ecki

|