IN THIS ARTICLE:
Introduction to Remote Session
The Remote Session feature in LogicMonitor provides a secure way to remotely access and operate on devices from within your LogicMonitor portal. Remote sessions are enabled via the use of Apache Guacamole, a clientless remote desktop gateway that requires no plugins or client software.
The remote session protocols available for establishing a communication stream between your account and the Collector monitoring your device are RDP, SSH, VNC, and Telnet. The protocol must be configured for the device endpoint in order to be able to establish a remote session connection. Remote sessions take place via a secure SSL connection where supported by the protocol (Telnet is not encrypted).
Initiating a Remote Session
To initiate a remote session:
- From the Resources tree, select the device you wish to access and, from its detail view, click the "Manage" arrow and select "Remote Session" and the desired protocol from the subsequent dropdown menus.
Any protocol can be used if properly configured on the device, but typically RDP is used for Windows devices and SSH is for non-Windows/Linux devices.
- A new browser window opens, prompting you to enter the account and password for your device.
Note: LogicMonitor does NOT currently support SSH key authentication or Network Level Authentication on Windows.
- Once the remote session is initiated, select Control+Alt+Shift to open the Apache Guacamole clipboard for copy-and-paste functionality or directly input new command lines.
Note: Some platforms are not supported by the Apache Guacamole clipboard copy-and-paste feature, as discussed in the Apache Guacamole Frequently Asked Questions.
Note: Collector version EA28.600 or higher is required to use VNC and Telnet. If an earlier Collector version is in use, these protocol selections will be disabled and a message to that effect will be displayed upon mouse-over.
Remote Session Device Properties
LogicMonitor supports several Remote Session protocol properties that you can use to override default connection behavior.
For more information on adding/updating properties for a device, see Device Properties.
Remote sessions do not change the underlying authentication and access control of the device operating system, but they do allow access to the device in situations where it may not otherwise be possible. For this reason, LogicMonitor has several controls in place that serve to limit access to the Remote Session feature on a global or more granular basis:
- Account-wide control. Remote Session can be disabled on an account-wide basis from LogicMonitor's account settings. For more information, see About the Account Information Page.
- Per-Collector control. Remote Session can be disabled on a per-Collector basis, effectively disabling the feature for all devices assigned to that Collector. This is accomplished by manually updating the remotesession.disable setting found in the Collector's configuration file to "true". For more information on editing a Collector's configurations, see Editing the Collector Config Files.
- Role-based access control. Remote Session is defined as a separate user privilege. As discussed in Roles, a role can be given the ability to initiate remote sessions on all devices, those in a specific group, or no devices at all.
Requirements and Limitations
Please note the following requirements/limitations:
- The protocol used to initiate a session must be enabled on the device to which you are attempting to connect.
- The remote session connection will not work if "RDP Security Layer" is enabled for Window Server 2008's Remote Desktop.
- If working with non-Windows or Linux devices (e.g. Cisco controllers), you will most likely use SSH to establish communication. However, you may need to manually do one of the following to ensure a proper connection:
- Ensure default SSH configurations are in place
- Enable username/password access for SSH on the device
- Make sure that the IPs used by the relay server are whitelisted. See LogicMonitor Public IP Addresses and DNS Names for a complete list.
- The VNC and Telnet protocols are recent additions to the supported protocols for Remote Session. These protocols require Collector version EA28.600 or higher in order to be available for selection.