Blog

Tuesday, July 08, 2014

Starting Interactive FireDaemon Services In Session via Automatic Logon and Scheduled Tasks

This article provides an alternate method of starting Interactive Windows Services and detection under FireDaemon control in the currently logged in session. In our previous article we discussed how to do this using logon scripts. In this article we discuss how to automate your Windows login and run interactive services using Scheduled Tasks.

Step 1: Install FireDaemon Pro and Setup Your Services This is fairly straight forward:

  1. Download and install FireDaemon Pro
  2. Create your FireDaemon services. Ensure they are set to Manual Start and they are running as the LocalSystem account (ie. don't specify a user in your configuration). Check out our HOWTOs if you need a guidance setting up your app under FireDaemon control.

Step 2: Setup Automatic Login You now want to set automatic login for user you want to run your services as. To do this on Windows 7:

  1. Run netplwiz.exe
  2. Uncheck "Users must enter a username and password to use this computer" then click OK
  3. Supply the autologin username and password. If you want to use a domain user account see this article.
Step 3: Create a Schedule You now need to create a scheduled to auto elevate FireDaemon the starting of your services:
    1. Create a new Task (not a Basic Task) as follows:
    2. Run sched.exe (Windows 7) or taskschd.msc /s (Windows 8). Then in the
      • General Tab
        • Name: FireDaemonServices
        • Check: Run only when user is logged on
        • Check: Run with highest privileges
        • Check: Hidden
        • Configure for: Windows 7, Windows Server 2008 R2 (change this to suite your app and version of Windows)
      • Actions Tab (add an action for each service to be elevated - click the New button. Replace ServiceA with the actual short name of your service)
        • Action: Start a Program
        • Settings / Program/Script: "C:\Program Files\FireDaemon\firedaemon.exe"
        • Settings / Add Arguments:  --start ServiceA --in-session
      • Conditions Tab
        • Uncheck Start the task only if the computer is on AC power
      • Settings Tab
        • Uncheck Stop the task if it runs longer than
        • Uncheck If the running task does not end when request
        • If the task is already running, then the following rules applies: Run a new instance in parallel
    Step 4: Create a Shortcut Lastly, create a shortcut in the Startup Folder of the user in question that points to: C:\Windows\System32\schtasks.exe /run /tn "FireDaemonServices" And that's it - when you boot/reboot your machine your machine will auto login and run all your nominated FireDaemon services interactively. Should a service crash or be terminated accidentally then FireDaemon will restart you app in session.
    Sunday, July 21, 2013

    Fortinet Fortigate 300C Active Directory Integration

    We recently had to install a Fortinet Fortigate 300C cluster. You may wish to integrate your firewall cluster into Active Directory to facilitate AD based administrative and VPN logins. This guide is based on FortiOS v4.0 MR3 Patch 8 (v4.0,build0632,120705 (MR3 Patch 8)).

    Configure DNS

    First thing is to ensure your Fortigate's DNS is configured to point to your Active Directory servers. Go to Network -> DNS:

    Configure LDAP

    Then you need to configure LDAP. So go to User -> Remote -> LDAP and Create a new LDAP entry. You will need to create an LDAP entry for each domain controller:

     

    Windows Server uses sAMAccountName and the Common Name (CN) Identifier. Your Distinguished Name is typically your top level AD DN. You need to do a Regular bind to AD and as a result you will need to specify the user that has access to AD to make queries. In this case the user LDAPBindFortinet was created explicitly with a non-expiring password. The User DN is CN=LDAPBindFortinet,OU=Services,OU=FireDaemon,DC=firedaemon,DC=int. Make sure you test connectivity and that you can successfully browser the directory. If you are having trouble divining CNs and DNs try browsing your directory with Softerra's LDAP Administrator.

    Configure User Group

    You will now need to create a remote authentication user group. So go to User -> User Group -> User Group.  Name it appropriately then add in your two Active Directory servers. Your users will ideally need to be in a group to permit firewall or VPN access. In this example, the group the users are in is:  CN=FortinetUsers,OU=Groups,OU=FireDaemon,DC=firedaemon,DC=int. You can obtain this DN by browsing the user and looking at their MemberOf attribute.

    Add Remote Users

    Lastly, you will need to add remote users (in this case for firewall configuration). So go to System -> Admin -> Administrators and add remote users.

     

    You should now be able to login as a domain user to your Fortigate:

     


    Recent Posts



    Tags


    Archive

      Sign up for Product Updates and Discounts
      Captcha Image
      ×