Source: https://www.nomachine.com/DT02O00125
Timestamp: 2019-04-26 08:55:11+00:00

Document:
Welcome to the NoMachine Enterprise Desktop - Installation and Configuration Guide v. 6.
What is NoMachine Enterprise Desktop for?
NoMachine Enterprise Desktop is a standalone server that provides unlimited concurrent accesses to the physical desktop of its host. Designed for work sharing sessions and real-time collaboration, remote teaching or assistance, it can be configured for full interaction with the desktop or view-only mode.
Available for Linux, Mac and Windows, the Enterprise Desktop accepts connections via a browser (thanks to its built-in web server) or via NoMachine client.
Additionally, it can also be federated under a Cloud Server. This solution is suitable to centralize the access to multiple NoMachine servers distributed across the world.
The NoMachine Enterprise Desktop server package includes the NoMachine GUI which provides the graphical interface (Server preferences) for administering the server and its services. This GUI acts also as client for running sessions and connecting to remote desktops.
Installation is conceived to provide a fully operative NoMachine server with a default configuration suitable for the greatest part of environments. All the necessary services are automatically started.
NoMachine Enterprise Desktop, available for Linux, Windows and Mac, supports multiple concurrent connections to the physical desktop (sharing of the desktop) of its host machine. Number of users is not limited. NoMachine Enterprise Desktop is a single server (standalone server), to all effects.
NoMachine Enterprise Desktop can be also federated under a Cloud Server v. 6 which provides a single point of access to multiple server subsystems. In this case, it's possible configuring the Enterprise Desktop to not accept direct connections. For more specific instructions about federating the Enterprise Desktop, refer to the Cloud Server administrative's guide.
By default, BaseDirectory is: /usr on Linux, C:\Program Files\ on Windows and /Applications on Mac.
is: BaseDirectory/NX on Linux, BaseDirectory/NoMachine on Windows and BaseDirectory/NoMachine.app on Mac.
You need to be a privileged system user to access all these functionalities. These commands can be run from an xterm or similar on Linux and Mac using the sudo utility or as root. On Windows they can be run from a command prompt (cmd.exe) executed as administrator.
move to the 'NoMachine' installation directory, by default it's under C:\'Program files (x86)' on 64bit systems and 'C:\Program file' on 32bits machines and go to the 'bin' subdirectory.
Connections by the web and by NoMachine clients are supported. Even if it's advisable to upgrade client installations to the same version 6 of the Enterprise Desktop, compatibility with clients v. 4 and 5 is preserved. NoMachine v. 6 is not compatible with the legacy NX version 3.5.0 (no longer supported since December 2016). Note also that when the Enterprise Desktop works as a federated server, NoMachine Cloud Server v. 6 requires a client v. 6.
Download the package for Windows from the NoMachine web site and install it by double-clicking on the icon of the executable: a setup wizard will take you through the installation. Accept to reboot the machine, this is mandatory for completing the installation.
If you own a customer license we recommend to download the package from your Customer Area: https://www.nomachine.com/support#login.
>SHUTDOWN -r -t 10 -c " your comments here"
Note for Windows XP: the NoMachine server will not start until the machine is rebooted.
The update procedure for server and node installations requires to stop all NoMachine services in order to correctly replace libraries and binaries. This implies that the Enterprise Desktop is not accessible to users during the update procedure. Current sessions will be terminated, users will be able to connect again later.
You can find detailed instructions for configuring the Automatic Updates in a separate document available at: https://www.nomachine.com/all-documents .
Note: Due to heavy changes between versions 5 and 6, the automatic updates are disabled: it's therefore necessary to upgrade NoMachine Enterprise Desktop v. 5 by using packages.
You can uninstall NoMachine Enterprise Desktop from the Windows Control Panel and the 'Add or Remove Programs' in Windows XP or 'Program and Features' in Windows Vista, 7, 8 or 10. Find the NoMachine program in the list of installed programs and choose to uninstall it.
On Windows 8 or later you can use the Search box from the Charms bar on the right side of the screen: type Control Panel to open it. Then access the Programs - 'Uninstall a program' panel.
Reboot is requested to complete the uninstalling process.
Uninstalling is completed when your command prompt is back. Then, your computer will restart automatically.
Download the DMG package from the NoMachine web site. Double-click on the disk Image to open it and see the package icon. Then double-click on the package icon to install the program: the installer will take you through the installation.
To uninstall the Enterprise Desktop drag and drop NoMachine from Applications to trash or select 'Move to trash' from the mouse button menu. This will uninstall all the NoMachine software.
includes a 30-days license which is automatically activated during the installation. No further actions are necessary.
Such license files have to be replaced with the customer's license files acquired from NoMachine. This can be done via the NoMachine server GUI in the 'Updates' panel: click on the server.lic and node.lic links to open their license panel and replace the license.
See https://www.nomachine.com/DT10O00155 for more details on the GUI usage, or https://www.nomachine.com/AR11O00942 for more instructions, included commands from a terminal to activate licenses manually.
First of all, ensure that the user has a system account on the Enterprise Desktop host: you can create it by using system tools or by using nxserver commands. Empty password is not supported.
Once installation is complete, Enterprise Desktop is ready to go.
In the login form, the end-user has to provide username and password of his/her system account on the Enterprise Desktop host and connect.
I Auto-reconnection is supported: when the connection is lost for whatever reason (including when browser's computer has entered sleep mode), the NoMachine web application will automatically try to reconnect for as long as the user keeps the web page open. If reconnecting is not possible, then the user will have to reconnect manually.
The configuration file for the web player program (which provides the graphical front-end) and the web client program (which manages web sessions) is server.cfg, located in the BaseDirectory/NX/etc directory on Linux, BaseDirectory/NoMachine/etc directory and Windows and BaseDirectory/NoMachine.app/Contents/Frameworks/etc on Mac.
For example on Linux: /usr/NX/etc/server.cfg.
NoMachine uses by default port 22 for SSH protocol on Linux and Mac, and port 4022 on Windows. The default port for NX protocol is 4000. In order to change the port for NX protocol, change the port for the nxd service and restart it. See the paragraph 'Connecting by NX Protocol'. To change the port for connections by SSH to Linux and Mac hosts it's necessary to modify the listen port for the SSH server on the system. On Windows instead, change the port for the nxsshd service.
You can start and stop the NoMachine HTTP server (nxhtd) from the Server preferences GUI -> Server preferences -> Network services panel. From the NoMachine GUI you can also change the port where the web server will be listening (by default 4080 and 4443 for secure connections).
From command line instead it's possible to do the following.
NoMachine Enterprise Desktop is designed to provide a fully integrated service to deploy sessions on the web which doesn't require additional software to be installed or manual configuration. The minimal Apache web server, nxhtd, provides the necessary modules and is pre-configured to work with the web player application.
However, it is possible to run the web player application with an alternative Apache web server. This requires the configuration of Apache and the web player.
See also: https://www.nomachine.com/AR07N00892 for further intructions about the configuration and: https://www.nomachine.com/AR07N00894 for an example about how to set up your own STUN/TURN server and configure the Enterprise Desktop accordingly.
In case of web sessions, by default, session data are streamed in video frames compressed and decompressed by using the MJPEG lossy algorithm, which is the video-format widely supported by browsers.
Oher video codecs like VP8 and H.264, require a browser which supports WebRTC and HTML5.
This will disable the progressive refinement of the image from the lower quality version of the image during moments of inactivity of the desktop till the target quality set in the Display quality slider. Disabling this refinement will send the image directly with target quality. This is not recommended when there is a very limited bandwidth.
The configuration files for the nxserver and nxweplayer/nxwebclient programs is server.cfg. The configuration file for the nxnode program is node.cfg.
NoMachine Enterprise Desktop comes with a default configuration that is sufficient to grant a working setup in the majority of environments. NoMachine administrators can tune their installation at any moment and according to their specific needs by setting the related configuration keys. In some cases this will require to restart all NoMachine services.
NoMachine configuration files are text files made up of a number of key-value pairs. All the configuration files can be edited manually by a text editor. For example 'vi' can be used on Linux and Mac, and 'notepad' on Windows. On Windows it can be necessary that you copy the cfg file in a different place, edit it and move it to the etc directory.
Installation and upgrade procedures take care of configuring and starting all the necessary services to make NoMachine Enterprise Desktop ready to accept connections to its physical desktop. The necessary services are configured to be restarted at each reboot of the host machine.
22 (Linux and Mac) TCP port for connections via SSH protocol on Linux and Mac. This port must be open in the firewall and mapped to the external IP of the server host. Set a different port for the system SSH server and align value set for SSHDPort in server.cfg. Then restart the NoMachine server.
4022 (Windows) TCP port for the NoMachine SSH server on Windows (nxsshd) and connections by SSH protocol. This port must be open in the firewall and mapped to the external IP of the server host. Set SSHDPort in server.cfg and restart the nxsshd service.
If the displaying of monitor's notification messages is disabled, the desktop owner will be unable to accept connection's requests by other users. Configure trusted users if you need to permit the connection without explicit authorization.
NoMachine provides an instant messaging tool, named whiteboard which allows also drawing and sharing files with connected users and fast-track access to file transfer. To access it, connect to the user's desktop and from the Monitor (!M icon) in your system tray click on 'Show the whiteboard'. Note that if multiple users are connected at the same time, they will all see the message.
connections by default use the NX protocol which is its own protocol for secure communication over the network. Encryption in the NX protocol is implemented using OpenSSL TLS/SSL, based on ECDHE-RSA-AES128-GCM-SHA256 as the default cipher suite. ECDHE-RSA-AES128-GCM-SHA256 is an AES (Advanced Encryption Standard) block cipher with 128 bits key in GCM (Galois/Counter Mode). RC4 (ECDHE-RSA-RC4-SHA cipher suite) is used as a backward compatibility when connecting from or to versions 4.0.
NoMachine Enterprise Desktop also provides tunneling of connections using SSH and full integration with any authentication backend supported by the host SSH server. On Windows systems, NoMachine provides a built-in SSH server, nxsshd.
The default setting of NoMachine is to run connections via the NX protocol on port 4000. On server side, the Network Server, nxd, is listening on port 4000. It's mandatory that this port is open between client and server to allow connections by NX protocol.
The default port used for the SSH protocol is 22 on Linux and Mac. On such platforms NoMachine relies on the SSH server installed on the system. If your SSHD is configured to listen on a port different from 22 you need to align the NoMachine server configuration accordingly. Connecting users will have to specify such value in their connection settings in the client GUI.
On Windows, NoMachine provides the SSH server, nxsshd, listening on port 4022. As explained above, this port can be changed from the GUI or in the server configuration file (SSHDPort 4022).
Automatic discover of the NoMachine Enterprise Desktop host is possible only when the server and the user's machine are on the same LAN. When the user connects over the internet or from a different network, it's mandatory to know the public (or external) IP of the Enterprise Desktop.
User's access based on system authentication (default) EnablePasswordDB 0 Authentication is requested to the system, user's connection is allowed once the user has been authenticated. PAM, LDAP, AD are supported.
Allow connections from all authenticated users (default) EnableUsersDB 0 Every time a new account is created via NoMachine or an already existing system user runs the session for the first time, the user is added to the NoMachine NX Users DB, even when the use of NX Users DB is disabled. These users cannot be disabled and are always allowed to connect if they authenticate successfully.
Enable or disable user's access to NoMachine EnableUsersDB 1 By default all users are enabled to access the NoMachine system once authenticated. With this configuration a user can be disabled and re-enabled at any moment from command line.
The Enterprise Desktop is able to handle two types of accounts: system accounts and NoMachine accounts. The latter allows to separate the system password from the NoMachine password.
III If this Enterprise Desktop is federated under a Cloud Server, each user must have the same system account on the Cloud Server host and on this Enterprise Desktop. Password can be different.
i)The user has run at least one session or have been added to NoMachine dbs by means of 'nxserver --useradd' command.
Trusted for: it shows if the user is trusted and therefore allowed to connect to the physical desktop of this host (only specific user are permitted to do that).
Access: it shows if the user is enabled or not to access the NoMachine system. This works in conjuction with the use of the NoMachine Users DB: when enabled (EnableUserDB 1 in the server configuration), it's possible to enable/disable user's access to the whole NoMachine system.
Forwarded to: this field is applicable only when the server is a NoMachine Cloud Server, so it's always empty in case of Enterprise Desktop.
By default when the connecting user is different from the owner of the physical desktop, the desktop owner has to authorize the user for the connection.
It is possible to define in advance a number of trusted users who don't need the specific owner's permission.
In order to create a list of trusted users, administrators should use the nxserver commands for creating and editing users. These commands provide the --trusted option to define if the user is trusted for connections to the physical desktop or not.
The Enterprise supports the possibility to generate guest accounts on demand. The automatic generation of guests accounts is available on all platforms, i.e. Linux, Windows and Mac. This feature however is not enabled by default and must be activated via a profile rule.
Guest users don't know their username and password and cannot unlock the remote screen if screen locking is enabled. It's therefore necessary to disable it on the system.
Finished - the session has been closed in a clean way and all NoMachine processes have been shut-down smoothly.
Transitional statuses are Connecting and Terminating.
If you need to terminate a remote desktop session after a certain time of inactivity, you can specify it by uncommenting and adding the '-timeout s' (s stays for seconds) option to the DisplayAgentExtraOptions key in the node configuration file.
If the NoMachine display agent doesn't receive any input from the user in the given timeout, it will terminate the session.
The server configuration provides a number of keys that can be activated to execute a custom script upon a certain event. According to the event, a number of parameters can be specified for each script. In a similar way, a number of keys is present in the node configuration file to allow to execute a custom script on a certain NoMachine node event. In both cases and according to the event, a number of parameters can be specified for each script. Keys and parameters not supported by the Enterprise Desktop are omitted in the table below.
Note that order of parameters is relevant. For example, a custom script to be run on node event 'UserScriptBeforeSessionStart' should use the $2 variable to retrieve username and $4 to retrieve display.
If NoMachine Enterprise Desktop is federated under a Cloud Server consider that custom scripts have to be placed in server.cfg or node.cfg file on the Enterprise Desktop host, not on the Cloud Server.
By default users can connect to the remote physical desktop of the Enterprise Desktop host. When the desktop owner is different from the connecting user, he/she is always required to authorize the incoming request for connection.
Authorization is not requested when the incoming user and the desktop owner are the same.
Rather than allow all users to connect without desktop's owner authorization or click accept for every single user which would like to connect, it is possible to define in advance a number of trusted users who don't need the specific owner's permission.
You can configure how users will connect to a desktop owned by another user from the Server status -> Server preferences -> Desktop access GUI. You can basically determine if users can connect or not without asking the desktop owner's permission and if users will be able to interact with the desktop.
or in the server configuration as explained in detail in the next paragraphs.
I Disabling the request for desktop owner's authorization before connecting can be useful in case of remote administration of headless machines.
II Allowing connections in interactive mode grants the user full access to the desktop resources and applications. View-only mode is suggested for example when making presentations or teaching a lesson.
III When the Enterprise Desktop is federated under a Cloud Server, each user must have the same system account on the Enterprise Desktop host and on the Cloud Server host. Password can be different.
NoMachine Enterprise Desktop supports also the screen blanking (the physical monitor is obscured until somebody is connected from remote) and the automatic lock of the remote screen when the last NoMachine user disconnects.
To request for the explicit authorization of the desktop owner before connecting the user, be sure that the following key is set in the server configuration. The authorization is requested when the connecting user is different from the desktop owner and is not a trusted user.
By default, the owner of the physical desktop, either sit in front of the computer or connected to the physical desktop via NoMachine, has the possibility to switch off/on the sharing of the screen at any moment.
When 'Accepting connection' is disabled, nobody can connect to that desktop by NoMachine. This setting lasts until the desktop owner changes it again. It persists also when the user physically is logged-out or closed the NoMachine connection. It's therefore strongly advisable to be very careful when disabling accepting connections from remote, since it will be no longer possible to reconnect to the desktop via NoMachine once the current session is closed.
This will hide the 'Accepting connection' item from the Monitor menu.
The Enterprise Desktop permits users to access and share their devices and resources from locale to remote and vice-versa. Disks, printers, USB devices and more can be connected inside the session to easily access them from both client and server side. At present device sharing is not available with web sessions and requires to connect by NoMachine client.
Two-ways copy and paste is fully supported. Web sessions implements the NoMachine virtual clipboard provides for copying text from/to the session running in the browser and the local computer.
by editing the corresponding keys. The manual configuration permits also to limit only oneway of service, for example forbid to connect a local printer to remote. The next paragraphs deal with manual node configurations in detail.
Administrators can configure paths on the server where public and private disks will be mounted as well as specifying which disks on the server can be made available to users. This service relies on the NoMachine File-system Server (nxfsd) and NoMachine File-system Adapter driver on Windows. On Mac it uses the nxfuse extension whilst on Linux it uses FUSE, installed on the system by default. The nxfs and nxfsserver programs are used on all systems to mount disks.
Printers Local and remote printers can be connected at any time (bi-directional printing). A connected printer is listed among the available printers when printing a document or similar. A printer can be connected to be 'Public', i.e. available to all users connected to that desktop, or private, for a specific user. It can be also configured to be the default printer. This services relies on the NoMachine Device Server service and the NoMachine Printer Adapter driver on Windows. On Mac and Linux it uses the CUPS infrastructure present on the system. In this last case, a printer can be exported to the server only if the connected user is in the lpadmin group.
USB devices USB devices such as disks, pendrives, webcam etc... are forwarded through the network. For example, when a USB device is forwarded from locale (where the player is running) to remote, it becomes available on the remote side only. This service is based only on the NoMachine USB Server (nxusbd) and drivers (NoMachine USB Hub, NoMachine USB Adapter and NoMachine USB Host Adapter on Windows, nxusb.ko kernel module for Linux and nxusb.kext for Mac) and doesn't require external tools.
Network ports Service ports (such as Samba, CUPS, FTP, SSH, telnet and others) can be made available from local to remote and vice-versa via a virtual network interface. This service uses the NoMachine Device Server and the NoMachine VPN Adapter driver on Windows and Mac. On Linux it relies on a NoMachine tool plus a standard driver.
On Linux and Mac this service uses the CUPS infrastructure present on the system.With CUPS 1.4 or later, to ensure that users are able to connect a printer from locale to their NoMachine session on Linux or Mac, it's necessary that the user already belongs to the CUPS System Group on the NoMachine server host. That's because, to add a printer to the CUPS system, the 'lpadmin' command line tool has to be executed by a user who belongs to the CUPS's System Group, which can be for example 'lpadmin' on Ubuntu, 'sys' on Fedora, RHEL and CentOS distributions and _lpadmin on Mac.
On Windows 10,8,7 and Vista NoMachine's audio system perfectly integrates with the Windows media framework. On XP instead, NoMachine relies on its own driver, the NoMachine Audio Adapter. For microphone support NoMachine always uses the NoMachine Microphone Adapter driver.
On Mac, NoMachine installs and uses its own virtual drivers to support audio and microphone seamlessly.
Accepted values on Windows and Mac are instead 'nxaudio' or 'disabled'.
NoMachine permits to record in a video all activities made inside the session or on the desktop. To start the recording of the session, users should open the NoMachine menu inside the session (ctrl+alt+0) and click on the 'Recording' button icon to access the Recording panel. From this panel it's possible to open the recording bar, change audio and video quality and open the recording directory to access all recorded files. Session recording is not available with sessions on the web.
To register activities made on the desktop, start the recording from the !M icon menu in the system tray of the Enterprise Desktop host and show the Recording bar from there. Desktop activities can be registered on the physical desktop without the need to be connected by NoMachine.
The Enterprise Desktop, as well as the other NoMachine client and server products, periodically checks NoMachine repositories (by default every two days) to verify if updates are available and will prompt a dialog informing the user that a new version is available.
A separate guide, available at: span class="linkGeneralGreen">https://www.nomachine.com/all-documents deals specifically with all the possible options for the automatic software updates.
To retrieve logs by using the NoMachine tools, please refer to guides available in the Configuration section at: https://www.nomachine.com/all-documents.
In its default configuration, the Enterprise Desktop removes the session directory from the user's home/.nx directory once the session has been correctly terminated.
If you own multiple installations of Enterprise Desktop, you may need to provide a single point of access to all of these servers. This can be done by installing NoMachine Cloud Server on a dedicated host and add each Enterprise Desktop to it.
In this way, users will connect to the hostname/IP of the Cloud Server and will be redirected to the appropriate Enterprise Desktop or, depending on the Cloud Server configuration, will be able to choose it manually.
You may also configure the NoMachine centralized infrastructure to make each Enterprise Desktop to accept or refuse direct connections to its host.
In order to federate an Enterprise Desktop under a Cloud Server, connect to the Cloud Server host as a NoMachine administrator and use the graphical interface to add the server.

References: v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v.