Configuring the WAPT agent¶
The configuration file C:\Program Files(x86)\wapt\wapt-get.ini
defines the behavior of the WAPT agent.
The [global] section is required:
[global]
Description of available options for the WAPT agent¶
Note
if
repo_urlandwapt_serverfields are empty, the WAPT agent will look for a repository using SRV records in thednsdomainzone;if there is no
wapt_serverattribute in the[global]section, no WAPT Server will be used;if there is no
repo_urlattribute in the[global]section, a repository in the[wapt]section will have to be explicitly defined;it will have to be enabled by adding it to the
repositoriesattribute to the[global]section;
Options |
Description |
|---|---|
|
Use host packages (default 1). |
|
Update frequency (120 minutes by default). |
|
Upgrade frequency (disabled by default) |
|
WAPT agent loopback port. It is not accessible from the network. |
|
Path to the local database file. |
|
Log level of the WAPT agent. Possible values are: |
|
List of packages maturities than can be viewed and installed by
WAPT Agent. Default value is |
|
Allows you to use the fqdn name rather than the uuid BIOS as the unique machine identifier in wapt. |
|
Define the frequency where the agent checks if he has audits to perform. |
|
Allows you to set the list of wapt agent languages to modify the list
of packages visible by wapt (for package filtering).
You can add multiple language (eg. |
|
Allows you to define a wapt package list that the wapt agent must install. |
|
Force default langauge for GUI (not for package filtering) |
|
Allows you to force an Organizational Unit on the WAPT agent.
(Convenient to assign a fake OU for out-of-domain PC) Make sure it respects
a consistent case (don’t mix “dc”s and “DC”s, for example), which you can find
in the console (in the DN/ |
|
Define whether a download of pending packages should be started after an update with waptupdate_task_period |
|
Send the log wapt in the window events |
|
How the self service authentication works. Possible values are:
|
|
Whether or not it is possible for the user to uninstall applications via the self-service. |
WAPT Server configuration attributes¶
These options will set WAPT agent behavior when connecting to WAPT Server.
Options |
Description |
|---|---|
|
WAPT Server URL. If the attribute is not present, no WAPT Server will be contacted.
If the attribute is empty, a DNS query will be triggered
to find the WAPT Server using the |
|
DNS zone on which the DNS SRV |
|
WAPT Server HTTPS connection timeout in seconds |
|
Use Kerberos authentication for initial registration on the WAPT Server. |
|
See the documentation on activating the verification of HTTPS certificates |
|
Folder of certificates authorized to verify the signature of WAPT packages,
by default, |
Using several repositories¶
There can be more sections in the wapt-get.ini file
to define more repositories:
[wapt]: main repository. Relevent attributes:repo_url,verify_cert,dnsdomain,http_proxy,use_http_proxy_for_repo,timeout. If this section does not exist, parameters are read from the[global]section;[wapt-template]: external remote repository that will be used in the WAPT console for importing new or updated packages;[wapt-host]: repository for host packages. If this section does not exist, default locations will be used on the main repository;
More information on that usage can be found in this article on working with multiple public or private repositories.
Note
Active repositories are listed in the repositories attribute
of the [global] section.
Options |
Description |
|---|---|
|
List of enabled repositories, separated by a comma. Each value defines a
section of the |
Note
This parameter can be configured both in the WAPT agent configuration
and in the WAPT console configuration file
C:\Users\%username%\AppData\Local\waptconsole\waptconsole.ini.
For information on configuring the WAPT console, please refer to this documentation.
Settings for waptexit¶
Options |
Description |
|---|---|
|
Prevents users from canceling package upgrades on computer shutdown. |
|
Timeout for scripts at computer shutdown. |
|
Timeout for GPO execution at computer shutdown. |
|
Disables Hiberboot on Windows 10 to make waptexit work correctly. |
Settings for WAPT Self-Service and Waptservice Authentification¶
Options |
Description |
|---|---|
|
Apply selfservice package view filtering for Local Administrators. |
|
Defines the authentication system of the wapt service, available value are system, waptserver-ldap, waptagent-ldap. |
|
Useful with waptagent-ldap, defines if the LDAP request must be encrypted. |
|
Useful with waptagent-ldap, define whether the certificate should be verified. |
|
Useful with waptagent-ldap, defines the base dn for the LDAP request. |
|
Useful with waptagent-ldap, defines the LDAP server to contact. |
|
Forces a user to authenticate on the WAPT service. |
|
sha256 hashed password when waptservice_user is used (the value NOPASSWORD disables the requirement for a password). |
Settings for wapttray¶
Options |
Description |
|---|---|
|
Prevents |
Proxy settings¶
Options |
Description |
|---|---|
|
HTTP proxy address |
|
Use the proxy to access the repositories. |
|
Use a proxy to access the WAPT Server. |
|
Use a proxy to access package template server. |
Settings for creating packages¶
Options |
Description |
|---|---|
|
Path to the Administrator’s private key. |
|
Directory for storing packages in development. |
|
Directory for storing host packages in development. |
|
Default prefix for new or imported packages. |
|
Default prefix for new or imported packages. |
Settings for WAPT Windows Updates¶
Refer to this article on configuring WAPTWUA on the WAPT agent.
Overriding settings of upload functions¶
It’s possible to override upload commands to define a particular behavior when uploading packages. It’s possible for example to upload packages on several repositories, or via another protocol, etc.
To upload packages on the repository (wapt-get upload-package or build-upload), use:
upload_cmd="C:\\Program Files (x86)\\WinSCP\\WinSCP.exe" admin@srvwapt.mydomain.lan /upload %(waptfile)s
To upload host-packages on the repository (upload-package or build-upload of a host package), use:
upload_cmd_host="C:\\Program Files (x86)"\\putty\\pscp -v -l admin %(waptfile)s srvwapt.mydomain.lan:/var/www/wapt-host/
To launch a command after a package upload, use:
after_upload="C:\\Program Files (x86)"\\putty\\plink -v -l admin srvwapt.mydomain.lan "python /var/www/wapt/wapt-scanpackages.py /var/www/%(waptdir)s/"
Configuration of WAPT agents¶
After standard installation, the default configuration is:
[global]
waptupdate_task_period=120
waptserver=https://srvwapt.mydomain.lan
repo_url=https://srvwapt.mydomain.lan/wapt/
use_hostpackages=1
Making changes in wapt-get.ini and regenerating an agent
is not sufficient to push the new configuration.
You can create a WAPT package to push updated wapt-get.ini settings.
The package is available from the Tranquil IT repository: https://store.wapt.fr/wapt/tis-wapt-conf-policy_6_f913e7abc2f223c3e243cc7b7f95caa5.wapt:
# -*- coding: utf-8 -*-
from setuphelpers import *
uninstallkey = []
def install():
print('Modify max_gpo_script_wait')
inifile_writestring(WAPT.config_filename,'global','max_gpo_script_wait',180)
print('Modify Preshutdowntimeout')
inifile_writestring(WAPT.config_filename,'global','pre_shutdown_timeout',180)
print('Disable Hyberboot')
inifile_writestring(WAPT.config_filename,'global','hiberboot_enabled',0)
print('Disable Notify User')
inifile_writestring(WAPT.config_filename,'global','notify_user',0)