Installing WAPT Server on Debian and Ubuntu¶

Setting up the server¶

In order to install a fresh Debian Linux 11 Bullseye or Ubuntu Focal LTS (physical or virtual).

Warning

Install 64bit version.
Install the Server without the graphical user interface.
Systemd must be enabled

Attention

The upgrade procedure is different from an initial installation. For an upgrade, please refer to the documentation on upgrading the WAPT Server.

Configuring the network parameters¶

The different parameters presented below are not specific to WAPT; you may adapt them as required for your environment.

Modify the following files in order to get a proper naming (FQDN) and network addressing strategy.

In the following example:

the FQDN name is srvwapt.mydomain.lan;
the short-name of the WAPT Server is srvwapt;
the DNS suffix is mydomain.lan;
the IP address is 10.0.0.10/24;

Configuring the name of the WAPT Server¶

Hint

The short name of the WAPT Server MUST not be longer than 15 characters (the limit is due to sAMAccountName restriction in Active Directory).

The name of the WAPT Server MUST be a FQDN, that is to say it has both the server name and the DNS suffix.

Modify the /etc/hostname file and write the FQDN of the WAPT Server.

# /etc/hostname of the WAPT Server
srvwapt.mydomain.lan

Configure the /etc/hosts file, be sure to put both the FQDN and the short name of the WAPT Server.

# /etc/hosts of the WAPT Server
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
10.0.0.10   srvwapt.mydomain.lan srvwapt

Hint

On the line defining the DNS server IP address, be sure to have the IP of the WAPT Server (not 127.0.0.1), then the FQDN, then the short name.
Do not change the line with localhost.

Configuring the IP address of the WAPT Server¶

Configure the IP address of the WAPT Server in the /etc/network/interfaces.

# /etc/network/interfaces of the WAPT Server
auto eth0
iface eth0 inet static
  address 10.0.0.10
  netmask 255.255.255.0
  gateway 10.0.0.254

Apply the network configuration by rebooting the host with a reboot.

reboot

If it has not already been done, create the DNS entry for the WAPT Server in the Organization’s Active Directory or DNS server.
After having rebooted, configure the system locale in English in order to have non-localized logs for easier searching of common errors.

apt install locales-all -y
localectl set-locale LANG=en_US.UTF-8
localectl status

Check whether the machine is properly synchronized with NTP server. If it is not synchronized please refer to the OS documentation to configure timedatectl.

timedatectl status

Update and upgrade the Operating System and make sure that the Debian default certificate authorities bundle is installed.

apt update && apt upgrade
apt install ca-certificates -y

Reboot the WAPT Server.

reboot

The server is now ready.

Installing the WAPT Server requires a few steps:

Configuring the repositories.
Installing additional Linux packages.
Installing and provisioning the PostgreSQL database.
Post-configuring the WAPT Server.

Note

The WAPT Server packages and repository are signed by Tranquil IT and it is necessary to get the gpg public key below in order to avoid warning messages during installation.

Installing the WAPT Server packages¶

Update the APT source, retrieve the .gpg key from Tranquil IT, then add Tranquil IT’s repository.

apt install apt-transport-https lsb-release gnupg wget -y
wget -O - https://wapt.tranquil.it/$(lsb_release -is)/tiswapt-pub.gpg | apt-key add -
echo "deb https://wapt.tranquil.it/$(lsb_release -is)/wapt-2.3/ $(lsb_release -c -s) main" > /etc/apt/sources.list.d/wapt.list

Then install the WAPT Server packages.

export DEBIAN_FRONTEND=noninteractive
apt update
apt install tis-waptserver tis-waptsetup -y
unset DEBIAN_FRONTEND

Post-configuring¶

WAPT Server Postconf script¶

Attention

For post-configuration to work properly, you MUST first have properly configured the hostname of the WAPT Server. To check, use the command echo $(hostname) which MUST return the DNS address that will be used by WAPT Agents on client computers.

The post-configuration script rewrites the nginx configuration. A backup file is created when running the postconf in the same directory.

This post-configuration script MUST be run as root.

Run the script.

/opt/wapt/waptserver/scripts/postconf.sh

Click on Yes to run the postconf script.

do you want to launch post configuration tool?

            < yes >          < no >

Choose a password (if not defined) for the SuperAdmin account of the WAPT Server (minimum length is 10 characters).

Please enter the wapt server password (min. 10 characters)

*****************

                < OK >          < Cancel >

Confirm the password.

Please enter the server password again:

*****************

                < OK >          < Cancel >

Choose the authentication mode for the initial registering of the WAPT Agents:
- Choice #1 allows to register computers without authentication. The WAPT Server registers all computers that ask to be registered.
- Choice #2 activates the initial registration based on kerberos (you can activate it later).
- Choice #3 does not activate the kerberos authentication mechanism for theinitial registering of hosts equipped with WAPT. The WAPT Server will require a login and a password for each host registering with it.

WaptAgent Authentication type?

--------------------------------------------------------------------------
(x) 1 Allow unauthenticated registration
( ) 2 Enable kerberos authentication required for machines registration.
        Registration will ask for password if kerberos not available
( ) 3 Disable kerberos but registration require strong authentication
--------------------------------------------------------------------------
                                        < OK >          < Cancel >

If you want to use WAPT for OS Deployment, select Yes.

Do you want to activate os deployment?

        < Yes >        < No >

If you answered Yes to enable the deployment of Operating Systems with WAPT, the post-configuration script will ask whether you want to use a secure authentication in order to deploy the OS image. It will then ask for a user / password when you will try to deploy the Operating System.

Would you like to activate secure authentication on wads?

        < Yes >        < No >

Still regarding the WADS feature, if you answered Yes to the last 2 questions, you will have a final question:

Would you like to mention an IP subnet exempt from wads authentication

        < Yes >        < No >

If you answer Yes to this prompt, you will have to give an IP subnet which can be a list (exemple: 192.168.0.0/24, 192.168.1.0/24).

Select OK to start WAPT Server.

Press OK to start waptserver

             < OK >

Select Yes to configure Nginx.

Do you want to configure nginx?

        < Yes >        < No >

Fill in the FQDN of the WAPT Server.

FQDN for the WAPT Server (eg. wapt.example.com)

---------------------------------------------
wapt.mydomain.lan
---------------------------------------------

            < OK >          < Cancel >

Select OK, a self-signed certificate will be generated, this step may take a long time.

Generating DH parameters, 2048 bit long safe prime, generator 2 This is going to take a long time
.......................................+...............................+...

Nginx is now configured, select OK to restart Nginx:

The Nginx config is done.
We need to restart Nginx?

              < OK >

The post-configuration is now finished.

Postconfiguration completed.
Please connect to https://wapt.mydomain.lan/ to access the WAPT Server.

                                  < OK >

Listing of post-configuration script options:

Options	Description
`--force-https`	Configures Nginx so that port 80 is permanently redirected to 443

The WAPT Server is now ready. You may go to the documentation on installing the WAPT Console.