Dell Wyse ThinOS 9 & 802.1x Configurations

I recently came across an issue that took some time trying to resolve regarding 802.1x configuration on ThinOS 9.1 that I wanted to share.

Ultimately, the issue came down to the SSL certificate name not matching the certificate name entered into the Wyse Management Suite (WMS) configuration.

When the device was trying to authenticate, it was using a certificate name that didn’t match what was in the WMS configuration and failed to authenticate because of this.

Some errors we received in the event log but weren’t very descriptive although it appeared to be a certificate authentication issue based on ‘private key passphrase needed for SSID’ error message.

  • TLS: Failed to set TLS connection parameters
  • EAP-TLS: Failed to initialize SSL
  • WLAN: CTRL-REQ-PASSPHRASE-0:Private key passphrase needed for SSID
  • WLAN: EAP: Failed to initialize EAP method: vendor 0 method 13 (TLS)

Example log:

We then looked at the WMS 802.1x configuration and verified the certificate name, in this case, ‘wyse.pfx’ – note the lowercase ‘w‘. We uploaded again to WMS and verified we got prompted for password so that looked correct.

We then looked at actual certificate we uploaded, ‘Wyse.pfx’, and made note of the case – capital ‘W‘ vs the lowercase ‘w‘ that was entered in WMS console so we changed WMS to match certificate name. We changed it from ‘wyse.pfx’ to ‘Wyse.pfx’. Once we did this and rebooted device, it connected to the network successfully!

Lesson learned, it’s never a bad idea to verify case sensitivity and try to make sure they match to avoid this potential pitfall!

Hope you found this helpful!

Additional Resources:

  • More details on 802.1x configurations noted here
  • If you are new to ThinOS 9.1, here is a quick video overview of some of it’s features.
  • Looking for more details on ThinOS 9.1? Check out the release notes here
  • Excellent Dell Wyse community located here
  • Dell Community forums for ThinOS here

@chris_messier ~~> Subscribe to blog to get latest updates <~~

Dell Wyse ThinOS 9.1 & Windows Virtual Desktop (WVD) Support

The Dell Wyse team has recently launched support for Windows Virtual Desktop(WVD) on Dell Wyse ThinOS 9.1. This is big news as it allows us to use a non-Windows thin client endpoint to connect to your WVD environment! Microsoft posted a quick announcement about this as well here.

I’ve covered some details about the configuration below and you can access the official documentation here;

  1. ThinOS 9.1 & WVD product summary noted here
  2. ThinOS 9.1 administrators guide here, release notes here, & 8.6 to 9.1 migration guide here
  3. Note – If you are still on ThinOS 8.6 you can learn how to upgrade to 9.x here

The configuration for ThinOS & WVD is pretty straightforward with the only configuration needed is a Wyse Management Suite (WMS) policy to specify Windows Virtual Desktop under the broker setting which is shown below.

Note – by default, the WVD client package is pre-installed on 9.1 but incase it’s not or you’re looking for latest you can get from support.dell.com under drivers for your model, for example 5070, search for ‘wvd’.

  1. In WMS, edit your ThinOS 9 policy and browse to ‘Advanced –> Broker Settings –> Windows Virtual Desktop Settings’ as shown below

2. Under the following section you just need to choose the appropriate WVD deployment model you are using. You will chose either the latest WVD ARM (Azure Resource Manager) based deployment model or the ‘classic’ WVD non ARM based deployment. In my testing, I am using the Azure portal ARM based deployment so I selected the (ARMv2) option. When you are done, click ‘Save & Publish’.

3. Also under, Broker Settings\Global Broker Settings set to – “Windows Virtual Desktop” on your policy as shown below:

4. Once the updated WMS policy is received by your device, you should see your new WVD setting reflected on your device as shown below

4. Once the devices reboots, you should be prompted with the Microsoft Azure AD login screen as shown below 5. At this point you are ready to login into WVD and access your VMs! wmswvd1_46. In this case I have access to a Windows 10 VM!

Hope you found this helpful!

Additional Resources:

  • If you are new to ThinOS 9.1, here is a quick video overview of some of it’s features.
  • Looking for more details on ThinOS 9.1? Check out the release notes here
  • ThinOS 9.1 release notes discussing WVD setup here & 8.6 vs 9.1 feature comparison here
  • Excellent Dell Wyse community located here
  • Dell Community forums for ThinOS here

@chris_messier ~~> Subscribe to blog to get latest updates <~~

Dell Wyse ThinOS 9 & Netscaler/ADC

I’ve run into a few issues lately where customers are currently using ThinOS 8.x successfully with Citrix Netscaler/ADC but having issues connecting with Dell Wyse ThinOS 9.x.

In more than one case, it’s been an issue with the existing Netscaler Session Policy that was setup specifically for Wyse devices and contains information from the ThinOS 8.x User-Agent HTTTP/S request header that may no longer apply to ThinOS 9.

The ThinOS 8.x User-Agent request header is: CitrixReciever WTOS/1.0

The ThinOS 9.0 User-Agent request header is: “CitrixReceiver”/18.12.0.65534 (X11; Linux x86_64) Warthog/9.0.8024 (Release) X1Class CWACapable

**Update 8/2021 #1 ** ThinOS 9.1 User-Agent request header has been changed to: CitrixReceiver/18.12.0.65534 (X11; Linux x86_64) WTOS/9 (Release) X1Class CWACapable (‘Warthog/9.0.8024′ was replaced with: ‘WTOS/9’)

**Update 8/2021 #2 ** If ThinOS is using the built-in web browser to connect to an MFA site, for example, Okta, Duo, etc.. then the HTTP header will be one of the following:

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.181 Warthog/9.0 Safari/537

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.181 Electron/3.1.11 Safari/537.36

Note: The following below may not be true if using >9.1 as the http header now again contains “WTOS”.

The issue I’ve seen is many customers using ThinOS 8.x have a Netscaler Session Policies setup to look for a User-Agent to include “WTOS” or “WTOS/1.0” and that does NOT exist in the 9.x User-Agent header so the existing Session Policy will be ignored and not applied.

Network trace from ThinOS 8.6_511:

Network trace from ThinOS 9.0_4024:

 

Network trace from ThinOS 9.1.2101 / CWA 21.1.0.14.8

 

To fix this, you have 2 options.

Option #1: Create a new session policy on Netscaler/ADC to contain something from the ThinOS 9.x header, for example, ‘Warthog’ (name for ThinOS 9) so it uses the policy.

Option #2: Wyse Management Suite has the ability to specify the User-Agent header under the WMS Citrix Broker/Netscaler section.  

  • Under ‘Citrix Broker’ settings from ThinOS 8.x policy

  • Under ‘Broker Settings’ settings from ThinOS 9.x policy

Finally, we also saw an issue where we get the following error; INFO: “Waiting for token to change, then enter the new tokencode”

The existing Netscaler/ADC policy was set to have an RSA policy first BUT since that policy was setup using the 8.6, “WTOS”, header, it was going to the second policy and only allowing LDAP, but threw this error. Once we fixed the policy as noted above with proper header, we were able to use or RSA policy as primary, and the LDAP as secondary.

You can configure this behavior under the “Citrix Netscaler/ADC” settings section in the ThinOS 9 policy.  

Hope you found this helpful!

@chris_messier ~~> Subscribe to blog to get latest updates <~~

Dell Wyse ThinOS Security Message (8.6_511)

“Client configuration were obtained using an unsecure connection. Please consider the potential security risk before proceeding.”

To resolve this, you will want to enter the following value on the Advanced section in WMS:

signon=yes enablemessage=no

This Advanced section is located under your group profile located in Advanced Device Configuration\Advanced as shown below.

You will then enter, signon=yes enablemessage=no, on an available line as shown in the example below:

Additional details:

Release notes here.

HTH!

@chris_messier ~~> Subscribe to blog to get latest updates <~~

Microsoft Teams Optimization for Dell Wyse ThinOS 9

 

Microsoft Teams Optimization is now available for Dell Wyse ThinOS 9 with the launch of the latest Citrix WorkSpace app 2006 for Linux. Users of ThinOS 9 can now download this latest Citrix WorkSpace app and get the benefits of Microsoft Teams Optimizations in a Citrix environment.

Unified Communications have always been a challenge in virtual desktop environments and the continued innovations in this area are much needed.

Citrix does a nice job of outlining the details of how the optimization works along with a quick video in this blog post.

Here are some additional details:

  • Download this latest Citrix WorkSpace App 2006 for ThinOS 9 here
  • Check out ThinOS 9 release notes for additional details here

Supported Platforms and Management Software:

  • Wyse 5070 Thin Clients (ThinOS)
  • Wyse 5470 Mobile Thin Clients (ThinOS)
  • Wyse 5470 AIO Thin Clients (ThinOS)
  • Wyse 3040 Thin Clients (ThinOS)
  • Wyse Management Suite 2.1

Citrix resources for Microsoft Teams Optimization

ThinOS 9 Resources

Enjoy!

@chris_messier ~~> Subscribe to blog to get latest updates <~~

SSL Certificates & Wyse Management Suite

In a previous post, here, I covered how to resolve the SSL error message, “SSL Certificate Authority is Unknown” when using ThinOS.

In this post I will cover how to upload SSL certificates into Wyse Management Suite (WMS) and how to assign them to a specific group configuration/profile for ThinOS 8.x and 9.x.

The process is slightly different for ThinOS 8.x & ThinOS 9.x but I will cover both below. 

How to upload SSL certificates for use by ThinOS 8.x:

1. In WMS, browse to “Apps & Data”:

2. Scroll down to “File Repository”:

3. Click “Add File” to upload Certificate:

4. Browse out to the Certificates you exported. You will need to do for each Certificate you exported.

 

5. Once you click upload it should show up under the ‘Apps & Data – Inventory File Repository”:

 

How to upload SSL certificates for use by ThinOS 9.x:

    1. In your ThinOS 9 policy, browse to “Privacy & Security\Certificates”. Here you can turn on “Auto Install Certificates” and browse to the certificates you want to upload as shown below:

 

How to assign SSL Certificates to WMS configuration group/policy: 

Once your certificates are imported into WMS, you then need to assign them to your ThinOS profile you are using under, “Groups & Configs” select the group you want to edit following steps below;

  • ThinOS 8.x: in the policy, browse to “Device Configuration\Security\General Settings”. Select “Auto-install Certificates” and your Certificate should show up in the list to select. Once you are done, click “Save & Publish”. The next time the device reboots, it will pick up the new Certificate.

  • ThinOS 9.x: in your policy, browse to “Privacy & Security\Certificates”. Here you can turn on “Auto Install Certificates” and browse to the certificates you want to upload as shown below:

This completes the process of uploading your SSL certificates to WMS and assigning them to a ThinOS policy.

For more assistance, check out Dell Community Forums (formally Dell TechCenter):

@chris_messier ~~> Subscribe to blog to get latest updates <~~

 

Dell Wyse ThinOS – “SSL Certificate Authority is Unknown”

“SSL Certificate Authority is Unknown”

A common issue connecting to a VDI connection broker, i.e Citrix, VMware, etc.., from Dell Wyse ThinOS or any thin client, is an SSL certificate error. There are generally 2 reasons why.

  • the Root Certificate Authority certificate is not installed on the device
  • the Intermediate Certificate Authority certificate is also not installed on the device

Error: SSL Certificate Authority is Unknown

This is easily fixed by installing both the missing Root and likely the Intermediate certificate.

To do this, you can simply export from a browser, and then import on the device, generally through Wyse Management Suite (WMS) or even a USB key if you had to.

I will cover the 3 step process to fix this.

  1. Export the required certificates from a browser
  2. Upload into Wyse Management Suite
  3. Assign the certificates to the device profile

Steps to export certificate from browser:

  1. In this example, I used https://portal.vmware.com as an example to work with certificates but this would be your VMware Horizon server, Citrix Storefront site, Citrix Netscaler/ADC, Microsoft Azure MFA site, etc…
  2. Click on the SSL padlock on your browser as shown below to bring up below window. Click on ‘Certificate (Valid)’ field.

3. This will bring up the certificate information:

4. Click on “Certification Path” tab bring up the following:

5. Select the top level certificate, in this case, “Sectigo (formally Comodo CA)”

6. This will bring up the Root certificate as shown below, “Comodo RSA Certification Authority”. This is the first certificate we want to export.

7. Click on the “Details” tab and select, “Copy to File”:

8. Take defaults and follow the wizard to export the certificate:

9. Once you export the top level Root Certificate, follow the same steps to export the Intermediate certificate. This Intermediate is chained, or trusted, by this top level Root Certificate so we need both certificates in this chain.

10. In the browser, select the Intermediate Certificate, “COMODO RSA Domain Validation Secure Server CA” and select “View Certificate”:

11. Select “Details” and “Copy to File” to export the certificate:

12. Follow wizard again to export the Intermediate Certificate:

13. You now have successfully exported both the top level Root Certificate, “Comodo RSA Certification Authority”, and the Intermediate Certificate, “COMODO RSA Domain Validation Secure Server CA”.

Once exported you need to upload them into your WMS server. It’s a simple process and the steps to upload the certifications are outlined here. Once complete, resume to step 15 below to assign the certificate(s) to your group configuration/profile.

15. Once certificates are imported into WMS, you then need to assign them to your ThinOS profile you are using under, “Groups & Configs” select the group you want to edit following steps below;

  • ThinOS 8.x: in the policy, browse to “Device Configuration\Security\General Settings”. Select “Auto-install Certificates” and your Certificate should show up in the list to select. Once you are done, click “Save & Publish”. The next time the device reboots, it will pick up the new Certificate.

  • ThinOS 9.x: in your policy, browse to “Privacy & Security\Certificates”. Here you can turn on “Auto Install Certificates” and browse to the certificates you want to upload as shown below:

 

This completes the process of exporting the SSL certs, uploading to WMS, and assigning them to your profile. This should resolve the issue of “SSL Certificate Authority is Unknown”.

For more assistance, check out Dell Community Forums (formally Dell TechCenter):

@chris_messier ~~> Subscribe to blog to get latest updates <~~

New! Wyse 5470 Thin Client Laptop and 24″ All in One!

Dell has recently released 2 new models, the Dell Wyse 5470 Thin Client Laptop and a 24″ All in One thin client!

The big news here is it’s the first thin client laptop Dell has released that runs Wyse ThinOS. The thin laptop also comes in Windows 10 IoT along with the ThinLinux platform. We’ve had Windows and Linux based thin laptops in the past but we’ve always had demand for a ThinOS version so it’s finally here!

The other Dell Wyse first is a ThinOS based 24″ All in One which we seen lots of interest in the healthcare space and other verticals interested in AIO’s. This replaces the previous 21.5″ ThinOS and the 24″ Teradici based options we had.

See more below!

Product video of 5470 All in One here!

Product video of 5470 Thin Client Laptop here!

Enjoy!

@chris_messier ~~> Subscribe to blog to get latest updates <~~

New Updates! Cisco Jabber & Microsoft Skype for Business Enhancements for Wyse ThinOS

Cisco Jabber & Microsoft Skype for Business, and other unified communications solutions, are some of the solutions often requested in virtual desktop deployments. Citrix & VMware have both made some key advancements on the server side, i.e. Citrix HDX RealTime Optimization Pack (RTME) & VMware Horizon Virtualization Pack for Skype for Business.

Most of the client side solutions to ‘offload’ some of this processing has been focused on using Windows, or Windows Embedded, based endpoints. The request of many customers is to simplify & secure the endpoint as much as possible, which can lead to using a non-Windows based endpoint and running Windows 10/7 in the data center.

Dell Wyse just released Wyse ThinOS 8.6 which includes support for Cisco Jabber Softphone for VDI for Citrix and Skype for Business on VMware Horizon.

You can see more on these announcements here and some technical details in the Wyse ThinOS 8.6 release notes here.

Enjoy!

@chris_messier ~~> Subscribe to blog to get latest updates <~~

Wyse Management Suite (WMS) DNS Discovery

Once you have Wyse Management Suite (WMS) installed the next step is to automatically have your devices ‘find’ and check-in into your WMS server. This is accomplished by setting up a few DNS records that include the key WMS server information. I’ve outlined the DNS records that need to be setup and steps to setup on Microsoft Server 2012.

  • Service Location (SRV) Record
    • _WMS_MGMT
    • _WMS_MQTT
  • Text (TXT) Record
    • _WMS_GROUPTOKEN
    • _WMS_CAValidation

Steps to setup Service Location (SRV) Record on Microsoft Server 2012

  1. On your DNS server navigate to the domain you want, then right click on “_tcp”, and select “Other New Records”.

  2. To setup the 2 SRV records, select “Service Location (SRV) from the options.

  3. Setup your record for, “_WMS_MGMT”. This is the FQDN of your WMS server. Use the following options below:
    1. Domain: Your domain name
    2. Service: _WMS_MGMT
    3. Protocol: _tcp
    4. Priority: 0
    5. Weight: 100
    6. Port Number: 443
    7. Host offering this service: your_wms_server, i.e. wms1.dellse.local

  4. Setup your record for, “_WMS_MQTT”. This is a service port WMS uses. This is the FQDN of your WMS server. Use the following options below:
    1. Domain: Your domain name
    2. Service: _WMS_MQTT
    3. Protocol: _tcp
    4. Priority: 0
    5. Weight: 100
    6. Port Number: 1883
    7. Host offering this service: your_wms_server, i.e. wms1.dellse.local

  5. To setup the next 2 records, navigate to the domain you want, select that node, then right click and select “Other New Records”. *Note* do not select a sub node such as _tcp for these records.

  6. Select the “Text (TXT)” Record type:

  7. Setup your record for, “_WMS_GROUPTOKEN”. This is the specific Group Token/Profile that you setup and want to use. Use the following options below:
    1. Record Name: _WMS_GROUPTOKEN
    2. Fully qualified domain name (FQDN): _WMS_GROUPTOKEN.your_domain
    3. Text: defa-labdemo1
      1. This “Text:” field is the key that you want to use. You will get this from your WMS console where you setup your group profile under the key icon.

  8. Setup your record for, “_WMS_CAValidation”. If you are not using an SSL cert (default), then this value needs to be set to ‘False’. If you are using a cert, then this would be set to “True”. Use the following options below:
    1. Record Name: _WMS_CAValidation
    2. Fully qualified domain name (FQDN): _WMS_CAValidation.your_domain
    3. Text: False (or True, if using a cert)

9. Once you have these 4 options setup, you should see the following in DNS;

The following records should be listed under your_domain:

The other 2 records should be listed under, your_domain\_tcp

10. This completes the setup. Once your device boots up and does it’s DNS lookup it will populate the proper fields on the device, in this example, Wyse ThinOS: