Home
Remote Control V9.1.4
BigFix® Remote Control V9.1.4 Administrators Guide
This guide is for users who want to administer BigFix® Remote Control.
Certificate management
When using BigFix® Remote Control to facilitate remote control sessions across the internet, you can use certificates to address the authentication and verification required for ensuring secure connections between brokers and endpoints.
Truststore configuration
The BigFix® Remote Control server holds the truststore that is used for verifying the broker certificates.
Adding a certificate to the truststore
Certificates are used for verifying the remote control connections that are established by using the Internet Connection Broker. You must add the certificates to the truststore on the remote control server.

Remote Control V9.1.4
- Release Notes V9.1.4 Fixpack 1
- BigFix® Remote Control V9.1.4 Installation Guide
  By using BigFix® Remote Control you can remotely support and control thousands of PCs and servers, on an enterprise scale, from a central location or directly, in peer to peer mode.
- BigFix® Remote Control V9.1.4 Administrators Guide
  This guide is for users who want to administer BigFix® Remote Control.
  - Set a secure environment
    Set a secure environment when you are using BigFix® Remote Control
  - Secure target registration
    To prevent unauthorized targets from registering with the BigFix® Remote Control server, you can use tokens to authenticate the target.
  - Configure SAML 2.0 authentication on the server
    BigFix® Remote Control V9.1.3 introduced support for SAML 2.0 authentication on the BigFix Remote Control server.
  - Access the server web interface.
  - Unlocking user accounts
    When a user account is locked, you can unlock the account by using the Unlock locked userid feature.
  - Manage targets and target groups
  - Manage users and user groups
  - Server session policies
  - How session policies are determined
  - Starting a managed session by using an installed controller
    When you start a managed session, you can configure the server to use an installed controller rather than using the Java™ Web Start method. Note that the Java Web Start plugin method is deprecated in Remote Control starting from Version 10.0.0 Update 8 (Build Number 0802). This feature makes starting a session faster and it removes any warning message windows that are displayed while the session is starting.
  - Manage permission sets for temporary access to targets
  - Requests for temporary access to targets
  - Generate custom reports
  - Manage the home page for a user or group
  - Adding tables and columns to queries
  - Configuration and troubleshooting options in the Admin menu
  - Ensure targets are registered correctly
  - Record the session on the target
  - Set up for exporting recordings
  - Audit log distribution
  - Access targets on different networks
  - Editing the properties files
    You can use the properties files in BigFix® Remote Control to customize your environment, configure LDAP, set debug options, and set controller and on-demand target properties. The files can be edited in the BigFix Remote Control Server UI.
  - Reduce the volume of target connections to the server
  - Broker configuration
    When you install broker support you can use the installed trc_broker.properties file to configure your environment for using the broker function.
  - Managing brokers
    After installing broker support you can register the broker machines in the BigFix® Remote Control server. When they have been registered you can view the list of brokers, edit the broker details and delete brokers that are no longer required.
  - Certificate management
    When using BigFix® Remote Control to facilitate remote control sessions across the internet, you can use certificates to address the authentication and verification required for ensuring secure connections between brokers and endpoints.
    - Creating a self signed certificate
      To generate the certificate for a broker you can use the IBM Key Management tool. This tool is provided with the BigFix® Remote Control application and with IBM WebSphere Application Server.
    - Configuring the keystore on the broker
      After you have created the keystore which holds the private key and certificate for the broker, it should be copied to the broker machine and the broker properties configured accordingly.
    - Self signed certificates with strict verification
      Strict verification can be used with self-signed certificates in BigFix® Remote Controll. To do this you should add each broker's certificate to the server trust store.
    - Certificate Authority signed certificates
      You can use Certificate Authority (CA) signed certificates to address the authentication and verification required for ensuring secure connections between brokers and endpoints.
    - Truststore configuration
      The BigFix® Remote Control server holds the truststore that is used for verifying the broker certificates.
      - Adding a certificate to the truststore
        Certificates are used for verifying the remote control connections that are established by using the Internet Connection Broker. You must add the certificates to the truststore on the remote control server.
      - Viewing certificates in the truststore
        After you have added certificates to the truststore, you can view the list of certificates from the BigFix® Remote Control server UI.
      - Editing a trusted certificate
        After you add certificates to the truststore on the BigFix® Remote Control, you can edit the certificate details.
      - Deleting a trusted certificate
        You can remove certificates from the truststore on the BigFix® Remote Control server when they are no longer required.
  - Migrating to a new certificate
    If your existing certificates are due to expire, you can create new certificates. Distribute the new certificates to the relevant endpoints so that they can continue to successfully establish remote control sessions through the broker.
  - Configuring the session connection code
    You can define the number of characters required and the timeout value, for the connection code used when starting a remote control session through a broker.
  - Target registration before a remote control session
    When you have targets that are on the internet or third-party networks and cannot register directly with the BigFix® Remote Control server you can configure server properties to allow the target to register with the server. When the target registers, you can start a remote control session with the target, by using a broker.
  - Configure target properties
  - Importing data from other sources
  - Database table and column descriptions
  - Troubleshooting and Help
  - Gateway sample scenarios
  - Properties for configuring logging activity
    Use properties to determine what type of information and how much is written to the broker, gateway, and target component log files.
- BigFix® Remote Control V9.1.4 Console Users Guide
- BigFix® Remote Control V9.1.4 Controller Users Guide
- BigFix® Remote Control V9.1.4 Target Users Guide
- BigFix® Remote Control V9.1.4 On-demand Target Guide
  Use BigFix® Remote Control to start remote control sessions over the internet with targets that do not have the target software installed.
- Remote Control V9.1.4 Readme file

Adding a certificate to the truststore

Certificates are used for verifying the remote control connections that are established by using the Internet Connection Broker. You must add the certificates to the truststore on the remote control server.

Before you begin

If you are using self-signed certificates, you must extract the certificate from the keystore file. For more information about extracting the certificate, see Extracting the certificate from the keystore. If you are using a CA certificate, you are required only to add the root certificate to the server.

About this task

You can add a certificate to the truststore by completing the following steps:

Procedure

Log on to the BigFix® Remote Control server with a valid admin ID and password.
Open the certificate file in a text editor. Select the certificate and copy it to the clipboard.
Select everything, including the BEGIN CERTIFICATE and END CERTIFICATE lines.
Select Admin > New Trusted Certificate.
Paste the certificate data from the clipboard into the Certificate field.
Click Submit.
The certificate details are shown.
Verify that the correct certificate is shown and click Submit.

Results

The certificate is added to the server truststore.

Note: After you add certificates to the truststore, all targets must be forced to contact the server so that they update their local truststore. Otherwise, the target cannot access those brokers for which it does not have a certificate. If there are any brokers for which the target does have a certificate, it can still use those brokers. The target automatically updates the truststore during the session and can use the new certificate in the future.