diff --git a/docs/Deployment/Database/nosql.md b/docs/Deployment/Database/nosql.md index 8194e02b6..e34531ae8 100644 --- a/docs/Deployment/Database/nosql.md +++ b/docs/Deployment/Database/nosql.md @@ -12,7 +12,7 @@ NoSQL support is integrated using the MongoDB API. This does not just limit inte ## MongoDB Docker Deployment -The below steps will show how to modify the basic [Open AMT Getting Started Docker deployment](../../GetStarted/setup.md) to integrate MongoDB for MPS to store and reference device data. +The below steps will show how to modify the basic [Open AMT Getting Started Docker deployment](../../GetStarted/Cloud/setup.md) to integrate MongoDB for MPS to store and reference device data. 1. Stop any running containers. This will wipe all data and devices will have to be reprovisioned against the new RPS/MPS servers. diff --git a/docs/Deployment/centralizedConfiguration.md b/docs/Deployment/centralizedConfiguration.md index 7765ce4e3..b9e0fed88 100644 --- a/docs/Deployment/centralizedConfiguration.md +++ b/docs/Deployment/centralizedConfiguration.md @@ -54,7 +54,7 @@ The Consul configurations are stored in a local volume. When cleaning up contain ## Enable Consul -1. This guide assumes you have completed the [Getting Started Guide](../GetStarted/setup.md) and have Open AMT currently running in Docker containers. If not, follow the [Get Started Guide Setup page](../GetStarted/setup.md). Stop and return here after the your services are running. +1. This guide assumes you have completed the [Getting Started Guide](../GetStarted/Cloud/setup.md) and have Open AMT currently running in Docker containers. If not, follow the [Get Started Guide Setup page](../GetStarted/Cloud/setup.md). Stop and return here after the your services are running. 2. In the `.env`, enable Consul and Save. diff --git a/docs/GetStarted/buildRPC.md b/docs/GetStarted/Cloud/buildRPC.md similarity index 87% rename from docs/GetStarted/buildRPC.md rename to docs/GetStarted/Cloud/buildRPC.md index 5ff9f7fe3..e12772234 100644 --- a/docs/GetStarted/buildRPC.md +++ b/docs/GetStarted/Cloud/buildRPC.md @@ -3,7 +3,7 @@ Developed in Go* programming language, the Remote Provisioning Client (RPC) appl
-
Getting Started Part 3: Follow along to learn about how to build RPC, some of the information it can provide, and how to activate an AMT device. Additional Resources: RPC as a Library and RPC Commands and Flags
+
Getting Started Part 3: Follow along to learn about how to build RPC, some of the information it can provide, and how to activate an AMT device. Additional Resources: RPC as a Library and RPC Commands and Flags
!!! important "Important - Production Environment" @@ -11,12 +11,12 @@ Developed in Go* programming language, the Remote Provisioning Client (RPC) appl
-Figure 1: RPC Configuration +Figure 1: RPC Configuration
Figure 1: RPC configuration
!!! note "Figure 1 Details" - The RPC on a managed device communicates with the Intel® Management Engine Interface (Intel® MEI, previously known as HECI) Driver and the Remote Provisioning Server (RPS) interfaces. The Driver uses the Intel® MEI to talk to Intel® AMT. The RPC activates Intel® AMT with an AMT profile, which is associated with a CIRA configuration (Step 3). The profile, which also distinguishes between Client Control Mode (CCM) or Admin Control Mode (ACM), and configuration were created in [Create a CIRA Config](../GetStarted/createCIRAConfig.md) or [Create an AMT Profile](../GetStarted/createProfileACM.md). After running RPC with a profile, Intel® AMT will establish a CIRA connection with the MPS (Step 4) allowing MPS to manage the remote device and issue AMT commands (Step 5). + The RPC on a managed device communicates with the Intel® Management Engine Interface (Intel® MEI, previously known as HECI) Driver and the Remote Provisioning Server (RPS) interfaces. The Driver uses the Intel® MEI to talk to Intel® AMT. The RPC activates Intel® AMT with an AMT profile, which is associated with a CIRA configuration (Step 3). The profile, which also distinguishes between Client Control Mode (CCM) or Admin Control Mode (ACM), and configuration were created in [Create a CIRA Config](createCIRAConfig.md) or [Create an AMT Profile](createProfileACM.md). After running RPC with a profile, Intel® AMT will establish a CIRA connection with the MPS (Step 4) allowing MPS to manage the remote device and issue AMT commands (Step 5). ## Get RPC @@ -42,7 +42,7 @@ After downloading, continue on to [Run RPC to Activate, Configure, and Connect t Alternatively, the RPC-Go binaries can be manually built using Go for development purposes or personal preference. ??? tip "Flexible Deployment - RPC as a Library" - The RPC can be built as an executable file or as a library, which offers the flexibility of deploying in your management agent or client. [Read more about building RPC as a library here](../Reference/RPC/libraryRPC.md). + The RPC can be built as an executable file or as a library, which offers the flexibility of deploying in your management agent or client. [Read more about building RPC as a library here](../../Reference/RPC/libraryRPC.md). If you are building an executable on a development system, you will copy the executable to the AMT device afterwards. @@ -128,17 +128,17 @@ If you are building an executable on a development system, you will copy the exe ``` ??? note "Note - Other RPC Flags and Commands" - See more about the [flags used here and the other available commands of RPC-Go](../Reference/RPC/commandsRPC.md). + See more about the [flags used here and the other available commands of RPC-Go](../../Reference/RPC/commandsRPC.md). !!! success
- Figure 2: Example output after configuration + Figure 2: Example output after configuration
Figure 2: Example output after configuration
!!! error "Troubleshooting" - Run into an issue? Try these [troubleshooting steps](../Reference/troubleshooting.md). + Run into an issue? Try these [troubleshooting steps](../../Reference/troubleshooting.md). ## Next up -**[Manage AMT Device](../GetStarted/manageDevice.md)** +**[Manage AMT Device](manageDevice.md)** diff --git a/docs/GetStarted/createCIRAConfig.md b/docs/GetStarted/Cloud/createCIRAConfig.md similarity index 91% rename from docs/GetStarted/createCIRAConfig.md rename to docs/GetStarted/Cloud/createCIRAConfig.md index bb3a89966..b12477893 100644 --- a/docs/GetStarted/createCIRAConfig.md +++ b/docs/GetStarted/Cloud/createCIRAConfig.md @@ -3,7 +3,7 @@ Client Initiated Remote Access (CIRA) enables a CIRA-capable edge device to initiate and establish a persistent connection to the MPS. As long as the managed device is connected to the network and to a power source, it can maintain a persistent connection. !!! note "Note - Wireless Activations" - This express setup assumes the managed device (i.e. AMT device) is on a wired connection for quickest setup. To learn more about a Wireless Setup, see the [Wireless Activation Tutorial](../Tutorials/createWiFiConfig.md). + This express setup assumes the managed device (i.e. AMT device) is on a wired connection for quickest setup. To learn more about a Wireless Setup, see the [Wireless Activation Tutorial](../../Tutorials/createWiFiConfig.md). **To create a CIRA Config:** @@ -11,7 +11,7 @@ Client Initiated Remote Access (CIRA) enables a CIRA-capable edge device to init 2. In the top-right corner, click **Add New.**
- Figure 1: Create a new CIRA Config + Figure 1: Create a new CIRA Config
Figure 1: Create a new CIRA Config
@@ -32,7 +32,7 @@ Client Initiated Remote Access (CIRA) enables a CIRA-capable edge device to init !!! example "Example CIRA Config"
- Figure 2: Example CIRA Config + Figure 2: Example CIRA Config
Figure 2: Example CIRA Config
diff --git a/docs/GetStarted/createProfileACM.md b/docs/GetStarted/Cloud/createProfileACM.md similarity index 85% rename from docs/GetStarted/createProfileACM.md rename to docs/GetStarted/Cloud/createProfileACM.md index 8f6f33217..b1ac78b46 100644 --- a/docs/GetStarted/createProfileACM.md +++ b/docs/GetStarted/Cloud/createProfileACM.md @@ -6,11 +6,8 @@ Admin Control Mode (ACM) provides full access to Intel® Active Management Techn - **Serial-over-LAN (SOL):** Manage devices with a command line interface (CLI) through SOL. - **IDE Redirection:** Share and mount images remotely with a specified storage media (e.g., USB flash drive). -!!! Important "Important - IDE Redirection" - While AMT supports this feature, the toolkit doesn't natively support it. -
-Figure 1: Set up configuration and profiles for N number of clients +Figure 1: Set up configuration and profiles for N number of clients
Figure 1: Set up configuration and profiles for n number of clients
@@ -18,7 +15,7 @@ Admin Control Mode (ACM) provides full access to Intel® Active Management Techn #### Provisioning Certificate -By purchasing a certificate, you'll be able to remotely activate an Intel® AMT device in ACM. This feature enables you to disable User Consent. Provisioning Certificates are available from four different Certificate Authorities. [Find more information about Provisioning Certificates](../Reference/Certificates/remoteProvisioning.md). +By purchasing a certificate, you'll be able to remotely activate an Intel® AMT device in ACM. This feature enables you to disable User Consent. Provisioning Certificates are available from four different Certificate Authorities. [Find more information about Provisioning Certificates](../../Reference/Certificates/remoteProvisioning.md). - [DigiCert](https://www.intel.com/content/www/us/en/support/articles/000055009/technologies.html) - [Entrust](https://www.intel.com/content/www/us/en/support/articles/000055010/technologies/intel-active-management-technology-intel-amt.html) @@ -27,7 +24,7 @@ By purchasing a certificate, you'll be able to remotely activate an Intel® AMT !!! Important "Important - Intel AMT and using CAs" For ACM in Open Active Management Technology (Open AMT) Cloud Toolkit, **use only** certificate vendors that support Intel® AMT. -Alternatively, for development, custom provisioning certificates can be generated. See [Custom Provisioning Certificate](../Reference/Certificates/generateProvisioningCert.md) for additional details. +Alternatively, for development, custom provisioning certificates can be generated. See [Custom Provisioning Certificate](../../Reference/Certificates/generateProvisioningCert.md) for additional details. #### DNS Suffix The DNS suffix encompasses the domain suffix (e.g., .com) and follows the hostname. Consider the following DNS Name example: @@ -39,7 +36,7 @@ In this example, the hostname is **cb-vending1** and the DNS suffix is **burgerb **To set the DNS suffix:** -1. Manually set it using MEBX on the managed device. Find instructions [here](../Reference/MEBX/dnsSuffix.md). +1. Manually set it using MEBX on the managed device. See [MEBx DNS Suffix](../../Reference/MEBX/dnsSuffix.md). 2. Alternately, change the DHCP Option 15 to DNS suffix within the Router settings. @@ -65,7 +62,7 @@ A Profile provides configuration information to the AMT Firmware during the acti In a production environment, devices are typically activated in ACM mode. ACM mode enables KVM access to devices without user consent. In most IoT use cases, edge devices such as digital signage or kiosks may not have immediate access to it or employees nearby. ACM mode proves immensely helpful in these scenarios. ??? note "Note - More Information about Passwords" - Open AMT Cloud Toolkit increases security with multiple passwords. Find an explanation of toolkit passwords in [Reference -> Architecture Overview](../Reference/architectureOverview.md#passwords). + Open AMT Cloud Toolkit increases security with multiple passwords. Find an explanation of toolkit passwords in [Reference -> Architecture Overview](../../Reference/architectureOverview.md#passwords). **To create an ACM profile:** @@ -74,7 +71,7 @@ A Profile provides configuration information to the AMT Firmware during the acti 2. Under the **Profiles** tab, click **Add New** in the top-right corner to create a profile.
- Figure 2: Create a new profile + Figure 2: Create a new profile
Figure 2: Create a new profile
@@ -95,7 +92,7 @@ A Profile provides configuration information to the AMT Firmware during the acti 9. Leave DHCP as the default for **Network Configuration**. -10. This express setup assumes the managed device (i.e. AMT device) is on a wired connection for quickest setup. To learn more about a Wireless Setup, see the [Wireless Activation Tutorial](../Tutorials/createWiFiConfig.md). +10. This express setup assumes the managed device (i.e. AMT device) is on a wired connection for quickest setup. To learn more about a Wireless Setup, see the [Wireless Activation Tutorial](../../Tutorials/createWiFiConfig.md). 11. Select **CIRA (Cloud)** for **Connection Configuration**. @@ -107,7 +104,7 @@ A Profile provides configuration information to the AMT Firmware during the acti !!! example "Example ACM Profile"
- Figure 3: Example ACM profile + Figure 3: Example ACM profile
Figure 3: Example ACM profile
@@ -123,7 +120,7 @@ Intel® AMT checks the network DNS suffix against the provisioning certificate a 2. In the top-right corner, click **Add New.**
- Figure 4: Create a new Domain profile + Figure 4: Create a new Domain profile
Figure 4: Create a new Domain profile
@@ -139,13 +136,13 @@ Intel® AMT checks the network DNS suffix against the provisioning certificate a !!! example "Example Domain"
- Figure 5: Example Domain profile + Figure 5: Example Domain profile
Figure 5: Example Domain profile
## Next Up -**[Build & Run RPC](../GetStarted/buildRPC.md)** +**[Build & Run RPC](buildRPC.md)** diff --git a/docs/GetStarted/createProfileCCM.md b/docs/GetStarted/Cloud/createProfileCCM.md similarity index 88% rename from docs/GetStarted/createProfileCCM.md rename to docs/GetStarted/Cloud/createProfileCCM.md index 51d60cc77..bd874a1a4 100644 --- a/docs/GetStarted/createProfileCCM.md +++ b/docs/GetStarted/Cloud/createProfileCCM.md @@ -12,7 +12,7 @@ These features require user consent in CCM: While AMT supports this feature, the toolkit doesn't natively support it.
-Figure 1: Set up configuration and profiles for N number of clients +Figure 1: Set up configuration and profiles for N number of clients
Figure 1: Set up configuration and profiles for n number of clients
@@ -22,7 +22,7 @@ Profiles provide configuration information to the firmware on platforms featurin ??? note "Note - More Information about Passwords" - Open AMT Cloud Toolkit increases security with multiple passwords. Find an explanation of toolkit passwords in [Reference -> Architecture Overview](../Reference/architectureOverview.md#passwords). + Open AMT Cloud Toolkit increases security with multiple passwords. Find an explanation of toolkit passwords in [Reference -> Architecture Overview](../../Reference/architectureOverview.md#passwords). **To create a CCM profile:** @@ -30,7 +30,7 @@ Profiles provide configuration information to the firmware on platforms featurin 2. Under the **Profiles** tab, click **New** in the top-right corner to create a profile.
- Figure 2: Create a new profile + Figure 2: Create a new profile
Figure 2: Create a new profile
@@ -49,7 +49,7 @@ Profiles provide configuration information to the firmware on platforms featurin 8. Leave DHCP as the default for **Network Configuration**. -9. This express setup assumes the managed device (i.e. AMT device) is on a wired connection for quickest setup. To learn more about a Wireless Setup, see the [Wireless Activation Tutorial](../Tutorials/createWiFiConfig.md). +9. This express setup assumes the managed device (i.e. AMT device) is on a wired connection for quickest setup. To learn more about a Wireless Setup, see the [Wireless Activation Tutorial](../../Tutorials/createWiFiConfig.md). 10. Select **CIRA (Cloud)** for **Connection Configuration**. @@ -61,7 +61,7 @@ Profiles provide configuration information to the firmware on platforms featurin !!! example "Example CCM Profile"
- Figure 3: Example CCM profile + Figure 3: Example CCM profile
Figure 3: Example CCM profile
diff --git a/docs/GetStarted/loginToUI.md b/docs/GetStarted/Cloud/loginToUI.md similarity index 91% rename from docs/GetStarted/loginToUI.md rename to docs/GetStarted/Cloud/loginToUI.md index 5467bf878..b19004ea9 100644 --- a/docs/GetStarted/loginToUI.md +++ b/docs/GetStarted/Cloud/loginToUI.md @@ -24,7 +24,7 @@ The web portal is available for login after the deployment of the MPS, RPS, and !!! example "Example - Chrome* Browser Warning Message"
- Figure 1: MPS Warning Message + Figure 1: MPS Warning Message
Figure 1: MPS warning message
@@ -36,7 +36,7 @@ The web portal is available for login after the deployment of the MPS, RPS, and !!! example "Example - Sample Web UI Home Page"
- Figure 2: Sample Web UI Home Pageg + Figure 2: Sample Web UI Home Pageg
Figure 2: Sample Web UI home page
diff --git a/docs/GetStarted/manageDevice.md b/docs/GetStarted/Cloud/manageDevice.md similarity index 74% rename from docs/GetStarted/manageDevice.md rename to docs/GetStarted/Cloud/manageDevice.md index a4da94e58..6e8a1a6c8 100644 --- a/docs/GetStarted/manageDevice.md +++ b/docs/GetStarted/Cloud/manageDevice.md @@ -2,7 +2,7 @@
-
Getting Started Part 4: Follow along to learn about the different Out-of-Band capabilities of Intel AMT. Next Steps: Using REST APIs and Deploying with Kubernetes
+
Getting Started Part 4: Follow along to learn about the different Out-of-Band capabilities of Intel AMT. Next Steps: Using REST APIs and Deploying with Kubernetes
## Try out Intel AMT Capabilities @@ -11,24 +11,24 @@ 2. Click the Devices tab from the menu on the left.
- Figure 1: Devices tab + Figure 1: Devices tab
Figure 1: Devices tab
!!! troubleshooting If the activated device is not listed or if it is listed as unconnected, try restarting the AMT device. After successfully restarting the device, refresh the Sample Web UI to see if the *Status* changes to *connected*. - [Additional troubleshooting steps.](../Reference/troubleshooting.md) + [Additional troubleshooting steps.](../../Reference/troubleshooting.md) 3. Click on your connected device. 4. Select an action to perform from the Power Actions in the center screen or Redirection options in the top-right. !!! warning "Warning - Power Actions in KVM" - Turn off active redirection sessions, such as KVM or SOL, before specific power state transitions. Power Cycle (Code 5) and Unconditional Power Down (Power Off, Code 8) will be rejected as invalid if there is an active redirection session. Reset (Code 10) **will function** in KVM along with the [other unmentioned Power Actions](../Reference/powerstates.md#out-of-band). + Turn off active redirection sessions, such as KVM or SOL, before specific power state transitions. Power Cycle (Code 5) and Unconditional Power Down (Power Off, Code 8) will be rejected as invalid if there is an active redirection session. Reset (Code 10) **will function** in KVM along with the [other unmentioned Power Actions](../../Reference/powerstates.md#out-of-band).
- Figure 2: Action options + Figure 2: Action options
Figure 2: Action options
@@ -41,7 +41,7 @@ 1. When performing a KVM action for a device activated in CCM or ACM with user consent enabled, input the user consent code displayed on the client device.
- Figure 2: User Consent + Figure 2: User Consent
Figure 3: User Consent
@@ -54,16 +54,16 @@ After successfully deploying the Open AMT Cloud Toolkit microservices and client ### REST API Calls Learn how to send commands to AMT devices with the curl-based REST API tutorial. Generate a JWT token for Authorization and construct an API call to get a list of devices. -[Get Started with REST API Calls](../Tutorials/apiTutorial.md){: .md-button .md-button--primary } +[Get Started with REST API Calls](../../Tutorials/apiTutorial.md){: .md-button .md-button--primary } ### UI Toolkit Explore how to add redirection features, such as Keyboard, Video, and Mouse (KVM) and IDE-Redirect (IDER), with prebuilt React components. -[Get Started with the UI Toolkit](../Tutorials/uitoolkitReact.md){: .md-button .md-button--primary } +[Get Started with the UI Toolkit](../../Tutorials/uitoolkitReact.md){: .md-button .md-button--primary } ### Security -Learn how to use the Open AMT Cloud Toolkit architecture to secure assets. Topics include credentials, allowlisting, best known security methods, and more. +Learn how to use the Open AMT Cloud Toolkit architecture to secure ..\assets. Topics include credentials, allowlisting, best known security methods, and more. -[Learn More about Security and Hardening](../Reference/MPS/securityMPS.md){: .md-button .md-button--primary } +[Learn More about Security and Hardening](../../Reference/MPS/securityMPS.md){: .md-button .md-button--primary } diff --git a/docs/GetStarted/prerequisites.md b/docs/GetStarted/Cloud/prerequisites.md similarity index 92% rename from docs/GetStarted/prerequisites.md rename to docs/GetStarted/Cloud/prerequisites.md index f519be8e8..54250c693 100644 --- a/docs/GetStarted/prerequisites.md +++ b/docs/GetStarted/Cloud/prerequisites.md @@ -10,7 +10,7 @@ This section contains prerequisites for deploying Open AMT Cloud Toolkit's MPS a ## What You'll Need -###Hardware +### Hardware **Configure a network that includes:** @@ -20,7 +20,7 @@ This section contains prerequisites for deploying Open AMT Cloud Toolkit's MPS a Both systems must use a wired (i.e., cable) connection on the same network. -###Development System Software +### Development System Software **Before MPS and RPS installation, install the following software on your development system:** @@ -36,7 +36,7 @@ Both systems must use a wired (i.e., cable) connection on the same network. ## What You'll Do
- Figure 1: Deploy microservices on a local development system as Docker containers + Figure 1: Deploy microservices on a local development system as Docker containers
Figure 1: Deploy microservices on a local development system as Docker containers
@@ -45,7 +45,7 @@ Both systems must use a wired (i.e., cable) connection on the same network. - Install the prerequisites. - Pull and deploy microservices with Docker. - Login to the Sample Web UI and configure profiles. -- Build RPC. +- Download RPC. - Copy RPC to a managed device. diff --git a/docs/GetStarted/setup.md b/docs/GetStarted/Cloud/setup.md similarity index 85% rename from docs/GetStarted/setup.md rename to docs/GetStarted/Cloud/setup.md index e17e21e47..778fbd9d0 100644 --- a/docs/GetStarted/setup.md +++ b/docs/GetStarted/Cloud/setup.md @@ -93,7 +93,7 @@ Set the shared secret used in Kong for JWT authentication. ``` ??? note "Note - Using SSL with Postgres Container" - By default in the Getting Started Guide, we do not enable an SSL connection for Postgres for ease of development. See [SSL with Local Postgres](../Reference/sslpostgresLocal.md) for how to enable SSL in your local Postgres container. For production environments, using a cloud-hosted database with an SSL connection to MPS/RPS is highly recommended as one step to maintain a secure deployment. Read more about cloud deployments for [Azure or AWS here](../Tutorials/Scaling/overview.md). + By default in the Getting Started Guide, we do not enable an SSL connection for Postgres for ease of development. See [SSL with Local Postgres](../../Reference/sslpostgresLocal.md) for how to enable SSL in your local Postgres container. For production environments, using a cloud-hosted database with an SSL connection to MPS/RPS is highly recommended as one step to maintain a secure deployment. Read more about cloud deployments for [Azure or AWS here](../../Tutorials/Scaling/overview.md). 2. Start the containers. @@ -108,6 +108,8 @@ Set the shared secret used in Kong for JWT authentication. docker ps --format "table {{.Image}}\t{{.Status}}\t{{.Names}}" {% endraw %} ``` + + **Because Vault is running in a dev mode, stored secrets will be lost upon a restart**, and profiles and configs must be recreated. They are not persistent in this mode. To persist data, run vault in production mode. See [Production Mode Vault](../../Reference/productionVault.md). !!! success ``` bash @@ -125,12 +127,8 @@ Set the shared secret used in Kong for JWT authentication. If any of the above containers are not running, walk through the steps again or file a GitHub issue [here]( https://github.com/open-amt-cloud-toolkit/open-amt-cloud-toolkit/issues). - If the kong container reloads repeatedly, verify kong.yaml edits. Misconfiguration of this file will cause the container to reload. - -!!! important "Important - Losing Data without Prod Mode Vault" - Because the vault is running in a dev mode, stored secrets will be lost upon a restart, and profiles and configs must be recreated. They are not persistent in this mode. Be sure to run `docker compose down -v` when bringing down the stack, which removes the volumes, and start fresh upon `docker compose up`. To run vault in production mode, follow the guide [here](../Reference/productionVault.md). - + If the Kong container reloads repeatedly, verify kong.yaml edits. Misconfiguration of this file will cause the container to reload. ## Next up -[**Login to Sample Web UI**](../GetStarted/loginToUI.md) +[**Login to Sample Web UI**](loginToUI.md) diff --git a/docs/GetStarted/Enterprise/activateDevice.md b/docs/GetStarted/Enterprise/activateDevice.md new file mode 100644 index 000000000..d93f34a37 --- /dev/null +++ b/docs/GetStarted/Enterprise/activateDevice.md @@ -0,0 +1,51 @@ +--8<-- "References/abbreviations.md" + +Developed in Go* programming language, the Remote Provisioning Client (RPC) application runs on the managed device. RPC-Go activates and configures Intel® AMT on the managed device. Once properly configured, the device can be added to Console. + +## Export Profiles + +1. Export the created profiles to a `.yaml` file that can be given to RPC-Go for device activation and configuration. + +2. Click the export button next to the profile. + +
+ Figure 1: Export Button +
Figure 1: Export Button
+
+ +3. **Save the given Profile Key.** It is only given this once. This key is used by RPC-Go to decode the encrypted config file. + +
+ Figure 2: Profile Key +
Figure 2: Profile Key
+
+ +4. Move the new, downloaded `.yaml` config file to the AMT device. + +## Download RPC + +On the AMT device, download the latest RPC-Go version from the [RPC-Go GitHub Repo Releases Page](https://github.com/open-amt-cloud-toolkit/rpc-go/releases) for the Operating System of the AMT device (Windows or Linux). + +## Activate Device + +1. On the AMT device, open a Terminal (Linux) or Powershell/Command Prompt **as Administrator** (Windows). + +2. Navigate to the directory containing the RPC application. + +3. Run RPC with the local **activate** command to activate and configure Intel® AMT. + + ``` + rpc activate -local -configv2 profileName.yaml -configencryptionkey w31W6548+eDZYziC97DnmkzaA4V4r4nC + ``` + +4. After finishing successfully, the device can now be added and connected to using Console. + +!!! success +
+ Figure 3: Example Successful Activation and Configuration +
Figure 3: Example Successful Activation and Configuration
+
+ +## Next up + +[**Add a Device**](addDevice.md) \ No newline at end of file diff --git a/docs/Reference/Console/GetStarted/addDevice.md b/docs/GetStarted/Enterprise/addDevice.md similarity index 66% rename from docs/Reference/Console/GetStarted/addDevice.md rename to docs/GetStarted/Enterprise/addDevice.md index ff87617e5..6adf0e19d 100644 --- a/docs/Reference/Console/GetStarted/addDevice.md +++ b/docs/GetStarted/Enterprise/addDevice.md @@ -1,14 +1,14 @@ --8<-- "References/abbreviations.md" -!!! warning "Warning - Console in Alpha Development" - Console is currently under development. The current available tags for download are Alpha version code. This could mean that certain features may not function yet, visual look and feel may change, or bugs/errors may occur. It is not recommended for use in Production deployments. Follow along our [Feature Backlog for future releases and feature updates](https://github.com/orgs/open-amt-cloud-toolkit/projects/10) +!!! warning "Warning - Console in Beta Development" + Console is currently under development. The current available tags for download are Beta version code. This could mean that certain features may not function yet, visual look and feel may change, or bugs/errors may occur. It is not recommended for use in Production deployments. Follow along our [Feature Backlog for future releases and feature updates](https://github.com/orgs/open-amt-cloud-toolkit/projects/10) 1. In the Console UI, navigate to the **Devices** page in the left-hand menu sidebar. 2. In the upper-right, select **Add a Device**.
- Figure 1: Add a New Device + Figure 1: Add a New Device
Figure 1: Add a New Device
@@ -25,7 +25,7 @@ ??? tip "Important - TLS Requirement for AMT 16.1 and newer devices" Starting with AMT 16.1, TLS is required. By default, the AMT device will come with a self-signed TLS certificate as part of the firmware. By selecting both the **Use TLS** and **Allow Self-Signed Certificates** checkboxes, AMT will utilize the built-in TLS certificate. *This is the recommended path for Getting Started as it requires less initial setup*. - To use a different TLS certificate, such as a 3rd party CA signed certificate, Enterprise Assistant is required. See the [Enterprise Assistant Overview](../../EA/overview.md) and [Enterprise Assistant TLS Configuration with RPC-Go](../../EA/RPCConfiguration/localtlsconfig.md) documentation for additional details. + To use a different TLS certificate, such as a 3rd party CA signed certificate, Enterprise Assistant is required. See the [Enterprise Assistant Overview](../../Reference/EA/overview.md) and [Enterprise Assistant TLS Configuration with RPC-Go](../../Reference/EA/RPCConfiguration/localtlsconfig.md) documentation for additional details. !!! note "Note - Not Sure of the AMT Version?" If the AMT version is not known, the RPC-Go `amtinfo` command can be used. This will print out the device's AMT version as part of the response. @@ -38,10 +38,10 @@ !!! example "Example - Add a New Device"
- Figure 2: Add a New Device Example + Figure 2: Add a New Device Example
Figure 2: Add a New Device Example
## Next up -[**Manage a Device**](../GetStarted/manageDevice.md) \ No newline at end of file +[**Manage a Device**](manageDevice.md) \ No newline at end of file diff --git a/docs/GetStarted/Enterprise/createProfileACM.md b/docs/GetStarted/Enterprise/createProfileACM.md new file mode 100644 index 000000000..60dcfaf9b --- /dev/null +++ b/docs/GetStarted/Enterprise/createProfileACM.md @@ -0,0 +1,142 @@ +--8<-- "References/abbreviations.md" + +Admin Control Mode (ACM) provides full access to Intel® Active Management Technology (Intel® AMT) functionality. User consent is optional for supported redirection features: + +- **Keyboard, Video, Mouse (KVM):** Control multiple devices with one keyboard, monitor, and mouse. +- **Serial-over-LAN (SOL):** Manage devices with a command line interface (CLI) through SOL. +- **IDE Redirection:** Share and mount images remotely with a specified storage media (e.g., USB flash drive). + +
+Figure 1: Set up configuration and profiles for N number of clients +
Figure 1: Set up configuration and profiles for n number of clients
+
+ +### What You'll Need + +#### Provisioning Certificate + +By purchasing a certificate, you'll be able to remotely activate an Intel® AMT device in ACM. This feature enables you to disable User Consent. Provisioning Certificates are available from four different Certificate Authorities. [Find more information about Provisioning Certificates](../../Reference/Certificates/remoteProvisioning.md). + +- [DigiCert](https://www.intel.com/content/www/us/en/support/articles/000055009/technologies.html) +- [Entrust](https://www.intel.com/content/www/us/en/support/articles/000055010/technologies/intel-active-management-technology-intel-amt.html) +- [GoDaddy](https://www.intel.com/content/www/us/en/support/articles/000020785/software.html) + +!!! Important "Important - Intel AMT and using CAs" + For ACM in Open Active Management Technology (Open AMT) Cloud Toolkit, **use only** certificate vendors that support Intel® AMT. + +Alternatively, for development, custom provisioning certificates can be generated. See [Custom Provisioning Certificate](../../Reference/Certificates/generateProvisioningCert.md) for additional details. + +#### DNS Suffix +The DNS suffix encompasses the domain suffix (e.g., .com) and follows the hostname. Consider the following DNS Name example: + +!!! example "Example - DNS" + DNS Name: cb-vending1.burgerbusiness.com + +In this example, the hostname is **cb-vending1** and the DNS suffix is **burgerbusiness.com.** + +**To set the DNS suffix:** + +1. Manually set it using MEBX on the managed device. See [MEBx DNS Suffix](../../Reference/MEBX/dnsSuffix.md). + +2. Alternately, change the DHCP Option 15 to DNS suffix within the Router settings. + +**To find the DNS suffix, use the following command:** + +=== "Linux" + ``` bash + ifconfig + ``` + +=== "Windows" + ``` + ipconfig /all + ``` + +
+ +### Create a Domain Profile + +ACM requires the creation of a Domain profile. + +Intel® AMT checks the network DNS suffix against the provisioning certificate as a security check. During provisioning, the trusted certificate chain is injected into the AMT firmware. AMT verifies that the certificate chain is complete and is signed by a trusted certificate authority. + +**To create a domain:** + +1. Select the **Domains** tab from the left-hand menu. + +2. In the top-right corner, click **Add New.** +
+ Figure 4: Create a new Domain profile +
Figure 4: Create a new Domain profile
+
+ +3. Specify a name of your choice for the Domain Profile for the **Name** field. This does not have to be the actual network Domain Name/Suffix. + +4. Provide your **DNS suffix** as the **Domain Name**. This is the actual DNS suffix of the network domain that is set in DHCP Option 15 or manually on the AMT device through MEBX. + +5. Click **Choose File** and select your purchased Provisioning Certificate. This certificate must contain the private key. + +6. Provide the **Provisioning Certificate Password** used to encrypt the `.pfx` file. + +7. Click **Save.** + + !!! example "Example Domain" +
+ Figure 5: Example Domain profile +
Figure 5: Example Domain profile
+
+ + +### Create a Profile + +A Profile provides configuration information to the AMT Firmware during the activation process with the Remote Provisioning Client (RPC). + +??? note "Note - More Information about Passwords" + Open AMT Cloud Toolkit increases security with multiple passwords. Find an explanation of toolkit passwords in [Reference -> Architecture Overview](../../Reference/architectureOverview.md#passwords). + +**To create an ACM profile:** + +1. Select the **Profiles** tab from the menu on the left. + +2. Under the **Profiles** tab, click **Add New** in the top-right corner to create a profile. + +
+ Figure 2: Create a new profile +
Figure 2: Create a new profile
+
+ +3. Specify a **Profile Name** of your choice. + +4. Under **Activation**, select **Admin Control Mode** from the dropdown menu. + +5. Enable desired redirection features for the profile under **AMT Features - Enable/Disable features**. + +6. Choose level of **User Consent**. By default for ACM, **None** is selected. This will disable all User Consent for ACM. + +7. Provide or generate a strong **AMT Password**. AMT will verify this password when receiving a command from Console. This password is also required for device deactivation. + + ??? warning "Warning - Viewing and Losing Random Passwords" + The two buttons next to the password input are for toggling visibility and/or generating a new random password. Please note that **if the database is lost or corrupted, all credentials that aren't also stored somewhere else will be lost.** There will be no way to login. The administrator will have to clear the CMOS battery on the managed devices! + +8. Provide or generate a strong **MEBX Password**. This password can be used to access Intel® Manageability Engine BIOS Extensions (Intel® MEBX) on the AMT device. + +9. Choose DHCP or Static based on environment for the **Network Configuration**. + +10. This express setup assumes the managed device (i.e. AMT device) is on a wired connection for quickest setup. To learn more about a Wireless Setup, see the [Wireless Activation Tutorial](../../Tutorials/createWiFiConfig.md). + +11. For quickest setup, select **Non TLS** under **Provisioned Connection Configuration**. + +12. Optionally, add **Tags** to help in organizing and querying devices as your list of managed devices grow. + +14. Click **Save.** + + !!! example "Example ACM Profile" +
+ Figure 3: Example ACM profile +
Figure 3: Example ACM profile
+
+ + +## Next Up + +**[Activate a Device](activateDevice.md)** \ No newline at end of file diff --git a/docs/GetStarted/Enterprise/createProfileCCM.md b/docs/GetStarted/Enterprise/createProfileCCM.md new file mode 100644 index 000000000..31c941ad4 --- /dev/null +++ b/docs/GetStarted/Enterprise/createProfileCCM.md @@ -0,0 +1,61 @@ +--8<-- "References/abbreviations.md" + +Client Control Mode (CCM) provides full access to features of Intel® Active Management Technology (Intel® AMT), but it does require user consent for all redirection features. + +These features require user consent in CCM: + +- **Keyboard, Video, Mouse (KVM):** Control multiple devices with one keyboard, monitor, and mouse. +- **Serial-over-LAN (SOL):** Manage devices with a command line interface (CLI) through SOL. +- **IDE Redirection:** Share and mount images remotely with a specified storage media (e.g., USB flash drive). + +## Create a Profile + +Profiles provide configuration information to the firmware on platforms featuring Intel® AMT during the activation process with the Remote Provisioning Client (RPC). + +??? note "Note - More Information about Passwords" + + Open AMT Cloud Toolkit increases security with multiple passwords. Find an explanation of toolkit passwords in [Reference -> Architecture Overview](../../Reference/architectureOverview.md#passwords). + +**To create a CCM profile:** + +1. Select the **Profiles** tab from the menu on the left. + +2. Under the **Profiles** tab, click **New** in the top-right corner to create a profile. +
+ Figure 2: Create a new profile +
Figure 2: Create a new profile
+
+ +3. Specify a **Profile Name** of your choice. + +4. Under **Activation Mode**, select **Client Control Mode** from the dropdown menu. + +5. Enable desired redirection features for the profile under **AMT Features - Enable/Disable features**. + +6. Provide or generate a strong **AMT Password**. AMT will verify this password when receiving a command from Console. This password is also required for device deactivation. + + ??? warning "Warning - Viewing and Losing Random Passwords" + The two buttons next to the password input are for toggling visibility and/or generating a new random password. Please note that **if the database is lost or corrupted, all credentials that aren't also stored somewhere else will be lost.** There will be no way to login. The administrator will have to clear the CMOS battery on the managed devices! + +7. The **MEBX Password** field is disabled. The password for Intel® Manageability Engine BIOS Extensions (Intel® MEBX) cannot be set when activating in CCM due to the lower level of trust when compared to ACM. + +8. Choose DHCP or Static based on environment for the **Network Configuration**. + +9. This express setup assumes the managed device (i.e. AMT device) is on a wired connection for quickest setup. To learn more about a Wireless Setup, see the [Wireless Activation Tutorial](../../Tutorials/createWiFiConfig.md). + +10. For quickest setup, select **Non TLS** under **Provisioned Connection Configuration**. + +11. Optionally, add **Tags** to help in organizing and querying devices as your list of managed devices grow. + +12. Click **Save.** + + !!! example "Example CCM Profile" +
+ Figure 3: Example CCM profile +
Figure 3: Example CCM profile
+
+ + +## Next up +**[Activate a Device](activateDevice.md)** + diff --git a/docs/Reference/Console/GetStarted/manageDevice.md b/docs/GetStarted/Enterprise/manageDevice.md similarity index 69% rename from docs/Reference/Console/GetStarted/manageDevice.md rename to docs/GetStarted/Enterprise/manageDevice.md index 18ad6271e..bb959ac64 100644 --- a/docs/Reference/Console/GetStarted/manageDevice.md +++ b/docs/GetStarted/Enterprise/manageDevice.md @@ -1,14 +1,14 @@ --8<-- "References/abbreviations.md" -!!! warning "Warning - Console in Alpha Development" - Console is currently under development. The current available tags for download are Alpha version code. This could mean that certain features may not function yet, visual look and feel may change, or bugs/errors may occur. It is not recommended for use in Production deployments. Follow along our [Feature Backlog for future releases and feature updates](https://github.com/orgs/open-amt-cloud-toolkit/projects/10) +!!! warning "Warning - Console in Beta Development" + Console is currently under development. The current available tags for download are Beta version code. This could mean that certain features may not function yet, visual look and feel may change, or bugs/errors may occur. It is not recommended for use in Production deployments. Follow along our [Feature Backlog for future releases and feature updates](https://github.com/orgs/open-amt-cloud-toolkit/projects/10) ## Try out Intel AMT Capabilities 1. Select the newly added AMT device.
- Figure 1: Devices Tab + Figure 1: Devices Tab
Figure 1: Devices Tab
@@ -17,11 +17,11 @@ The right-hand navigation menu can be used to find additional device information, such as logs and hardware info, and out-of-band capabilities, such as KVM and Serial-Over-LAN. !!! warning "Warning - Power Actions in KVM" - Turn off active redirection sessions, such as KVM or SOL, before specific power state transitions. Power Cycle (Code 5) and Unconditional Power Down (Power Off, Code 8) will be rejected as invalid if there is an active redirection session. Reset (Code 10) **will function** in KVM along with the [other unmentioned Power Actions](../../powerstates.md#out-of-band). + Turn off active redirection sessions, such as KVM or SOL, before specific power state transitions. Power Cycle (Code 5) and Unconditional Power Down (Power Off, Code 8) will be rejected as invalid if there is an active redirection session. Reset (Code 10) **will function** in KVM along with the [other unmentioned Power Actions](../../Reference/powerstates.md#out-of-band).
- Figure 2: Device Page and Options + Figure 2: Device Page and Options
Figure 2: Device Page and Options
@@ -32,7 +32,7 @@ After successfully adding and managing devices using Console, explore other tool ### 802.1x and TLS Environments using Enterprise Assistant Learn how to setup and use Enterprise Assistant to help with configuring devices for 802.1x and TLS environments using existing Microsoft services such as Microsoft Certificate Authority and Microsoft Active Directory. -[Get Started with Enterprise Assistant](../../EA/overview.md){: .md-button .md-button--primary } +[Get Started with Enterprise Assistant](../../Reference/EA/overview.md){: .md-button .md-button--primary }