1. Citrix MPS 3.0 Licensing Douglas A. Brown President dbrown@dabcc.com

2. RSA Security Agenda  Introduction to Citrix Licensing About FlexLm licensing Components of a license server Daemons & Ports  License File  Tools

3. RSA Security What is FLEXlm Licensing  A license manager that manages floating software licenses  An SDK licensed from MacroVision and integrated into Presentation Server  Includes the following components:  The License Server  Libraries embedded in MPS  Command Line Utilities

4. RSA Security What is a License Server  Four Components: License Manager Daemon (LMGRD.exe) Vendor Daemon (CITRIX.exe) License file Utilities

5. RSA Security New Features of MPS Licensing  Enterprise, Advanced and Standard edition will replace product codes and XPs. XPa and XPe  Product edition changes on the Presentation Server will require a reboot to inform all the components of the new license status

6. RSA Security Software Requirements  Operating Systems License server is only support on Windows 2000 and Windows 2003 servers Unix Platforms will not be support until the next release of MFU  MPS 3.0 and Conferencing Manager 3.0 are the only Citrix products that support the new licensing model.

7. RSA Security Software Prerequisites  Prerequisites: Microsoft.NET Framework Version 1.1 or later Java Runtime Environment (JRE) version 1.4.1_02 or later Visual Studios J#.NET Version 1.1 or later ASP.NET (A Windows component) Setup will automatically install any software prerequisites  Only is using Autorun installation

8. RSA Security Impact on Hardware  CPU usage will increase with: Single treaded application so no need for multiple CPUs Large amounts of check in/outs (hundreds as second) Many products exchanging heartbeat messages with the license server  Hard Drive space will be affected: Depending on the size of the report log, more activity bigger the log  Network: Transactions use less than 1KB of bandwidth Memory usage increases: Depending on size of license file, options file, and concurrent users

9. RSA Security MPS Initial Grace Period  96 hours  If you run over this date then: 1 administator can connect 2 users can connect  Hotfix available to extend this limit to 60 days

10. RSA Security License File  Should be two *.lic files located in “Program Files\Citrix\Licensing\MyFiles” Citrix_startup.lic ????.lic (licensing file downloaded from mycitrix.com  License File Contains Hostname of license server Vendor daemon name At least one line of INCREMENT or FEATURE data  Particular changes to the license file may corrupt the digital signature Can change license port Can’t change hostname or anything else

11. RSA Security Citrix_Startup.lic  Installed by default  Dummy license file that services the following purposes: Keeps the heartbeat alive between the MPS server and the license server Show what MPS servers are connected to the license server Has out of the box grace period information

12. RSA Security ????.lic (License for mycitrix.com)  Obtained from mycitrix.com  MPS acquires connection license from this file when users connect  One license per client  License released after all client connections to all MPS servers are closed  Name of the file does not matter

13. RSA Security How Does it Work?  MPS licensing policy resides in the wsxica.dll which is loaded by termsrv.exe  Wsxica communicates with the license server for license check in/out  License check in/out occurs during log in/out  License server and MPS exchange a heartbeat message every 120 second  Citrix licensing is enforced on RDP connections

14. RSA Security License Sharing Across Servers  There can be more than one license server  MPS server makes requests to the license server for each unique client connection  All client connections from the same client id share a single product license

15. RSA Security License Manager Daemon (LMGRD)  Handles the initial contact with the MetaFrame Access Suite product  Starts the Citrix vendor daemon and passes connections to it  Uses default TCP port 27000 The default port can be changed by modifying the license file on the license server (CTX103008)

16. RSA Security Citrix Vendor Daemon  Process is called Citrix.exe  Job is to grant, deny, and keep track of licenses for Access Suite products  Writes to report log and the debug log  Default TCP port is chosen by the operating system when LS is rebooted or the CitrixLicensing service is restarted Sites with firewalls that require a static IP Port can specify a hard coded port through CTX103356

17. RSA Security Date Based Versioning  Increment or Permanent Licensing SA date: “version” of license. 1 year from time the license file was created Burn Date: Date product released  If SA date is earlier the Burn date product will not function

18. RSA Security License Management Console  Is optional but cannot be installed on a separate server from the license server  Functions: Allows creation of reports logs the detail past license usage Assign user permissions and roles for access to the LMC Display license inventory, current usage, set the thresholds for warnings and alerts

19. RSA Security Tools Verify Check out Data:  Lmstat –a to verify checkout data:  Shows the data the license server has recorded for each connection.  Also shows: The product that the user has check out a license for The client machine that check out the license The checkout data The version of the license License Server name and port Date license was checked out

20. RSA Security More Command Line Tools  Lmdiag –c “path to the license file” Helps diagnose whether license can be checked out  Lmreread – c “path to the license file” Reloads the license file in the memory without restarting the service”  LmhostID –hostname Displays the host name of the license server

21. RSA Security More Command Line Tools  Netstat –a on the License server Shows if the correct ports are listening (LMGRD) Shows all MPS server connected to a license Server

22. RSA Security License Error Messages  You can receive error messages for licensing in the following places: Event Log of the MPS Server Pop-up messages on the license server Pop-up messages on the client device  Verify license is installed and services are running  Restart IIS  Restart all services  Verify hostname to license file host name

23. RSA Security Gotchas  When a port is changed in the license file all future license files will need to be modified to reflect the port number  User connecting to MPS server of different editions will take multiple license one for each edition  If clock on MPS or LS is modified 24 hours back licensing will not function and server will need to be rebuilt

24. “A Splendid Time is Guaranteed for All!”