Difference between revisions of "Citrix"

From ArchWiki
Jump to: navigation, search
(Google Chromium)
m (added resolution for sticky ctrl key in session)
 
(33 intermediate revisions by 16 users not shown)
Line 1: Line 1:
 
[[Category:Virtualization]]
 
[[Category:Virtualization]]
 +
{{Style|See [[Help:Style]]; also add an introduction.}}
 
== Install from AUR ==
 
== Install from AUR ==
 +
{{Out of date|Citrix provides an automatic installer, see manual installation}}
 
====Install Package====
 
====Install Package====
{{AUR|citrix-client}} x86 and x86_64 (multilib)
+
{{AUR|icaclient}} x86_64
  
{{AUR|bin32-citrix-client}} x86_64 (outdated)
+
SSL connections are supported by default in this packages. Also Firefox plugin will be installed by default as well as the wfica.desktop file. That way Arch knows how to open ica files.
 
+
SSL connections are supported by default in both of these packages.
+
 
+
====Update make dependencies for package lib32-libxaw (x86_64 only)====
+
When installing the lib32-xaw dependency, a conflict will be signalled for the packages gcc, gcc-libs, and binutils.
+
 
+
Replace these packages with their multilib versions, but do not forget to reinstall them after bin32-citrix-client has been succesfully installed
+
 
+
====Set Firefox to use Citrix====
+
Then set Firefox to use one the following programs to open .ICA files, depending on your architecture.
+
 
+
x86:
+
<pre>/usr/bin/citrix-client.sh</pre>
+
x86_64:
+
<pre>/usr/lib32/ICAClient/wfica</pre>
+
  
 
====Google Chromium====
 
====Google Chromium====
Line 41: Line 28:
  
 
== Manual Install ==
 
== Manual Install ==
====Installation====
+
====Citrix Receiver (icaclient) Installation====
* '''Step 0. 64-bit Arch systems only - install 32-bit libs:'''
+
from arch repositories: lib32-libxmu, for nspluginwrapper: lib32-alsa-lib, lib32-gcc-libs, lib32-libxft, lib32-gtk2, lib32-libxdamage.
+
From AUR: lib32-printproto, lib32-libxp, lib32-libxpm, lib32-libxaw, lib32-openmotif, nspluginwrapper
+
  
If you have a 64 bit version of Firefox, the Citrix plugin will not be detected. To use the 32 bit plugin, install nspluginwrapper-ubuntu from the AUR. Then do:
+
* '''Step 1.''' Download Citrix Receiver  It can be found [http://www.citrix.com/downloads/citrix-receiver/linux.html here]. Choose the latest version of the x86 client for 32-bit systems or the x86_64 file for 64-bit systems in the .tar.gz format.
  
<pre># nspluginwrapper -i /usr/lib32/ICAClient/npica.so</pre>
 
 
You can read [https://bbs.archlinux.org/viewtopic.php?id=60334 this thread] for more information.
 
 
 
* '''Step 1.''' Download the Citrix XenApp linux binary.  It can be found here: [http://www.citrix.com/ citrix.com] > Downloads > Citrix Clients > Linux Clients > Choose the latest version of the x86 client in the .tar.gz format.  It reads "x86 client - requires OpenMotif v.2.3.1"
 
 
* '''Step 2.''' Unpack the archive:
 
* '''Step 2.''' Unpack the archive:
  
Line 81: Line 59:
 
You can check this as such:
 
You can check this as such:
 
<pre>
 
<pre>
# find /usr -name npica.so
+
# find / -name npica.so
/usr/local/lib/netscape/plugins/npica.so
+
/opt/Citrix/ICAClient/npica.so
/usr/lib/ICAClient/npica.so
+
/usr/lib/firefox-3.5/plugins/npica.so
+
/usr/lib/mozilla/plugins/npica.so
+
 
</pre>
 
</pre>
 
Or you can check if your browser loads the plugin, in Firefox this can be done by typing "about:plugins" in the address bar. If you have a 64-bit version of Firefox, the plugin will not be loaded. You can check below what to do.
 
Or you can check if your browser loads the plugin, in Firefox this can be done by typing "about:plugins" in the address bar. If you have a 64-bit version of Firefox, the plugin will not be loaded. You can check below what to do.
  
 
Create missing links as such:
 
Create missing links as such:
<pre># ln -s /usr/lib32/ICAClient/npica.so /opt/mozilla/lib/plugins/</pre>
+
<pre># ln -s /opt/Citrix/ICAClient/npica.so /usr/lib/mozilla/plugins/</pre>
* '''Step 5.''' Install openmotif: <pre># pacman -S community/openmotif</pre>
+
 
* '''Step 6.''' (Might not be necessary:) <pre># ln -s /usr/lib/libXm.so.4 /usr/lib/libXm.so.3</pre>
+
* '''Step 6.''' Restart your browser
* '''Step 7.''' Restart your browser
+
  
 
At this point, everything should work, including wfcmgr. In the case of Opera, integration should be automatic.  The ICAClient will automatically be launched whenever you try to access a citrix-based application from either Firefox or Opera.
 
At this point, everything should work, including wfcmgr. In the case of Opera, integration should be automatic.  The ICAClient will automatically be launched whenever you try to access a citrix-based application from either Firefox or Opera.
  
'''Note:''' If for some reason firefox prompts you for which application to use when opening a citrix-based application, use <code>/usr/lib/ICAClient/wfica</code>
+
'''Note:''' If for some reason firefox prompts you for which application to use when opening a citrix-based application, use <code>/opt/Citrix/ICAClient/wfica</code>
  
====Security Certificates====
+
==TLS/SSL Certificates==
 
Because ICAClient uses SSL you may need a security certificate to connect to the server, check with the server administrator. If there is a certificate download and place it in {{ic|/usr/lib/ICAClient/keystore/cacerts/}}.
 
Because ICAClient uses SSL you may need a security certificate to connect to the server, check with the server administrator. If there is a certificate download and place it in {{ic|/usr/lib/ICAClient/keystore/cacerts/}}.
  
You may then receive the error {{ic|You have not chosen to trust the issuer of the server's security certificate. (SSL Error 61)}}. This means you do not have the root Certificate Authority (CA) certificates.
+
You may then receive the error {{ic|You have not chosen to trust the issuer of the server's security certificate. (SSL Error 61)}}.
 +
 
 +
There may be several reasons for this:
 +
 
 +
; You do not have the root Certificate Authority (CA) certificates.
 +
: These are already installed on most systems, they are part of the core package {{Pkg|ca-certificates}}, but they are not where ICAClient looks for them. Copy the certificates from {{ic|/etc/ssl/certs/}} to {{ic|/usr/lib/ICAClient/keystore/cacerts/}}. For Citrix versions before 13.1, run the following command as root:
 +
: {{bc|# ln -sf /etc/ssl/certs/* /opt/Citrix/ICAClient/keystore/cacerts/}}
 +
: Since versions 13.1, Citrix needs the certificates in separate files. You need to run the following commands as root:
 +
<pre>
 +
# cd /opt/Citrix/ICAClient/keystore/cacerts/
 +
# cp /etc/ssl/certs/ca-certificates.crt .
 +
# awk 'BEGIN {c=0;} /BEGIN CERT/{c++} { print > "cert." c ".pem"}' < ca-certificates.crt
 +
</pre>
 +
: You may also need to download your CA's intermediate certificates and store them in the same directory.
 +
: Changes to your certificate directory will likely require rehashing links for openssl to find them properly. Skipping this step might result in Citrix still giving certificate errors. To do this, use this command (borrowed from [https://help.ubuntu.com/community/CitrixICAClientHowTo#A5._Add_more_SSL_certificates])
 +
: {{bc|# c_rehash /opt/Citrix/ICAClient/keystore/cacerts/}}
 +
 
 +
; Your server is using a certificate with a SHA-2 hash for the Signature Algorithm.
 +
: Microsoft has mandated that any certificates with an expiry date of 2017 or later must use a SHA-2 hash[http://www.p2vme.com/2014/02/sha2-certificates-and-citrix-receiver.html]. You may either:
 +
# Upgrade your client to 13.1 or later. Citrix now supports SHA-2 hashes in the ICA client version 13.1.0.285639.
 +
# Contact your CA and have your certificate re-keyed with a SHA-1 hash.
 +
 
 +
== Troubleshooting ==
 +
 
 +
If you have issues opening a Citrix connection under Firefox you may need to set the Citrix Receiver plugin to 'Always Activate' under the Firefox Add-ons Manager plugin settings.
 +
 
 +
If you have cursor alignment issues under Citrix and you have multiple displays connected to your machine you may need to disable all but one when using Citrix.
  
These are already installed on most systems, they are part of the core package {{Pkg|ca-certificates}}, but they are not where ICAClient looks for them. Copy the certificates from {{ic|/usr/share/ca-certificates/mozilla/}} to {{ic|/usr/lib/ICAClient/keystore/cacerts/}}. As root, run the following command:
+
If you have sticky Control Ctrl key issues after logging to session you may resolve it using this [http://looselytyped.blogspot.com/2014/08/fixing-sticky-control-key-issues-with.html guide]
{{bc|# cp /usr/share/ca-certificates/mozilla/* /usr/lib/ICAClient/keystore/cacerts/}}
+

Latest revision as of 07:29, 6 May 2016

Tango-edit-clear.pngThis article or section needs language, wiki syntax or style improvements.Tango-edit-clear.png

Reason: See Help:Style; also add an introduction. (Discuss in Talk:Citrix#)

Install from AUR

Tango-view-refresh-red.pngThis article or section is out of date.Tango-view-refresh-red.png

Reason: Citrix provides an automatic installer, see manual installation (Discuss in Talk:Citrix#)

Install Package

icaclientAUR x86_64

SSL connections are supported by default in this packages. Also Firefox plugin will be installed by default as well as the wfica.desktop file. That way Arch knows how to open ica files.

Google Chromium

If you have problems launching Citrix applications with Chromium, just go to about:plugins and disable "Citrix Receiver for Linux".

Next, create /usr/share/applications/wfica.desktop (Exec path may vary based on package installed):

[Desktop Entry]
Name=Citrix ICA client
Comment="Launch Citrix applications from .ica files"
Categories=Network;
Exec=/usr/bin/wfica
Terminal=false
Type=Application
NoDisplay=true
MimeType=application/x-ica;

Now xdg-open will handle .ica extensions using /usr/bin/wfica.

Note: if you are running Xfce and Chromium is opening the .ica files in the wrong application (e.g. a text editor), make sure you have xorg-xprop installed.

Manual Install

Citrix Receiver (icaclient) Installation

  • Step 1. Download Citrix Receiver It can be found here. Choose the latest version of the x86 client for 32-bit systems or the x86_64 file for 64-bit systems in the .tar.gz format.
  • Step 2. Unpack the archive:
# tar zxvf en.linuxx86.tar.gz
./
./PkgId
./install.txt
./eula.txt
./readme.txt
./setupwfc
./linuxx86/
./linuxx86/hinst
./linuxx86/linuxx86.cor/
./linuxx86/linuxx86.cor/nls/
./linuxx86/linuxx86.cor/nls/en/
./linuxx86/linuxx86.cor/nls/en/UTF-8/
./linuxx86/linuxx86.cor/nls/en/UTF-8/Wfica
./linuxx86/linuxx86.cor/nls/en/UTF-8/Wfcmgr
... many more files ...
  • Step 3. Run setupwfc:
    # ./setupwfc
    (Follow all instructions prompted by setupwfc.)
  • Step 4. (Applies only for Firefox integration:)

The setup program should have made appropriate links to the "Citrix Receiver for Linux" plugin. You can check this as such:

# find / -name npica.so
/opt/Citrix/ICAClient/npica.so

Or you can check if your browser loads the plugin, in Firefox this can be done by typing "about:plugins" in the address bar. If you have a 64-bit version of Firefox, the plugin will not be loaded. You can check below what to do.

Create missing links as such:

# ln -s /opt/Citrix/ICAClient/npica.so /usr/lib/mozilla/plugins/
  • Step 6. Restart your browser

At this point, everything should work, including wfcmgr. In the case of Opera, integration should be automatic. The ICAClient will automatically be launched whenever you try to access a citrix-based application from either Firefox or Opera.

Note: If for some reason firefox prompts you for which application to use when opening a citrix-based application, use /opt/Citrix/ICAClient/wfica

TLS/SSL Certificates

Because ICAClient uses SSL you may need a security certificate to connect to the server, check with the server administrator. If there is a certificate download and place it in /usr/lib/ICAClient/keystore/cacerts/.

You may then receive the error You have not chosen to trust the issuer of the server's security certificate. (SSL Error 61).

There may be several reasons for this:

You do not have the root Certificate Authority (CA) certificates.
These are already installed on most systems, they are part of the core package ca-certificates, but they are not where ICAClient looks for them. Copy the certificates from /etc/ssl/certs/ to /usr/lib/ICAClient/keystore/cacerts/. For Citrix versions before 13.1, run the following command as root:
# ln -sf /etc/ssl/certs/* /opt/Citrix/ICAClient/keystore/cacerts/
Since versions 13.1, Citrix needs the certificates in separate files. You need to run the following commands as root:
# cd /opt/Citrix/ICAClient/keystore/cacerts/
# cp /etc/ssl/certs/ca-certificates.crt .
# awk 'BEGIN {c=0;} /BEGIN CERT/{c++} { print > "cert." c ".pem"}' < ca-certificates.crt
You may also need to download your CA's intermediate certificates and store them in the same directory.
Changes to your certificate directory will likely require rehashing links for openssl to find them properly. Skipping this step might result in Citrix still giving certificate errors. To do this, use this command (borrowed from [1])
# c_rehash /opt/Citrix/ICAClient/keystore/cacerts/
Your server is using a certificate with a SHA-2 hash for the Signature Algorithm.
Microsoft has mandated that any certificates with an expiry date of 2017 or later must use a SHA-2 hash[2]. You may either:
  1. Upgrade your client to 13.1 or later. Citrix now supports SHA-2 hashes in the ICA client version 13.1.0.285639.
  2. Contact your CA and have your certificate re-keyed with a SHA-1 hash.

Troubleshooting

If you have issues opening a Citrix connection under Firefox you may need to set the Citrix Receiver plugin to 'Always Activate' under the Firefox Add-ons Manager plugin settings.

If you have cursor alignment issues under Citrix and you have multiple displays connected to your machine you may need to disable all but one when using Citrix.

If you have sticky Control Ctrl key issues after logging to session you may resolve it using this guide