All Teramind solutions are available to deploy on Amazon’s distributed, highly scalable, and reliable Amazon Web Services (AWS) platform as a Private Cloud option. This deployment guide will help you discover what you can expect from your Teramind on AWS deployment and provide you with installation prerequisites, step-by-step instructions, technical and support information.

You can download a PDF version of the deployment guide by clicking the button below:

If you prefer on-premise deployments but unwilling to incur the cost and hassle of an in-house infrastructure or you want to move to the Cloud but have been concerned about compliance, security or have made the transition and already host on AWS, then Teramind on AWS is the right choice for you. With our AWS Private Cloud hosting option, enjoy the benefits of both worlds: cost and scalability comparable to a Cloud deployment and security and flexibility similar to an On-Premise solution. Here are some infrastructure benefits you can expect if you choose to deploy Teramind on AWS:

You only pay for the AWS resources you consume (i.e. CPU, storage, memory). Teramind’s recommended configuration for a standard deployment (m4.xlarge instance, supporting up to 100 users) costs only a few cents per hour. Note that infrastructure costs are set by Amazon and subject to change.

Create a Teramind server with a single click by launching the Teramind AMI (Amazon Machine Image) from the AWS Marketplace.

Vertical and horizontal scaling to adjusts capacity based on demand.

Choose the region, OS, storage, database, etc. For example, you can use an Amazon S3 storage for Teramind’s session recordings and Amazon RDS databases for session logs that are highly optimized for performance on AWS.

Support for High Availability (HA), redundancy with multi-geo replications, on-demand backup, and disaster recovery.

Configure and manage all your deployments from one central location.

Firewall, encryption at rest, SSL encryption, VLAN, SSH tunnels, 2FA, IP whitelisting, and encrypted disks allowing for easy regulatory compliance for HIPAA, GDPR, PCI DSS, and more make it ideal for Teramind customers in government, healthcare, finance, and other regulated industries.

Deployments for under 1,000 concurrent users can be hosted on one all-inclusive server, in most cases. EC2 instance(s) should be provisioned based on the expected number of concurrent monitored sessions, according to the following table:

*The requirements are applicable for a typical user who works on a single computer with Full HD (1920x1080) screen resolution, doing regular office work. If the users have multiple screens, higher-resolution screens, or have an unusual work pattern (e.g., watching many videos) then the requirements will be higher.

*The requirements are applicable for a typical user who works on a single computer with Full HD (1920x1080) screen resolution, doing regular office work. If the users have multiple screens, higher-resolution screens, or have an unusual work pattern (e.g., watching many videos) then the requirements will be higher.

**Disk size is estimated for 1 year of average usage and may vary depending on monitored data, monitoring profiles, etc.

*The requirements are applicable for a typical user who works on a single computer with Full HD (1920x1080) screen resolution, doing regular office work. If the users have multiple screens, higher-resolution screens, or have an unusual work pattern (e.g., watching many videos) then the requirements will be higher.

The Teramind virtual appliance comes with a primary volume of 50 GB by default. This volume contains the Teramind server application and database. The size of this volume can be increased at a later point in time.

The simplest way to add scalable storage is to use AWS S3 Storage. For instruction on how to do so, check out Step 3: Adding an S3 Storage.

Detailed agent specifications can be found here.

You can get Teramind from the AWS Marketplace.

Once there, click the Continue to Subscribe button on the top right corner.

On the Subscribe tab, click the Accept Terms button.

Click the Continue to Configuration button on the Subscribe tab.

On the Configure tab, you can choose the Delivery Method, Software Version, and the Region. Be sure to select a region closest to you for better performance.

Click the Continue to Launch button when done.

On the Launch tab, click the Choose Action pull-down menu and select Launch through EC2.

Click the Launch button.

On the Choose an Instance Type screen, select an instance type from the list of available instances.

Once done, click the Review and Launch button at the bottom of the page.

The Review Instance Launch screen shows all the details associated with your selected instance. You can edit any configuration if needed.

Click Launch to accept the configurations and launch the instance.

Once the instance is ready, a window will pop up where you can select an existing key pair or create a new pair.

From the first pull-down menu, select Create a new key pair and give it a name.

Click the Download Key Pair button and save the file in a secure place. You will need it in Step 1.16: Accessing the Teramind Server with SSH.

Once done saving, click Launch Instances.

The instance will be initialized in a few moments

On the Launch Status window, click the View Instances button at the bottom to see your newly created instance(s).

We now need to assign an elastic IP to the instance. Otherwise, each time you restart the instance, it’s going to assign a new IP address causing the Teramind Agent to lose connection.

To assign an elastic IP, click the Elastic IPs (under Network & Security) from the left sidebar. Then click the Allocate Elastic IP address button on the top-right side of the screen.

We will use the default settings on the Allocate Elastic IP address screen.

Click the Allocate button.

Once the IP is allocated, click the IP address or the checkmark in front to select it.

Click the Actions menu on top and select Associate Elastic IP address from the pull-down menu.

On the Associate Elastic IP address screen, make sure Instance is selected as the Resource type.

Click the Instance box. You will see a list of available instances.

Select the instance you created earlier and then click the Associate button.

Go back to the Instance menu.

Copy or write down the Public IPv4 DNS address for the instance you created. You will need it in the next step.

Launch an SSH session. If you are on Windows, you can use a tool like Putty or a similar utility for the SSH. Make sure you have administrative access.

Type:

Where<pem file>is the full path of the key pair file you downloaded in Step 1.8: Creating a New Key Pair.

<DNS> is the Public IPv4 DNS address you copied in the previous step.

Press Enter. The server will be ready in a few minutes.

Once the server is ready, you will see this message, ‘Welcome to Teramind!’. Under the message you will be given options to assign roles for the nodes/hosts, beginning with the Master role. However, before you can assign a role, you will need to finish the rest of the steps.

Keep this command window open as you will use it to finalize the setup at a later stage.

Before you proceed any further with the setup process, you will need to determine if you want to use external databases or storage with the instance. External databases or storage are not mandatory. However, you may want to use Amazon RDS as the database, and Amazon S3 for screen and audio recordings. Using RDS and S3 will improve the scalability of your platform and is recommended for deployments over 100 concurrent users.

This guide will show you how to use an external database and storage using an AWS RDS database and the AWS S3 storage service. First, it will show you how to create an RDS database. If you already know how to create an RDS database, you can skip the next section.

From your EC2 Management Console, click Services from the top left-hand side. A Few options will show up.

Type RDS in the search field.

Select the RDS under the Database category.

Select Databases from the left-hand sidebar.

Then, click the Create database button on the top-right corner of the screen.

On the Create database screen, select Standard create under the Choose a database creation method.

Select PostgreSQL under the Engine options section.

Select the latest Version for the database.

Scroll down until you reach the Templates section.

Under the Templates section, select either Production or Dev/Test depending on what you want to do. In this case, we will use the Dev/Test option.

Scroll down until you reach the Settings section.

Under the Settings section, type a name in the DB instance identifier field. Assign a Master user name and a password.

Scroll down until you reach the DB instance class section.

Under the DB instance class section, select the Standard classes option.

Scroll down until you reach the Connectivity section.

Under the Connectivity section, you can configure various connectivity options according to your needs.

For this tutorial’s purposes we will use the following settings:

Select Default VPC for the Virtual private cloud (VPC) option.

Select Yes for the Public access option.

Select Choose existing for the VPC security group option.

Under Additional configurations, assign a port in the Database port field. This TCP/IP port should be open so that your applications can use the database.

Scroll down until you reach the Database authentication section.

Under the Database authentication section, select Password authentication for the Database authentication options.

Under the Additional configurations section, you can specify additional options such as encryption, backup, enhanced monitoring, etc. For this tutorial’s purposes, we will keep them to their default settings.

Under the Estimated monthly costs section, you will be able to see the cost breakdown for your database.

Once ready, click the Create database button at the bottom to create the database.

Teramind does not need external storage. However, Teramind can utilize a file storage system for screen and audio recordings, captured attachments, printer documents, and metadata such as user images. AWS S3 is an efficient, secure, scalable, and redundant solution to store objects like these. The S3 storage will improve the scalability of your platform and is recommended for deployments of over 100 concurrent monitored users.

To use the AWS S3 storage, you will need to attach an Identity and Access Management or IAM profile to your storage instance. IAM enables you to manage access to your AWS services and resources securely. Using IAM, you can create and manage AWS users and groups and control user permissions.

This guide will show you how to create an IAM profile and attach it to your S3 instance. If you already know how to create one, you can skip this section.

Go to the Instances screen from your EC2 Management Console. Make sure the instance you want to use is selected.

Click the Actions button near the top-right corner. From the pull-down menu, select Security > Modify IAM Role.

On the Modify IAM Role screen, click the Create new IAM role link.

On the Roles screen, you will see an explanation of the IAM roles and links to some resources and documentations.

Click the Create role button to continue.

Select the default AWS service as the type for the trusted entity.

Click the Next: Permissions button.

From the list of permission policies, select the one named AmazonS3FullAccess (you can quickly locate it using the Search field).

Click the Next: Tags button to continue.

Tages are optional and we will not use any in this tutorial. You can still add some tags if you want.

Click the Next: Review button to go to the next screen.

On the Review screen, give the role a name and click the Create role button.

Go back to the Instances screen from your EC2 Management Console. Make sure the instance you want to use is selected.

Click the Actions near the top-right corner. From the pull-down menu, select Security > Modify IAM Role.

On the Modify IAM Role screen, click the Choose IAM role field and select the IAM role you created in Step 3.7: Reviewing and Creating the IAM Role.

Click the Save button to attach the IAM role to your instance.

As the last step of the server deployment process, you will need to assign the external database and storage to your master instance, setup the Teramind Server using the SSH and finally, configure your account settings on the Teramind Dashboard.

Go back to the command prompt window you left open in Step 1.17: Getting Ready for the Next Step.

Enter a name at the Role (master) prompt.

At the Use external database? prompt enter Yes.

Supply the RDS database IP / hostname, username, and password you created before. Press Enter when done.

Teramind will initialize the database, tables, and required indexes automatically.

After Teramind has finished the database initializations, it will ask, Use S3 for storing data?. Type Yes.

Type Yes at the Create new buckets? prompt. You will be prompted to enter names for three buckets: one for screen recordings, one for user content i.e. attachments or printer docs, and the third one for application objects. Give unique names to each bucket.

Please see the S3 Bucket Naming Requirements below for information on rules related to the naming of the buckets.

Once you have entered the bucket Teramind will set up the servers. Finally, you will be provided with a link to your dashboard. Click the link or enter it on your browser to continue.

When you open the Teramind Server link in the browser, you might see a warning message on your browser saying the connection is not private or secure. This is normal. The warning is shown because you haven’t assigned any SSL certificate to your server. You can upload your own certificate later from the Teramind Dashboard (for more information, check out the Settings > Security > SSL section of the User Guide).

If you are using Google Chrome, you can click the Advanced button on the warning page and then click the Proceed to… link to continue. Other browsers have similar options to bypass the warning.

When you enter the Teramind Dashboard for the first time, you will see the End-User License Agreement screen.

Scroll down and click the Accept & Continue button.

On the Welcome to Teramind screen, select your language and timezone and click CONTINUE.

On the Lets secure your Teramind installation screen, enter an email and a password for your Admin account.

Open a new browser tab and go to: https://www.teramind.co/portal. Login with the admin email and password.

Click the Licenses tab.

From the list of licenses, click the Key link under the Actions column. A pop-up will display the license key.

Copy the license key or write it down.

Go back to your Teramind Dashboard. Enter the license key and click the CONTINUE button.

At this stage, you can install the Teramind agent and start monitoring the targeted computer(s). Or, you can do it later.

To install the agent, click one of the options under Install agents. If you need help installing the agent, check out this article. You can also watch this short video: Downloading and Installing Teramind's Hidden Agent

To install the agent at a later time, click the SKIP TO DASHBOARD button.

If you want to use the OCR feature, you will need to setup two VMs/nodes in addition to a master node.

Create the master VM as usual.

Then, create two additional VMs. The first node will store the OCR videos. In Teramind, we will refer to it as teracv. The second node is for the OCR database. In Teramind, we will refer to it as elastic.

Make sure all the nodes are in the same Security Group.

From your AWS portal’s Instances page, copy the Public IPv4 DNS address for the teracv instance.

Launch an SSH session. If you are on Windows, you can use a tool like Putty or a similar utility for the SSH. Make sure you have administrative access.

Type:

Where <pem file> is the full path of the key pair file you downloaded when creating the teracv VM.

<DNS> is the Public IPv4 DNS you copied in the previous step (Step 5.2: Copying the Public IPv4 DNS Address of the OCR Node).

If prompted to confirm the connection, enter yes.

Press Enter. The server will be ready in a few minutes.

On the AWS portal’s Instances page, select the master instance.

At the bottom of the screen, you will notice a Description panel is shown.

Copy or write down the Private IP address from the Description panel.

Go back to the command prompt window.

When asked, enter teracv at the Role (Master) prompt.

Paste the Private IP address you copied in the previous step (Step 5.4: Copying the Private IP Address of the Master Node).

It will take a few minutes for Teramind to set up the teracv node.

From your AWS portal’s Instances page, copy the Public IPv4 DNS address for the elastic instance.

Launch an SSH session. If you are on Windows, you can use a tool like Putty or a similar utility for the SSH. Make sure you have administrative access.

Type:

Where <pem file> is the full path of the key pair file you downloaded when creating the elastic VM.

<DNS> is the Public IPv4 DNS address you copied in the previous step (Step 5.6: Copying the Public DNS Address of the OCR Database Node).

If prompted to confirm the connection, enter yes.

Press Enter. The server will be ready in a few minutes.

When asked, enter elastic at the Role (Master) prompt.

Paste the Private IP address of the master node you copied in Step 5.4: Copying the Private IP Address of the Master Node.

It will take a few minutes for Teramind to set up the elastic node.

We will now need to approve the two nodes on the Teramind Dashboard.

Login to your Teramind Dashboard on the master server.

Click the Cog Wheel icon near the top-right corner of the dashboard and select Settings from the pull-down menu.

From the Settings screen, click the Server management tab.

Turn on the ENABLE MULTI-NODE DEPLOYMENT option under the Security settings section.

Under the Nodes section, you will notice the Screen mining database node and the Screen mining node.

Approve both nodes by clicking the APPROVE buttons.

You are now all set up for the OCR.

Teramind Agent can be installed both locally and remotely. Check out this article to learn how to download and install the agent: How to download and install the Teramind Agent.

In most cases, you should not have to change any settings to get Teramind to work. By default, the Teramind Agents communicate with the Teramind server on two ports: 443, and 10000.

The Teramind management interface is entirely web driven and runs over HTTPS (port 443). This means that most proxies will allow the traffic through, provided you properly installed your SSL certificates.

For live and recorded screen playback, as well as live sessions listing, Teramind uses WebSocket. Although the WebSocket operates as HTTPS over port 443, some older proxies may not recognize this protocol. In either case, if you are experiencing trouble accessing your Teramind dashboard, try to disable your proxy temporarily to isolate the cause.

Also note that, if audio recording is enabled, Teramind Agent will connect to the server on a random UDP ports in the range 1000-65535 to send the audio recordings. Make sure UDP ports in that range are enabled and open from the endpoint to the server.

Teramind Agent and its drivers come digitally signed with an extended-validation certificate. We’ve made every effort to coordinate our signature with the major antivirus vendors, and as a result, Teramind should work normally with the vast majority of antivirus software.

Once you have installed Teramind successfully, you can configure other aspects of the server, agent and other settings entirely from the web-based dashboard.

Check out this article for help: How to change the license key (On-Premise / Private Cloud Deployment).

Teramind regularly releases server updates for the On-Premise deployment on our Self-Hosted Portal and the virtual machine images may not always contain the latest server updates. These updates may contain bug fixes, security patches and new features. To keep your deployment up-to-date, we recommend that you update your server regularly. To update your server, download the latest server image from the Self-Hosted Portal at www.teramind.co/portal. Under the Download > Teramind Update section. Download the platform update file (with a TMU extension) by clicking the download icon.

Once you have downloaded the file, you can upload it to the dashboard under Settings > About tab.

Check out this article for help: How to update the Teramind Server and BI Classification (On-Premise deployment).

Check out the Settings > Active Directory section on the Teramind User Guide to learn how to setup an Active Directory / LDAP integration.

Configuring the SMTP settings is necessary for the Teramind server to be able to send outbound emails such as the daily digest emails sent to administrators, scheduled reports, low storage notifications, license alerts, and password recovery emails.

You can configure the SMTP from the Settings > SMTP tab.

Check out this article for help: SMTP Configurations (On-Premise).

Teramind strongly recommends proper configuration of SSL in order to avoid browser warnings and restrictions. Some browsers will not allow WebSocket communications if the certificates are invalid. This may prevent you from watching live screens or screen recordings.

Configuring the SMTP settings is also necessary for the Teramind server to be able to send outbound emails such as the daily digest emails sent to administrators, scheduled reports, low storage notifications, license alerts, and password recovery emails.

You can upload your SSL certificate from the Settings > SSL tab.

Check out the Settings > SSL section on the Teramind User Guide for more information. You can also create your own SSL certificates for use with your on-premise deployments.

To learn how to generate such self-signed certificates, check out this article.

To learn how to use a third-party certificate, check out this article.

1. Teramind Agent asks Management Server for an Application Server IP and port

2. Management Server responds

3. Teramind Agent connects to the assigned Application Server

A. OCR Miner talks to the Management Server and asks for a record to process

B. Management Server fetches a screen file from the S3 Screen & Audio Storage and sends it to the OCR Miner Node

C. Once OCR is done, the OCR Miner sends results as text to the Management Server

D. Management Server writes the OCR result text to Elasticsearch

The Management Server serves the admin dashboard, load balances agents, and provides data to the OCR Miner Nodes. Teramind Agent connects to an Application Server via an always-on, TLS-encrypted connection, using our own protocol based on Google Protocol Buffers. OCR Miners are stateless and work with spot instances.