avoidik/README.md

## README.md

      
    Raw
  

              README.md
            
          
    Citrix Workspace

In this manual I assume that we'll be using usb audio handset instead of hdmi audio output
Step

Check available architectures first
$ dpkg --print-architecture
arm64

$ dpkg --print-foreign-architectures
armhf

Add armhf if foreign architectures list is empty
sudo dpkg --add-architecture armhf
sudo apt-get update
Install required dependencies
sudo apt-get install \
  libc++1-13:armhf \
  libunwind-13:armhf \
  libcanberra-gtk-module:armhf \
  libcanberra-gtk3-module:armhf \
  libwebkit2gtk-4.0-37:armhf
Download Linux armhf deb package from here https://www.citrix.com/downloads/workspace-app/linux/workspace-app-for-linux-latest.html
Install it
sudo dpkg -i icaclient_aa.bb.cc.dd_armhf.deb

In some cases you can install missing packages using sudo apt-get install --fix-broken

Also install murrine theme
sudo apt-get install gtk2-engines-murrine:armhf
This will fix ugly UI and prevent errors like this
(wfica:48086): Gtk-WARNING **: 15:54:38.500: Unable to locate theme engine in module_path: "murrine"

Link and rehash trusted CA certificates
sudo ln -s /etc/ssl/certs/*.pem /opt/Citrix/ICAClient/keystore/cacerts/
sudo /opt/Citrix/ICAClient/util/ctx_rehash
Enable pulseaudio support for all users (make sure this flag is in the file), otherwise ALSA will be in use
$ nano /opt/Citrix/ICAClient/config/module.ini
[ClientAudio]
AudioRedirectionV4=True

Enable microphone and set medium audio quality for current user only (make sure this flag is in the file)
$ nano ~/.ICAClient/wfclient.ini
[WFClient]
AllowAudioInput=True
EnableAudioInput=true
AudioBandWidthLimit=1

Here AudioBandWidthLimit can be one of the following:

0 specifies the bandwidth as high and means the Vorbis codec is used
1 specifies the bandwidth as medium and means the Speex codec is used
2 specifies the bandwidth as low and means the Speex codec is used


Note: If you want to change the default for all Citrix Workspace app users, modify the module.ini configuration file in the $ICAROOT/config directory (e.g. /opt/Citrix/ICAClient/config/module.ini).


Note: If an entry in All_Regions.ini is set to a specific value, the value for that entry in module.ini isn't used. The values in All_Regions.ini take precedence over the value in module.ini


Note: If the $HOME/.ICAClient/wfclient.ini file does not exist, wfica creates it by copying $ICAROOT/config/wfclient.template. When you change this template file, the changes are applied to all the Citrix Workspace app users.


Note: To apply configuration changes for a user, modify the wfclient.ini file in the user's $HOME/.ICAClient directory. The settings in this file apply to future connections for that user.


Note: The value set in wfclient.ini takes precedence over the value in module.ini.

Install pulseaudio volume control
sudo apt install pavucontrol
Prioritize usb audio
echo "options snd-usb-audio index=0" | sudo tee /etc/modprobe.d/alsa-base.conf

On Ubuntu it's also recommended to set tsched flag to 0, just open /etc/pulse/default.pa file and append tsched=0 to the load-module module-udev-detect line

Adjust /boot/config.txt file
# dtparam=audio=on
dtoverlay=vc4-kms-v3d,noaudio
max_framebuffers=2
gpu_mem=128
disable_splash=1


On Ubuntu someone has recommended to use vc4-fkms-v3d instead, personally for me vc4-kms-v3d works much better, I also faced no video output on HDMI port issue, I was able to resolved it by setting hdmi_force_hotplug=1 and config_hdmi_boost=4 flags

Reboot and check audio output
aplay -l
pactl list sinks short
pactl list cards short
aplay -Dplughw:0,0 -fcd /usr/share/sounds/alsa/Front_Center.wav
Run Citrix Workspace check
sudo /opt/Citrix/ICAClient/util/workspacecheck.sh
If something went wrong with the audio output
journalctl --list-boots --no-pager
journalctl --boot 0 --no-pager --user -xeu pulseaudio.service
rm -f ~/.asoundrc
Hide citrixlog user from the login session
$ cat /etc/lightdm/users.conf
Append citrixlog to hidden-users list in this file
Alternatively, add the citrixlog user to AccountsService as follows
cat <<-'EOF' | sudo tee /var/lib/AccountsService/users/citrixlog
[User]
SystemAccount=true
EOF
sudo systemctl restart accounts-daemon.service

Now connect to Citrix VDI as usual using your favorite web-browser
Extra

To enable windowed-mode by default (for current user only)
$ cat ~/.ICAClient/wfclient.ini
[Thinwire3.0]
DesiredHRES=1600
DesiredVRES=900
UseFullScreen=False
TWIMode=Off

$ cat ~/.ICAClient/All_Regions.ini
[Virtual Channels\Seamless Windows]
TWIMode=Off
[Virtual Channels\Keyboard]
TransparentKeyPassthrough=Remote

[Virtual Channels\Thinwire Graphics]
DesiredHRES=1600
DesiredVRES=900
UseFullScreen=False
TWIFullScreenMode=0

If you see something like this
FIPS violation detected at crypto/evp/digest.c:219, reason: SHA-1 hash algorithm is not allowed in FIPS mode.

This error means that one or more trusted CA certificate uses SHA-1 as a signature algo by default, which is considered insecure due to potential collisions. You can find them all at once:
for cert in /opt/Citrix/ICAClient/keystore/cacerts/*.pem ; do if openssl x509 -text -noout -in $cert | grep -q 'sha1With' ; then echo $cert ; fi ; done

References

https://docs.citrix.com/en-us/citrix-workspace-app-for-linux/configure-xenapp.html