{% endhint %} LCC uses MQTT to sync with devices. MQTT syncs are instant upon policy change or upload of a new software version. The force sync action is used in troubleshooting devices that do not sync with LCC as designed. # Policy Management ## About the feature The Policy Management features provide a way for organizations to manage and configure devices seamlessly at scale. It is an administrative tool for remote device configuration. Lunar Control Center interacts with devices through a collection of APIs integrated with the managed devices through a System application. Lunar Control Center does not rely on any third-party infrastructure of services, such as Google Play Store or Android Enterprise. It delivers its functionality through services hosted by the organization. Lunar Control Center admins can manage the following device policies through the Console: ### Device policies Those represent a group of policies, including hardware, device, sync, wipe lock screen, and encryption policies. #### Hardware policies {% hint style="info" %} Includes settings related to the availability of functions delivered by hardware components. When disabled, applications will not be able to provide functions that require the use of these components even if applications are granted access to these components. {% endhint %}
Camera
Allows to enable or disable device cameras. Admins can disable only the front camera, only the rear cameras, or all device cameras.Location access
Allows to enable or disable access to location services by the device.USB
Allows to enable or disable USB functions including File Transfer, MIDI, PTP for connected devices. Deices with disabled USB by policy can still be charged through their USB port.Bluetooth
Allows to enable or disable Bluetooth connection on the device.WiFi
Allows to enable or disable WiFi connection on the device.Screenshots
Allows to enable or disable screenshot taking on the device. The screenshot taking permissions affects screenshot taking through any application, including system or third party applications.Microphone
Allows to enable or disable the usage of a microphone on the device. Disabling the microphone will prevent all voice functionality including calls, push-to-talk messages, audio recording, and audio feed on recorded videos.Fingerprint
Allows to enable or disable the usage of the fingerprint sensor as authentication on the device.Device sensors
Allows to enable or disable the functionality of all device sensors such as accelerometer, geomagnetic field, gravity, gyroscope, light, proximity, and more sensors. Device sensors depend on the device model used.Kill switch
Allows to enable or disable the functionality of a custom device component used for disabling services such as connectivity, bluetooth, WiFi from the user. Kill switch functions are only available for specific device models.Developer options
Allows to enable or disable access to Android Developer Options on the device.Voice service
Allows to enable or disable voice services on the device. When disabled it restricts all incoming and outgoing telephony calls on the device. VoIP calls made through external apps are not restricted.SMS/MMS
Allows to enable or disable SMS and MMS services on the device. When disabled it restricts all incoming and outgoing SMS or MMS messages, including silent SMS or MMS.Installation of 3rd party apps
Allows to enable or disable the installation of 3rd party applications on the device. Disabling it prevents installation of any applications through 3rd party app stores or local APK installation. When disabled, users will only be able to install applications allowed in their application policy.Send debugging information
When disabled, prevents users from sending device software bug reports to Lunar Control Center.Emergency center
Allows to enable or disable access of the device user to the emergency center functionality on Lunar OS. When enabled the user can activate an SOS sound alarm or initiate an SOS device Wipe, including sending an SOS message to their organization and triggering instant device wipe.Can manage Screen timeout
Allows to enable or disable the option for users to change their screen timeout setting on the device.SIM logs
When disabled, Lunar Control Center can not get SIM logs from the device.Top-up
When enabled, it adds a top-up option for users in their My Account menu on their device. Top up menu function depends on the custom implementation on the OS side.Update account password
Allows to enable or disable the function for device users to update the account password used to enroll the device. If disabled, the account password can only be changed from Lunar Control Center.MicroG Services
When enabled, devices get MicroG service installed and configured on their device. [Read more about MicroG functionality here](https://microg.org/).Allow accounts to manage "sync" section in personal account settings
If enabled, users will be able to select the sync interval and the max failed sync to wipe settings.Sync interval [s]
Determines how frequently would the device attempt to sync with the Lunar Control Center.Max failed sync to wipe
Determines the maximum unsuccessful sync attempts a device is allowed before a local device wipe triggers. If the device fails to sync with Lunar Control Center server for the set interval, an automated factory reset will be triggered, wiping all device data and logging out of the account.Count missed offline syncs
If disabled, the max failed sync to wipe will not trigger a device wipe.Allow accounts to manage "wipe password" section in personal account settings
If enabled, users will be able to set up a duress wipe PIN/Password on their device.Wipe password
Allows Lunar Control Center administrators to set up a wipe password for the device. The device wipe password is used to wipe the device when entered in the lock screen menu.Lock Screen Method
Determines if the user is allowed to use a PIN code or a Password when setting up their lock screen protection. For PIN code method, administrators can set minimum PIN symbols required. For Password method, administrators can set a pass quality requirement.Pass history restriction
Determines if the user is allowed to use a PIN code or a Password when setting up their lock screen protection. For PIN code method, administrators can set minimum PIN symbols required. For Password method, administrators can set: * pass quality requirement * password history restriction (determines the number of unique new passwords that must be associated with a user account before an old password can be reused) * Password minimum length * Password expiration \[days]Timeout for screen lock [s]
Used to set value for screen timeout before automatic device lock. Available values include 15s, 30s, 1min, 2min, 5 min, 10 min, and 30 min.Can manage Screen timeout
Allows to enable or disable the option for users to change their screen timeout setting on the device.
3. Click on + Default Policies\
4. Select OS type\
5. Select policies
6. Click on Create\
{% endhint %}
### Group level
Groups are objects created by Lunar Control Center administrators in order to manage policies for a collection of accounts. Group policies overwrite Default System policies and are applied to all users part of the Group.
To start you will have to create a group, by following the steps below:
{% hint style="success" %}
1. Hover over the Config icon in the top right corner. \
2. Click on Groups
3. Click + Create \
4. Fill up fields, including:\
\- **Name**: the name the group will be identified with\
\- **Parent group**: allows you to create a group under an already existing parent group. \
\- **Group disk quota \[MB]**: allows you to set up a quota different than the default for the maximum amount of backup each account can use.\
\- **Group traffic quota \[MB]**: allows you to set up a traffic quota different than the default for the maximum network traffic a device can make.
{% endhint %}
Once you fill in the necessary fields, you can complete the group creation by pressing Create.
3. Click on + Create\
4. Find your group in the Search for Group field\
5. Select OS type\
6. Enter a policy name\
7. Select policies
8. Click on Create\
{% endhint %}
### Personal level
Personal policies are created for each user account. Personal policies overwrite Group and Default System policies.
You can do that by following the steps:
{% hint style="success" %}
1. Click on Manage\
2. Click on Device Policy / Application Policy / OS Policy / Software Policy (depending on what policy you want to create)\
3. Click on + Create\
4. Find your group in the Search for Group field\
5. Select OS type\
6. Enter a policy name\
7. Select policies
8. Click on Create\
{% endhint %}
## Assignment of Policies
Newly enrolled devices are automatically assigned with their Group Policies if a group exists, or assigned with the Default System Policies if they are not part of a group.
If the same Policies (Default System or Group) are being edited, the changes will affect devices under those policies.
As a Lunar Control Center admin, you can change the policy for each user account, by following the steps:
{% hint style="info" %}
1. Click on Manage\
2. Click on Accounts\
3. Click on the User's username under the "Username" section\
4. Select from the dropdown the Device, Application or OS policy you want to reassign.\
5. Click on Save\
{% endhint %}
## User Access Level
The access level of the user determines how much control users can have on their device policies.
There are 3 access levels:
* **Limited user**: users are not able to change their own device policies. Policies assigned to them are forced.
* **Power-user**: power users' devices receive the policies assigned to them, but they can also change those via their Phone Manager application (installed on their device), or through the Lunar Control Center User Portal if such is enabled.
* **Group administrator**: group administrators have all the rights of power users, plus the ability to manage policies for devices that are in their group. Management of group policies is only available in the Lunar Control Center User Portal if such is enabled.
As an administrator, you can change user access level by following the steps:
{% hint style="success" %}
1. Click on Manage\
2. Click on Accounts\
3. Click on the User's username under the "Username" section\
4. Select an option from the access level dropdown.\
5. Click on Save\
{% endhint %}
## Permission Groups
Permission groups allow additional policy control for Lunar Control Center administrators.
Permission Groups are used to set restrictions for Power Users, limiting what policies they can manage themselves and what policies are restricted and can not be changed.
Policies with an open padlock icon indicate that power users can manage that policy. Policies with a closed padlock icon indicate that power users can not manage that policy
3. Click on Manage Users\  4. Select users to be added to the permission group by clicking on the checkmark next to the username (only users that are part to the linked Group will be shown as available) 5. Press Add All Checked Users\  6. Press Save\  {% endhint %} The Manage Users menu also allows you to remove Users from the Permission Group. # Application management Lunar Control Center lets you manage what applications can users access. Once added to your LCC instance, you can enable applications through the [Application policies](/lunar-control-center-console/policy-management#application-policies). ## Application levels Lunar Control Center supports 2 levels for applications: * **Organization apps**: organization apps are installed for all users, regardless of their policies. In addition, the necessary in-phone permissions are granted automatically for organization apps * **Custom apps**: custom apps are applications that may or may not be enabled for users through policies. Users will have to grant app permissions after app installation. ## Adding applications You can add applications by uploading a file locally or by getting an app from the Update Server (requires [connection to the update server](/lunar-control-center-console/automated-software-updates#how-to-enable-software-updates)) ### Adding app through Update Server You can add applications by following the steps: {% hint style="success" %} 1. Click on Apps\  2. Click on Organization or Custom apps (depending on what app level you want to add)\  3. Click on Add from APK station\  4. Type the app name or package name in the search section and press search\  5. When you find the app(s) you need, press the request toggle\  6. Press the request button after you are done selecting apps\  7. Open the update menu by pressing on the Android icon\  8. Download each app you have requested by pressing the download icon next to the app\  {% endhint %} ### Adding app from local upload You can add applications by following the steps: {% hint style="success" %} 1. Click on Apps\  2. Click on Organization or Custom apps (depending on what app level you want to add)\  3. Click on Create\  4. Fill up the fields:\ \- File: upload the APK file of the app\ \- Icon: upload an icon. The icon will be visible in LCC Console and in the App store to users.\ \- Name: Put the name of the app. The app name will be visible in LCC Console and in the App store to users.\ \- Author: Add an author of the app. The app author will be visible in LCC Console and in the App store to users.\ \- Category: Select a category of the app.\ \- Available on the following OS: select if the app is for a specific Device OS version.\ \- Prevent app from updating: if toggled on, the app version can not be updated.\ \- Images: upload images of the app UI. The images will be visible in LCC Console and in the App store to users.\ \- Description: add a description of the app. The description will be visible in LCC Console and in the App store to users.\ \- Summary for description: add a summary of the description. The description summary will be visible in LCC Console and in the App store to users.\ \- Change log: add an internal note regarding the change. 5. Click on Create\  {% endhint %} ## App version management Administrators of Lunar Control Center can easily manage the application version pushed to devices. ### Checking for new App version The connection with Lunr's [Update Server](/lunar-control-center-console/automated-software-updates#application-updates) allows for instant checks of the latest available app version. Administrators can use the check update feature for both Organization and Custom apps. #### Organization Apps Follow the steps below to check for a new version of Organization Apps: {% hint style="success" %} 1. Click on Apps\  2. Click on Organization Apps\  3. Hover over the app you want to check and click on the edit icon\  4. Click on Check For Updates\  5. Click on OK If a new app version is available, you will receive a notification in the top right corner (see Android icon). 6. Open the update menu by pressing on the Android icon\  7. Download the new app version by clicking on the download icon next to the app\  8. Once you download the latest version, navigate back to the application menu by following steps 1, 2 and 3. 9. Hover over the app information button and select the latest version\  10. Click on the Mark as Default button to make the version default for all devices that have the app enabled by policy\  {% endhint %} #### Custom Apps Follow the steps below to check for a new version of Custom Apps: {% hint style="success" %} 1. Click on Apps\  2. Click on Custom Apps\  3. Click on the application name (or icon) you want to check\  4. Click on Check For Updates\  5. Click on OK If a new app version is available, you will receive a notification in the top right corner (see Android icon). 6. Open the update menu by pressing on the Android icon\  7. Download the new app version you by clicking on the download icon next to the app\  8. Once you download the latest version, navigate back to the application menu by following steps 1, 2 and 3. 9. Hover over the app information button and select the latest version\  10. Click on the Mark as Default button to make the version default for all devices that have the app enabled by policy\  {% endhint %} ### Update app version through local upload Administrators can upload a new app version in case they have not connected to Lunr's Update Server or in case the app is not found through a search to the Update Server. The app version can be uploaded for both Organization and Custom apps. #### Organization Apps Follow the steps below to upload a new Organization app version: {% hint style="success" %} 1. Click on Apps\  2. Click on Organization Apps\  3. Hover over the app you want to check and click on the edit icon\  4. Click on Create New Version\  5. Fill up the fields: \ \- Set as default version: sets the version you are about to upload as default version for devices that have the app enabled by policy\ \- File: upload the APK file\ \- Change log: add notes about the app changes. Change log notes will be visible to LCC administrators. 6. Click on Create\  {% endhint %} #### Custom Apps Follow the steps below to upload a new Custom app version: {% hint style="success" %} 1. Click on Apps\  2. Click on Custom Apps\  3. Click on the application name (or icon) you want to check\  4. Click on Create New Version\  5. Fill up the fields: \ \- Set as default version: sets the version you are about to upload as default version for devices that have the app enabled by policy\ \- File: upload the APK file\ \- Change log: add notes about the app changes. Change log notes will be visible to LCC administrators. 6. Click on Create\  {% endhint %} ## Deleting applications Deleting applications from your Lunar Control Center instance helps you improve user experience by removing unneeded apps. Once applications are deleted, they are removed from user devices. As an Administrator, you can delete both Organization and Custom Apps. #### Deleting Organization Apps Follow the steps below to delete an Organization app: {% hint style="success" %} 1. Click on Apps\  2. Click on Organization Apps\  3. Hover over the app you want to check and click on the X icon\  4. Click on OK {% endhint %} #### Custom Apps Follow the steps below to check for a new version for Custom Apps: {% hint style="success" %} 1. Click on Apps\  2. Click on Custom Apps\  3. Click on the bin icon next to the app you want to delete\  4. Click on OK
{% endhint %} ## Validation certificates Ensuring that you are pushing an authentic application version is crucial for securing your device fleet. Lunar Control Center allows you to add certificates in order to guarantee the authenticity of the apps you are uploading. You can add validation certificates by following the steps: {% hint style="success" %} 1. Hover over the config button\  2. Click on Settings\  3. Click on Updates\  4. Fill up values for: \ \- **Secure APK validation certificate**: enter the certificate values\ \- **Secure APK validation certificate owner**: enter the certificate owner values 5. Click on Save {% endhint %} Applications that do not pass the certificate validation will show as Untrusted once uploaded to your Lunar Control Center # Automated software updates ## About Updating your Lunar Control Center and device software to the latest version is crucial for the security of your device fleet. We've made the update process easy, through the integration with our update server. You can benefit from secure OTA updates on your Lunar Control Center, Devie Operating System, and applications, all easily managed through the LCC Console. ## How to enable software updates To enable automated software updates, you will have to first connect your LCC instance to Lunr's update server, by following the steps: {% hint style="success" %} 1. Hover over the Config icon in the top right corner\  2. Click on Settings\  3. Click on Updates\
4. Toggle On Subscribe On Updates\
5. Add Lunr's update server URL: noc-noc.cc\
6. Add Update Server access token (it is the same as your registry subscription key you used to install your LCC instance)\
{% endhint %}
## Application Updates
The connection between your LCC instance and Lunr's Update Server allows you to automate updates of the software version of your organization and custom applications added to your instance.
### Configuring app updates
You can configure your App Update settings by following the steps:
{% hint style="success" %}
1. Hover over the Config icon in the top right corner\
2. Click on Settings\
3. Click on Updates\
4. Navigate to APK Updates section\
{% endhint %}
Once you navigate to the section, you will see the following options:
* **Automatic APK download**: toggle on to download the latest app version in your LCC instance. If disabled, you will need to download app versions when they are made available manually.
* **Automatic APK release**: toggle on to automatically update the app version to the latest downloaded app version. If toggled off, you will need to release the new app version to devices manually.
* **Expiration time for an update notifications \[minutes]**: defines for how long should an update notification be kept if you have not downloaded the app. This value is relevant if you have disabled Automatic APK download.
### Manually downloading app updates
To update manually you need to navigate to the update menu, by clicking on the icon  on the top right. Once clicked, you will be taken to the menu with requested applications that are available for downloading. In the menu, you will be able to download the new version of the app by clicking on the download icon.
## OS updates
### Configuring OS updates
You can configure your OS Update settings by following the steps:
{% hint style="success" %}
1. Hover over the Config icon in the top right corner\
2. Click on Settings\
3. Click on Updates\
4. Navigate to OS Updates section\
{% endhint %}
Once you navigate to the section, you will see the following options:
* **OS updates**: toggle on to subscribe for OS version updates.
* **Automatic OS download**: toggle on to download automatically the new stable OS version. If toggled off, you will need to download the OS update to your LCC instance manually. Downloading the OS automatically or manually will not release it to end-users.
* **Automatic OS publish**: toggle on to automatically publish the newly downloaded version to users. If toggled off, you will need to publish the OS to devices manually.
* **Beta releases**: toggle on to subscribe for beta OS releases. The behavior in terms of auto-downloading or publishing is determined by the Automatic OS publish and Automatic OS download toggle options.
# Managing device models
Lunar Control Center can be used to manage different compatible Android devices.
## Adding a new device model
In order to manage Android devices, you first need to add it as a device to your Lunar Control Center.
You can add a new device by following the steps:
{% hint style="success" %}
1. Click on OS\
2. Click on Device Models\
3. Click on + Create\
4. Fill up the fields, including:\
\- **Name**: this is the name of the device. You will see it in your console\
\- **Unique**: it is a unique identification of the device. Make sure to fill in the exact one as provided by the phone manufacturer. It is required in order to fetch OS updates from the Update Server\
\- **Build JSON**: this is a piece of JSON that gets fed to the device. Make sure to follow the instructions provided by the phone manufacturer.
5. Click on Create\
{% endhint %}
## Enabling MicroG
MicroG is an integration with LCC-compatible devices that enables push notifications for de-googled Android devices. If your use case requires MicroG, you will need to add the necessary MicroG libraries to the device model.
You can do that by following the steps:
{% hint style="success" %}
1. Click on OS\
2. Click on Device Models\
3. Click on the edit icon next to your device model\
4. Upload the necessary library files as instructed by the manufacturer of the phone.
5. Click on Save\
{% endhint %}
# LCC CLI
## About
The LCC CLI is a tool designed to provide administrators with efficient management capabilities for the Lunar Control Center system. It provides a unified command line interface for deployment, update, and backup services.
LCC CLI runs on the machine hosting the LCC instance. Follow the [installation guide](/deployment/installation) to get started.
Once LCC CLI is installed, you can start using it through your terminal.
In order to use LCC CLI functions, you first need to activate a custom Python environment environment:
```
source /usr/local/lib/lcc/bin/activate
```
The environment gets deactivated automatically after the LCC-CLI is no longer in use.
## LCC-CLI: List of available commands
***
### Help command
Get a list of all available commands
```
lcc-cli --help
```
***
### Version command
Print Lunar Control Center and third-party services software version information.
```
lcc-cli version
```
***
### Service status command
Get the current state of Lunar Control Center docker service.
```
lcc-cli status --service proxy_proxy
```
***
### Service install command
This command provides the capability to install additional services integrated with Lunar Control Center.
```
lcc-cli install [OPTIONS]
```
| Name | Description |
|---|---|
| --service [openfire | kamailio | portainer | grafana | zabbix | wazuh | homer | ntp | dnscrypt] | Choose a service to install. [default: None] [required] |
| --help |
| Name | Description |
|---|---|
| --service [openfire | kamailio | portainer | grafana | zabbix | wazuh | homer | ntp | dnscrypt] | Choose a service to uninstall. [default: None] [required] |
| --help |
| Name | Description |
|---|---|
| --lcc-domain-name | Selection of domain for the LCC instance. [required] |
| --lcc-admin-username | Selection of admin username. Has to be in email format. [required] |
| --lcc-admin-password | Selection of admin password. Has to be in passphrase format. [required] |
| --lcc-registry-subscription-key | LCC Registry Subscription Key [default: None] [required] |
| --help |
lcc-cli cleanup [OPTIONS]
| Name | Description |
|---|---|
| --force | Forces a deep cleaning procedure [default: no-force] |
| --no-force | Initiates a deep cleaning procedure [default: no-force] |
| --help |
| Name | Description |
|---|---|
| --force | Forces a flush of instance from previous LCC installation [default: no-force] |
| --no-force | Flush an instance from previous LCC installation [default: no-force] |
| --help |
| Name | Description |
|---|---|
| --action [request | renew | status | generate] | Generate,request or renew your LCC Let'sEncrypt certificates. [default: None] [required] |
| --help |
| Name | Description |
|---|---|
| --password | Enter your new password. [default: None] [required]. The entered password should be between apostrophes (e.g. 'password') |
| --help |
| Name | Description |
|---|---|
| --path | Chooses a path where the backup file will be saved. Path should be writable. |
| --help |
| Name | Description |
|---|---|
| --file | Selects a path and file for the restoration process. File should exist and the directory with the file should be writable |
| --help |
2. **Download the script to start the installation process** ``` bash <(wget -qO- lcc.sh) ``` Running the command above will start the installation process of the latest stable version of LCC CLI and Lunar Control Center. 3. **Provide the required information to set up LCC** The installation process requires the set up of the LCC instance and verification of a LCC registry subscription key. Administrators will be prompted to input the following information: 3.1. **LCC Domain** ``` LCC Domain name: [enter your domain name here] ``` Administrators are required to set up a domain for LCC. For LCC to function, DNS should be configured with the right records, as per the article [Requirements](/deployment/requirements). 3.2. **Admin credentials** ``` LCC Admin username (email): [enter your admin email here] LCC Admin password: [enter your admin password here] ``` The script will suggest an admin user to you, based on the domain chosen (e.g.
| Product | Description |
|---|---|
| Zabbix | Monitoring software that provides real-time monitoring and metrics collection for your LCC instance. |
| Wazuh | Security monitoring platform for detecting, monitoring, and responding to security threats on your infrastructure hosting LCC. |
| Openfire | A real-time collaboration (RTC) server that enables XMPP communication. |
| Kamailio | A SIP server that handles SIP signaling, registration, routing, and other tasks necessary for enabling VoIP services. |
| Portainer | A lightweight container management platform that provides a user-friendly interface for managing Docker containers, and related resources. |
| Grafana | A data visualization tool that allows users to create dashboards and graphs for analyzing and monitoring metrics from various data sources such as databases, APIs, and monitoring systems like Zabbix. |
| Homer | Packet and Event Observability framework for VoiP/RTC Monitoring Applications based on the HEP/EEP protocol for ingesting signaling, rtc events, logs and statistics with instant search, end-to-end correlation and drill-down capabilities. Used for monitoring and troubleshooting SIP-related issues. |
| NTP | The Network Time Protocol is a networking protocol for clock synchronization between computer systems over packet-switched, variable-latency data networks. |
| DNScrypt | A protocol that authenticates communications between a DNS client and a DNS resolver. It prevents DNS spoofing. It uses cryptographic signatures to verify that responses originate from the chosen DNS resolver and haven't been tampered with. |