PGP Universal Server 3.1 User guide

PGP Universal™ Server

Administrator's Guide

Version Information

PGP Universal Server Administrator's Guide. PGP Universal Server Version 3.1.0. Released September 2010.

Copyright Information

means, electronic or mechanical, for any purpose, without the express written permission of PGP Corporation.

Trademark Information

PGP, Pretty Good Privacy, and the PGP logo are registered trademarks of PGP Corporation in the US and other countries. IDEA is a trademark of

Ascom Tech AG. Windows and ActiveX are registered trademarks of Microsoft Corporation. AOL is a registered trademark, and AOL Instant

Messenger is a trademark, of America Online, Inc. Red Hat and Red Hat Linux are trademarks or registered trademarks of Red Hat, Inc. Linux is a

registered trademark of Linus Torvalds. Solaris is a trademark or registered trademark of Sun Microsystems, Inc. AIX is a trademark or registered

trademark of International Business Machines Corporation. HP-UX is a trademark or registered trademark of Hewlett-Packard Company. SSH and

Secure Shell are trademarks of SSH Communications Security, Inc. Rendezvous and Mac OS X are trademarks or registered trademarks of Apple

Computer, Inc. All other registered and unregistered trademarks in this document are the sole property of their respective owners.

Licensing and Patent Information

The IDEA cryptographic cipher described in U.S. patent number 5,214,703 is licensed from Ascom Tech AG. The CAST-128 encryption algorithm,

implemented from RFC 2144, is available worldwide on a royalty-free basis for commercial and non-commercial uses. PGP Corporation has secured a

license to the patent rights contained in the patent application Serial Number 10/655,563 by The Regents of the University of California, entitled Block

Cipher Mode of Operation for Constructing a Wide-blocksize block Cipher from a Conventional Block Cipher. Some third-party software included in PGP

Universal Server is licensed under the GNU General Public License (GPL). PGP Universal Server as a whole is not licensed under the GPL. If you would

like a copy of the source code for the GPL software included in PGP Universal Server, contact PGP Support (

https://support.pgp.com). PGP Corporation

may have patents and/or pending patent applications covering subject matter in this software or its documentation; the furnishing of this software or

documentation does not give you any license to these patents.

Acknowledgments

This product includes or may include:

-- The Zip and ZLib compression code, created by Mark Adler and Jean-Loup Gailly, is used with permission from the free Info-ZIP implementation,

developed by zlib (

http://www.zlib.net). -- Libxml2, the XML C parser and toolkit developed for the Gnome project and distributed and copyrighted

under the MIT License found at

http://jakarta.apache.org/), web

server (

http://www.apache.org/), Jakarta Commons (http://jakarta.apache.org/commons/license.html) and log4j, a Java-based library used to parse

HTML, developed by the Apache Software Foundation. The license is at

www.apache.org/licenses/LICENSE-2.0.txt. -- Castor, an open-source, data-

binding framework for moving data from XML to Java programming language objects and from Java to databases, is released by the ExoLab Group

under an Apache 2.0-style license, available at

http://www.castor.org/license.html. -- Xalan, an open-source software library from the Apache Software

Foundation that implements the XSLT XML transformation language and the XPath XML query language, is released under the Apache Software

License, version 1.1, available at

http://xml.apache.org/xalan-j/#license1.1. -- Apache Axis is an implementation of the SOAP ("Simple Object Access

Protocol") used for communications between various PGP products is provided under the Apache license found at

http://www.apache.org/licenses/LICENSE-2.0.txt. -- mx4j, an open-source implementation of the Java Management Extensions (JMX), is released

under an Apache-style license, available at

http://mx4j.sourceforge.net/docs/ch01s06.html. -- jpeglib version 6a is based in part on the work of the

Independent JPEG Group. (

http://www.ijg.org/) -- libxslt the XSLT C library developed for the GNOME project and used for XML transformations is

distributed under the MIT License

http://www.opensource.org/licenses/mit-license.html. -- PCRE Perl regular expression compiler, copyrighted and

http://www.pcre.org/license.txt. -- BIND Balanced Binary Tree Library

and Domain Name System (DNS) protocols developed and copyrighted by Internet Systems Consortium, Inc. (

http://www.isc.org) -- Free BSD

http://net-snmp.sourceforge.net/about/license.html. -- NTP version 4.2 developed

by Network Time Protocol and copyrighted to various contributors. -- Lightweight Directory Access Protocol developed and copyrighted by OpenLDAP

OpenLDAP Foundation. The license agreement is at

http://www.openldap.org/software/release/license.html. Secure shell OpenSSH developed by

OpenBSD project is released by the OpenBSD Project under a BSD-style license, available at

http://www.openbsd.org/cgi-

bin/cvsweb/src/usr.bin/ssh/LICENCE?rev=HEAD. -- PC/SC Lite is a free implementation of PC/SC, a specification for SmartCard integration is released

under the BSD license. -- Postfix, an open source mail transfer agent (MTA), is released under the IBM Public License 1.0, available at

http://www.opensource.org/licenses/ibmpl.php. -- PostgreSQL, a free software object-relational database management system, is released under a

BSD-style license, available at

http://www.postgresql.org/about/licence. -- PostgreSQL JDBC driver, a free Java program used to connect to a

BSD-style license, available at

http://jdbc.postgresql.org/license.html. -- PostgreSQL Regular Expression Library, a free software object-relational

database management system, is released under a BSD-style license, available at

http://www.postgresql.org/about/licence. -- 21.vixie-cron is the Vixie

- JacORB, a Java object used to facilitate communication between processes written in Java and the data layer, is open source licensed under the

GNU Library General Public License (LGPL) available at

is an open-source implementation of a CORBA Object Request Broker (ORB), and is used for communication between processes written in C/C++ and

Vanderbilt University. The open source software license is available at

http://www.cs.wustl.edu/~schmidt/ACE-copying.html. -- libcURL, a library for

downloading files via common network services, is open source software provided under a MIT/X derivate license available at

under a BSD-style license, available at

libpopt, a library that parses command line options, is released under the terms of the GNU Free Documentation License available at

to communicate with the Intel Corporation AMT chipset on a motherboard, is distributed under the gSOAP Public License version 1.3b, available at

http://www.cs.fsu.edu/~engelen/license.html. -- Windows Template Library (WTL) is used for developing user interface components and is distributed

under the Common Public License v1.0 found at

http://opensource.org/licenses/cpl1.0.php. -- The Perl Kit provides several independent utilities used to

automate a variety of maintenance functions and is provided under the Perl Artistic License, found at

http://www.perl.com/pub/a/language/misc/Artistic.html. -- rEFIt - libeg, provides a graphical interface library for EFI, including image rendering, text

rendering, and alpha blending, and is distributed under the license found at

reserved. -- Java Radius Client, used to authenticate PGP Universal Web Messenger users via Radius, is distributed under the Lesser General Public

License (LGPL) found at

http://www.gnu.org/licenses/lgpl.html. -- Yahoo! User Interface (YUI) library version 2.5.2, a Web UI interface library for AJAX.

http://developer.yahoo.com/yui/license.html. --

JSON-lib version 2.2.1, a Java library used to convert Java objects to JSON (JavaScript Object Notation) objects for AJAX. Distributed under the

Apache 2.0 license, available at

http://json-lib.sourceforge.net/license.html. -- EZMorph, used by JSON-lib, is distributed under the Apache 2.0 license,

available at

http://ezmorph.sourceforge.net/license.html. -- Apache Commons Lang, used by JSON-lib, is distributed under the Apache 2.0 license,

available at

http://commons.apache.org/license.html. -- Apache Commons BeanUtils, used by JSON-lib, is distributed under the Apache 2.0 license,

available at

http://commons.apache.org/license.html. -- SimpleIni is an .ini format file parser and provides the ability to read and write .ini files, a

common configuration file format used on Windows, on other platforms. Distributed under the MIT License found at

Standard Template Library functions and data structures and is distributed under the MIT License found at

http://www.opensource.org/licenses/mit-

format, are used to serialize structure data in the PGP SDK. Distributed under the BSD license found at

http://www.opensource.org/licenses/bsd-

Additional acknowledgements and legal notices are included as part of the PGP Universal Server.

Export Information

Export of this software and documentation may be subject to compliance with the rules and regulations promulgated from time to time by the Bureau

of Export Administration, United States Department of Commerce, which restricts the export and re-export of certain products and technical data.

Limitations

The software provided with this documentation is licensed to you for your individual use under the terms of the End User License Agreement provided

with the software. The information in this document is subject to change without notice. PGP Corporation does not warrant that the information meets

your requirements or that the information is free of errors. The information may include technical inaccuracies or typographical errors. Changes may be

made to the information and incorporated in new editions of this document, if and when made available by PGP Corporation.

Unsupported Third Party Products

By utilizing third party products, software, drivers, or other components ("Unsupported Third Party Product") to interact with the PGP software and/or by

utilizing any associated PGP command or code provided by to you by PGP at its sole discretion to interact with the Unsupported Third Party Product

("PGP Third Party Commands"), you acknowledge that the PGP software has not been designed for or formally tested with the Unsupported Third Party

Product, and therefore PGP provides no support or warranties with respect to the PGP Third Party Commands or the PGP software's compatibility with

Unsupported Third Party Products. THE PGP THIRD PARTY COMMANDS ARE PROVIDED "AS IS," WITH ALL FAULTS, AND THE ENTIRE RISK AS TO

SATISFACTORY QUALITY, PERFORMANCE, ACCURACY, AND EFFORT IS WITH YOU. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE

LAW, PGP DISCLAIMS ALL REPRESENTATIONS, WARRANTIES, AND CONDITIONS, WHETHER EXPRESS OR IMPLIED, INCLUDING ANY

WARRANTIES OR CONDITIONS OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NONINFRINGEMENT, QUIET

ENJOYMENT, AND ACCURACY WITH RESPECT TO THE PGP THIRD PARTY COMMANDS OR THE PGP SOFTWARE'S COMPATIBILITY WITH THE

UNSUPPORTED THIRD PARTY PRODUCT.

4

15

Contents

Introduction

What is PGP Universal Server? 15

PGP Universal Server Product Family 16

Who Should Read This Guide 16

Common Criteria Environments 16

Improvements in this Version of PGP Universal Server 17

Using the PGP Universal Server with the Command Line 17

Symbols 18

Getting Assistance 18

Getting product information 18

Contact Information 19

The Big Picture 21

Important Terms 21

PGP Products 21

PGP Universal Server Concepts 23

PGP Universal Server Features 23

PGP Universal Server User Types 25

Installation Overview 26

Open Ports 33

TCP Ports 33

UDP Ports 35

Naming your PGP Universal Server

37

Considering a Name for Your PGP Universal Server 37

Methods for Naming a PGP Universal Server 38

Understanding the Administrative Interface

39

System Requirements 39

Logging In 39

The System Overview Page 41

Managing Alerts 42

Logging In For the First Time 43

Administrative Interface Map 43

Icons 44

i

PGP Universal™ Server Contents

Licensing Your Software 51

Overview 51

Licensing a PGP Universal Server 51

License Authorization 51

Licensing the Mail Proxy Feature 52

Licensing PGP Desktop 52

Operating in Learn Mode 53

Purpose of Learn Mode 53

Checking the Logs 54

Managing Learn Mode 54

Managed Domains 57

About Managed Domains 57

Adding Managed Domains 58

Deleting Managed Domains 58

Understanding Keys 61

Choosing a Key Mode For Key Management 61

Changing Key Modes 63

How PGP Universal Server Uses Certificate Revocation Lists 65

Key Reconstruction Blocks 65

Managed Key Permissions 66

Managing Organization Keys 67

About Organization Keys 67

Organization Key 67

Inspecting the Organization Key 68

Regenerating the Organization Key 68

Importing an Organization Key 69

Organization Certificate 70

Inspecting the Organization Certificate 71

Exporting the Organization Certificate 71

Deleting the Organization Certificate 72

Generating the Organization Certificate 72

Importing the Organization Certificate 73

Additional Decryption Key (ADK) 73

Importing the ADK 74

Inspecting the ADK 74

Deleting the ADK 74

Verified Directory Key 75

Importing the Verified Directory Key 75

Inspecting the Verified Directory Key 75

ii

PGP Universal™ Server Contents

Deleting the Verified Directory Key 76

Administering Managed Keys

77

Viewing Managed Keys 78

Managed Key Information 79

Email Addresses 81

Subkeys 81

Certificates 81

Permissions 82

Attributes 83

Symmetric Key Series 83

Symmetric Keys 85

Custom Data Objects 86

Exporting Consumer Keys 88

Exporting the Managed Key of an Internal User 88

Exporting the Managed Key of an External User 89

Exporting PGP Verified Directory User Keys 89

Exporting the Managed Key of a Managed Device 90

Deleting Consumer Keys 90

Deleting the Managed Key of an Internal User 90

Deleting the Managed Key of an External User 91

Deleting the Key of a PGP Verified Directory User 91

Deleting the Managed Key of a Managed Device 92

Approving Pending Keys 92

Revoking Managed Keys 93

Managing Trusted Keys and Certificates 95

Overview 95

Trusted Keys 95

Trusted Certificates 95

Adding a Trusted Key or Certificate 96

Inspecting and Changing Trusted Key Properties 97

Deleting Trusted Keys and Certificates 97

Searching for Trusted Keys and Certificates 98

Setting Mail Policy

99

Overview 99

How Policy Chains Work 100

Mail Policy and Dictionaries 101

Mail Policy and Key Searches 101

Mail Policy and Cached Keys 102

Migrating Settings from Version 2.0.x 102

Restoring Mail Policy Rules 103

Understanding the Pre-Installed Policy Chains 109

Mail Policy Outside the Mailflow 111

Using the Rule Interface 112

iii

PGP Universal™ Server Contents

The Conditions Card 112

The Actions Card 114

Building Valid Chains and Rules 115

Using Valid Processing Order 115

Creating Valid Groups 116

Creating a Valid Rule 117

Managing Policy Chains 118

Mail Policy Best Practices 118

Restoring Mail Policy to Default Settings 118

Editing Policy Chain Settings 119

Adding Policy Chains 119

Deleting Policy Chains 120

Exporting Policy Chains 121

Printing Policy Chains 121

Managing Rules 122

Adding Rules to Policy Chains 122

Deleting Rules from Policy Chains 122

Enabling and Disabling Rules 123

Changing the Processing Order of the Rules 123

Adding Key Searches 123

Choosing Condition Statements, Conditions, and Actions 124

Condition Statements 124

Conditions 125

Actions 132

Working with Common Access Cards 145

Applying Key Not Found Settings to External Users 147

Overview 147

Bounce the Message 148

PDF Messenger 148

Certified Delivery with PDF Messenger 149

Send Unencrypted 149

Smart Trailer 150

PGP Universal Web Messenger 151

Changing Policy Settings 152

Changing User Delivery Method Preference 153

Using Dictionaries with Policy 155

Overview 155

Default Dictionaries 156

Editing Default Dictionaries 158

User-Defined Dictionaries 159

Adding a User-Defined Dictionary 159

Editing a User-Defined Dictionary 160

Deleting a Dictionary 160

Exporting a Dictionary 161

Searching the Dictionaries 161

iv

PGP Universal™ Server Contents

Keyservers, SMTP Archive Servers, and Mail Policy 163

Overview 163

Keyservers 163

Adding or Editing a Keyserver 164

Deleting a Keyserver 166

SMTP Servers 166

Adding or Editing an Archive Server 167

Deleting an Archive Server 167

Managing Keys in the Key Cache

169

Overview 169

Changing Cached Key Timeout 169

Purging Keys from the Cache 170

Trusting Cached Keys 170

Viewing Cached Keys 170

Searching the Key Cache 171

Configuring Mail Proxies 173

Overview 173

PGP Universal Server and Mail Proxies 173

Mail Proxies in an Internal Placement 174

Mail Proxies in a Gateway Placement 175

Changes in Proxy Settings from PGP Universal Server 2.0 to 2.5 and later 177

Mail Proxies Page 177

Creating New or Editing Existing Proxies 178

Creating or Editing a POP/IMAP Proxy 178

Creating or Editing an Outbound SMTP Proxy 180

Creating or Editing an Inbound SMTP Proxy 182

Creating or Editing a Unified SMTP Proxy 184

Email in the Mail Queue

189

Overview 189

Deleting Messages from the Mail Queue 190

Specifying Mail Routes 191

Overview 191

Managing Mail Routes 192

Adding a Mail Route 192

Editing a Mail Route 193

Deleting a Mail Route 193

v

PGP Universal™ Server Contents

Customizing System Message Templates 195

Overview 195

Templates and Message Size 196

PDF Messenger Templates 196

Templates for New PGP Universal Web Messenger Users 196

Editing a Message Template 197

Managing Groups 199

Understanding Groups 199

Sorting Consumers into Groups 199

Everyone Group 200

Excluded Group 200

Policy Group Order 201

Migrating Groups from Version 2.x 201

Setting Policy Group Order 201

Creating a New Group 202

Deleting a Group 202

Viewing Group Members 202

Manually Adding Group Members 203

Manually Removing Members from a Group 203

Group Permissions 204

Adding Group Permissions 205

Deleting Group Permissions 205

Setting Group Membership 206

Searching Groups 207

Creating Group Client Installations 208

How Group Policy is Assigned to PGP Desktop Installers 208

When to Bind a Client Installation 209

Creating PGP Desktop Installers 210

Managing Devices

215

Managed Devices 216

Adding and Deleting Managed Devices 216

Adding Managed Devices to Groups 217

Managed Device Information 218

Deleting Devices from PGP Universal Server 222

Deleting Managed Devices from Groups 223

WDE Devices (Computers and Disks) 224

WDE Computers 224

WDE Disks 226

Searching for Devices 227

Administering Consumer Policy 231

Understanding Consumer Policy 231

vi

PGP Universal™ Server Contents

Managing Consumer Policies 231

Adding a Consumer Policy 232

Editing a Consumer Policy 232

Deleting a Consumer Policy 233

Making Sure Users Create Strong Passphrases 234

Understanding Entropy 234

Using the Windows Preinstallation Environment 235

X.509 Certificate Management in Lotus Notes Environments 235

Trusting Certificates Created by PGP Universal Server 236

Setting the Lotus Notes Key Settings in PGP Universal Server 238

Technical Deployment Information 239

Offline Policy 239

Using a Policy ADK 241

Out of Mail Stream Support 241

Enrolling Users through Silent Enrollment 243

Silent Enrollment with Windows 243

Silent Enrollment with Mac OS X 243

PGP Whole Disk Encryption Administration 243

PGP Whole Disk Encryption on Mac OS X with FileVault 244

How Does Single Sign-On Work? 244

Enabling Single Sign-On 245

Managing Clients Remotely Using a PGP WDE Administrator Active Directory Group 246

Managing Clients Locally Using the PGP WDE Administrator Key 247

Setting Policy for Clients 249

Client and PGP Universal Server Version Compatibility 249

Serving PGP Admin 8 Preferences 250

Establishing PGP Desktop Settings for Your PGP Desktop Clients 251

PGP Desktop Feature License Settings 252

Enabling PGP Desktop Client Features in Consumer Policies 253

Controlling PGP Desktop Components 253

PGP Portable 255

PGP Mobile 255

PGP NetShare 256

How the PGP NetShare Policy Settings Work Together 256

Multi-user environments and managing PGP NetShare 256

Backing Up PGP NetShare-Protected Files 257

Using Directory Synchronization to Manage Consumers 259

How PGP Universal Server Uses Directory Synchronization 259

Base DN and Bind DN 261

Consumer Matching Rules 262

Understanding User Enrollment Methods 262

Before Creating a Client Installer 263

Email Enrollment 264

Directory Enrollment 266

Enabling Directory Synchronization 268

Adding or Editing an LDAP Directory 268

vii

PGP Universal™ Server Contents

The LDAP Servers Tab 270

The Base Distinguished Name Tab 270

The Consumer Matching Rules Tab 271

Testing the LDAP Connection 271

Using Sample Records to Configure LDAP Settings 271

Deleting an LDAP Directory 272

Setting LDAP Directory Order 272

Directory Synchronization Settings 272

Managing User Accounts 275

Understanding User Account Types 275

Viewing User Accounts 275

User Management Tasks 275

Setting User Authentication 276

Editing User Attributes 276

Adding Users to Groups 276

Editing User Permissions 277

Deleting Users 277

Searching for Users 278

Viewing User Log Entries 278

Changing Display Names and Usernames 279

Exporting a User’s X.509 Certificate 279

Revoking a User's X.509 Certificate 280

Managing User Keys 280

Managing Internal User Accounts 281

Importing Internal User Keys Manually 281

Creating New Internal User Accounts 282

Exporting PGP Whole Disk Encryption Login Failure Data 283

Internal User Settings 283

Managing External User Accounts 288

Importing External Users 288

Exporting Delivery Receipts 289

External User Settings 290

Managing Verified Directory User Accounts 292

Importing Verified Directory Users 292

PGP Verified Directory User Settings 293

Recovering Encrypted Data in an Enterprise Environment 295

Using Key Reconstruction 295

Recovering Encryption Key Material without Key Reconstruction 296

Encryption Key Recovery of CKM Keys 296

Encryption Key Recovery of GKM Keys 296

Encryption Key Recovery of SCKM Keys 297

Encryption Key Recovery of SKM Keys 298

Using an Additional Decryption Key for Data Recovery 298

viii

PGP Universal™ Server Contents

PGP Universal Satellite 301

Overview 301

Technical Information 302

Distributing the PGP Universal Satellite Software 302

Configuration 302

Key Mode 302

PGP Universal Satellite Configurations 303

Switching Key Modes 306

Policy and Key or Certificate Retrieval 306

Retrieving Lost Policies 306

Retrieving Lost Keys or Certificates 307

PGP Universal Satellite for Mac OS X 311

Overview 311

System Requirements 311

Obtaining the Installer 312

Installation 312

Updates 313

Files 313

PGP Universal Satellite for Windows 315

Overview 315

System Requirements 315

Obtaining the Installer 316

Installation 316

Updates 317

Files 317

MAPI Support 317

External MAPI Configuration 318

Lotus Notes Support 318

External Lotus Notes Configuration 319

Configuring PGP Universal Web Messenger

321

Overview 321

PGP Universal Web Messenger and Clustering 322

External Authentication 323

Customizing PGP Universal Web Messenger 324

Adding a New Template 325

Troubleshooting Customization 329

Changing the Active Template 332

Deleting a Template 332

Editing a Template 332

Downloading Template Files 333

Restoring to Factory Defaults 333

ix

PGP Universal™ Server Contents

Configuring the PGP Universal Web Messenger Service 333

Starting and Stopping PGP Universal Web Messenger 334

Selecting the PGP Universal Web Messenger Network Interface 334

Setting Up External Authentication 336

Creating Settings for PGP Universal Web Messenger User Accounts 337

Setting Message Replication in a Cluster 338

Configuring the Integrated Keyserver

341

Overview 341

Starting and Stopping the Keyserver Service 341

Configuring the Keyserver Service 341

Configuring the PGP Verified Directory

345

Overview 345

Starting and Stopping the PGP Verified Directory 346

Configuring the PGP Verified Directory 346

Managing the Certificate Revocation List Service 349

Overview 349

Starting and Stopping the CRL Service 349

Editing CRL Service Settings 350

Configuring Universal Services Protocol 351

Starting and Stopping USP 351

Adding USP Interfaces 351

Managing PGP Remote Disable & Destroy for Encrypted Disks 353

Deploying PGP RDD 353

Network and Clustering Considerations 354

Hardware and System Requirements 354

Licensing PGP Remote Disable & Destroy with Intel Anti-Theft Technology 355

Setting PGP RDD in Consumer Policies 356

Setting Up the PGP RDD Service 357

Managing PGP RDD Policy 358

Starting and Stopping the PGP RDD Service 359

PGP RDD Administrator Tasks 360

Viewing Anti-Theft Information 361

Managing Intel Anti-Theft Status 362

AT Activated 363

Decommissioned 363

AT Deactivated 363

Stolen 364

Changing a Computer's Status 364

Recovering Locked Systems 365

x

PGP Universal™ Server Contents

Reporting and Logging 367

System Graphs

369

Overview 369

CPU Usage 369

Message Activity 369

Whole Disk Encryption 370

System Logs 373

Overview 373

Filtering the Log View 374

Searching the Log Files 375

Exporting a Log File 375

Enabling External Logging 376

Configuring SNMP Monitoring 377

Overview 377

Starting and Stopping SNMP Monitoring 378

Configuring the SNMP Service 378

Downloading the Custom MIB File 379

Viewing Server and License Settings and Shutting Down Services 381

Overview 381

Server Information 381

Setting the Time 382

Licensing a PGP Universal Server 382

Downloading the Release Notes 383

Shutting Down and Restarting the PGP Universal Server Software Services 383

Shutting Down and Restarting the PGP Universal Server Hardware 384

Managing Administrator Accounts

385

Overview 385

Administrator Roles 386

Administrator Authentication 386

Creating a New Administrator 387

Importing SSH v2 Keys 388

Deleting Administrators 388

Inspecting and Changing the Settings of an Administrator 389

Configuring RSA SecurID Authentication 390

Resetting SecurID PINs 391

Daily Status Email 392

xi

PGP Universal™ Server Contents

Protecting PGP Universal Server with Ignition Keys 395

Overview 395

Ignition Keys and Clustering 396

Preparing Hardware Tokens to be Ignition Keys 397

Configuring a Hardware Token Ignition Key 398

Configuring a Soft-Ignition Passphrase Ignition Key 399

Deleting Ignition Keys 399

Backing Up and Restoring System and User Data 401

Overview 401

Creating Backups 402

Scheduling Backups 402

Performing On-Demand Backups 402

Configuring the Backup Location 402

Restoring From a Backup 404

Restoring On-Demand 404

Restoring Configuration 404

Restoring from a Different Version 406

Updating PGP Universal Server Software 407

Overview 407

Inspecting Update Packages 408

Setting Network Interfaces 409

Understanding the Network Settings 409

Changing Interface Settings 410

Adding Interface Settings 410

Deleting Interface Settings 410

Editing Global Network Settings 411

Assigning a Certificate 411

Working with Certificates 412

Importing an Existing Certificate 412

Generating a Certificate Request 413

Adding a Pending Certificate 414

Inspecting a Certificate 414

Exporting a Certificate 415

Deleting a Certificate 415

Clustering your PGP Universal Servers

417

Overview 417

Cluster Status 418

Creating a Cluster 419

Deleting Cluster Members 422

xii

PGP Universal™ Server Contents

Clustering and PGP Universal Web Messenger 422

Managing Settings for Cluster Members 423

Changing Network Settings in Clusters 424

Index

427

xiii

1

Introduction

This Administrator’s Guide describes both the PGP Universal

™

Server and Client

software. It tells you how to get them up and running on your network, how to

configure them, and how to maintain them. This section provides a high-level

overview of PGP Universal Server.

What is PGP Universal Server?

PGP Universal Server is a single console for managing the applications that

provide email, disk, and network file encryption.

PGP Universal Server with PGP Universal Gateway Email gives you secure

messaging: it transparently protects your enterprise messages with little or no

user interaction.

The PGP Universal Server also replaces the PGP Keyserver product with a built-

in keyserver, and the PGP Admin product with PGP Desktop configuration and

deployment capabilities.

PGP Universal Server automatically creates and maintains a Self-Managing

Security Architecture (SMSA) by monitoring authenticated users and their email

traffic. You can also send protected messages to addresses that are not part of

the SMSA. The PGP Universal Server encrypts, decrypts, signs, and verifies

messages automatically, providing strong security through policies you control.

PGP Universal Satellite, a client-side feature of PGP Universal Server, extends

PGP security for email messages all the way to the computer of the email user,

it allows external users to become part of the SMSA, and it gives end users the

option to create and manage their keys on their own computer (if allowed by

the PGP administrator).

PGP Desktop, a client product, is created and managed through PGP Universal

Server policy. It creates PGP keypairs and can manage user keypairs as well as

store the public keys of others. It encrypts user email and instant messaging

(IM). It can encrypt entire or partial hard drives. It also enables secure file

sharing with others over a network.

15

PGP Universal™ Server Introduction

PGP Universal Server Product Family

PGP Universal Server functions as a management console for a variety of

encryption solutions. You can purchase any of the PGP Desktop applications or

bundles and use PGP Universal Server to create and manage client installations.

You can also purchase a license that enables PGP Gateway Email to encrypt

email in the mailstream.

The PGP Universal Server can manage any combination of PGP encryption

applications. PGP encryption applications are:

 PGP Universal Gateway Email provides automatic email encryption in the

gateway, based on centralized mail policy. This product requires

administration by the PGP Universal Server.

 PGP Desktop Email provides encryption at the desktop for mail, files, and

AOL Instant Messenger traffic. This product can be managed by the PGP

Universal Server.

 PGP Whole Disk Encryption provides encryption at the desktop for an

entire disk. This product can be managed by the PGP Universal Server.

 PGP NetShare provides transparent file encryption and sharing among

desktops. This product can be managed by the PGP Universal Server.

Who Should Read This Guide

This Administrator’s Guide is for the person or persons who implement and

maintain your organization’s PGP Universal Server environment. These are the

PGP Universal Server administrators.

This guide is also intended for anyone else who wants to learn about how PGP

Universal Server works.

Common Criteria Environments

To be Common Criteria compliant, please refer to the best practices shown in

PGP Universal Server 2.9 Common Criteria Supplemental. Note that these best

practices supersede recommendations made elsewhere in this and other

documentation.

16

Page is loading ...

PGP Universal Server 3.1 User guide

PGP Universal Server 3.1 User guide

Related papers

Other documents