PGP Universal Server 3.1 User guide

Category
Software
Type
User guide
PGP Universalâ„¢ Server
Administrator's Guide
Version Information
PGP Universal Server Administrator's Guide. PGP Universal Server Version 3.1.0. Released September 2010.
Copyright Information
Copyright © 1991-2010 by PGP Corporation. All Rights Reserved. No part of this document can be reproduced or transmitted in any form or by any
means, electronic or mechanical, for any purpose, without the express written permission of PGP Corporation.
Trademark Information
PGP, Pretty Good Privacy, and the PGP logo are registered trademarks of PGP Corporation in the US and other countries. IDEA is a trademark of
Ascom Tech AG. Windows and ActiveX are registered trademarks of Microsoft Corporation. AOL is a registered trademark, and AOL Instant
Messenger is a trademark, of America Online, Inc. Red Hat and Red Hat Linux are trademarks or registered trademarks of Red Hat, Inc. Linux is a
registered trademark of Linus Torvalds. Solaris is a trademark or registered trademark of Sun Microsystems, Inc. AIX is a trademark or registered
trademark of International Business Machines Corporation. HP-UX is a trademark or registered trademark of Hewlett-Packard Company. SSH and
Secure Shell are trademarks of SSH Communications Security, Inc. Rendezvous and Mac OS X are trademarks or registered trademarks of Apple
Computer, Inc. All other registered and unregistered trademarks in this document are the sole property of their respective owners.
Licensing and Patent Information
The IDEA cryptographic cipher described in U.S. patent number 5,214,703 is licensed from Ascom Tech AG. The CAST-128 encryption algorithm,
implemented from RFC 2144, is available worldwide on a royalty-free basis for commercial and non-commercial uses. PGP Corporation has secured a
license to the patent rights contained in the patent application Serial Number 10/655,563 by The Regents of the University of California, entitled Block
Cipher Mode of Operation for Constructing a Wide-blocksize block Cipher from a Conventional Block Cipher. Some third-party software included in PGP
Universal Server is licensed under the GNU General Public License (GPL). PGP Universal Server as a whole is not licensed under the GPL. If you would
like a copy of the source code for the GPL software included in PGP Universal Server, contact PGP Support (
https://support.pgp.com). PGP Corporation
may have patents and/or pending patent applications covering subject matter in this software or its documentation; the furnishing of this software or
documentation does not give you any license to these patents.
Acknowledgments
This product includes or may include:
-- The Zip and ZLib compression code, created by Mark Adler and Jean-Loup Gailly, is used with permission from the free Info-ZIP implementation,
developed by zlib (
http://www.zlib.net). -- Libxml2, the XML C parser and toolkit developed for the Gnome project and distributed and copyrighted
under the MIT License found at
http://www.opensource.org/licenses/mit-license.html. Copyright © 2007 by the Open Source Initiative. -- bzip2 1.0, a
freely available high-quality data compressor, is copyrighted by Julian Seward, © 1996-2005. -- Application server (
http://jakarta.apache.org/), web
server (
http://www.apache.org/), Jakarta Commons (http://jakarta.apache.org/commons/license.html) and log4j, a Java-based library used to parse
HTML, developed by the Apache Software Foundation. The license is at
www.apache.org/licenses/LICENSE-2.0.txt. -- Castor, an open-source, data-
binding framework for moving data from XML to Java programming language objects and from Java to databases, is released by the ExoLab Group
under an Apache 2.0-style license, available at
http://www.castor.org/license.html. -- Xalan, an open-source software library from the Apache Software
Foundation that implements the XSLT XML transformation language and the XPath XML query language, is released under the Apache Software
License, version 1.1, available at
http://xml.apache.org/xalan-j/#license1.1. -- Apache Axis is an implementation of the SOAP ("Simple Object Access
Protocol") used for communications between various PGP products is provided under the Apache license found at
http://www.apache.org/licenses/LICENSE-2.0.txt. -- mx4j, an open-source implementation of the Java Management Extensions (JMX), is released
under an Apache-style license, available at
http://mx4j.sourceforge.net/docs/ch01s06.html. -- jpeglib version 6a is based in part on the work of the
Independent JPEG Group. (
http://www.ijg.org/) -- libxslt the XSLT C library developed for the GNOME project and used for XML transformations is
distributed under the MIT License
http://www.opensource.org/licenses/mit-license.html. -- PCRE Perl regular expression compiler, copyrighted and
distributed by University of Cambridge. ©1997-2006. The license agreement is at
http://www.pcre.org/license.txt. -- BIND Balanced Binary Tree Library
and Domain Name System (DNS) protocols developed and copyrighted by Internet Systems Consortium, Inc. (
http://www.isc.org) -- Free BSD
implementation of daemon developed by The FreeBSD Project, © 1994-2006. -- Simple Network Management Protocol Library developed and
copyrighted by Carnegie Mellon University © 1989, 1991, 1992, Networks Associates Technology, Inc, © 2001- 2003, Cambridge Broadband Ltd. ©
2001- 2003, Sun Microsystems, Inc., © 2003, Sparta, Inc, © 2003-2006, Cisco, Inc and Information Network Center of Beijing University of Posts and
Telecommunications, © 2004. The license agreement for these is at
http://net-snmp.sourceforge.net/about/license.html. -- NTP version 4.2 developed
by Network Time Protocol and copyrighted to various contributors. -- Lightweight Directory Access Protocol developed and copyrighted by OpenLDAP
Foundation. OpenLDAP is an open-source implementation of the Lightweight Directory Access Protocol (LDAP). Copyright © 1999-2003, The
OpenLDAP Foundation. The license agreement is at
http://www.openldap.org/software/release/license.html. Secure shell OpenSSH developed by
OpenBSD project is released by the OpenBSD Project under a BSD-style license, available at
http://www.openbsd.org/cgi-
bin/cvsweb/src/usr.bin/ssh/LICENCE?rev=HEAD. -- PC/SC Lite is a free implementation of PC/SC, a specification for SmartCard integration is released
under the BSD license. -- Postfix, an open source mail transfer agent (MTA), is released under the IBM Public License 1.0, available at
http://www.opensource.org/licenses/ibmpl.php. -- PostgreSQL, a free software object-relational database management system, is released under a
BSD-style license, available at
http://www.postgresql.org/about/licence. -- PostgreSQL JDBC driver, a free Java program used to connect to a
PostgreSQL database using standard, database independent Java code, (c) 1997-2005, PostgreSQL Global Development Group, is released under a
BSD-style license, available at
http://jdbc.postgresql.org/license.html. -- PostgreSQL Regular Expression Library, a free software object-relational
database management system, is released under a BSD-style license, available at
http://www.postgresql.org/about/licence. -- 21.vixie-cron is the Vixie
version of cron, a standard UNIX daemon that runs specified programs at scheduled times. Copyright © 1993, 1994 by Paul Vixie; used by permission. -
- JacORB, a Java object used to facilitate communication between processes written in Java and the data layer, is open source licensed under the
GNU Library General Public License (LGPL) available at
http://www.jacorb.org/lgpl.html. Copyright © 2006 The JacORB Project. -- TAO (The ACE ORB)
is an open-source implementation of a CORBA Object Request Broker (ORB), and is used for communication between processes written in C/C++ and
the data layer. Copyright (c) 1993-2006 by Douglas C. Schmidt and his research group at Washington University, University of California, Irvine, and
Vanderbilt University. The open source software license is available at
http://www.cs.wustl.edu/~schmidt/ACE-copying.html. -- libcURL, a library for
downloading files via common network services, is open source software provided under a MIT/X derivate license available at
http://curl.haxx.se/docs/copyright.html. Copyright (c) 1996 - 2007, Daniel Stenberg. -- libuuid, a library used to generate unique identifiers, is released
under a BSD-style license, available at
http://thunk.org/hg/e2fsprogs/?file/fe55db3e508c/lib/uuid/COPYING. Copyright (C) 1996, 1997 Theodore Ts'o. --
libpopt, a library that parses command line options, is released under the terms of the GNU Free Documentation License available at
http://directory.fsf.org/libs/COPYING.DOC. Copyright © 2000-2003 Free Software Foundation, Inc. -- gSOAP, a development tool for Windows clients
to communicate with the Intel Corporation AMT chipset on a motherboard, is distributed under the gSOAP Public License version 1.3b, available at
http://www.cs.fsu.edu/~engelen/license.html. -- Windows Template Library (WTL) is used for developing user interface components and is distributed
under the Common Public License v1.0 found at
http://opensource.org/licenses/cpl1.0.php. -- The Perl Kit provides several independent utilities used to
automate a variety of maintenance functions and is provided under the Perl Artistic License, found at
http://www.perl.com/pub/a/language/misc/Artistic.html. -- rEFIt - libeg, provides a graphical interface library for EFI, including image rendering, text
rendering, and alpha blending, and is distributed under the license found at
http://refit.svn.sourceforge.net/viewvc/*checkout*/refit/trunk/refit/LICENSE.txt?revision=288. Copyright (c) 2006 Christoph Pfisterer. All rights
reserved. -- Java Radius Client, used to authenticate PGP Universal Web Messenger users via Radius, is distributed under the Lesser General Public
License (LGPL) found at
http://www.gnu.org/licenses/lgpl.html. -- Yahoo! User Interface (YUI) library version 2.5.2, a Web UI interface library for AJAX.
Copyright (c) 2009, Yahoo! Inc. All rights reserved. Released under a BSD-style license, available at
http://developer.yahoo.com/yui/license.html. --
JSON-lib version 2.2.1, a Java library used to convert Java objects to JSON (JavaScript Object Notation) objects for AJAX. Distributed under the
Apache 2.0 license, available at
http://json-lib.sourceforge.net/license.html. -- EZMorph, used by JSON-lib, is distributed under the Apache 2.0 license,
available at
http://ezmorph.sourceforge.net/license.html. -- Apache Commons Lang, used by JSON-lib, is distributed under the Apache 2.0 license,
available at
http://commons.apache.org/license.html. -- Apache Commons BeanUtils, used by JSON-lib, is distributed under the Apache 2.0 license,
available at
http://commons.apache.org/license.html. -- SimpleIni is an .ini format file parser and provides the ability to read and write .ini files, a
common configuration file format used on Windows, on other platforms. Distributed under the MIT License found at
http://www.opensource.org/licenses/mit-license.html. Copyright 2006-2008, Brodie Thiesfield. -- uSTL provides a small fast implementation of common
Standard Template Library functions and data structures and is distributed under the MIT License found at
http://www.opensource.org/licenses/mit-
license.html. Copyright (c) 2005-2009 by Mike Sharov <[email protected]ceforge.net>. -- Protocol Buffers (protobuf), Google's data interchange
format, are used to serialize structure data in the PGP SDK. Distributed under the BSD license found at
http://www.opensource.org/licenses/bsd-
license.php. Copyright 2008 Google Inc. All rights reserved.
Additional acknowledgements and legal notices are included as part of the PGP Universal Server.
Export Information
Export of this software and documentation may be subject to compliance with the rules and regulations promulgated from time to time by the Bureau
of Export Administration, United States Department of Commerce, which restricts the export and re-export of certain products and technical data.
Limitations
The software provided with this documentation is licensed to you for your individual use under the terms of the End User License Agreement provided
with the software. The information in this document is subject to change without notice. PGP Corporation does not warrant that the information meets
your requirements or that the information is free of errors. The information may include technical inaccuracies or typographical errors. Changes may be
made to the information and incorporated in new editions of this document, if and when made available by PGP Corporation.
Unsupported Third Party Products
By utilizing third party products, software, drivers, or other components ("Unsupported Third Party Product") to interact with the PGP software and/or by
utilizing any associated PGP command or code provided by to you by PGP at its sole discretion to interact with the Unsupported Third Party Product
("PGP Third Party Commands"), you acknowledge that the PGP software has not been designed for or formally tested with the Unsupported Third Party
Product, and therefore PGP provides no support or warranties with respect to the PGP Third Party Commands or the PGP software's compatibility with
Unsupported Third Party Products. THE PGP THIRD PARTY COMMANDS ARE PROVIDED "AS IS," WITH ALL FAULTS, AND THE ENTIRE RISK AS TO
SATISFACTORY QUALITY, PERFORMANCE, ACCURACY, AND EFFORT IS WITH YOU. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE
LAW, PGP DISCLAIMS ALL REPRESENTATIONS, WARRANTIES, AND CONDITIONS, WHETHER EXPRESS OR IMPLIED, INCLUDING ANY
WARRANTIES OR CONDITIONS OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NONINFRINGEMENT, QUIET
ENJOYMENT, AND ACCURACY WITH RESPECT TO THE PGP THIRD PARTY COMMANDS OR THE PGP SOFTWARE'S COMPATIBILITY WITH THE
UNSUPPORTED THIRD PARTY PRODUCT.
4
15
Contents
Introduction
What is PGP Universal Server? 15
PGP Universal Server Product Family 16
Who Should Read This Guide 16
Common Criteria Environments 16
Improvements in this Version of PGP Universal Server 17
Using the PGP Universal Server with the Command Line 17
Symbols 18
Getting Assistance 18
Getting product information 18
Contact Information 19
The Big Picture 21
Important Terms 21
PGP Products 21
PGP Universal Server Concepts 23
PGP Universal Server Features 23
PGP Universal Server User Types 25
Installation Overview 26
Open Ports 33
TCP Ports 33
UDP Ports 35
Naming your PGP Universal Server
37
Considering a Name for Your PGP Universal Server 37
Methods for Naming a PGP Universal Server 38
Understanding the Administrative Interface
39
System Requirements 39
Logging In 39
The System Overview Page 41
Managing Alerts 42
Logging In For the First Time 43
Administrative Interface Map 43
Icons 44
i
PGP Universalâ„¢ Server Contents
Licensing Your Software 51
Overview 51
Licensing a PGP Universal Server 51
License Authorization 51
Licensing the Mail Proxy Feature 52
Licensing PGP Desktop 52
Operating in Learn Mode 53
Purpose of Learn Mode 53
Checking the Logs 54
Managing Learn Mode 54
Managed Domains 57
About Managed Domains 57
Adding Managed Domains 58
Deleting Managed Domains 58
Understanding Keys 61
Choosing a Key Mode For Key Management 61
Changing Key Modes 63
How PGP Universal Server Uses Certificate Revocation Lists 65
Key Reconstruction Blocks 65
Managed Key Permissions 66
Managing Organization Keys 67
About Organization Keys 67
Organization Key 67
Inspecting the Organization Key 68
Regenerating the Organization Key 68
Importing an Organization Key 69
Organization Certificate 70
Inspecting the Organization Certificate 71
Exporting the Organization Certificate 71
Deleting the Organization Certificate 72
Generating the Organization Certificate 72
Importing the Organization Certificate 73
Additional Decryption Key (ADK) 73
Importing the ADK 74
Inspecting the ADK 74
Deleting the ADK 74
Verified Directory Key 75
Importing the Verified Directory Key 75
Inspecting the Verified Directory Key 75
ii
PGP Universalâ„¢ Server Contents
Deleting the Verified Directory Key 76
Administering Managed Keys
77
Viewing Managed Keys 78
Managed Key Information 79
Email Addresses 81
Subkeys 81
Certificates 81
Permissions 82
Attributes 83
Symmetric Key Series 83
Symmetric Keys 85
Custom Data Objects 86
Exporting Consumer Keys 88
Exporting the Managed Key of an Internal User 88
Exporting the Managed Key of an External User 89
Exporting PGP Verified Directory User Keys 89
Exporting the Managed Key of a Managed Device 90
Deleting Consumer Keys 90
Deleting the Managed Key of an Internal User 90
Deleting the Managed Key of an External User 91
Deleting the Key of a PGP Verified Directory User 91
Deleting the Managed Key of a Managed Device 92
Approving Pending Keys 92
Revoking Managed Keys 93
Managing Trusted Keys and Certificates 95
Overview 95
Trusted Keys 95
Trusted Certificates 95
Adding a Trusted Key or Certificate 96
Inspecting and Changing Trusted Key Properties 97
Deleting Trusted Keys and Certificates 97
Searching for Trusted Keys and Certificates 98
Setting Mail Policy
99
Overview 99
How Policy Chains Work 100
Mail Policy and Dictionaries 101
Mail Policy and Key Searches 101
Mail Policy and Cached Keys 102
Migrating Settings from Version 2.0.x 102
Restoring Mail Policy Rules 103
Understanding the Pre-Installed Policy Chains 109
Mail Policy Outside the Mailflow 111
Using the Rule Interface 112
iii
PGP Universalâ„¢ Server Contents
The Conditions Card 112
The Actions Card 114
Building Valid Chains and Rules 115
Using Valid Processing Order 115
Creating Valid Groups 116
Creating a Valid Rule 117
Managing Policy Chains 118
Mail Policy Best Practices 118
Restoring Mail Policy to Default Settings 118
Editing Policy Chain Settings 119
Adding Policy Chains 119
Deleting Policy Chains 120
Exporting Policy Chains 121
Printing Policy Chains 121
Managing Rules 122
Adding Rules to Policy Chains 122
Deleting Rules from Policy Chains 122
Enabling and Disabling Rules 123
Changing the Processing Order of the Rules 123
Adding Key Searches 123
Choosing Condition Statements, Conditions, and Actions 124
Condition Statements 124
Conditions 125
Actions 132
Working with Common Access Cards 145
Applying Key Not Found Settings to External Users 147
Overview 147
Bounce the Message 148
PDF Messenger 148
Certified Delivery with PDF Messenger 149
Send Unencrypted 149
Smart Trailer 150
PGP Universal Web Messenger 151
Changing Policy Settings 152
Changing User Delivery Method Preference 153
Using Dictionaries with Policy 155
Overview 155
Default Dictionaries 156
Editing Default Dictionaries 158
User-Defined Dictionaries 159
Adding a User-Defined Dictionary 159
Editing a User-Defined Dictionary 160
Deleting a Dictionary 160
Exporting a Dictionary 161
Searching the Dictionaries 161
iv
PGP Universalâ„¢ Server Contents
Keyservers, SMTP Archive Servers, and Mail Policy 163
Overview 163
Keyservers 163
Adding or Editing a Keyserver 164
Deleting a Keyserver 166
SMTP Servers 166
Adding or Editing an Archive Server 167
Deleting an Archive Server 167
Managing Keys in the Key Cache
169
Overview 169
Changing Cached Key Timeout 169
Purging Keys from the Cache 170
Trusting Cached Keys 170
Viewing Cached Keys 170
Searching the Key Cache 171
Configuring Mail Proxies 173
Overview 173
PGP Universal Server and Mail Proxies 173
Mail Proxies in an Internal Placement 174
Mail Proxies in a Gateway Placement 175
Changes in Proxy Settings from PGP Universal Server 2.0 to 2.5 and later 177
Mail Proxies Page 177
Creating New or Editing Existing Proxies 178
Creating or Editing a POP/IMAP Proxy 178
Creating or Editing an Outbound SMTP Proxy 180
Creating or Editing an Inbound SMTP Proxy 182
Creating or Editing a Unified SMTP Proxy 184
Email in the Mail Queue
189
Overview 189
Deleting Messages from the Mail Queue 190
Specifying Mail Routes 191
Overview 191
Managing Mail Routes 192
Adding a Mail Route 192
Editing a Mail Route 193
Deleting a Mail Route 193
v
PGP Universalâ„¢ Server Contents
Customizing System Message Templates 195
Overview 195
Templates and Message Size 196
PDF Messenger Templates 196
Templates for New PGP Universal Web Messenger Users 196
Editing a Message Template 197
Managing Groups 199
Understanding Groups 199
Sorting Consumers into Groups 199
Everyone Group 200
Excluded Group 200
Policy Group Order 201
Migrating Groups from Version 2.x 201
Setting Policy Group Order 201
Creating a New Group 202
Deleting a Group 202
Viewing Group Members 202
Manually Adding Group Members 203
Manually Removing Members from a Group 203
Group Permissions 204
Adding Group Permissions 205
Deleting Group Permissions 205
Setting Group Membership 206
Searching Groups 207
Creating Group Client Installations 208
How Group Policy is Assigned to PGP Desktop Installers 208
When to Bind a Client Installation 209
Creating PGP Desktop Installers 210
Managing Devices
215
Managed Devices 216
Adding and Deleting Managed Devices 216
Adding Managed Devices to Groups 217
Managed Device Information 218
Deleting Devices from PGP Universal Server 222
Deleting Managed Devices from Groups 223
WDE Devices (Computers and Disks) 224
WDE Computers 224
WDE Disks 226
Searching for Devices 227
Administering Consumer Policy 231
Understanding Consumer Policy 231
vi
PGP Universalâ„¢ Server Contents
Managing Consumer Policies 231
Adding a Consumer Policy 232
Editing a Consumer Policy 232
Deleting a Consumer Policy 233
Making Sure Users Create Strong Passphrases 234
Understanding Entropy 234
Using the Windows Preinstallation Environment 235
X.509 Certificate Management in Lotus Notes Environments 235
Trusting Certificates Created by PGP Universal Server 236
Setting the Lotus Notes Key Settings in PGP Universal Server 238
Technical Deployment Information 239
Offline Policy 239
Using a Policy ADK 241
Out of Mail Stream Support 241
Enrolling Users through Silent Enrollment 243
Silent Enrollment with Windows 243
Silent Enrollment with Mac OS X 243
PGP Whole Disk Encryption Administration 243
PGP Whole Disk Encryption on Mac OS X with FileVault 244
How Does Single Sign-On Work? 244
Enabling Single Sign-On 245
Managing Clients Remotely Using a PGP WDE Administrator Active Directory Group 246
Managing Clients Locally Using the PGP WDE Administrator Key 247
Setting Policy for Clients 249
Client and PGP Universal Server Version Compatibility 249
Serving PGP Admin 8 Preferences 250
Establishing PGP Desktop Settings for Your PGP Desktop Clients 251
PGP Desktop Feature License Settings 252
Enabling PGP Desktop Client Features in Consumer Policies 253
Controlling PGP Desktop Components 253
PGP Portable 255
PGP Mobile 255
PGP NetShare 256
How the PGP NetShare Policy Settings Work Together 256
Multi-user environments and managing PGP NetShare 256
Backing Up PGP NetShare-Protected Files 257
Using Directory Synchronization to Manage Consumers 259
How PGP Universal Server Uses Directory Synchronization 259
Base DN and Bind DN 261
Consumer Matching Rules 262
Understanding User Enrollment Methods 262
Before Creating a Client Installer 263
Email Enrollment 264
Directory Enrollment 266
Enabling Directory Synchronization 268
Adding or Editing an LDAP Directory 268
vii
PGP Universalâ„¢ Server Contents
The LDAP Servers Tab 270
The Base Distinguished Name Tab 270
The Consumer Matching Rules Tab 271
Testing the LDAP Connection 271
Using Sample Records to Configure LDAP Settings 271
Deleting an LDAP Directory 272
Setting LDAP Directory Order 272
Directory Synchronization Settings 272
Managing User Accounts 275
Understanding User Account Types 275
Viewing User Accounts 275
User Management Tasks 275
Setting User Authentication 276
Editing User Attributes 276
Adding Users to Groups 276
Editing User Permissions 277
Deleting Users 277
Searching for Users 278
Viewing User Log Entries 278
Changing Display Names and Usernames 279
Exporting a User’s X.509 Certificate 279
Revoking a User's X.509 Certificate 280
Managing User Keys 280
Managing Internal User Accounts 281
Importing Internal User Keys Manually 281
Creating New Internal User Accounts 282
Exporting PGP Whole Disk Encryption Login Failure Data 283
Internal User Settings 283
Managing External User Accounts 288
Importing External Users 288
Exporting Delivery Receipts 289
External User Settings 290
Managing Verified Directory User Accounts 292
Importing Verified Directory Users 292
PGP Verified Directory User Settings 293
Recovering Encrypted Data in an Enterprise Environment 295
Using Key Reconstruction 295
Recovering Encryption Key Material without Key Reconstruction 296
Encryption Key Recovery of CKM Keys 296
Encryption Key Recovery of GKM Keys 296
Encryption Key Recovery of SCKM Keys 297
Encryption Key Recovery of SKM Keys 298
Using an Additional Decryption Key for Data Recovery 298
viii
PGP Universalâ„¢ Server Contents
PGP Universal Satellite 301
Overview 301
Technical Information 302
Distributing the PGP Universal Satellite Software 302
Configuration 302
Key Mode 302
PGP Universal Satellite Configurations 303
Switching Key Modes 306
Policy and Key or Certificate Retrieval 306
Retrieving Lost Policies 306
Retrieving Lost Keys or Certificates 307
PGP Universal Satellite for Mac OS X 311
Overview 311
System Requirements 311
Obtaining the Installer 312
Installation 312
Updates 313
Files 313
PGP Universal Satellite for Windows 315
Overview 315
System Requirements 315
Obtaining the Installer 316
Installation 316
Updates 317
Files 317
MAPI Support 317
External MAPI Configuration 318
Lotus Notes Support 318
External Lotus Notes Configuration 319
Configuring PGP Universal Web Messenger
321
Overview 321
PGP Universal Web Messenger and Clustering 322
External Authentication 323
Customizing PGP Universal Web Messenger 324
Adding a New Template 325
Troubleshooting Customization 329
Changing the Active Template 332
Deleting a Template 332
Editing a Template 332
Downloading Template Files 333
Restoring to Factory Defaults 333
ix
PGP Universalâ„¢ Server Contents
Configuring the PGP Universal Web Messenger Service 333
Starting and Stopping PGP Universal Web Messenger 334
Selecting the PGP Universal Web Messenger Network Interface 334
Setting Up External Authentication 336
Creating Settings for PGP Universal Web Messenger User Accounts 337
Setting Message Replication in a Cluster 338
Configuring the Integrated Keyserver
341
Overview 341
Starting and Stopping the Keyserver Service 341
Configuring the Keyserver Service 341
Configuring the PGP Verified Directory
345
Overview 345
Starting and Stopping the PGP Verified Directory 346
Configuring the PGP Verified Directory 346
Managing the Certificate Revocation List Service 349
Overview 349
Starting and Stopping the CRL Service 349
Editing CRL Service Settings 350
Configuring Universal Services Protocol 351
Starting and Stopping USP 351
Adding USP Interfaces 351
Managing PGP Remote Disable & Destroy for Encrypted Disks 353
Deploying PGP RDD 353
Network and Clustering Considerations 354
Hardware and System Requirements 354
Licensing PGP Remote Disable & Destroy with Intel Anti-Theft Technology 355
Setting PGP RDD in Consumer Policies 356
Setting Up the PGP RDD Service 357
Managing PGP RDD Policy 358
Starting and Stopping the PGP RDD Service 359
PGP RDD Administrator Tasks 360
Viewing Anti-Theft Information 361
Managing Intel Anti-Theft Status 362
AT Activated 363
Decommissioned 363
AT Deactivated 363
Stolen 364
Changing a Computer's Status 364
Recovering Locked Systems 365
x
PGP Universalâ„¢ Server Contents
Reporting and Logging 367
System Graphs
369
Overview 369
CPU Usage 369
Message Activity 369
Whole Disk Encryption 370
System Logs 373
Overview 373
Filtering the Log View 374
Searching the Log Files 375
Exporting a Log File 375
Enabling External Logging 376
Configuring SNMP Monitoring 377
Overview 377
Starting and Stopping SNMP Monitoring 378
Configuring the SNMP Service 378
Downloading the Custom MIB File 379
Viewing Server and License Settings and Shutting Down Services 381
Overview 381
Server Information 381
Setting the Time 382
Licensing a PGP Universal Server 382
Downloading the Release Notes 383
Shutting Down and Restarting the PGP Universal Server Software Services 383
Shutting Down and Restarting the PGP Universal Server Hardware 384
Managing Administrator Accounts
385
Overview 385
Administrator Roles 386
Administrator Authentication 386
Creating a New Administrator 387
Importing SSH v2 Keys 388
Deleting Administrators 388
Inspecting and Changing the Settings of an Administrator 389
Configuring RSA SecurID Authentication 390
Resetting SecurID PINs 391
Daily Status Email 392
xi
PGP Universalâ„¢ Server Contents
Protecting PGP Universal Server with Ignition Keys 395
Overview 395
Ignition Keys and Clustering 396
Preparing Hardware Tokens to be Ignition Keys 397
Configuring a Hardware Token Ignition Key 398
Configuring a Soft-Ignition Passphrase Ignition Key 399
Deleting Ignition Keys 399
Backing Up and Restoring System and User Data 401
Overview 401
Creating Backups 402
Scheduling Backups 402
Performing On-Demand Backups 402
Configuring the Backup Location 402
Restoring From a Backup 404
Restoring On-Demand 404
Restoring Configuration 404
Restoring from a Different Version 406
Updating PGP Universal Server Software 407
Overview 407
Inspecting Update Packages 408
Setting Network Interfaces 409
Understanding the Network Settings 409
Changing Interface Settings 410
Adding Interface Settings 410
Deleting Interface Settings 410
Editing Global Network Settings 411
Assigning a Certificate 411
Working with Certificates 412
Importing an Existing Certificate 412
Generating a Certificate Request 413
Adding a Pending Certificate 414
Inspecting a Certificate 414
Exporting a Certificate 415
Deleting a Certificate 415
Clustering your PGP Universal Servers
417
Overview 417
Cluster Status 418
Creating a Cluster 419
Deleting Cluster Members 422
xii
PGP Universalâ„¢ Server Contents
Clustering and PGP Universal Web Messenger 422
Managing Settings for Cluster Members 423
Changing Network Settings in Clusters 424
Index
427
xiii
1
Introduction
This Administrator’s Guide describes both the PGP Universal
â„¢
Server and Client
software. It tells you how to get them up and running on your network, how to
configure them, and how to maintain them. This section provides a high-level
overview of PGP Universal Server.
What is PGP Universal Server?
PGP Universal Server is a single console for managing the applications that
provide email, disk, and network file encryption.
PGP Universal Server with PGP Universal Gateway Email gives you secure
messaging: it transparently protects your enterprise messages with little or no
user interaction.
The PGP Universal Server also replaces the PGP Keyserver product with a built-
in keyserver, and the PGP Admin product with PGP Desktop configuration and
deployment capabilities.
PGP Universal Server automatically creates and maintains a Self-Managing
Security Architecture (SMSA) by monitoring authenticated users and their email
traffic. You can also send protected messages to addresses that are not part of
the SMSA. The PGP Universal Server encrypts, decrypts, signs, and verifies
messages automatically, providing strong security through policies you control.
PGP Universal Satellite, a client-side feature of PGP Universal Server, extends
PGP security for email messages all the way to the computer of the email user,
it allows external users to become part of the SMSA, and it gives end users the
option to create and manage their keys on their own computer (if allowed by
the PGP administrator).
PGP Desktop, a client product, is created and managed through PGP Universal
Server policy. It creates PGP keypairs and can manage user keypairs as well as
store the public keys of others. It encrypts user email and instant messaging
(IM). It can encrypt entire or partial hard drives. It also enables secure file
sharing with others over a network.
15
PGP Universalâ„¢ Server Introduction
PGP Universal Server Product Family
PGP Universal Server functions as a management console for a variety of
encryption solutions. You can purchase any of the PGP Desktop applications or
bundles and use PGP Universal Server to create and manage client installations.
You can also purchase a license that enables PGP Gateway Email to encrypt
email in the mailstream.
The PGP Universal Server can manage any combination of PGP encryption
applications. PGP encryption applications are:
 PGP Universal Gateway Email provides automatic email encryption in the
gateway, based on centralized mail policy. This product requires
administration by the PGP Universal Server.
 PGP Desktop Email provides encryption at the desktop for mail, files, and
AOL Instant Messenger traffic. This product can be managed by the PGP
Universal Server.
 PGP Whole Disk Encryption provides encryption at the desktop for an
entire disk. This product can be managed by the PGP Universal Server.
 PGP NetShare provides transparent file encryption and sharing among
desktops. This product can be managed by the PGP Universal Server.
Who Should Read This Guide
This Administrator’s Guide is for the person or persons who implement and
maintain your organization’s PGP Universal Server environment. These are the
PGP Universal Server administrators.
This guide is also intended for anyone else who wants to learn about how PGP
Universal Server works.
Common Criteria Environments
To be Common Criteria compliant, please refer to the best practices shown in
PGP Universal Server 2.9 Common Criteria Supplemental. Note that these best
practices supersede recommendations made elsewhere in this and other
documentation.
16
  • Page 1 1
  • Page 2 2
  • Page 3 3
  • Page 4 4
  • Page 5 5
  • Page 6 6
  • Page 7 7
  • Page 8 8
  • Page 9 9
  • Page 10 10
  • Page 11 11
  • Page 12 12
  • Page 13 13
  • Page 14 14
  • Page 15 15
  • Page 16 16
  • Page 17 17
  • Page 18 18
  • Page 19 19
  • Page 20 20
  • Page 21 21
  • Page 22 22
  • Page 23 23
  • Page 24 24
  • Page 25 25
  • Page 26 26
  • Page 27 27
  • Page 28 28
  • Page 29 29
  • Page 30 30
  • Page 31 31
  • Page 32 32
  • Page 33 33
  • Page 34 34
  • Page 35 35
  • Page 36 36
  • Page 37 37
  • Page 38 38
  • Page 39 39
  • Page 40 40
  • Page 41 41
  • Page 42 42
  • Page 43 43
  • Page 44 44
  • Page 45 45
  • Page 46 46
  • Page 47 47
  • Page 48 48
  • Page 49 49
  • Page 50 50
  • Page 51 51
  • Page 52 52
  • Page 53 53
  • Page 54 54
  • Page 55 55
  • Page 56 56
  • Page 57 57
  • Page 58 58
  • Page 59 59
  • Page 60 60
  • Page 61 61
  • Page 62 62
  • Page 63 63
  • Page 64 64
  • Page 65 65
  • Page 66 66
  • Page 67 67
  • Page 68 68
  • Page 69 69
  • Page 70 70
  • Page 71 71
  • Page 72 72
  • Page 73 73
  • Page 74 74
  • Page 75 75
  • Page 76 76
  • Page 77 77
  • Page 78 78
  • Page 79 79
  • Page 80 80
  • Page 81 81
  • Page 82 82
  • Page 83 83
  • Page 84 84
  • Page 85 85
  • Page 86 86
  • Page 87 87
  • Page 88 88
  • Page 89 89
  • Page 90 90
  • Page 91 91
  • Page 92 92
  • Page 93 93
  • Page 94 94
  • Page 95 95
  • Page 96 96
  • Page 97 97
  • Page 98 98
  • Page 99 99
  • Page 100 100
  • Page 101 101
  • Page 102 102
  • Page 103 103
  • Page 104 104
  • Page 105 105
  • Page 106 106
  • Page 107 107
  • Page 108 108
  • Page 109 109
  • Page 110 110
  • Page 111 111
  • Page 112 112
  • Page 113 113
  • Page 114 114
  • Page 115 115
  • Page 116 116
  • Page 117 117
  • Page 118 118
  • Page 119 119
  • Page 120 120
  • Page 121 121
  • Page 122 122
  • Page 123 123
  • Page 124 124
  • Page 125 125
  • Page 126 126
  • Page 127 127
  • Page 128 128
  • Page 129 129
  • Page 130 130
  • Page 131 131
  • Page 132 132
  • Page 133 133
  • Page 134 134
  • Page 135 135
  • Page 136 136
  • Page 137 137
  • Page 138 138
  • Page 139 139
  • Page 140 140
  • Page 141 141
  • Page 142 142
  • Page 143 143
  • Page 144 144
  • Page 145 145
  • Page 146 146
  • Page 147 147
  • Page 148 148
  • Page 149 149
  • Page 150 150
  • Page 151 151
  • Page 152 152
  • Page 153 153
  • Page 154 154
  • Page 155 155
  • Page 156 156
  • Page 157 157
  • Page 158 158
  • Page 159 159
  • Page 160 160
  • Page 161 161
  • Page 162 162
  • Page 163 163
  • Page 164 164
  • Page 165 165
  • Page 166 166
  • Page 167 167
  • Page 168 168
  • Page 169 169
  • Page 170 170
  • Page 171 171
  • Page 172 172
  • Page 173 173
  • Page 174 174
  • Page 175 175
  • Page 176 176
  • Page 177 177
  • Page 178 178
  • Page 179 179
  • Page 180 180
  • Page 181 181
  • Page 182 182
  • Page 183 183
  • Page 184 184
  • Page 185 185
  • Page 186 186
  • Page 187 187
  • Page 188 188
  • Page 189 189
  • Page 190 190
  • Page 191 191
  • Page 192 192
  • Page 193 193
  • Page 194 194
  • Page 195 195
  • Page 196 196
  • Page 197 197
  • Page 198 198
  • Page 199 199
  • Page 200 200
  • Page 201 201
  • Page 202 202
  • Page 203 203
  • Page 204 204
  • Page 205 205
  • Page 206 206
  • Page 207 207
  • Page 208 208
  • Page 209 209
  • Page 210 210
  • Page 211 211
  • Page 212 212
  • Page 213 213
  • Page 214 214
  • Page 215 215
  • Page 216 216
  • Page 217 217
  • Page 218 218
  • Page 219 219
  • Page 220 220
  • Page 221 221
  • Page 222 222
  • Page 223 223
  • Page 224 224
  • Page 225 225
  • Page 226 226
  • Page 227 227
  • Page 228 228
  • Page 229 229
  • Page 230 230
  • Page 231 231
  • Page 232 232
  • Page 233 233
  • Page 234 234
  • Page 235 235
  • Page 236 236
  • Page 237 237
  • Page 238 238
  • Page 239 239
  • Page 240 240
  • Page 241 241
  • Page 242 242
  • Page 243 243
  • Page 244 244
  • Page 245 245
  • Page 246 246
  • Page 247 247
  • Page 248 248
  • Page 249 249
  • Page 250 250
  • Page 251 251
  • Page 252 252
  • Page 253 253
  • Page 254 254
  • Page 255 255
  • Page 256 256
  • Page 257 257
  • Page 258 258
  • Page 259 259
  • Page 260 260
  • Page 261 261
  • Page 262 262
  • Page 263 263
  • Page 264 264
  • Page 265 265
  • Page 266 266
  • Page 267 267
  • Page 268 268
  • Page 269 269
  • Page 270 270
  • Page 271 271
  • Page 272 272
  • Page 273 273
  • Page 274 274
  • Page 275 275
  • Page 276 276
  • Page 277 277
  • Page 278 278
  • Page 279 279
  • Page 280 280
  • Page 281 281
  • Page 282 282
  • Page 283 283
  • Page 284 284
  • Page 285 285
  • Page 286 286
  • Page 287 287
  • Page 288 288
  • Page 289 289
  • Page 290 290
  • Page 291 291
  • Page 292 292
  • Page 293 293
  • Page 294 294
  • Page 295 295
  • Page 296 296
  • Page 297 297
  • Page 298 298
  • Page 299 299
  • Page 300 300
  • Page 301 301
  • Page 302 302
  • Page 303 303
  • Page 304 304
  • Page 305 305
  • Page 306 306
  • Page 307 307
  • Page 308 308
  • Page 309 309
  • Page 310 310
  • Page 311 311
  • Page 312 312
  • Page 313 313
  • Page 314 314
  • Page 315 315
  • Page 316 316
  • Page 317 317
  • Page 318 318
  • Page 319 319
  • Page 320 320
  • Page 321 321
  • Page 322 322
  • Page 323 323
  • Page 324 324
  • Page 325 325
  • Page 326 326
  • Page 327 327
  • Page 328 328
  • Page 329 329
  • Page 330 330
  • Page 331 331
  • Page 332 332
  • Page 333 333
  • Page 334 334
  • Page 335 335
  • Page 336 336
  • Page 337 337
  • Page 338 338
  • Page 339 339
  • Page 340 340
  • Page 341 341
  • Page 342 342
  • Page 343 343
  • Page 344 344
  • Page 345 345
  • Page 346 346
  • Page 347 347
  • Page 348 348
  • Page 349 349
  • Page 350 350
  • Page 351 351
  • Page 352 352
  • Page 353 353
  • Page 354 354
  • Page 355 355
  • Page 356 356
  • Page 357 357
  • Page 358 358
  • Page 359 359
  • Page 360 360
  • Page 361 361
  • Page 362 362
  • Page 363 363
  • Page 364 364
  • Page 365 365
  • Page 366 366
  • Page 367 367
  • Page 368 368
  • Page 369 369
  • Page 370 370
  • Page 371 371
  • Page 372 372
  • Page 373 373
  • Page 374 374
  • Page 375 375
  • Page 376 376
  • Page 377 377
  • Page 378 378
  • Page 379 379
  • Page 380 380
  • Page 381 381
  • Page 382 382
  • Page 383 383
  • Page 384 384
  • Page 385 385
  • Page 386 386
  • Page 387 387
  • Page 388 388
  • Page 389 389
  • Page 390 390
  • Page 391 391
  • Page 392 392
  • Page 393 393
  • Page 394 394
  • Page 395 395
  • Page 396 396
  • Page 397 397
  • Page 398 398
  • Page 399 399
  • Page 400 400
  • Page 401 401
  • Page 402 402
  • Page 403 403
  • Page 404 404
  • Page 405 405
  • Page 406 406
  • Page 407 407
  • Page 408 408
  • Page 409 409
  • Page 410 410
  • Page 411 411
  • Page 412 412
  • Page 413 413
  • Page 414 414
  • Page 415 415
  • Page 416 416
  • Page 417 417
  • Page 418 418
  • Page 419 419
  • Page 420 420
  • Page 421 421
  • Page 422 422
  • Page 423 423
  • Page 424 424
  • Page 425 425
  • Page 426 426
  • Page 427 427
  • Page 428 428
  • Page 429 429
  • Page 430 430
  • Page 431 431
  • Page 432 432
  • Page 433 433
  • Page 434 434
  • Page 435 435
  • Page 436 436
  • Page 437 437
  • Page 438 438

PGP Universal Server 3.1 User guide

Category
Software
Type
User guide

Ask a question and I''ll find the answer in the document

Finding information in a document is now easier with AI