Page is loading ...
PGP Universal Server
Administrator's Guide
Version Information
PGP Universal Server Administrator's Guide. PGP Universal Server Version 2.8.3. Released May 2008.
Copyright Information
Copyright © 1991–2008 by PGP Corporation. All Rights Reserved. No part of this document can be reproduced or transmitted in any form or by any
means, electronic or mechanical, for any purpose, without the express written permission of PGP Corporation.
Trademark Information
PGP, Pretty Good Privacy, and the PGP logo are registered trademarks of PGP Corporation in the US and other countries. IDEA is a trademark of
Ascom Tech AG. Windows and ActiveX are registered trademarks of Microsoft Corporation. AOL is a registered trademark, and AOL Instant
Messenger is a trademark, of America Online, Inc. Red Hat and Red Hat Linux are trademarks or registered trademarks of Red Hat, Inc. Linux is a
registered trademark of Linus Torvalds. Solaris is a trademark or registered trademark of Sun Microsystems, Inc. AIX is a trademark or registered
trademark of International Business Machines Corporation. HP-UX is a trademark or registered trademark of Hewlett-Packard Company. SSH and
Secure Shell are trademarks of SSH Communications Security, Inc. Rendezvous and Mac OS X are trademarks or registered trademarks of Apple
Computer, Inc. All other registered and unregistered trademarks in this document are the sole property of their respective owners.
Licensing and Patent Information
The IDEA cryptographic cipher described in U.S. patent number 5,214,703 is licensed from Ascom Tech AG. The CAST-128 encryption algorithm,
implemented from RFC 2144, is available worldwide on a royalty-free basis for commercial and non-commercial uses. PGP Corporation has secured a
license to the patent rights contained in the patent application Serial Number 10/655,563 by The Regents of the University of California, entitled Block
Cipher Mode of Operation for Constructing a Wide-blocksize block Cipher from a Conventional Block Cipher. Some third-party software included in PGP
Universal Server is licensed under the GNU General Public License (GPL). PGP Universal Server as a whole is not licensed under the GPL. If you would
like a copy of the source code for the GPL software included in PGP Universal Server, contact PGP Support (
http://www.pgp.com/support). PGP
Corporation may have patents and/or pending patent applications covering subject matter in this software or its documentation; the furnishing of this
software or documentation does not give you any license to these patents.
Acknowledgments
This product includes or may include:
• The Zip and ZLib compression code, created by Mark Adler and Jean-Loup Gailly, is used with permission from the free Info-ZIP implementation,
developed by zlib (
http://www.zlib.net). • Libxml2, the XML C parser and toolkit developed for the Gnome project and distributed and copyrighted
under the MIT License found at
http://www.opensource.org/licenses/mit-license.html. Copyright © 2007 by the Open Source Initiative. • bzip2 1.0, a
freely available high-quality data compressor, is copyrighted by Julian Seward, © 1996-2005. • Application server (
http://jakarta.apache.org/), web
server (
http://www.apache.org/), Jakarta Commons (http://jakarta.apache.org/commons/license.html) and log4j, a Java-based library used to parse
HTML, developed by the Apache Software Foundation. The license is at
www.apache.org/licenses/LICENSE-2.0.txt. • Castor, an open-source, data-
binding framework for moving data from XML to Java programming language objects and from Java to databases, is released by the ExoLab Group
under an Apache 2.0-style license, available at
http://www.castor.org/license.html. • Xalan, an open-source software library from the Apache Software
Foundation that implements the XSLT XML transformation language and the XPath XML query language, is released under the Apache Software
License, version 1.1, available at
http://xml.apache.org/xalan-j/#license1.1. • Apache Axis is an implementation of the SOAP ("Simple Object Access
Protocol") used for communications between various PGP products is provided under the Apache license found at
http://www.apache.org/licenses/LICENSE-2.0.txt. • mx4j, an open-source implementation of the Java Management Extensions (JMX), is released
under an Apache-style license, available at
http://mx4j.sourceforge.net/docs/ch01s06.html. • jpeglib version 6a is based in part on the work of the
Independent JPEG Group. (
http://www.ijg.org/) • libxslt the XSLT C library developed for the GNOME project and used for XML transformations is
distributed under the MIT License
http://www.opensource.org/licenses/mit-license.html. • PCRE version 4.5 Perl regular expression compiler,
copyrighted and distributed by University of Cambridge. ©1997-2006. The license agreement is at
http://www.pcre.org/license.txt. • BIND Balanced
Binary Tree Library and Domain Name System (DNS) protocols developed and copyrighted by Internet Systems Consortium, Inc. (
http://www.isc.org)
• Free BSD implementation of daemon developed by The FreeBSD Project, © 1994-2006. • Simple Network Management Protocol Library developed
and copyrighted by Carnegie Mellon University © 1989, 1991, 1992, Networks Associates Technology, Inc, © 2001- 2003, Cambridge Broadband Ltd.
© 2001- 2003, Sun Microsystems, Inc., © 2003, Sparta, Inc, © 2003-2006, Cisco, Inc and Information Network Center of Beijing University of Posts
and Telecommunications, © 2004. The license agreement for these is at
http://net-snmp.sourceforge.net/about/license.html. • NTP version 4.2
developed by Network Time Protocol and copyrighted to various contributors. • Lightweight Directory Access Protocol developed and copyrighted by
OpenLDAP Foundation. OpenLDAP is an open-source implementation of the Lightweight Directory Access Protocol (LDAP). Copyright © 1999-2003,
The OpenLDAP Foundation. The license agreement is at
http://www.openldap.org/software/release/license.html. • Secure shell OpenSSH version
4.2.1 developed by OpenBSD project is released by the OpenBSD Project under a BSD-style license, available at
http://www.openbsd.org/cgi-
bin/cvsweb/src/usr.bin/ssh/LICENCE?rev=HEAD. • PC/SC Lite is a free implementation of PC/SC, a specification for SmartCard integration is released
under the BSD license. • Postfix, an open source mail transfer agent (MTA), is released under the IBM Public License 1.0, available at
http://www.opensource.org/licenses/ibmpl.php. • PostgreSQL, a free software object-relational database management system, is released under a
BSD-style license, available at
http://www.postgresql.org/about/licence. • PostgreSQL JDBC driver, a free Java program used to connect to a
PostgreSQL database using standard, database independent Java code, (c) 1997-2005, PostgreSQL Global Development Group, is released under a
BSD-style license, available at
http://jdbc.postgresql.org/license.html. • PostgreSQL Regular Expression Library, a free software object-relational
database management system, is released under a BSD-style license, available at
http://www.postgresql.org/about/licence. • 21.vixie-cron is the Vixie
version of cron, a standard UNIX daemon that runs specified programs at scheduled times. Copyright © 1993, 1994 by Paul Vixie; used by permission.
• JacORB, a Java object used to facilitate communication between processes written in Java and the data layer, is open source licensed under the
GNU Library General Public License (LGPL) available at
http://www.jacorb.org/lgpl.html. Copyright © 2006 The JacORB Project. • TAO (The ACE ORB)
is an open-source implementation of a CORBA Object Request Broker (ORB), and is used for communication between processes written in C/C++ and
the data layer. Copyright (c) 1993-2006 by Douglas C. Schmidt and his research group at Washington University, University of California, Irvine, and
Vanderbilt University. The open source software license is available at
http://www.cs.wustl.edu/~schmidt/ACE-copying.html. • libcURL, a library for
downloading files via common network services, is open source software provided under a MIT/X derivate license available at
http://curl.haxx.se/docs/copyright.html. Copyright (c) 1996 - 2007, Daniel Stenberg. • libuuid, a library used to generate unique identifiers, is released
under a BSD-style license, available at
http://thunk.org/hg/e2fsprogs/?file/fe55db3e508c/lib/uuid/COPYING. Copyright (C) 1996, 1997 Theodore Ts'o.
• libpopt, a library that parses command line options, is released under the terms of the GNU Free Documentation License available at
http://directory.fsf.org/libs/COPYING.DOC. Copyright © 2000-2003 Free Software Foundation, Inc. • gSOAP, a development tool for Windows clients
to communicate with the Intel Corporation AMT chipset on a motherboard, is distributed under the GNU Public License, available at
4
PGP Universal Server Introduction
http://www.cs.fsu.edu/~engelen/soaplicense.html. • Windows Template Library (WRT) is used for developing user interface components and is
distributed under the Common Public License v1.0 found at
http://opensource.org/licenses/cpl1.0.php. • The Perl Kit provides several independent
utilities used to automate a variety of maintenance functions and is provided under the Perl Artistic License, found at
http://www.perl.com/pub/a/language/misc/Artistic.html.
Export Information
Export of this software and documentation may be subject to compliance with the rules and regulations promulgated from time to time by the Bureau
of Export Administration, United States Department of Commerce, which restricts the export and re-export of certain products and technical data.
Limitations
The software provided with this documentation is licensed to you for your individual use under the terms of the End User License Agreement provided
with the software. The information in this document is subject to change without notice. PGP Corporation does not warrant that the information meets
your requirements or that the information is free of errors. The information may include technical inaccuracies or typographical errors. Changes may be
made to the information and incorporated in new editions of this document, if and when made available by PGP Corporation.
i
Contents
Introduction 15
What is PGP Universal Server? 15
PGP Universal Server Product Family 16
Who Should Read This Guide 16
Improvements in This Version of PGP Universal Server 16
PGP Universal Server 17
PGP Messaging 17
PGP Keys 18
PGP Desktop 19
PGP Desktop Email 19
PGP NetShare 20
PGP Whole Disk Encryption 21
Using the PGP Universal Server with the Command Line 22
Symbols 23
Getting Assistance 23
Getting product information 23
Contact information 24
The Big Picture 25
Important Terms 25
PGP Products 25
PGP Universal Server Concepts 25
PGP Universal Server Features 26
PGP Universal Server User Types 28
Installation Overview 29
Adding the PGP Universal Server to Your Network
35
Server Placement 35
Gateway Placement 36
Internal Placement 37
Using a Mail Relay 38
Microsoft Exchange Server 38
Lotus Domino Server 39
Configuration Examples 39
Internal Placement Configuration 40
Gateway Placement Configuration 41
Non-mailstream Placement Configuration 42
Cluster Configuration 43
Clustered Proxy and Keyserver Configuration 44
Gateway Cluster with Load Balancer 46
Gateway and Internal Placement Cluster 47
ii
PGP Universal Server Contents
Encircled Configuration 49
Large Enterprise Configuration 50
Spam Filters and PGP Universal Server 51
Exchange with PGP Client Software 52
Lotus Domino Server with PGP Client Software 53
Unsupported Configurations 53
Open Ports 55
TCP Ports 55
UDP Ports 57
Naming your PGP Universal Server
59
Considering a Name for Your PGP Universal Server 59
Methods for Naming a PGP Universal Server 60
Installing the PGP Universal Server 61
About the Installation Procedure 61
System Requirements 62
Installation Materials 62
Installation Options 62
Standard Installation Procedure 63
PGP Installation Procedure 64
Setting Up the PGP Universal Server 65
About the Setup Assistant 65
Preparing for Setup after pgp Install 66
Hardware 66
System Information 66
Connect to the PGP Universal Server 67
iii
PGP Universal Server Contents
Initial Configuration with Setup Assistant 67
Primary or Secondary Configuration 76
Restoring From a Server Backup 86
Migrating the Keys from a PGP Keyserver 87
Understanding the Administrative Interface 89
System Requirements 89
Logging In 89
Managing Alerts 92
Logging In For the First Time 93
Administrative Interface Map 94
Icons 95
Licensing Your Software 101
Overview 101
License Changes for PGP Universal Server 2.5 and Later 101
Manual and Automatic Licensing 103
Licensing a PGP Universal Server 103
Licensing the Mail Proxy Feature 103
Operating in Learn Mode 105
Purpose of Learn Mode 105
Checking the Logs 106
Managing Learn Mode 106
Managed Domains 109
About Managed Domains 109
Adding Managed Domains 110
Deleting Managed Domains 111
Managing Organization Keys
113
About Organization Keys 113
Organization Key 113
Inspecting the Organization Key 114
Regenerating the Organization Key 116
Importing an Organization Key 117
Organization Certificate 119
Inspecting the Organization Certificate 119
Exporting the Organization Certificate 120
Deleting the Organization Certificate 121
Generating the Organization Certificate 122
Importing the Organization Certificate 124
iv
PGP Universal Server Contents
Additional Decryption Key (ADK) 125
Importing the ADK 126
Inspecting the ADK 127
Deleting the ADK 128
Verified Directory Key 129
Importing the Verified Directory Key 129
Inspecting the Verified Directory Key 130
Deleting the Verified Directory Key 131
Managing Trusted Keys and Certificates 133
Overview 134
Trusted Keys 136
Trusted Certificates 136
Adding a Trusted Key or Certificate 136
Inspecting and Changing Trusted Key Properties 138
Deleting Trusted Keys and Certificates 139
Searching for Trusted Keys and Certificates 139
Recovering Encrypted Data in an Enterprise Environment 141
Using Key Reconstruction 141
Recovering Encryption Key Material without Key Reconstruction 142
Encryption Key Recovery of CKM Keys 142
Encryption Key Recovery of GKM Keys 143
Encryption Key Recovery of SCKM Keys 143
Encryption Key Recovery of SKM Keys 144
Using an Additional Decryption Key for Data Recovery 144
Setting Mail Policy 147
Overview 148
How Policy Chains Work 149
Mail Policy and Dictionaries 150
Mail Policy and Key Searches 151
Mail Policy and Cached Keys 151
Migrating Settings from Version 2.0.x 151
Understanding the Pre-Installed Policy Chains 152
Mail Policy Outside the Mailflow 153
Building Valid Chains and Rules 154
Using Valid Processing Order 154
Creating Valid Groups 155
Creating a Valid Rule 156
Using the Rule Interface 157
The Conditions Card 158
The Actions Card 160
Managing Policy Chains 160
Mail Policy Best Practices 161
v
PGP Universal Server Contents
Restoring Mail Policy to Default Settings 161
Editing Policy Chain Settings 161
Adding Policy Chains 162
Deleting Policy Chains 164
Exporting Policy Chains 165
Printing Policy Chains 165
Managing Rules 165
Adding Rules to Policy Chains 165
Deleting Rules from Policy Chains 166
Enabling and Disabling Rules 166
Changing the Processing Order of the Rules 167
Adding Key Searches 167
Choosing Condition Statements, Conditions, and Actions 168
Condition Statements 168
Conditions 168
Actions 176
Working with Common Access Cards 183
Applying Key Not Found Settings to External Users 185
Overview 185
Bounce the Message 186
PDF Messenger 186
Certified Delivery with PDF Messenger 187
Send Unencrypted 188
Smart Trailer 188
PGP Universal Web Messenger 191
Changing Policy Settings 193
Changing User Delivery Method Preference 193
Using Dictionaries with Policy 195
Overview 195
Default Dictionaries 197
Editing Default Dictionaries 198
User-Defined Dictionaries 201
Adding a User-Defined Dictionary 201
Editing a User-Defined Dictionary 203
Deleting a Dictionary 204
Exporting a Dictionary 205
Searching the Dictionaries 205
Keyservers, SMTP Servers, and Mail Policy
207
Overview 207
Keyservers 208
Adding or Editing a Keyserver 209
Deleting a Keyserver 211
vi
PGP Universal Server Contents
SMTP Servers 212
Adding or Editing an SMTP Server 212
Deleting an SMTP Server 214
Managing Keys in the Key Cache
215
Overview 215
Changing Cached Key Timeout 216
Purging Keys from the Cache 217
Trusting Cached Keys 217
Viewing Cached Keys 217
Searching the Key Cache 218
Configuring Mail Proxies 219
Overview 219
PGP Universal Server and Mail Proxies 220
Mail Proxies in an Internal Placement 220
Mail Proxies in a Gateway Placement 222
Changes in Proxy Settings from PGP Universal Server 2.0 to 2.5 and later 223
Mail Proxies Card 224
Creating New or Editing Existing Proxies 224
Creating or Editing a POP/IMAP Proxy 225
Creating or Editing an Outbound SMTP Proxy 227
Creating or Editing an Inbound SMTP Proxy 230
Creating or Editing a Unified SMTP Proxy 231
Email in the Mail Queue 235
Overview 235
Deleting Messages from the Mail Queue 236
Specifying Mail Routes
237
Overview 237
Managing Mail Routes 238
Adding a Mail Route 238
Editing a Mail Route 239
Deleting a Mail Route 239
Customizing System Message Templates 241
Overview 241
Templates and Message Size 242
PDF Messenger Templates 242
Templates for New PGP Universal Web Messenger Users 243
vii
PGP Universal Server Contents
Editing a Message Template 243
Setting Internal User Policy
245
Overview 246
Managing Internal User Policies 247
Adding a New Internal User Policy 247
Editing Internal User Policies 248
Editing the Excluded Users Policy 256
Deleting Internal User Policies 258
Downloading Client Software 258
Directory Synchronization 261
Choosing a Key Mode For Key Management 261
Disabling Key Generation 265
Adding PGP Desktop Solutions to Existing PGP Universal Gateway Email Environments265
Changing Key Modes 265
X.509 Certificate Management in Lotus Notes Environments 267
Trusting Certificates Created by PGP Universal Server 268
Setting the Lotus Notes Key Settings in PGP Universal Server 269
Technical Deployment Information 270
Customizing the Windows Preinstallation Environment for PGP Whole Disk Encryption 271
Introduction 271
Creating a Windows PE CD 273
Customizing the Vista Installation Package to Upgrade Encrypted Operating Systems to
Windows Vista
276
Using PGP Whole Disk Encryption with IBM Lenovo ThinkPad Systems 279
Using PGP Whole Disk Encryption with the Microsoft Windows XP Recovery Console 280
Pgppe Commands 280
Customizing the BartPE or BartPE-based Tools 283
Using Directory Synchronization to Manage Users 285
Overview 285
Enabling Directory Synchronization 287
Testing the LDAP Connection 290
Excluding Users 290
Including Only Some Users 292
Matching Attributes 292
Base DN and Bind DN 294
Understanding User Enrollment Methods 296
Before Creating a Client Installer 296
Email Enrollment 297
Directory Enrollment 299
viii
PGP Universal Server Contents
Serving PGP Admin 8 Preferences 301
Configuring PGP Desktop Installations
303
Establishing PGP Desktop Settings for Your PGP Desktop Clients 303
PGP Desktop Licensing 304
Configuring PGP Desktop Settings 305
General Tab 309
Licensing Tab 314
Messaging & Keys Tab 317
File & Disk Tab 319
WDE Tab 324
PGP Desktop Installer Policies 328
Creating PGP Desktop Installers 329
Creating an Installer with No Policy Settings 329
Creating an Installer with Auto-Detect Policy 329
Creating an Installer with Preset Policy 331
Controlling PGP Desktop Components 333
PGP Whole Disk Encryption Administration 334
How Does Single Sign-On Work? 334
Enabling Single Sign-On 335
Managing Clients Remotely Using a PGP WDE Administrator Active Directory Group 337
Managing Clients Locally Using the PGP WDE Administrator Key 338
Setting External User Policy 341
Overview 342
Managing External User Policies 343
Regrouping External Users 343
Adding a New External User Policy 343
Editing External User Policies 344
Deleting External User Policies 352
Configuring PGP Universal Web Messenger 353
Overview 353
High Availability Mode 354
Customizing PGP Universal Web Messenger 355
Adding a New Template 356
Troubleshooting Customization 361
Changing the Active Template 365
Deleting a Template 365
Editing a Template 365
Downloading Template Files 366
Restoring to Factory Defaults 366
ix
PGP Universal Server Contents
Configuring the PGP Universal Web Messenger Service 367
Configuring the PGP Verified Directory
375
Overview 375
Enabling the PGP Verified Directory 376
Configuring the PGP Verified Directory 377
Managing Internal User Accounts 381
Overview 381
Certificate Revocation Lists 382
Adding Internal Users Manually 383
Deleting Internal Users 385
Approving Pending Keys 385
Searching for Internal Users 386
Exporting PGP Whole Disk Login Failure Data 387
Internal User Settings 387
Changing Internal User Settings 388
Exporting an Internal User’s X.509 Certificate 389
Revoking the PGP Key of an Internal User 389
Revoking the X.509 Certificate of an Internal User 390
Exporting the PGP Key of an Internal User 391
Deleting the PGP Key of an Internal User 391
Deleting a PGP Desktop Key Reconstruction Block 392
Using Whole Disk Recovery Tokens 392
Deleting Whole Disk Recovery Tokens 393
Viewing PGP Whole Disk Encryption Status 394
Viewing Internal User Log Entries 395
Key Reconstruction Blocks 395
Managing External User Accounts 397
Overview 397
Importing External Users 398
Deleting External Users 399
Searching for External Users 399
Exporting Delivery Receipts 400
External User Settings 401
Changing External User Settings 402
Viewing External User Log Entries 403
Exporting an External User’s X.509 Certificate 403
Exporting the PGP Key of an External User 404
Deleting the PGP Key of an External User 404
Changing the Passphrase of an External User 405
x
PGP Universal Server Contents
Managing PGP Verified Directory User Accounts 407
Overview 407
Importing Verified Directory Users 408
PGP Verified Directory User Settings 410
Changing PGP Verified Directory User Settings 411
Approving Pending Keys 411
Deleting the PGP Key of a PGP Verified Directory User 412
Viewing PGP Verified Directory User Log Entries 412
Deleting PGP Verified Directory Users 412
Exporting PGP Verified Directory Users 413
Searching for PGP Verified Directory Users 413
Managing Administrator Accounts 415
Overview 415
Creating a New Administrator 416
Importing SSH v2 Keys 418
Deleting Administrators 418
Inspecting and Changing the Settings of an Administrator 419
Daily Status Email 419
PGP Universal Satellite 421
Overview 421
Technical Information 422
Distributing the PGP Universal Satellite Software 423
Configuration 424
Deployment Mode 424
Key Mode 424
Satellite Configurations 425
Switching Key Modes 430
Binding 430
Pre-Binding 431
Manual Binding 432
Policy and Key or Certificate Retrieval 433
Retrieving Lost Policies 433
Retrieving Lost Keys or Certificates 435
xi
PGP Universal Server Contents
PGP Universal Satellite for Mac OS X 437
Overview 437
System Requirements 438
Obtaining the Installer 438
Installation 438
Updates 439
Files 439
User Interface 440
About PGP Universal Server 441
Help 442
Show Log 442
Clear Log 443
Policies 443
Preferences 450
Purge Caches 451
Hide and Quit PGP Universal Satellite 451
PGP Universal Satellite for Windows 455
Overview 455
System Requirements 456
Obtaining the Installer 456
Installation 457
Updates 459
Files 460
MAPI Support 460
External MAPI Configuration 461
Internal MAPI Configuration 462
Using MAPI 463
Lotus Notes Support 463
External Lotus Notes Configuration 463
Internal Lotus Notes Configuration 465
Using Lotus Notes 466
Notes IDs 466
User Interface 466
The Policy Tab 467
The Log Tab 469
The Satellite Tray Icon 471
xii
PGP Universal Server Contents
Configuring the Integrated Keyserver 475
Overview 475
Configuring the Keyserver Service 475
Managing the Certificate Revocation List Service 481
Overview 481
Enabling and Disabling the CRL Service 482
Editing CRL Service Settings 482
System Graphs
485
Overview 485
CPU Usage 485
Message Activity 486
Whole Disk Encryption 487
Recipient Statistics 489
Recipient Domain Statistics 489
System Logs 491
Overview 491
Filtering the Log View 492
Searching the Log Files 493
Exporting a Log File 493
Enabling External Logging 494
Shutting Down and Restarting Services and Power 497
Overview 498
PGP Universal Server 500
Setting the Time 500
Updating Software 501
Licensing a PGP Universal Server 502
Downloading the Release Notes 502
xiii
PGP Universal Server Contents
Shutting Down and Restarting the PGP Universal Server Software Services 503
Shutting Down and Restarting the PGP Universal Server Hardware 503
Configuring SNMP Monitoring 505
Overview 505
Downloading the Custom MIB File 506
Configuring the SNMP Service 507
Setting Network Interfaces 511
Overview 512
Connecting to a Proxy Server 513
Changing Interface Settings 514
Adding Interface Settings 514
Deleting Interface Settings 515
Editing Global Network Settings 515
Assigning a Certificate 515
Working with Certificates 516
Importing an Existing Certificate 517
Generating a Certificate Request 520
Adding a Pending Certificate 521
Inspecting a Certificate 522
Exporting a Certificate 523
Deleting a Certificate 524
Clustering your PGP Universal Servers 525
Overview 525
Clustering Utilities 526
Clustering and PGP Universal Web Messenger 527
Cluster Status 528
Creating Clusters 530
Deleting Clusters 531
Changing Network Settings in Clusters 531
Managing Secondary Settings in Clusters 532
Protecting PGP Universal Server with Ignition Keys 533
Overview 533
Ignition Keys and Clustering 535
xiv
PGP Universal Server Contents
Preparing Hardware Tokens to be Ignition Keys 535
Configuring a Hardware Token Ignition Key 537
Configuring a Soft-Ignition Passphrase Ignition Key 537
Deleting Ignition Keys 538
Backing Up and Restoring System and User Data 539
Overview 539
Creating Backups 540
Scheduling Backups 540
Performing On-Demand Backups 541
Configuring the Backup Location 541
Restoring From a Backup 543
Restoring On-Demand 543
Restoring Configuration 544
Restoring from a Different Version 548
Updating PGP Universal Server Software 551
Overview 551
Inspecting Update Packages 552
Establishing Software Update Settings 552
Checking for New Updates 553
Uploading Update Packages 553
Manually Installing an Update 553
Index 555
15
This Administrator’s Guide describes both the PGP Universal Server and PGP
Universal Satellite. It tells you how to get them up and running on your network,
how to configure them, and how to maintain them. This section provides a high-
level overview of PGP Universal Server.
In This Chapter
What is PGP Universal Server? ................................................................15
PGP Universal Server Product Family ......................................................16
Who Should Read This Guide ..................................................................16
Improvements in This Version of PGP Universal Server..........................16
Using the PGP Universal Server with the Command Line.......................22
Symbols....................................................................................................23
Getting Assistance ...................................................................................23
What is PGP Universal Server?
PGP Universal Server provides multiple encryption solutions managed from a
single console.
PGP Universal Server with PGP Universal Gateway Email gives you secure
messaging: it transparently protects your enterprise messages with little or no
user interaction.
The PGP Universal Server also replaces the PGP Keyserver product with a built-
in keyserver, and the PGP Admin product with PGP Desktop configuration and
deployment capabilities.
It automatically creates and maintains a Self-Managing Security Architecture
(SMSA) by monitoring authenticated users and their email traffic. You can also
send protected messages to addresses that are not part of the SMSA. The PGP
Universal Server encrypts, decrypts, signs, and verifies messages automatically,
providing strong security through policies you control.
PGP Universal Satellite, a client-side feature of PGP Universal Server, extends
PGP security for email messages all the way to the computer of the email user,
it allows external users to become part of the SMSA, and it gives end users the
option to create and manage their keys on their own computer (if allowed by
the PGP administrator).
1
Introduction
16
PGP Universal Server Introduction
PGP Universal Server Product Family
PGP Universal Server functions as a management console for a variety of
encryption solutions. You can purchase any of the PGP Desktop applications or
bundles and use PGP Universal Server to create and manage client installations.
You can also purchase a license that enables PGP Gateway Email to encrypt
email in the mailstream.
The PGP Universal Server can manage any combination of PGP encryption
applications. PGP encryption applications are:
 PGP Universal Gateway Email provides automatic email encryption in the
gateway, based on centralized mail policy. This product requires
administration by the PGP Universal Server.
 PGP Desktop Email provides encryption at the desktop level for mail, files,
and AOL Instant Messenger traffic. This product can be managed by the
PGP Universal Server.
 PGP Whole Disk Encryption provides encryption at the desktop level for
an entire disk. This product can be managed by the PGP Universal Server.
 PGP NetShare provides transparent file encryption and sharing among
desktops. This product can be managed by the PGP Universal Server.
Who Should Read This Guide
This Administrator’s Guide is for the person or persons who will be
implementing and maintaining your organization’s PGP Universal Server
environment. These are the PGP administrators.
This guide is also intended for anyone else who wants to learn about how PGP
Universal Server works.
Improvements in This Version of PGP Universal Server
This release of PGP Universal Server introduces the following new features:
 PGP Universal Server (on page
17)
 PGP Messaging (on page
17)
 PGP Keys (on page
18)
 PGP Desktop (on page
19)
 PGP Desktop Email (on page
19)
/
