PGP Universal Server 3.0 User guide

PGP Universal Server

Administrator's Guide

Version Information

PGP Universal Server Administrator's Guide. PGP Universal Server Version 3.0.0. Released March 2010.

Copyright Information

means, electronic or mechanical, for any purpose, without the express written permission of PGP Corporation.

Trademark Information

PGP, Pretty Good Privacy, and the PGP logo are registered trademarks of PGP Corporation in the US and other countries. IDEA is a trademark of Ascom

Tech AG. Windows and ActiveX are registered trademarks of Microsoft Corporation. AOL is a registered trademark, and AOL Instant Messenger is a

trademark, of America Online, Inc. Red Hat and Red Hat Linux are trademarks or registered trademarks of Red Hat, Inc. Linux is a registered trademark

of Linus Torvalds. Solaris is a trademark or registered trademark of Sun Microsystems, Inc. AIX is a trademark or registered trademark of International

Business Machines Corporation. HP-UX is a trademark or registered trademark of Hewlett-Packard Company. SSH and Secure Shell are trademarks of

SSH Communications Security, Inc. Rendezvous and Mac OS X are trademarks or registered trademarks of Apple Computer, Inc. All other registered

and unregistered trademarks in this document are the sole property of their respective owners.

Licensing and Patent Information

The IDEA cryptographic cipher described in U.S. patent number 5,214,703 is licensed from Ascom Tech AG. The CAST-128 encryption algorithm,

implemented from RFC 2144, is available worldwide on a royalty-free basis for commercial and non-commercial uses. PGP Corporation has secured a

license to the patent rights contained in the patent application Serial Number 10/655,563 by The Regents of the University of California, entitled Block

Cipher Mode of Operation for Constructing a Wide-blocksize block Cipher from a Conventional Block Cipher. Some third-party software included in PGP

Universal Server is licensed under the GNU General Public License (GPL). PGP Universal Server as a whole is not licensed under the GPL. If you would

like a copy of the source code for the GPL software included in PGP Universal Server, contact PGP Support (

https://support.pgp.com). PGP Corporation

may have patents and/or pending patent applications covering subject matter in this software or its documentation; the furnishing of this software or

documentation does not give you any license to these patents.

Acknowledgments

This product includes or may include:

-- The Zip and ZLib compression code, created by Mark Adler and Jean-Loup Gailly, is used with permission from the free Info-ZIP implementation,

developed by zlib (

http://www.zlib.net). -- Libxml2, the XML C parser and toolkit developed for the Gnome project and distributed and copyrighted under

the MIT License found at

http://jakarta.apache.org/), web server

(

http://www.apache.org/), Jakarta Commons (http://jakarta.apache.org/commons/license.html) and log4j, a Java-based library used to parse HTML,

developed by the Apache Software Foundation. The license is at

www.apache.org/licenses/LICENSE-2.0.txt. -- Castor, an open-source, data-binding

framework for moving data from XML to Java programming language objects and from Java to databases, is released by the ExoLab Group under an

Apache 2.0-style license, available at

http://www.castor.org/license.html. -- Xalan, an open-source software library from the Apache Software

Foundation that implements the XSLT XML transformation language and the XPath XML query language, is released under the Apache Software

License, version 1.1, available at

http://xml.apache.org/xalan-j/#license1.1. -- Apache Axis is an implementation of the SOAP ("Simple Object Access

Protocol") used for communications between various PGP products is provided under the Apache license found at

http://www.apache.org/licenses/LICENSE-2.0.txt. -- mx4j, an open-source implementation of the Java Management Extensions (JMX), is released under

an Apache-style license, available at

http://mx4j.sourceforge.net/docs/ch01s06.html. -- jpeglib version 6a is based in part on the work of the

Independent JPEG Group. (

http://www.ijg.org/) -- libxslt the XSLT C library developed for the GNOME project and used for XML transformations is

distributed under the MIT License

http://www.opensource.org/licenses/mit-license.html. -- PCRE Perl regular expression compiler, copyrighted and

http://www.pcre.org/license.txt. -- BIND Balanced Binary Tree Library

and Domain Name System (DNS) protocols developed and copyrighted by Internet Systems Consortium, Inc. (

http://www.isc.org) -- Free BSD

http://net-snmp.sourceforge.net/about/license.html. -- NTP version 4.2 developed

by Network Time Protocol and copyrighted to various contributors. -- Lightweight Directory Access Protocol developed and copyrighted by OpenLDAP

OpenLDAP Foundation. The license agreement is at

http://www.openldap.org/software/release/license.html. Secure shell OpenSSH developed by

OpenBSD project is released by the OpenBSD Project under a BSD-style license, available at

http://www.openbsd.org/cgi-

bin/cvsweb/src/usr.bin/ssh/LICENCE?rev=HEAD. -- PC/SC Lite is a free implementation of PC/SC, a specification for SmartCard integration is released

under the BSD license. -- Postfix, an open source mail transfer agent (MTA), is released under the IBM Public License 1.0, available at

http://www.opensource.org/licenses/ibmpl.php. -- PostgreSQL, a free software object-relational database management system, is released under a

BSD-style license, available at

http://www.postgresql.org/about/licence. -- PostgreSQL JDBC driver, a free Java program used to connect to a

BSD-style license, available at

http://jdbc.postgresql.org/license.html. -- PostgreSQL Regular Expression Library, a free software object-relational

database management system, is released under a BSD-style license, available at

http://www.postgresql.org/about/licence. -- 21.vixie-cron is the Vixie

- JacORB, a Java object used to facilitate communication between processes written in Java and the data layer, is open source licensed under the GNU

Library General Public License (LGPL) available at

open-source implementation of a CORBA Object Request Broker (ORB), and is used for communication between processes written in C/C++ and the

Vanderbilt University. The open source software license is available at

http://www.cs.wustl.edu/~schmidt/ACE-copying.html. -- libcURL, a library for

downloading files via common network services, is open source software provided under a MIT/X derivate license available at

under a BSD-style license, available at

libpopt, a library that parses command line options, is released under the terms of the GNU Free Documentation License available at

communicate with the Intel Corporation AMT chipset on a motherboard, is distributed under the gSOAP Public License version 1.3b, available at

http://www.cs.fsu.edu/~engelen/license.html. -- Windows Template Library (WTL) is used for developing user interface components and is distributed

under the Common Public License v1.0 found at

http://opensource.org/licenses/cpl1.0.php. -- The Perl Kit provides several independent utilities used to

automate a variety of maintenance functions and is provided under the Perl Artistic License, found at

http://www.perl.com/pub/a/language/misc/Artistic.html. -- rEFIt - libeg, provides a graphical interface library for EFI, including image rendering, text

rendering, and alpha blending, and is distributed under the license found at

-- Java Radius Client, used to authenticate PGP Universal Web Messenger users via Radius, is distributed under the Lesser General Public License

(LGPL) found at

http://www.gnu.org/licenses/lgpl.html. -- Yahoo! User Interface (YUI) library version 2.5.2, a Web UI interface library for AJAX.

http://developer.yahoo.com/yui/license.html. --

JSON-lib version 2.2.1, a Java library used to convert Java objects to JSON (JavaScript Object Notation) objects for AJAX. Distributed under the Apache

2.0 license, available at

http://json-lib.sourceforge.net/license.html. -- EZMorph, used by JSON-lib, is distributed under the Apache 2.0 license, available

at

http://ezmorph.sourceforge.net/license.html. -- Apache Commons Lang, used by JSON-lib, is distributed under the Apache 2.0 license, available at

http://commons.apache.org/license.html. -- Apache Commons BeanUtils, used by JSON-lib, is distributed under the Apache 2.0 license, available at

http://commons.apache.org/license.html. -- SimpleIni is an .ini format file parser and provides the ability to read and write .ini files, a common

configuration file format used on Windows, on other platforms. Distributed under the MIT License found at

http://www.opensource.org/licenses/mit-

data structures and is distributed under the MIT License found at

Mike Sharov <

[email protected]>. -- Protocol Buffers (protobuf), Google's data interchange format, are used to serialize structure data in

the PGP SDK. Distributed under the BSD license found at

reserved.

Additional acknowledgements and legal notices are included as part of the PGP Universal Server.

Export Information

Export of this software and documentation may be subject to compliance with the rules and regulations promulgated from time to time by the Bureau

of Export Administration, United States Department of Commerce, which restricts the export and re-export of certain products and technical data.

Limitations

The software provided with this documentation is licensed to you for your individual use under the terms of the End User License Agreement provided

with the software. The information in this document is subject to change without notice. PGP Corporation does not warrant that the information meets

your requirements or that the information is free of errors. The information may include technical inaccuracies or typographical errors. Changes may be

made to the information and incorporated in new editions of this document, if and when made available by PGP Corporation.

4

15

Contents

Introduction

What is PGP Universal Server? 15

PGP Universal Server Product Family 16

Who Should Read This Guide 16

Common Criteria Environments 16

Improvements in this Version of PGP Universal Server 17

Using the PGP Universal Server with the Command Line 18

Symbols 18

Getting Assistance 19

Getting product information 19

Contact Information 20

The Big Picture 21

Important Terms 21

PGP Products 21

PGP Universal Server Concepts 22

PGP Universal Server Features 23

PGP Universal Server User Types 25

Installation Overview 26

Open Ports 33

TCP Ports 33

UDP Ports 35

Naming your PGP Universal Server

37

Considering a Name for Your PGP Universal Server 37

Methods for Naming a PGP Universal Server 38

Understanding the Administrative Interface 39

System Requirements 39

Logging In 39

The System Overview Page 41

Managing Alerts 42

Logging In For the First Time 43

Administrative Interface Map 43

Icons 45

i

PGP Universal Server Contents

Licensing Your Software 51

Overview 51

Manual and Automatic Licensing 51

Licensing a PGP Universal Server 51

Licensing the Mail Proxy Feature 52

Operating in Learn Mode 53

Purpose of Learn Mode 53

Checking the Logs 54

Managing Learn Mode 54

Managed Domains

57

About Managed Domains 57

Adding Managed Domains 58

Deleting Managed Domains 58

Understanding Keys 59

Choosing a Key Mode For Key Management 59

Adding PGP Desktop Solutions to Existing Gateway Email Environments 62

Changing Key Modes 63

How PGP Universal Server Uses Certificate Revocation Lists 64

Key Reconstruction Blocks 64

Managed Key Permissions 65

Managing Organization Keys

67

About Organization Keys 67

Organization Key 67

Inspecting the Organization Key 68

Regenerating the Organization Key 68

Importing an Organization Key 69

Organization Certificate 70

Inspecting the Organization Certificate 71

Exporting the Organization Certificate 71

Deleting the Organization Certificate 72

Generating the Organization Certificate 72

Importing the Organization Certificate 73

Additional Decryption Key (ADK) 73

Importing the ADK 74

Inspecting the ADK 74

Deleting the ADK 74

Verified Directory Key 75

ii

PGP Universal Server Contents

Importing the Verified Directory Key 75

Inspecting the Verified Directory Key 75

Deleting the Verified Directory Key 76

Administering Managed Keys 77

Viewing Managed Keys 78

Managed Key Information 79

Email Addresses 81

Subkeys 81

Certificates 81

Permissions 82

Attributes 83

Symmetric Key Series 83

Symmetric Keys 85

Custom Data Objects 86

Exporting Consumer Keys 87

Exporting the Managed Key of an Internal User 88

Exporting the Managed Key of an External User 88

Exporting PGP Verified Directory User Keys 89

Exporting the Managed Key of a Managed Device 89

Deleting Consumer Keys 90

Deleting the Managed Key of an Internal User 90

Deleting the Managed Key of an External User 90

Deleting the Key of a PGP Verified Directory User 91

Deleting the Managed Key of a Managed Device 91

Approving Pending Keys 91

Revoking Managed Keys 92

Managing Trusted Keys and Certificates 95

Overview 95

Trusted Keys 95

Trusted Certificates 95

Adding a Trusted Key or Certificate 96

Inspecting and Changing Trusted Key Properties 97

Deleting Trusted Keys and Certificates 97

Searching for Trusted Keys and Certificates 98

Setting Mail Policy 99

Overview 99

How Policy Chains Work 100

Mail Policy and Dictionaries 101

Mail Policy and Key Searches 101

Mail Policy and Cached Keys 102

Migrating Settings from Version 2.0.x 102

Restoring Mail Policy Rules 103

iii

PGP Universal Server Contents

Understanding the Pre-Installed Policy Chains 108

Mail Policy Outside the Mailflow 110

Using the Rule Interface 111

The Conditions Card 111

The Actions Card 113

Building Valid Chains and Rules 114

Using Valid Processing Order 114

Creating Valid Groups 115

Creating a Valid Rule 116

Managing Policy Chains 117

Mail Policy Best Practices 117

Restoring Mail Policy to Default Settings 117

Editing Policy Chain Settings 118

Adding Policy Chains 118

Deleting Policy Chains 119

Exporting Policy Chains 120

Printing Policy Chains 120

Managing Rules 121

Adding Rules to Policy Chains 121

Deleting Rules from Policy Chains 121

Enabling and Disabling Rules 122

Changing the Processing Order of the Rules 122

Adding Key Searches 122

Choosing Condition Statements, Conditions, and Actions 123

Condition Statements 123

Conditions 124

Actions 131

Working with Common Access Cards 144

Applying Key Not Found Settings to External Users 145

Overview 145

Bounce the Message 146

PDF Messenger 146

Certified Delivery with PDF Messenger 147

Send Unencrypted 147

Smart Trailer 148

PGP Universal Web Messenger 149

Changing Policy Settings 150

Changing User Delivery Method Preference 151

Using Dictionaries with Policy 153

Overview 153

Default Dictionaries 154

Editing Default Dictionaries 156

User-Defined Dictionaries 157

Adding a User-Defined Dictionary 157

iv

PGP Universal Server Contents

Editing a User-Defined Dictionary 158

Deleting a Dictionary 158

Exporting a Dictionary 159

Searching the Dictionaries 159

Keyservers, SMTP Archive Servers, and Mail Policy 161

Overview 161

Keyservers 161

Adding or Editing a Keyserver 162

Deleting a Keyserver 164

SMTP Servers 164

Adding or Editing an Archive Server 164

Deleting an Archive Server 165

Managing Keys in the Key Cache 167

Overview 167

Changing Cached Key Timeout 167

Purging Keys from the Cache 168

Trusting Cached Keys 168

Viewing Cached Keys 168

Searching the Key Cache 169

Configuring Mail Proxies 171

Overview 171

PGP Universal Server and Mail Proxies 171

Mail Proxies in an Internal Placement 172

Mail Proxies in a Gateway Placement 173

Changes in Proxy Settings from PGP Universal Server 2.0 to 2.5 and later 175

Mail Proxies Page 175

Creating New or Editing Existing Proxies 176

Creating or Editing a POP/IMAP Proxy 176

Creating or Editing an Outbound SMTP Proxy 178

Creating or Editing an Inbound SMTP Proxy 180

Creating or Editing a Unified SMTP Proxy 182

Email in the Mail Queue 187

Overview 187

Deleting Messages from the Mail Queue 188

Specifying Mail Routes 189

Overview 189

Managing Mail Routes 190

v

PGP Universal Server Contents

Adding a Mail Route 190

Editing a Mail Route 191

Deleting a Mail Route 191

Customizing System Message Templates 193

Overview 193

Templates and Message Size 194

PDF Messenger Templates 194

Templates for New PGP Universal Web Messenger Users 194

Editing a Message Template 195

Managing Groups 197

Understanding Groups 197

Sorting Consumers into Groups 197

Everyone Group 198

Excluded Group 198

Policy Group Order 199

Migrating Groups from Version 2.x 199

Setting Policy Group Order 199

Creating a New Group 199

Deleting a Group 200

Viewing Group Members 200

Manually Adding Group Members 201

Manually Removing Members from a Group 201

Group Permissions 202

Adding Group Permissions 203

Deleting Group Permissions 203

Setting Group Membership 204

Searching Groups 205

Creating Group Client Installations 205

How Group Policy is Assigned to PGP Desktop Installers 206

Creating PGP Desktop Installers 207

Managing Devices 211

Managed Devices 212

Adding and Deleting Managed Devices 212

Adding Managed Devices to Groups 213

Managed Device Information 214

Deleting Managed Devices from PGP Universal Server 218

Deleting Managed Devices from Groups 219

WDE Devices (Computers and Disks) 220

WDE Computers 220

WDE Disks 222

Searching for Devices 223

vi

PGP Universal Server Contents

Administering Consumer Policy 225

Understanding Consumer Policy 225

Making Sure Users Create Strong Passphrases 226

Understanding Entropy 226

Using the Windows Preinstallation Environment 227

X.509 Certificate Management in Lotus Notes Environments 227

Trusting Certificates Created by PGP Universal Server 228

Setting the Lotus Notes Key Settings in PGP Universal Server 230

Technical Deployment Information 231

Offline Policy 231

Using a Policy ADK 233

Out of Mail Stream Support 233

Enrolling Users through Silent Enrollment 235

Silent Enrollment with Windows 235

Silent Enrollment with Mac OS X 235

PGP Whole Disk Encryption Administration 235

PGP Whole Disk Encryption on Mac OS X with FileVault 236

How Does Single Sign-On Work? 236

Enabling Single Sign-On 237

Managing Clients Remotely Using a PGP WDE Administrator Active Directory Group 238

Managing Clients Locally Using the PGP WDE Administrator Key 239

Managing Consumer Policies 240

Adding a Consumer Policy 241

Editing a Consumer Policy 241

Deleting a Consumer Policy 242

Setting Policy for Clients 243

Client and PGP Universal Server Version Compatibility 243

Serving PGP Admin 8 Preferences 244

Establishing PGP Desktop Settings for Your PGP Desktop Clients 245

PGP Desktop Feature License Settings 245

Controlling PGP Desktop Components 246

PGP Portable 248

PGP Mobile 248

PGP NetShare 249

How the PGP NetShare Policy Settings Work Together 249

Multi-user environments and managing PGP NetShare 249

Backing Up PGP NetShare-Protected Files 250

Using Directory Synchronization to Manage Consumers

251

How PGP Universal Server Uses Directory Synchronization 251

Base DN and Bind DN 253

Consumer Matching Rules 254

Understanding User Enrollment Methods 254

vii

PGP Universal Server Contents

Before Creating a Client Installer 255

Email Enrollment 256

Directory Enrollment 257

Enabling Directory Synchronization 260

Adding or Editing an LDAP Directory 260

The LDAP Servers Tab 261

The Base Distinguished Name Tab 262

The Consumer Matching Rules Tab 262

Testing the LDAP Connection 263

Using Sample Records to Configure LDAP Settings 263

Deleting an LDAP Directory 263

Setting LDAP Directory Order 264

Directory Synchronization Settings 264

Managing User Accounts

267

Understanding User Account Types 267

Viewing User Accounts 267

User Management Tasks 267

Setting User Authentication 268

Editing User Attributes 268

Adding Users to Groups 268

Editing User Permissions 269

Deleting Users 269

Searching for Users 270

Viewing User Log Entries 270

Changing Display Names and Usernames 270

Exporting a User’s X.509 Certificate 271

Revoking a User's X.509 Certificate 272

Managing User Keys 272

Managing Internal User Accounts 273

Importing Internal User Keys Manually 273

Creating New Internal User Accounts 274

Exporting PGP Whole Disk Encryption Login Failure Data 274

Internal User Settings 275

Managing External User Accounts 279

Importing External Users 280

Exporting Delivery Receipts 280

External User Settings 281

Managing Verified Directory User Accounts 283

Importing Verified Directory Users 284

PGP Verified Directory User Settings 284

Recovering Encrypted Data in an Enterprise Environment

287

Using Key Reconstruction 287

Recovering Encryption Key Material without Key Reconstruction 288

Encryption Key Recovery of CKM Keys 288

viii

PGP Universal Server Contents

Encryption Key Recovery of GKM Keys 288

Encryption Key Recovery of SCKM Keys 289

Encryption Key Recovery of SKM Keys 290

Using an Additional Decryption Key for Data Recovery 290

PGP Universal Satellite 293

Overview 293

Technical Information 294

Distributing the PGP Universal Satellite Software 294

Configuration 295

Deployment Mode 295

Key Mode 295

PGP Universal Satellite Configurations 296

Switching Key Modes 300

Binding 300

Pre-Binding 301

Manual Binding 302

Policy and Key or Certificate Retrieval 303

Retrieving Lost Policies 304

Retrieving Lost Keys or Certificates 305

PGP Universal Satellite for Mac OS X 309

Overview 309

System Requirements 309

Obtaining the Installer 310

Installation 310

Updates 311

Files 311

PGP Universal Satellite for Windows

313

Overview 313

System Requirements 314

Obtaining the Installer 314

Installation 315

Updates 316

Files 316

MAPI Support 316

External MAPI Configuration 316

Internal MAPI Configuration 317

Using MAPI 318

Lotus Notes Support 319

External Lotus Notes Configuration 319

Internal Lotus Notes Configuration 320

Using Lotus Notes 321

Notes IDs 321

ix

PGP Universal Server Contents

Configuring PGP Universal Web Messenger 323

Overview 323

PGP Universal Web Messenger and Clustering 324

External Authentication 325

Customizing PGP Universal Web Messenger 326

Adding a New Template 327

Troubleshooting Customization 331

Changing the Active Template 334

Deleting a Template 334

Editing a Template 334

Downloading Template Files 335

Restoring to Factory Defaults 335

Configuring the PGP Universal Web Messenger Service 335

Starting and Stopping PGP Universal Web Messenger 336

Selecting the PGP Universal Web Messenger Network Interface 336

Setting Up External Authentication 338

Creating Settings for PGP Universal Web Messenger User Accounts 339

Setting Message Replication in a Cluster 340

Configuring the Integrated Keyserver 341

Overview 341

Starting and Stopping the Keyserver Service 341

Configuring the Keyserver Service 342

Configuring the PGP Verified Directory 345

Overview 345

Starting and Stopping the PGP Verified Directory 346

Configuring the PGP Verified Directory 346

Managing the Certificate Revocation List Service

349

Overview 349

Starting and Stopping the CRL Service 349

Editing CRL Service Settings 350

Configuring Universal Services Protocol 351

Starting and Stopping USP 351

Adding USP Interfaces 351

x

PGP Universal Server Contents

System Graphs 353

Overview 353

CPU Usage 353

Message Activity 354

Whole Disk Encryption 354

Recipient Statistics 355

Recipient Domain Statistics 355

System Logs 357

Overview 357

Filtering the Log View 358

Searching the Log Files 359

Exporting a Log File 359

Enabling External Logging 360

Configuring SNMP Monitoring 361

Overview 361

Starting and Stopping SNMP Monitoring 362

Configuring the SNMP Service 362

Downloading the Custom MIB File 363

Shutting Down and Restarting Services and Power 365

Overview 365

Server Information 365

Setting the Time 365

Updating Software 366

Licensing a PGP Universal Server 366

Downloading the Release Notes 367

Shutting Down and Restarting the PGP Universal Server Software Services 367

Shutting Down and Restarting the PGP Universal Server Hardware 367

Managing Administrator Accounts 369

Overview 369

Administrator Roles 370

Administrator Authentication 370

Creating a New Administrator 371

Importing SSH v2 Keys 372

Deleting Administrators 372

Inspecting and Changing the Settings of an Administrator 373

Configuring RSA SecurID Authentication 374

Resetting SecurID PINs 375

xi

PGP Universal Server Contents

Daily Status Email 376

Protecting PGP Universal Server with Ignition Keys 377

Overview 377

Ignition Keys and Clustering 378

Preparing Hardware Tokens to be Ignition Keys 379

Configuring a Hardware Token Ignition Key 380

Configuring a Soft-Ignition Passphrase Ignition Key 381

Deleting Ignition Keys 381

Backing Up and Restoring System and User Data 383

Overview 383

Creating Backups 383

Scheduling Backups 384

Performing On-Demand Backups 384

Configuring the Backup Location 384

Restoring From a Backup 385

Restoring On-Demand 386

Restoring Configuration 386

Restoring from a Different Version 387

Updating PGP Universal Server Software 389

Overview 389

Inspecting Update Packages 390

Establishing Software Update Settings 390

Checking for New Updates 391

Uploading Update Packages 391

Manually Installing an Update 391

Setting Network Interfaces

393

Understanding the Network Settings 393

Connecting to a Proxy Server 394

Changing Interface Settings 394

Adding Interface Settings 395

Deleting Interface Settings 395

Editing Global Network Settings 395

Assigning a Certificate 396

Working with Certificates 396

Importing an Existing Certificate 397

Generating a Certificate Request 397

Adding a Pending Certificate 398

Inspecting a Certificate 399

Exporting a Certificate 399

Deleting a Certificate 399

xii

PGP Universal Server Contents

Clustering your PGP Universal Servers 401

Overview 401

Clustering and PGP Universal Web Messenger 402

Cluster Status 403

Creating a Cluster 404

Deleting Cluster Members 406

Managing Settings for Cluster Members 406

Changing Network Settings in Clusters 408

Index 409

xiii

1

Introduction

This Administrator’s Guide describes both the PGP Universal Server

™

and client

software. It tells you how to get them up and running on your network, how to

configure them, and how to maintain them. This section provides a high-level

overview of PGP Universal Server.

What is PGP Universal Server?

PGP Universal Server is a single console for managing the applications that

provide email, disk, and network file encryption.

PGP Universal Server with PGP Universal Gateway Email gives you secure

messaging: it transparently protects your enterprise messages with little or no

user interaction.

The PGP Universal Server also replaces the PGP Keyserver product with a built-

in keyserver, and the PGP Admin product with PGP Desktop configuration and

deployment capabilities.

PGP Universal Server automatically creates and maintains a Self-Managing

Security Architecture (SMSA) by monitoring authenticated users and their email

traffic. You can also send protected messages to addresses that are not part of

the SMSA. The PGP Universal Server encrypts, decrypts, signs, and verifies

messages automatically, providing strong security through policies you control.

PGP Universal Satellite, a client-side feature of PGP Universal Server, extends

PGP security for email messages all the way to the computer of the email user,

it allows external users to become part of the SMSA, and it gives end users the

option to create and manage their keys on their own computer (if allowed by the

PGP administrator).

PGP Desktop, a client product, is created and managed through PGP Universal

Server policy. It creates PGP keypairs and can manage user keypairs as well as

store the public keys of others. It encrypts user email and instant messaging

(IM). It can encrypt entire or partial hard drives. It also enables secure file

sharing with others over a network.

15

PGP Universal Server Introduction

PGP Universal Server Product Family

PGP Universal Server functions as a management console for a variety of

encryption solutions. You can purchase any of the PGP Desktop applications or

bundles and use PGP Universal Server to create and manage client installations.

You can also purchase a license that enables PGP Gateway Email to encrypt

email in the mailstream.

The PGP Universal Server can manage any combination of PGP encryption

applications. PGP encryption applications are:

 PGP Universal Gateway Email provides automatic email encryption in the

gateway, based on centralized mail policy. This product requires

administration by the PGP Universal Server.

 PGP Desktop Email provides encryption at the desktop for mail, files, and

AOL Instant Messenger traffic. This product can be managed by the PGP

Universal Server.

 PGP Whole Disk Encryption provides encryption at the desktop for an

entire disk. This product can be managed by the PGP Universal Server.

 PGP NetShare provides transparent file encryption and sharing among

desktops. This product can be managed by the PGP Universal Server.

Who Should Read This Guide

This Administrator’s Guide is for the person or persons who implement and

maintain your organization’s PGP Universal Server environment. These are the

PGP Universal Server administrators.

This guide is also intended for anyone else who wants to learn about how PGP

Universal Server works.

Common Criteria Environments

To be Common Criteria compliant, please refer to the best practices shown in

PGP Universal Server 2.9 Common Criteria Supplemental. Note that these best

practices supersede recommendations made elsewhere in this and other

documentation.

16

Page is loading ...

PGP Universal Server 3.0 User guide

Related papers

Other documents