PGP Universal Server 3.1 User manual

Brand: PGP

Model: Universal Server 3.1

Type: User manual

PGP Universal™ Server Upgrade Guide

Upgrade Guide

Version Information

PGP Universal Server Upgrade Guide. PGP Universal Server Version 3.1.0. Released September 2010.

means, electronic or mechanical, for any purpose, without the express written permission of PGP Corporation.

Trademark Information

PGP, Pretty Good Privacy, and the PGP logo are registered trademarks of PGP Corporation in the US and other countries. IDEA is a trademark of

Ascom Tech AG. Windows and ActiveX are registered trademarks of Microsoft Corporation. AOL is a registered trademark, and AOL Instant

Messenger is a trademark, of America Online, Inc. Red Hat and Red Hat Linux are trademarks or registered trademarks of Red Hat, Inc. Linux is a

registered trademark of Linus Torvalds. Solaris is a trademark or registered trademark of Sun Microsystems, Inc. AIX is a trademark or registered

trademark of International Business Machines Corporation. HP-UX is a trademark or registered trademark of Hewlett-Packard Company. SSH and

Secure Shell are trademarks of SSH Communications Security, Inc. Rendezvous and Mac OS X are trademarks or registered trademarks of Apple

Computer, Inc. All other registered and unregistered trademarks in this document are the sole property of their respective owners.

Licensing and Patent Information

The IDEA cryptographic cipher described in U.S. patent number 5,214,703 is licensed from Ascom Tech AG. The CAST-128 encryption algorithm,

implemented from RFC 2144, is available worldwide on a royalty-free basis for commercial and non-commercial uses. PGP Corporation has secured a

license to the patent rights contained in the patent application Serial Number 10/655,563 by The Regents of the University of California, entitled Block

Cipher Mode of Operation for Constructing a Wide-blocksize block Cipher from a Conventional Block Cipher. Some third-party software included in PGP

Universal Server is licensed under the GNU General Public License (GPL). PGP Universal Server as a whole is not licensed under the GPL. If you would

like a copy of the source code for the GPL software included in PGP Universal Server, contact PGP Support (

https://support.pgp.com). PGP Corporation

may have patents and/or pending patent applications covering subject matter in this software or its documentation; the furnishing of this software or

documentation does not give you any license to these patents.

Acknowledgments

This product includes or may include:

-- The Zip and ZLib compression code, created by Mark Adler and Jean-Loup Gailly, is used with permission from the free Info-ZIP implementation,

developed by zlib (

http://www.zlib.net). -- Libxml2, the XML C parser and toolkit developed for the Gnome project and distributed and copyrighted

under the MIT License found at

http://jakarta.apache.org/), web

server (

http://www.apache.org/), Jakarta Commons (http://jakarta.apache.org/commons/license.html) and log4j, a Java-based library used to parse

HTML, developed by the Apache Software Foundation. The license is at

www.apache.org/licenses/LICENSE-2.0.txt. -- Castor, an open-source, data-

binding framework for moving data from XML to Java programming language objects and from Java to databases, is released by the ExoLab Group

under an Apache 2.0-style license, available at

http://www.castor.org/license.html. -- Xalan, an open-source software library from the Apache Software

Foundation that implements the XSLT XML transformation language and the XPath XML query language, is released under the Apache Software

License, version 1.1, available at

http://xml.apache.org/xalan-j/#license1.1. -- Apache Axis is an implementation of the SOAP ("Simple Object Access

Protocol") used for communications between various PGP products is provided under the Apache license found at

http://www.apache.org/licenses/LICENSE-2.0.txt. -- mx4j, an open-source implementation of the Java Management Extensions (JMX), is released

under an Apache-style license, available at

http://mx4j.sourceforge.net/docs/ch01s06.html. -- jpeglib version 6a is based in part on the work of the

Independent JPEG Group. (

http://www.ijg.org/) -- libxslt the XSLT C library developed for the GNOME project and used for XML transformations is

distributed under the MIT License

http://www.opensource.org/licenses/mit-license.html. -- PCRE Perl regular expression compiler, copyrighted and

http://www.pcre.org/license.txt. -- BIND Balanced Binary Tree Library

and Domain Name System (DNS) protocols developed and copyrighted by Internet Systems Consortium, Inc. (

http://www.isc.org) -- Free BSD

http://net-snmp.sourceforge.net/about/license.html. -- NTP version 4.2 developed

by Network Time Protocol and copyrighted to various contributors. -- Lightweight Directory Access Protocol developed and copyrighted by OpenLDAP

OpenLDAP Foundation. The license agreement is at

http://www.openldap.org/software/release/license.html. Secure shell OpenSSH developed by

OpenBSD project is released by the OpenBSD Project under a BSD-style license, available at

http://www.openbsd.org/cgi-

bin/cvsweb/src/usr.bin/ssh/LICENCE?rev=HEAD. -- PC/SC Lite is a free implementation of PC/SC, a specification for SmartCard integration is released

under the BSD license. -- Postfix, an open source mail transfer agent (MTA), is released under the IBM Public License 1.0, available at

http://www.opensource.org/licenses/ibmpl.php. -- PostgreSQL, a free software object-relational database management system, is released under a

BSD-style license, available at

http://www.postgresql.org/about/licence. -- PostgreSQL JDBC driver, a free Java program used to connect to a

BSD-style license, available at

http://jdbc.postgresql.org/license.html. -- PostgreSQL Regular Expression Library, a free software object-relational

database management system, is released under a BSD-style license, available at

http://www.postgresql.org/about/licence. -- 21.vixie-cron is the Vixie

- JacORB, a Java object used to facilitate communication between processes written in Java and the data layer, is open source licensed under the

GNU Library General Public License (LGPL) available at

is an open-source implementation of a CORBA Object Request Broker (ORB), and is used for communication between processes written in C/C++ and

Vanderbilt University. The open source software license is available at

http://www.cs.wustl.edu/~schmidt/ACE-copying.html. -- libcURL, a library for

downloading files via common network services, is open source software provided under a MIT/X derivate license available at

under a BSD-style license, available at

libpopt, a library that parses command line options, is released under the terms of the GNU Free Documentation License available at

to communicate with the Intel Corporation AMT chipset on a motherboard, is distributed under the gSOAP Public License version 1.3b, available at

http://www.cs.fsu.edu/~engelen/license.html. -- Windows Template Library (WTL) is used for developing user interface components and is distributed

under the Common Public License v1.0 found at

http://opensource.org/licenses/cpl1.0.php. -- The Perl Kit provides several independent utilities used to

automate a variety of maintenance functions and is provided under the Perl Artistic License, found at

http://www.perl.com/pub/a/language/misc/Artistic.html. -- rEFIt - libeg, provides a graphical interface library for EFI, including image rendering, text

rendering, and alpha blending, and is distributed under the license found at

reserved. -- Java Radius Client, used to authenticate PGP Universal Web Messenger users via Radius, is distributed under the Lesser General Public

License (LGPL) found at

http://www.gnu.org/licenses/lgpl.html. -- Yahoo! User Interface (YUI) library version 2.5.2, a Web UI interface library for AJAX.

http://developer.yahoo.com/yui/license.html. --

JSON-lib version 2.2.1, a Java library used to convert Java objects to JSON (JavaScript Object Notation) objects for AJAX. Distributed under the

Apache 2.0 license, available at

http://json-lib.sourceforge.net/license.html. -- EZMorph, used by JSON-lib, is distributed under the Apache 2.0 license,

available at

http://ezmorph.sourceforge.net/license.html. -- Apache Commons Lang, used by JSON-lib, is distributed under the Apache 2.0 license,

available at

http://commons.apache.org/license.html. -- Apache Commons BeanUtils, used by JSON-lib, is distributed under the Apache 2.0 license,

available at

http://commons.apache.org/license.html. -- SimpleIni is an .ini format file parser and provides the ability to read and write .ini files, a

common configuration file format used on Windows, on other platforms. Distributed under the MIT License found at

Standard Template Library functions and data structures and is distributed under the MIT License found at

http://www.opensource.org/licenses/mit-

format, are used to serialize structure data in the PGP SDK. Distributed under the BSD license found at

http://www.opensource.org/licenses/bsd-

Additional acknowledgements and legal notices are included as part of the PGP Universal Server.

Export Information

Export of this software and documentation may be subject to compliance with the rules and regulations promulgated from time to time by the Bureau

of Export Administration, United States Department of Commerce, which restricts the export and re-export of certain products and technical data.

Limitations

The software provided with this documentation is licensed to you for your individual use under the terms of the End User License Agreement provided

with the software. The information in this document is subject to change without notice. PGP Corporation does not warrant that the information meets

your requirements or that the information is free of errors. The information may include technical inaccuracies or typographical errors. Changes may be

made to the information and incorporated in new editions of this document, if and when made available by PGP Corporation.

Unsupported Third Party Products

By utilizing third party products, software, drivers, or other components ("Unsupported Third Party Product") to interact with the PGP software and/or by

utilizing any associated PGP command or code provided by to you by PGP at its sole discretion to interact with the Unsupported Third Party Product

("PGP Third Party Commands"), you acknowledge that the PGP software has not been designed for or formally tested with the Unsupported Third Party

Product, and therefore PGP provides no support or warranties with respect to the PGP Third Party Commands or the PGP software's compatibility with

Unsupported Third Party Products. THE PGP THIRD PARTY COMMANDS ARE PROVIDED "AS IS," WITH ALL FAULTS, AND THE ENTIRE RISK AS TO

SATISFACTORY QUALITY, PERFORMANCE, ACCURACY, AND EFFORT IS WITH YOU. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE

LAW, PGP DISCLAIMS ALL REPRESENTATIONS, WARRANTIES, AND CONDITIONS, WHETHER EXPRESS OR IMPLIED, INCLUDING ANY

WARRANTIES OR CONDITIONS OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NONINFRINGEMENT, QUIET

ENJOYMENT, AND ACCURACY WITH RESPECT TO THE PGP THIRD PARTY COMMANDS OR THE PGP SOFTWARE'S COMPATIBILITY WITH THE

UNSUPPORTED THIRD PARTY PRODUCT.

Contents

Introduction

Who Should Read This Guide 1

Common Criteria Environments 1

Using the PGP Universal Server with the Command Line 1

Symbols 2

Getting Assistance 2

Getting product information 2

Contact Information 3

Upgrading the PGP Universal Server 5

Licensing the Upgrade 5

Backing Up the Data and Organization Key 6

Overview 7

Best Practices for Upgrade 10

Supported Client and PGP Universal Server Version Combinations 11

Configuring the PGP Universal Server 13

Restoring Configuration and Data 13

Migrating Groups from Version 2.x 14

Restoring Mail Policy Rules 15

Migrating a Cluster 21

Cluster Migration Overview 21

Identifying Cluster Synchronization Issues Prior to Migration 23

Accessing the PGP Universal Server using SSH 24

Migrating your Primary Cluster Server 25

Migrating a Secondary Cluster Member 27

Manually Reconfiguring Non-replicated Server Settings 28

Changing Your Web Messenger Message Replication Settings 29

Index 31

Introduction

This Upgrade Guide describes how to upgrade PGP Universal

™

Server software,

and how to migrate your data to new versions. It explains how to upgrade

previous versions of PGP Universal Server to version 3.1.0, and how to migrate

a cluster to version 3.1.0.

This section provides a high-level overview of PGP Universal Server.

Who Should Read This Guide

This Upgrade Guide is for the person or persons who will be upgrading the

software or migrating the data of your organization’s PGP Universal Server

environment. These are the PGP administrators.

Common Criteria Environments

To be Common Criteria compliant, please refer to the best practices shown in

PGP Universal Server 2.9 Common Criteria Supplemental. Note that these best

practices supersede recommendations made elsewhere in this and other

documentation.

Using the PGP Universal Server with the Command Line

Using the PGP Universal Server command line for read-only access (such as to

view settings, services, logs, processes, disk space, query the database, etc) is

supported. However, performing configuration modifications via the command

line voids your PGP Support agreement unless these procedures are followed.

Any changes made to the PGP Universal Server via the command line must be:

 Authorized in writing by PGP Support.

 Implemented by a PGP Partner, reseller or internal employee who is

certified in the PGP Advanced Administration and Deployment Training.

 Summarized and documented in a text file in

/var/lib/ovid/customization on the PGP Universal Server itself.

PGP Universal™ Server Upgrade Guide Introduction

Changes made through the command line might not persist through reboots

and might be incompatible with future releases. PGP Support can require

reverting any custom configurations on the PGP Universal Server back to a

default state when troubleshooting new issues.

Symbols

Notes, Cautions, and Warnings are used in the following ways.

Note: Notes are extra, but important, information. A Note calls your attention

to important aspects of the product. You can use the product better if you

read the Notes.

Caution: Cautions indicate the possibility of loss of data or a minor security

breach. A Caution tells you about a situation where problems can occur

unless precautions are taken. Pay attention to Cautions.

Warning: Warnings indicate the possibility of significant data loss or a major

security breach. A Warning means serious problems will occur unless you

take the appropriate action. Please take Warnings very seriously.

Getting Assistance

For additional resources, see these sections.

Getting product information

The following documents and online help are companions to the PGP Universal

Server Administrator’s Guide. This guide occasionally refers to information that

can be found in one or more of these sources:

 Online help is installed and is available within the PGP Universal Server

product.

 PGP Universal Server Installation Guide—Describes how to install the

PGP Universal Server software.

 PGP Universal Server Upgrade Guide—Describes the process of

upgrading your PGP Universal Server.

 PGP Universal Mail Policy Diagram—Provides a graphical representation

of how email is processed through mail policy. You can access this

document via the PGP Universal Server online help.

 Tutorials—Provides animated introductions on how to manage the mail

policy feature in PGP Universal Server 2.5 and later, and how upgraded

PGP Universal Server settings migrate into the new mail policy feature.

PGP Universal™ Server Upgrade Guide Introduction

You can also access all the documentation and tutorials by clicking the

online help icon in the upper-right corner of the PGP Universal Server

screen.

 PGP Universal Satellite for Windows and Mac OS X include online help.

 PGP Universal Server and PGP Satellite release notes are also provided,

which may have last-minute information not found in the product

documentation.

The documentation, provided as Adobe Acrobat PDF files, are available on the

Documentation (

https://pgp.custhelp.com/app/docs) section on the PGP Support

Portal.

Once PGP Universal Server is released, additional information regarding the

product is added to the online Knowledge Base available on PGP Corporation’s

Support Portal (

https://support.pgp.com).

Contact Information

Contacting Technical Support

 To learn about PGP support options and how to contact PGP Technical

Support, please visit the PGP Corporation Support Home Page

(

https://support.pgp.com).

 To access the PGP Support Knowledge Base or request PGP Technical

Support, please visit PGP Support Portal Web Site

(

https://support.pgp.com). Note that you may access portions of the

PGP Support Knowledge Base without a support agreement;

however, you must have a valid support agreement to request

Technical Support.

 To access the PGP Support forums, please visit PGP Support

(

http://forum.pgp.com). These are user community support forums hosted

by PGP Corporation.

Contacting Customer Service

 For help with orders, downloads, and licensing, please visit PGP

Corporation Customer Service (

https://pgp.custhelp.com/app/cshome).

Contacting Other Departments

 For any other contacts at PGP Corporation, please visit the PGP Contacts

Page (

http://www.pgp.com/about_pgp_corporation/contact/index.html).

 For general information about PGP Corporation, please visit the PGP Web

Site (

http://www.pgp.com).

PGP Universal™ Server Upgrade Guide Introduction

Upgrading the PGP

Universal Server

This chapter describes how to upgrade previous versions of PGP Universal

Server to version 3.1 for a single server.

Warning: If you have a hardware token Ignition Key or a Hardware Security

Module (HSM), you must contact PGP Technical Support before migrating to

PGP Universal Server 3.1.0. Migration to version 3.1.0 requires the creation

of a new setting on the upgraded (3.1.0) version of PGP Universal Server

before you restore the backup from your previous system. This setting can

only be added through SSH access, with the help of PGP Technical Support.

If you migrate to version 3.1.0 without adding this preference, you will be

locked out of the user interface after upgrade and you will not be able to use

your hardware token Ignition Key to unlock your PGP Universal Server.

This can also occur if you upgrade from 3.0.0 to 3.1.0 using a PUP update. If

you plan to do a PUP update from 3.0.0, you must edit the settings in your

3.0.0 installation BEFORE you do the update. You do not need to change any

settings if you are running PGP Universal Server version 3.0.1.

Warning: If you plan to migrate a cluster from PGP Universal Server version

2.x to PGP Universal Server version 3.1.0, you must run the most recent

pgpSyncUsers utility on your 2.x cluster to ensure the user data is consistent

prior to beginning the migration process. See Migrating a Cluster (on page 21)

for details.

Important: In order to successfully migrate your data from PGP Universal

Server 2.x to PGP Universal Server version 3.1.0, you should plan to have

disk space available equal to 10 times the size of the backup file (the backup

file will be significantly smaller that the size of the original 2.x database). For

example, if your version 2.x backup file is 1 GB in size, you should have 10

GB of disk space available to allow for the migration and re-expansion of your

data into the 3.1 database.

Licensing the Upgrade

The licensing mechanism for the PGP Universal Server and the managed PGP

Desktop has changed as of PGP Universal Server version 3.1. However, if you

have a valid subscription license or Perpetual 2.0 License, you will not need a

new license to use PGP Universal Server 3.1.0.

PGP Universal™ Server Upgrade Guide Upgrading the PGP Universal Server

If you had PGP Desktop licenses configured through Consumer (User) Policies,

these will continue to be valid and the appropriate features will be enabled after

you upgrade.

However, if you perform a new installation of PGP Universal Server version 3.1,

you will not be able to add your old PGP Desktop licenses through the Client

Licensing page of your Consumer Policies. You will need to restore a backup

that includes your previous licenses in order to continue to use your old PGP

Desktop licenses.

Backing Up the Data and Organization Key

Warning: Back up the Organization Key and all the data from your PGP

Universal Server before you upgrade. Make sure you back up your data to an

external location, because the software installation process will delete all data

stored on your PGP Universal Server. For more information, see the

documentation you received with your version of PGP Universal Server.

Caution: If you do not or cannot use FTP to back up your data to an external

location, contact PGP Support (PGP Corporation Support Home Page

(https://support.pgp.com)).

Export the entire keypair of the Organization Key.

1 From Organization > Organization Keys (for versions prior to 3.0) or Keys

> Organization Keys (for version 3.0 or later), select the Organization Key.

The Organization Key Info dialog appears.

2 Click Export.

The Export Key dialog appears.

3 Select Export Keypair and type the passphrase. Click Export to save the

Organization Keypair to your desktop.

4 Back up the server data and configuration to an external server location.

From System > Backups, click Backup Location.

The Backup Location dialog appears.

5 Specify the remote location where you want the data to be saved, and click

Save. It is important that you save the data somewhere other than the PGP

Universal Server itself, because all data on the PGP Universal Server will be

erased during the software installation.

The Backups page appears.

6 Click Backup Now to back up the data.

PGP Universal™ Server Upgrade Guide Upgrading the PGP Universal Server

Overview

There are two methods available for upgrading a PGP Universal Server:

 The migration process, where you back up data to an external location,

install the new software version from CD or DVD, and then restore your

data. Follow the instructions in the PGP Universal Server Installation Guide

to perform an installation from DVD.

 The PUP update process, where you download and install a PGP Update

Package (PUP)format file from within the administrative interface of your

PGP Universal Server. This method automatically preserves your data and

system settings. For instructions on performing a PUP update, see the PGP

Universal Server Administrator's Guide.

Note: Not all upgrades are available as PUP update files. Some upgrades may

require a full migration where you to back up your system, perform a new

installation of the software, and restore your backup. The upgrade to version

3.1.0 from versions prior to 3.0 is an example.

Note: The licensing mechanism for the PGP Universal Server and the

managed PGP Desktop has changed as of PGP Universal Server version 3.1.

However, these changes have minimal effects on the upgrade process -- your

existing PGP Universal Server and PGP Desktop licenses will still be valid

after you upgrade.

If you perform a migration (where you back up your system, perform a new

installation, and then restore your backup) your previous licenses will be

restored, and all features that were previously enabled will continue to be

enabled. The same will be true if you upgrade from PGP Universal Server

3.0.0 or 3.0 1 using the PUP upgrade process.

Warning: There are special requirements for upgrading a cluster running

version 2.x software. For instructions on migrating a cluster, see Migrating a

Cluster (on page 21) in thePGP Universal Server Upgrade Guide.

The following applies to PGP Universal Servers that you will run as stand-

alone systems.

The upgrade to PGP Universal Server version 3.1.0 from a version prior to

version 3.0.0 requires a migration: you must back up your current system, install

the upgrade from DVD, and then restore your data.

You can migrate to PGP Universal Server 3.1.0 from version 2.7.0 or later. If you

are running a version prior to 2.7.0, you must first upgrade to 2.7.0.

If you are running PGP Universal Server version 3.0.0 or later, you can use the

PUP update process to update to version 3.1.0.

PGP Universal™ Server Upgrade Guide Upgrading the PGP Universal Server

Important: Before you upgrade to PGP Universal Server 3.1.0, you must

back up your data and your organization key to an external location. You will

need your organization key to restore your backed-up data.

You can migrate directly to PGP Universal Server version 3.1.0 from any of the

following previous versions:

 2.7.0

 2.7.1

 2.7.2

 2.8.0

 2.8.1

 2.8.2

 2.8.3

 2.9.0

 2.9.1

 2.10.0

 2.12.0

 2.12 R2

 3.0.0

 3.0.1

Note: On PGP Universal Server 3.1.0, you can only restore backed-up data from

version 2.7.0 and later. To upgrade from version 2.5.3 or 2.6.x you must first

migrate to version 2.7.0. To upgrade from a version prior to 2.5.3, you must first

upgrade to 2.5.3 and then upgrade to 2.7.0. The software installation process

deletes all data on the system. In order to migrate your existing user data and

configuration settings, you must create a backup to an external location before

upgrading, and then restore the backup to the new installation after the

upgrade. You will need both the backed-up data file and the Organization Key

used to encrypt and decrypt the backup file.

The detailed instructions for installing the software from DVD can be found in

the PGP Universal Server Installation Guide. Once the software has been

installed and the Setup Assistant has started, there are several paths you can

take through the setup, depending on how you want to restore your data.

Caution: It is not possible to upload backups of 2GB or larger through the

PGP Universal Server web interface. Contact PGP Support (PGP Corporation

Support Home Page (https://support.pgp.com)) for help restoring your data.

The following sections describe the steps required to perform an upgrade from

a previous version of PGP Universal Server for a single server that is not a

cluster member.

For instructions on migrating a cluster, see Migrating a Cluster (on page

21).

PGP Universal™ Server Upgrade Guide Upgrading the PGP Universal Server

Note: As part of restoring a backup onto the 3.1.0 system, data from the

earlier version must be migrated to the new 3.1.0 database. Once the

migration completes, the system may remain busy for a time due to database

activity. This is a normal part of the upgrade process.

 To migrate from a version of PGP Universal Server prior to 2.5.3:

1 Log in to your PGP Universal Server administrative interface.

2 Back up your version 2.0.x system data to an external location. (See the

PGP Universal Server Administrator's Guide for your software version for

installation, backup and restore instructions and best practices.)

3 Migrate to version 2.0.6 using the 2.0.6 CD. Restore your backed-up data.

4 Back up your version 2.0.6 data to an external location.

5 Migrate to version 2.5.0 using the 2.5.0 CD. Restore your backed-up data.

6 Go to

http://www.pgp.com/downloads/updates/index.html.

7 One at a time, download and install PUP updates for versions 2.5.1, 2.5.2,

and 2.5.3.

Note: You do not need to back up and restore data when upgrading using

a PUP file. However, it is always a good idea to have a current backup

when performing maintenance tasks on PGP Universal Server.

Note: When installing multiple PUP updates, download and install them

one at a time. If you download multiple PUP updates before you begin

installing them, only the first installation succeeds.

8 Back up your version 2.5.3 data and organization key to an external

location.

9 Migrate to version 2.7.0 and restore your backed up data.

10 Back up your version 2.7.0 data to an external location.

11 Upgrade to version 3.1.0 using the 3.1.0 DVD, following the instructions in

the PGP Universal Server Installation Guide.

12 Restore your backed-up data.

 To migrate from PGP Universal Server 2.5.3 or 2.6.x:

1 Log in to your PGP Universal Server administrative interface.

2 Back up your data and organization key to an external location.

3 Migrate to version 2.7.0 and restore your backed up data.

4 Back up your version 2.7.0 data to an external location.

5 Upgrade to version 3.1.0 using the 3.1.0 DVD, following the instructions in

the PGP Universal Server Installation Guide.

6 Restore your backed-up data.

PGP Universal™ Server Upgrade Guide Upgrading the PGP Universal Server

 To migrate from PGP Universal Server 2.7.0 or later

1 Log in to your PGP Universal Server administrative interface.

2 Back up your data and organization key to an external location.

3 Upgrade to version 3.1.0 using the 3.1.0 DVD, following the instructions in

the PGP Universal Server Installation Guide.

4 Restore your backed-up data.

 To upgrade from PGP Universal Server 3.0 or later

1 Backup up your version 3.0 data and organization key to an external

location. (This is not required for the update, but is strongly recommended).

2 Go to

http://www.pgp.com/downloads/updates/index.html.

3 Download the PUP update for version 3.1.0 and copy it to the computer

running PGP Universal Server version 3.0.

Note: You must have a valid maintenance agreement with PGP

Corporation to access PUP updates. For more information, see

http://www.pgp.com/products/upgrade.

4 Log in to the PGP Universal Server administrative interface.

5 Select the System tab, and then click Updates.

6 Click Upload Update Packages to upload the update package from your

hard drive.

The Upload Update dialog box appears.

7 Browse to find the file you want, then click Upload.

The update package appears on the list.

8 Click the icon in the Install column to install the update.

The text in the Date of Last Action column says “Currently Installing” while

the install is in progress.

Note: You do not need to back up and restore data when upgrading using a

PUP file. However, it is always a good idea to have a current backup when

performing maintenance tasks on PGP Universal Server.

Best Practices for Upgrade

 PGP Corporation recommends that you install and test the upgrade in a lab

or staging environment before integrating the upgrade into your network.

PGP Universal™ Server Upgrade Guide Upgrading the PGP Universal Server

 Back up the Organization Key and all the data from your PGP Universal

Server before you upgrade. Make sure you back up your data to an external

location, because the upgrade process will delete all data stored on your

PGP Universal Server. For more information, see the documentation you

received with your version of PGP Universal Server. If you do not or cannot

use FTP to back up your data to an external location, contact PGP Support

(PGP Corporation Support Home Page (

https://support.pgp.com)).

 Remember to keep a copy of the installation media saved, in case you

need to revert back to the previous version.

 During upgrade, the PGP Universal Server does not process email. Before

you upgrade your PGP Universal Server, make sure it has been temporarily

removed from the mailflow.

 If your network includes an MTA, reconfigure the MTA to stop routing

email through the PGP Universal Server.

a If all your company’s email routes through your PGP Universal Server,

configure your MTA to halt outbound email processing.

If email that matches criteria in your MTA content filter routes through

the PGP Universal Server, configure the MTA to queue email that

matches the criteria.

b Configure the MTA to queue incoming email that normally passes

through the PGP Universal Server; for example, signed and/or

encrypted email.

c Examine the PGP Universal Server log files to make sure that no email

is passing through the PGP Universal Server.

d Upgrade your PGP Universal Server and restore your user data.

e After your PGP Universal Server has been successfully upgraded,

reconfigure your MTA to resume routing email to the PGP Universal

Server.

Note: You can find more information online about moving to PGP Universal

Server 3.1.0 at the PGP Corporation website (http://www.pgp.com).

Supported Client and PGP Universal Server Version Combinations

PGP Corporation supports backward compatibility for clients only. For example,

PGP Universal Server 2.0 is not supported for use with PGP Desktop 9.9.

PGP Universal Server 3.1.0 supports managing policy of these versions (and

subsequent maintenance releases of each) of PGP Desktop:

 9.5.3

 9.6.3

 9.7.1

PGP Universal™ Server Upgrade Guide Upgrading the PGP Universal Server

 9.8.2

 9.9.0

 9.10

 9.12

 10.0.0

 10.0.1

 10.0.2

 10.1.0

Note: For the most current information on which client versions are

supported, see the Knowledge Base.

Note: There are certain features of PGP Desktop version 10.1 that may

require the addition of preference settings in PGP Universal Server to change

the default behavior or to enable new features. For information on the

features that require additional preferences, and for instructions on how to

add these preferences, see Knowledge Base Article 2212

http://support.pgp.com/?faq=2212.

PGP Universal Server 3.1.0 supports managing policy of these versions (and

subsequent maintenance releases of each) of PGP Universal Satellite:

 2.5.3

 2.6.3

 2.7.1

 2.8.2

 2.9.0

 2.10

 2.12

 3.0

 3.0.1

 3.1.0

Note: Policy options for features that are non-existent in supported legacy

versions are ignored by those installations.

PGP Universal Server 3.1.0 provides limited management support (without

policy) back to PGP Desktop version 9.0 and PGP Universal Satellite version 2.0.

PGP Universal™ Server Upgrade Guide Upgrading the PGP Universal Server

Configuring the PGP Universal Server

Now that you have the data from the previous version saved, it can be brought

into a PGP Universal Server during configuration using the Setup Assistant.

This procedure describes how to upgrade to the latest version of the software

and restore all the data and configuration information to the PGP Universal

Server.

 To upgrade and restore your data and configuration information:

1 Install the upgrade software as described in the PGP Universal Server

Installation Guide.

2 Begin configuration of the PGP Universal Server using the Setup Assistant.

In the Setup Assistant, you can elect to perform a New Installation, or you

can restore your back-up configuration and data as part of the process. If

you elect to perform a new installation you can restore your backup later

through the PGP Universal Server administrative interface.

For more information on using the Setup Assistant to configure the PGP

Universal Server as a new installation, see the PGP Universal Server

Installation Guide.

For instructions on restoring your backed up configuration and data using

the Setup Assistant, follow the instructions in Restoring Configuration and

Data (on page

13).

Restoring Configuration and Data

 To restore backed-up data during the installation of the server:

1 Access the Setup Assistant for the new server.

2 On the Welcome page, read the text and then click Forward.

The End User License Agreement page appears.

3 Read the text, click I Agree at the end, then click Forward.

The Setup Type page appears.

4 Select Restore, then click Forward.

The Import Organization Key page appears.

5 Upload a file containing your Organization Key, then click Forward.

The Upload Current Backup File page appears.

PGP Universal™ Server Upgrade Guide Upgrading the PGP Universal Server

6 Click Choose File, select the backup file from which you want to restore,

then click OK. When the Upload Current Backup File page appears again,

click Forward.

Caution: It is not possible to upload backups of 2GB or larger through the

PGP Universal Server web interface. Contact PGP Support (PGP

Corporation Support Home Page (https://support.pgp.com)) for help

restoring your data.

The backup will install.

When installation is complete, the Network Configuration Changed page

appears and the server restarts automatically. You can also check the

update or migration logs for the message "Database migration check

completed."

You will be redirected to the PGP Universal Server administrative interface.

The server is configured with the settings from the backup file you

selected.

Your PGP Desktop license(s) have been restored along with the appropriate

Consumer Policy setting. If your existing PGP Desktop licenses are valid

and provide the features you need, there is no need to change to the new

default PGP Desktop client license.

Your mail policy and proxy settings have been reproduced in the new mail

policy feature. For more information on mail policy and reproducing your

previous settings, see Migrating Groups from Version 2.x (on page

14),

Restoring Mail Policy Rules (on page

15), and the PGP Universal Server

Administrator’s Guide.

7 Continue setting up the PGP Universal Server. For more information on

configuring the PGP Universal Server after the Setup Assistant is complete,

see the PGP Universal Server Administrator's Guide.

Note: The new software version is running in Learn Mode.

Migrating Groups from Version 2.x

Caution: After migrating from a previous version of PGP Universal Server,

you must make sure that the groups are in the correct priority order. If groups

are prioritized in the wrong order, users will not receive the correct policy

settings.

In PGP Universal Server versions 2.12 and earlier, if a user could be matched to

more than one user policy, then the user received the policy with the name that

came first in alphabetical order. Administrators could not change this ordering.

In PGP Universal Server 3.1, because users can belong to more than one group,

you must make sure that the policies are ranked correctly.

PGP Universal™ Server Upgrade Guide Upgrading the PGP Universal Server

Restoring Mail Policy Rules

In PGP Universal Server version 3.1, new actions are available for use in mail

policy chains. The Outbound policy chain has been enhanced to include three

new rules:

 Sign + Encrypt Buttons: a rule that takes effect when the user selects

both the sign and encrypt plug-in buttons.

 Sign Button: a rule that takes effect when the user selects the sign plug-in

button.

 Encrypt Button: a rule that takes effect when the user selects the encrypt

plug-in button.

However, when you restore your data from a previous release, the Outbound

policy chain definition is overwritten with the backed-up Outbound policy chain,

and these three rules are missing from the policy chain. Therefore, you must

manually add these three rules back into the Outbound policy chain.

To add these rules back to the Outbound policy chain, perform the following

steps.

 Add the Sign+Encrypt Buttons rule

1 From the PGP Universal Server administrative interface, go to the Mail >

Mail Policy page, and click on the Outbound policy chain.

The Outbound policy chain details page appears.

2 Click Add Rule... to go to the Add Rule page.

3 Type "Sign + Encrypt Buttons" in the Rule Name field.

4 Type "User selects both sign and encrypt plugiin buttons." in the

Description field.

5 Under the Conditions tab, set the following:

 Condition statement: leave If all the following are true selected.

 Fill in the first condition row so that it contains the following:

Message header X-PGP-Sign-Button contains selected

 Click Add Condition and fill in the second condition row so that it

contains the following:

Message header X-PGP-Encrypt-Button contains selected

Page is loading ...

PGP Universal Server 3.1 User manual

PGP Universal Server 3.1 User manual

PGP Universal Server 3.1 User manual

Related papers

Other documents