PGP Universal Server 3.0.1 User guide

PGP Universal™ Server

Administrator's Guide

Version Information

PGP Universal Server Administrator's Guide. PGP Universal Server Version 3.0.1. Released June 2010.

Copyright Information

means, electronic or mechanical, for any purpose, without the express written permission of PGP Corporation.

Trademark Information

PGP, Pretty Good Privacy, and the PGP logo are registered trademarks of PGP Corporation in the US and other countries. IDEA is a trademark of

Ascom Tech AG. Windows and ActiveX are registered trademarks of Microsoft Corporation. AOL is a registered trademark, and AOL Instant

Messenger is a trademark, of America Online, Inc. Red Hat and Red Hat Linux are trademarks or registered trademarks of Red Hat, Inc. Linux is a

registered trademark of Linus Torvalds. Solaris is a trademark or registered trademark of Sun Microsystems, Inc. AIX is a trademark or registered

trademark of International Business Machines Corporation. HP-UX is a trademark or registered trademark of Hewlett-Packard Company. SSH and

Secure Shell are trademarks of SSH Communications Security, Inc. Rendezvous and Mac OS X are trademarks or registered trademarks of Apple

Computer, Inc. All other registered and unregistered trademarks in this document are the sole property of their respective owners.

Licensing and Patent Information

The IDEA cryptographic cipher described in U.S. patent number 5,214,703 is licensed from Ascom Tech AG. The CAST-128 encryption algorithm,

implemented from RFC 2144, is available worldwide on a royalty-free basis for commercial and non-commercial uses. PGP Corporation has secured a

license to the patent rights contained in the patent application Serial Number 10/655,563 by The Regents of the University of California, entitled Block

Cipher Mode of Operation for Constructing a Wide-blocksize block Cipher from a Conventional Block Cipher. Some third-party software included in PGP

Universal Server is licensed under the GNU General Public License (GPL). PGP Universal Server as a whole is not licensed under the GPL. If you would

like a copy of the source code for the GPL software included in PGP Universal Server, contact PGP Support (

https://support.pgp.com). PGP Corporation

may have patents and/or pending patent applications covering subject matter in this software or its documentation; the furnishing of this software or

documentation does not give you any license to these patents.

Acknowledgments

This product includes or may include:

-- The Zip and ZLib compression code, created by Mark Adler and Jean-Loup Gailly, is used with permission from the free Info-ZIP implementation,

developed by zlib (

http://www.zlib.net). -- Libxml2, the XML C parser and toolkit developed for the Gnome project and distributed and copyrighted

under the MIT License found at

http://jakarta.apache.org/), web

server (

http://www.apache.org/), Jakarta Commons (http://jakarta.apache.org/commons/license.html) and log4j, a Java-based library used to parse

HTML, developed by the Apache Software Foundation. The license is at

www.apache.org/licenses/LICENSE-2.0.txt. -- Castor, an open-source, data-

binding framework for moving data from XML to Java programming language objects and from Java to databases, is released by the ExoLab Group

under an Apache 2.0-style license, available at

http://www.castor.org/license.html. -- Xalan, an open-source software library from the Apache Software

Foundation that implements the XSLT XML transformation language and the XPath XML query language, is released under the Apache Software

License, version 1.1, available at

http://xml.apache.org/xalan-j/#license1.1. -- Apache Axis is an implementation of the SOAP ("Simple Object Access

Protocol") used for communications between various PGP products is provided under the Apache license found at

http://www.apache.org/licenses/LICENSE-2.0.txt. -- mx4j, an open-source implementation of the Java Management Extensions (JMX), is released

under an Apache-style license, available at

http://mx4j.sourceforge.net/docs/ch01s06.html. -- jpeglib version 6a is based in part on the work of the

Independent JPEG Group. (

http://www.ijg.org/) -- libxslt the XSLT C library developed for the GNOME project and used for XML transformations is

distributed under the MIT License

http://www.opensource.org/licenses/mit-license.html. -- PCRE Perl regular expression compiler, copyrighted and

http://www.pcre.org/license.txt. -- BIND Balanced Binary Tree Library

and Domain Name System (DNS) protocols developed and copyrighted by Internet Systems Consortium, Inc. (

http://www.isc.org) -- Free BSD

http://net-snmp.sourceforge.net/about/license.html. -- NTP version 4.2 developed

by Network Time Protocol and copyrighted to various contributors. -- Lightweight Directory Access Protocol developed and copyrighted by OpenLDAP

OpenLDAP Foundation. The license agreement is at

http://www.openldap.org/software/release/license.html. Secure shell OpenSSH developed by

OpenBSD project is released by the OpenBSD Project under a BSD-style license, available at

http://www.openbsd.org/cgi-

bin/cvsweb/src/usr.bin/ssh/LICENCE?rev=HEAD. -- PC/SC Lite is a free implementation of PC/SC, a specification for SmartCard integration is released

under the BSD license. -- Postfix, an open source mail transfer agent (MTA), is released under the IBM Public License 1.0, available at

http://www.opensource.org/licenses/ibmpl.php. -- PostgreSQL, a free software object-relational database management system, is released under a

BSD-style license, available at

http://www.postgresql.org/about/licence. -- PostgreSQL JDBC driver, a free Java program used to connect to a

BSD-style license, available at

http://jdbc.postgresql.org/license.html. -- PostgreSQL Regular Expression Library, a free software object-relational

database management system, is released under a BSD-style license, available at

http://www.postgresql.org/about/licence. -- 21.vixie-cron is the Vixie

- JacORB, a Java object used to facilitate communication between processes written in Java and the data layer, is open source licensed under the

GNU Library General Public License (LGPL) available at

is an open-source implementation of a CORBA Object Request Broker (ORB), and is used for communication between processes written in C/C++ and

Vanderbilt University. The open source software license is available at

http://www.cs.wustl.edu/~schmidt/ACE-copying.html. -- libcURL, a library for

downloading files via common network services, is open source software provided under a MIT/X derivate license available at

under a BSD-style license, available at

libpopt, a library that parses command line options, is released under the terms of the GNU Free Documentation License available at

to communicate with the Intel Corporation AMT chipset on a motherboard, is distributed under the gSOAP Public License version 1.3b, available at

http://www.cs.fsu.edu/~engelen/license.html. -- Windows Template Library (WTL) is used for developing user interface components and is distributed

under the Common Public License v1.0 found at

http://opensource.org/licenses/cpl1.0.php. -- The Perl Kit provides several independent utilities used to

automate a variety of maintenance functions and is provided under the Perl Artistic License, found at

http://www.perl.com/pub/a/language/misc/Artistic.html. -- rEFIt - libeg, provides a graphical interface library for EFI, including image rendering, text

rendering, and alpha blending, and is distributed under the license found at

reserved. -- Java Radius Client, used to authenticate PGP Universal Web Messenger users via Radius, is distributed under the Lesser General Public

License (LGPL) found at

http://www.gnu.org/licenses/lgpl.html. -- Yahoo! User Interface (YUI) library version 2.5.2, a Web UI interface library for AJAX.

http://developer.yahoo.com/yui/license.html. --

JSON-lib version 2.2.1, a Java library used to convert Java objects to JSON (JavaScript Object Notation) objects for AJAX. Distributed under the

Apache 2.0 license, available at

http://json-lib.sourceforge.net/license.html. -- EZMorph, used by JSON-lib, is distributed under the Apache 2.0 license,

available at

http://ezmorph.sourceforge.net/license.html. -- Apache Commons Lang, used by JSON-lib, is distributed under the Apache 2.0 license,

available at

http://commons.apache.org/license.html. -- Apache Commons BeanUtils, used by JSON-lib, is distributed under the Apache 2.0 license,

available at

http://commons.apache.org/license.html. -- SimpleIni is an .ini format file parser and provides the ability to read and write .ini files, a

common configuration file format used on Windows, on other platforms. Distributed under the MIT License found at

Standard Template Library functions and data structures and is distributed under the MIT License found at

http://www.opensource.org/licenses/mit-

format, are used to serialize structure data in the PGP SDK. Distributed under the BSD license found at

http://www.opensource.org/licenses/bsd-

Additional acknowledgements and legal notices are included as part of the PGP Universal Server.

Export Information

Export of this software and documentation may be subject to compliance with the rules and regulations promulgated from time to time by the Bureau

of Export Administration, United States Department of Commerce, which restricts the export and re-export of certain products and technical data.

Limitations

The software provided with this documentation is licensed to you for your individual use under the terms of the End User License Agreement provided

with the software. The information in this document is subject to change without notice. PGP Corporation does not warrant that the information meets

your requirements or that the information is free of errors. The information may include technical inaccuracies or typographical errors. Changes may be

made to the information and incorporated in new editions of this document, if and when made available by PGP Corporation.

Unsupported Third Party Products

By utilizing third party products, software, drivers, or other components ("Unsupported Third Party Product") to interact with the PGP software and/or by

utilizing any associated PGP command or code provided by to you by PGP at its sole discretion to interact with the Unsupported Third Party Product

("PGP Third Party Commands"), you acknowledge that the PGP software has not been designed for or formally tested with the Unsupported Third Party

Product, and therefore PGP provides no support or warranties with respect to the PGP Third Party Commands or the PGP software's compatibility with

Unsupported Third Party Products. THE PGP THIRD PARTY COMMANDS ARE PROVIDED "AS IS," WITH ALL FAULTS, AND THE ENTIRE RISK AS TO

SATISFACTORY QUALITY, PERFORMANCE, ACCURACY, AND EFFORT IS WITH YOU. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE

LAW, PGP DISCLAIMS ALL REPRESENTATIONS, WARRANTIES, AND CONDITIONS, WHETHER EXPRESS OR IMPLIED, INCLUDING ANY

WARRANTIES OR CONDITIONS OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NONINFRINGEMENT, QUIET

ENJOYMENT, AND ACCURACY WITH RESPECT TO THE PGP THIRD PARTY COMMANDS OR THE PGP SOFTWARE'S COMPATIBILITY WITH THE

UNSUPPORTED THIRD PARTY PRODUCT.

4

15

Contents

Introduction

What is PGP Universal Server? 15

PGP Universal Server Product Family 16

Who Should Read This Guide 16

Common Criteria Environments 16

Improvements in this Version of PGP Universal Server 17

Using the PGP Universal Server with the Command Line 18

Symbols 18

Getting Assistance 19

Getting product information 19

Contact Information 20

The Big Picture 21

Important Terms 21

PGP Products 21

PGP Universal Server Concepts 23

PGP Universal Server Features 23

PGP Universal Server User Types 25

Installation Overview 26

Open Ports 33

TCP Ports 33

UDP Ports 35

Naming your PGP Universal Server

37

Considering a Name for Your PGP Universal Server 37

Methods for Naming a PGP Universal Server 38

Understanding the Administrative Interface

39

System Requirements 39

Logging In 39

The System Overview Page 41

Managing Alerts 42

Logging In For the First Time 43

Administrative Interface Map 43

Icons 44

i

PGP Universal™ Server Contents

Licensing Your Software 51

Overview 51

Manual and Automatic Licensing 51

Licensing a PGP Universal Server 51

Licensing the Mail Proxy Feature 52

Operating in Learn Mode 53

Purpose of Learn Mode 53

Checking the Logs 54

Managing Learn Mode 54

Managed Domains 57

About Managed Domains 57

Adding Managed Domains 58

Deleting Managed Domains 58

Understanding Keys 59

Choosing a Key Mode For Key Management 59

Changing Key Modes 62

How PGP Universal Server Uses Certificate Revocation Lists 63

Key Reconstruction Blocks 63

Managed Key Permissions 64

Managing Organization Keys 65

About Organization Keys 65

Organization Key 65

Inspecting the Organization Key 66

Regenerating the Organization Key 66

Importing an Organization Key 67

Organization Certificate 68

Inspecting the Organization Certificate 69

Exporting the Organization Certificate 69

Deleting the Organization Certificate 70

Generating the Organization Certificate 70

Importing the Organization Certificate 71

Additional Decryption Key (ADK) 71

Importing the ADK 72

Inspecting the ADK 72

Deleting the ADK 72

Verified Directory Key 73

Importing the Verified Directory Key 73

Inspecting the Verified Directory Key 73

Deleting the Verified Directory Key 74

ii

PGP Universal™ Server Contents

Administering Managed Keys 75

Viewing Managed Keys 76

Managed Key Information 77

Email Addresses 80

Subkeys 80

Certificates 80

Permissions 80

Attributes 81

Symmetric Key Series 82

Symmetric Keys 84

Custom Data Objects 85

Exporting Consumer Keys 86

Exporting the Managed Key of an Internal User 86

Exporting the Managed Key of an External User 87

Exporting PGP Verified Directory User Keys 88

Exporting the Managed Key of a Managed Device 88

Deleting Consumer Keys 89

Deleting the Managed Key of an Internal User 89

Deleting the Managed Key of an External User 89

Deleting the Key of a PGP Verified Directory User 90

Deleting the Managed Key of a Managed Device 90

Approving Pending Keys 90

Revoking Managed Keys 91

Managing Trusted Keys and Certificates 93

Overview 93

Trusted Keys 93

Trusted Certificates 93

Adding a Trusted Key or Certificate 94

Inspecting and Changing Trusted Key Properties 95

Deleting Trusted Keys and Certificates 95

Searching for Trusted Keys and Certificates 96

Setting Mail Policy

97

Overview 97

How Policy Chains Work 98

Mail Policy and Dictionaries 99

Mail Policy and Key Searches 99

Mail Policy and Cached Keys 100

Migrating Settings from Version 2.0.x 100

Restoring Mail Policy Rules 101

Understanding the Pre-Installed Policy Chains 107

Mail Policy Outside the Mailflow 109

Using the Rule Interface 110

The Conditions Card 110

iii

PGP Universal™ Server Contents

The Actions Card 112

Building Valid Chains and Rules 113

Using Valid Processing Order 113

Creating Valid Groups 114

Creating a Valid Rule 115

Managing Policy Chains 116

Mail Policy Best Practices 116

Restoring Mail Policy to Default Settings 116

Editing Policy Chain Settings 117

Adding Policy Chains 117

Deleting Policy Chains 118

Exporting Policy Chains 119

Printing Policy Chains 119

Managing Rules 120

Adding Rules to Policy Chains 120

Deleting Rules from Policy Chains 120

Enabling and Disabling Rules 121

Changing the Processing Order of the Rules 121

Adding Key Searches 121

Choosing Condition Statements, Conditions, and Actions 122

Condition Statements 122

Conditions 123

Actions 129

Working with Common Access Cards 144

Applying Key Not Found Settings to External Users 145

Overview 145

Bounce the Message 146

PDF Messenger 146

Certified Delivery with PDF Messenger 147

Send Unencrypted 147

Smart Trailer 148

PGP Universal Web Messenger 149

Changing Policy Settings 150

Changing User Delivery Method Preference 151

Using Dictionaries with Policy

153

Overview 153

Default Dictionaries 154

Editing Default Dictionaries 156

User-Defined Dictionaries 157

Adding a User-Defined Dictionary 157

Editing a User-Defined Dictionary 158

Deleting a Dictionary 158

Exporting a Dictionary 159

Searching the Dictionaries 160

iv

PGP Universal™ Server Contents

Keyservers, SMTP Archive Servers, and Mail Policy 161

Overview 161

Keyservers 161

Adding or Editing a Keyserver 162

Deleting a Keyserver 164

SMTP Servers 164

Adding or Editing an Archive Server 165

Deleting an Archive Server 165

Managing Keys in the Key Cache

167

Overview 167

Changing Cached Key Timeout 167

Purging Keys from the Cache 168

Trusting Cached Keys 168

Viewing Cached Keys 168

Searching the Key Cache 169

Configuring Mail Proxies 171

Overview 171

PGP Universal Server and Mail Proxies 171

Mail Proxies in an Internal Placement 172

Mail Proxies in a Gateway Placement 174

Changes in Proxy Settings from PGP Universal Server 2.0 to 2.5 and later 175

Mail Proxies Page 176

Creating New or Editing Existing Proxies 176

Creating or Editing a POP/IMAP Proxy 176

Creating or Editing an Outbound SMTP Proxy 179

Creating or Editing an Inbound SMTP Proxy 181

Creating or Editing a Unified SMTP Proxy 182

Email in the Mail Queue

187

Overview 187

Deleting Messages from the Mail Queue 188

Specifying Mail Routes 189

Overview 189

Managing Mail Routes 190

Adding a Mail Route 190

Editing a Mail Route 191

Deleting a Mail Route 191

v

PGP Universal™ Server Contents

Customizing System Message Templates 193

Overview 193

Templates and Message Size 194

PDF Messenger Templates 194

Templates for New PGP Universal Web Messenger Users 194

Editing a Message Template 195

Managing Groups 197

Understanding Groups 197

Sorting Consumers into Groups 197

Everyone Group 198

Excluded Group 198

Policy Group Order 199

Migrating Groups from Version 2.x 199

Setting Policy Group Order 199

Creating a New Group 200

Deleting a Group 200

Viewing Group Members 200

Manually Adding Group Members 201

Manually Removing Members from a Group 201

Group Permissions 202

Adding Group Permissions 203

Deleting Group Permissions 203

Setting Group Membership 204

Searching Groups 205

Creating Group Client Installations 206

How Group Policy is Assigned to PGP Desktop Installers 206

When to Bind a Client Installation 207

Creating PGP Desktop Installers 208

Managing Devices

213

Managed Devices 214

Adding and Deleting Managed Devices 214

Adding Managed Devices to Groups 215

Managed Device Information 216

Deleting Managed Devices from PGP Universal Server 220

Deleting Managed Devices from Groups 220

vi

PGP Universal™ Server Contents

WDE Devices (Computers and Disks) 221

WDE Computers 222

WDE Disks 223

Searching for Devices 225

Administering Consumer Policy 227

Understanding Consumer Policy 227

Making Sure Users Create Strong Passphrases 227

Understanding Entropy 228

Using the Windows Preinstallation Environment 229

X.509 Certificate Management in Lotus Notes Environments 229

Trusting Certificates Created by PGP Universal Server 230

Setting the Lotus Notes Key Settings in PGP Universal Server 232

Technical Deployment Information 233

Offline Policy 233

Using a Policy ADK 235

Out of Mail Stream Support 235

Enrolling Users through Silent Enrollment 237

Silent Enrollment with Windows 237

Silent Enrollment with Mac OS X 237

PGP Whole Disk Encryption Administration 237

PGP Whole Disk Encryption on Mac OS X with FileVault 238

How Does Single Sign-On Work? 238

Enabling Single Sign-On 239

Managing Clients Remotely Using a PGP WDE Administrator Active Directory Group 240

Managing Clients Locally Using the PGP WDE Administrator Key 241

Managing Consumer Policies 242

Adding a Consumer Policy 243

Editing a Consumer Policy 243

Deleting a Consumer Policy 244

Setting Policy for Clients 245

Client and PGP Universal Server Version Compatibility 245

Serving PGP Admin 8 Preferences 246

Establishing PGP Desktop Settings for Your PGP Desktop Clients 247

PGP Desktop Feature License Settings 248

Controlling PGP Desktop Components 248

PGP Portable 250

PGP Mobile 250

PGP NetShare 251

How the PGP NetShare Policy Settings Work Together 251

Multi-user environments and managing PGP NetShare 251

Backing Up PGP NetShare-Protected Files 252

Using Directory Synchronization to Manage Consumers

253

How PGP Universal Server Uses Directory Synchronization 253

vii

PGP Universal™ Server Contents

Base DN and Bind DN 255

Consumer Matching Rules 256

Understanding User Enrollment Methods 256

Before Creating a Client Installer 257

Email Enrollment 258

Directory Enrollment 260

Enabling Directory Synchronization 262

Adding or Editing an LDAP Directory 262

The LDAP Servers Tab 264

The Base Distinguished Name Tab 264

The Consumer Matching Rules Tab 265

Testing the LDAP Connection 265

Using Sample Records to Configure LDAP Settings 265

Deleting an LDAP Directory 266

Setting LDAP Directory Order 266

Directory Synchronization Settings 266

Managing User Accounts 269

Understanding User Account Types 269

Viewing User Accounts 269

User Management Tasks 269

Setting User Authentication 270

Editing User Attributes 270

Adding Users to Groups 270

Editing User Permissions 271

Deleting Users 271

Searching for Users 272

Viewing User Log Entries 272

Changing Display Names and Usernames 272

Exporting a User’s X.509 Certificate 273

Revoking a User's X.509 Certificate 274

Managing User Keys 274

Managing Internal User Accounts 275

Importing Internal User Keys Manually 275

Creating New Internal User Accounts 276

Exporting PGP Whole Disk Encryption Login Failure Data 276

Internal User Settings 277

Managing External User Accounts 281

Importing External Users 282

Exporting Delivery Receipts 282

External User Settings 283

viii

PGP Universal™ Server Contents

Managing Verified Directory User Accounts 285

Importing Verified Directory Users 286

PGP Verified Directory User Settings 286

Recovering Encrypted Data in an Enterprise Environment

289

Using Key Reconstruction 289

Recovering Encryption Key Material without Key Reconstruction 290

Encryption Key Recovery of CKM Keys 290

Encryption Key Recovery of GKM Keys 290

Encryption Key Recovery of SCKM Keys 291

Encryption Key Recovery of SKM Keys 292

Using an Additional Decryption Key for Data Recovery 292

PGP Universal Satellite 295

Overview 295

Technical Information 296

Distributing the PGP Universal Satellite Software 296

Configuration 296

Key Mode 296

PGP Universal Satellite Configurations 297

Switching Key Modes 300

Policy and Key or Certificate Retrieval 300

Retrieving Lost Policies 300

Retrieving Lost Keys or Certificates 301

PGP Universal Satellite for Mac OS X 305

Overview 305

System Requirements 305

Obtaining the Installer 306

Installation 306

Updates 307

Files 307

PGP Universal Satellite for Windows

309

Overview 309

System Requirements 309

Obtaining the Installer 310

Installation 310

Updates 311

Files 311

ix

PGP Universal™ Server Contents

MAPI Support 311

External MAPI Configuration 312

Lotus Notes Support 312

External Lotus Notes Configuration 313

Configuring PGP Universal Web Messenger 315

Overview 315

PGP Universal Web Messenger and Clustering 316

External Authentication 317

Customizing PGP Universal Web Messenger 318

Adding a New Template 319

Troubleshooting Customization 323

Changing the Active Template 326

Deleting a Template 326

Editing a Template 326

Downloading Template Files 327

Restoring to Factory Defaults 327

Configuring the PGP Universal Web Messenger Service 327

Starting and Stopping PGP Universal Web Messenger 328

Selecting the PGP Universal Web Messenger Network Interface 328

Setting Up External Authentication 330

Creating Settings for PGP Universal Web Messenger User Accounts 331

Setting Message Replication in a Cluster 332

Configuring the Integrated Keyserver 333

Overview 333

Starting and Stopping the Keyserver Service 333

Configuring the Keyserver Service 333

Configuring the PGP Verified Directory 337

Overview 337

Starting and Stopping the PGP Verified Directory 338

Configuring the PGP Verified Directory 338

Managing the Certificate Revocation List Service 341

Overview 341

Starting and Stopping the CRL Service 341

Editing CRL Service Settings 342

Configuring Universal Services Protocol

343

Starting and Stopping USP 343

Adding USP Interfaces 343

x

PGP Universal™ Server Contents

System Graphs 345

Overview 345

CPU Usage 345

Message Activity 345

Whole Disk Encryption 346

System Logs 349

Overview 349

Filtering the Log View 350

Searching the Log Files 351

Exporting a Log File 351

Enabling External Logging 352

Configuring SNMP Monitoring 353

Overview 353

Starting and Stopping SNMP Monitoring 354

Configuring the SNMP Service 354

Downloading the Custom MIB File 355

Shutting Down and Restarting Services and Power 357

Overview 357

Server Information 357

Setting the Time 357

Updating Software 358

Licensing a PGP Universal Server 358

Downloading the Release Notes 359

Shutting Down and Restarting the PGP Universal Server Software Services 359

Shutting Down and Restarting the PGP Universal Server Hardware 359

Managing Administrator Accounts

361

Overview 361

Administrator Roles 362

Administrator Authentication 362

Creating a New Administrator 363

Importing SSH v2 Keys 364

Deleting Administrators 364

Inspecting and Changing the Settings of an Administrator 365

Configuring RSA SecurID Authentication 366

Resetting SecurID PINs 367

Daily Status Email 368

xi

PGP Universal™ Server Contents

Protecting PGP Universal Server with Ignition Keys 371

Overview 371

Ignition Keys and Clustering 372

Preparing Hardware Tokens to be Ignition Keys 373

Configuring a Hardware Token Ignition Key 374

Configuring a Soft-Ignition Passphrase Ignition Key 375

Deleting Ignition Keys 375

Backing Up and Restoring System and User Data 377

Overview 377

Creating Backups 378

Scheduling Backups 378

Performing On-Demand Backups 378

Configuring the Backup Location 378

Restoring From a Backup 379

Restoring On-Demand 380

Restoring Configuration 380

Restoring from a Different Version 381

Updating PGP Universal Server Software 383

Overview 383

Inspecting Update Packages 384

Establishing Software Update Settings 384

Checking for New Updates 385

Uploading Update Packages 385

Manually Installing an Update 385

Setting Network Interfaces 387

Understanding the Network Settings 387

Connecting to a Proxy Server 388

Changing Interface Settings 388

Adding Interface Settings 389

Deleting Interface Settings 389

Editing Global Network Settings 389

Assigning a Certificate 390

Working with Certificates 390

Importing an Existing Certificate 391

Generating a Certificate Request 391

Adding a Pending Certificate 392

Inspecting a Certificate 393

Exporting a Certificate 393

Deleting a Certificate 393

xii

PGP Universal™ Server Contents

Clustering your PGP Universal Servers 395

Overview 395

Cluster Status 396

Creating a Cluster 397

Deleting Cluster Members 399

Clustering and PGP Universal Web Messenger 400

Managing Settings for Cluster Members 401

Changing Network Settings in Clusters 402

Index

403

xiii

1

Introduction

This Administrator’s Guide describes both the PGP Universal

™

Server and Client

software. It tells you how to get them up and running on your network, how to

configure them, and how to maintain them. This section provides a high-level

overview of PGP Universal Server.

What is PGP Universal Server?

PGP Universal Server is a single console for managing the applications that

provide email, disk, and network file encryption.

PGP Universal Server with PGP Universal Gateway Email gives you secure

messaging: it transparently protects your enterprise messages with little or no

user interaction.

The PGP Universal Server also replaces the PGP Keyserver product with a built-

in keyserver, and the PGP Admin product with PGP Desktop configuration and

deployment capabilities.

PGP Universal Server automatically creates and maintains a Self-Managing

Security Architecture (SMSA) by monitoring authenticated users and their email

traffic. You can also send protected messages to addresses that are not part of

the SMSA. The PGP Universal Server encrypts, decrypts, signs, and verifies

messages automatically, providing strong security through policies you control.

PGP Universal Satellite, a client-side feature of PGP Universal Server, extends

PGP security for email messages all the way to the computer of the email user,

it allows external users to become part of the SMSA, and it gives end users the

option to create and manage their keys on their own computer (if allowed by

the PGP administrator).

PGP Desktop, a client product, is created and managed through PGP Universal

Server policy. It creates PGP keypairs and can manage user keypairs as well as

store the public keys of others. It encrypts user email and instant messaging

(IM). It can encrypt entire or partial hard drives. It also enables secure file

sharing with others over a network.

15

PGP Universal™ Server Introduction

PGP Universal Server Product Family

PGP Universal Server functions as a management console for a variety of

encryption solutions. You can purchase any of the PGP Desktop applications or

bundles and use PGP Universal Server to create and manage client installations.

You can also purchase a license that enables PGP Gateway Email to encrypt

email in the mailstream.

The PGP Universal Server can manage any combination of PGP encryption

applications. PGP encryption applications are:

 PGP Universal Gateway Email provides automatic email encryption in the

gateway, based on centralized mail policy. This product requires

administration by the PGP Universal Server.

 PGP Desktop Email provides encryption at the desktop for mail, files, and

AOL Instant Messenger traffic. This product can be managed by the PGP

Universal Server.

 PGP Whole Disk Encryption provides encryption at the desktop for an

entire disk. This product can be managed by the PGP Universal Server.

 PGP NetShare provides transparent file encryption and sharing among

desktops. This product can be managed by the PGP Universal Server.

Who Should Read This Guide

This Administrator’s Guide is for the person or persons who implement and

maintain your organization’s PGP Universal Server environment. These are the

PGP Universal Server administrators.

This guide is also intended for anyone else who wants to learn about how PGP

Universal Server works.

Common Criteria Environments

To be Common Criteria compliant, please refer to the best practices shown in

PGP Universal Server 2.9 Common Criteria Supplemental. Note that these best

practices supersede recommendations made elsewhere in this and other

documentation.

16

PGP Universal Server 3.0.1 User guide

Related papers

Other documents