PGP Endpoint 4.4 SR1 Installation guide

Brand: PGP

Model: Endpoint 4.4 SR1

Category: Software

Type: Installation guide

Setup Guide

PGP Endpoint 4.4 SR1

02_102P 4.4 SR1 Setup Guide

- 2 -

- 3 -

Notices

Version Information

PGP Endpoint Setup Guide - PGP Endpoint Version 4.4 SR1 - Released: August 2009

Document Number: 02_102P_4.4 SR1_092391000

reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without

the express written permission of PGP Corporation.

Trademark Information

PGP, Pretty Good Privacy, and the PGP logo are registered trademarks of PGP Corporation in the

US and other countries. IDEA is a trademark of Ascom Tech AG. Windows and ActiveX are registered

trademarks of Microsoft Corporation. AOL is a registered trademark, and AOL Instant Messenger is a

trademark, of America Online, Inc. Red Hat and Red Hat Linux are trademarks or registered trademarks

of Red Hat, Inc. Linux is a registered trademark of Linus Torvalds. Solaris is a trademark or registered

trademark of Sun Microsystems, Inc. AIX is a trademark or registered trademark of International Business

Machines Corporation. HP-UX is a trademark or registered trademark of Hewlett-Packard Company. SSH

and Secure Shell are trademarks of SSH Communications Security, Inc. Rendezvous and Mac OS X

are trademarks or registered trademarks of Apple Computer, Inc. All other registered and unregistered

trademarks in this document are the sole property of their respective owners.

Licensing and Patent Information

The IDEA cryptographic cipher described in U.S. patent number 5,214,703 is licensed from Ascom Tech

AG. The CAST-128 encryption algorithm, implemented from RFC 2144, is available worldwide on a royalty-

free basis for commercial and non-commercial uses. PGP Corporation has secured a license to the patent

rights contained in the patent application Serial Number 10/655,563 by The Regents of the University of

California, entitled Block Cipher Mode of Operation for Constructing a Wide-blocksize block Cipher from a

Conventional Block Cipher. Some third-party software included in PGP Universal Server is licensed under

the GNU General Public License (GPL). PGP Universal Server as a whole is not licensed under the GPL.

If you would like a copy of the source code for the GPL software included in PGP Universal Server, contact

PGP Support (http://www.pgp.com/support). PGP Corporation may have patents and/or pending patent

applications covering subject matter in this software or its documentation; the furnishing of this software or

documentation does not give you any license to these patents.

Acknowledgements

This product includes or may include:

• The Zip and ZLib compression code, created by Mark Adler and Jean-Loup Gailly, is used with

permission from the free Info-ZIP implementation, developed by zlib (http://www.zlib.net). • Libxml2,

the XML C parser and toolkit developed for the Gnome project and distributed and copyrighted under

the Open Source Initiative. • bzip2 1.0, a freely available high-quality data compressor, is copyrighted

PGP Endpoint

- 4 -

www.apache.org/), Jakarta Commons (http://jakarta.apache.org/commons/license.html) and log4j, a

Java-based library used to parse HTML, developed by the Apache Software Foundation. The license

is at www.apache.org/licenses/LICENSE-2.0.txt. • Castor, an open-source, databinding framework for

moving data from XML to Java programming language objects and from Java to databases, is released

by the ExoLab Group under an Apache 2.0-style license, available at http://www.castor.org/license.html.

• Xalan, an open-source software library from the Apache Software Foundation that implements the

XSLT XML transformation language and the XPath XML query language, is released under the Apache

Software License, version 1.1, available at http://xml.apache.org/xalan-j/#license1.1. • Apache Axis is

an implementation of the SOAP (“Simple Object Access Protocol”) used for communications between

various PGP products is provided under the Apache license found at http://www.apache.org/licenses/

LICENSE-2.0.txt. • mx4j, an open-source implementation of the Java Management Extensions (JMX),

is released under an Apache-style license, available at http://mx4j.sourceforge.net/docs/ch01s06.html.

• jpeglib version 6a is based in part on the work of the Independent JPEG Group. (http://www.ijg.org/)

• libxslt the XSLT C library developed for the GNOME project and used for XML transformations is

distributed under the MIT License http://www.opensource.org/licenses/mit-license.html. • PCRE version

The license agreement is at http://www.pcre.org/license.txt. • BIND Balanced Binary Tree Library and

Domain Name System (DNS) protocols developed and copyrighted by Internet Systems Consortium,

Inc. (http://www.isc.org) • Free BSD implementation of daemon developed by The FreeBSD Project, ©

1994-2006. • Simple Network Management Protocol Library developed and copyrighted by Carnegie

agreement for these is at http://net-snmp.sourceforge.net/about/license.html. • NTP version 4.2 developed

by Network Time Protocol and copyrighted to various contributors. • Lightweight Directory Access Protocol

developed and copyrighted by OpenLDAP Foundation. OpenLDAP is an open-source implementation of

The license agreement is at http://www.openldap.org/software/release/license.html. • Secure shell

OpenSSH version 4.2.1 developed by OpenBSD project is released by the OpenBSD Project under

a BSD-style license, available at http://www.openbsd.org/cgibin/cvsweb/src/usr.bin/ssh/LICENCE?

rev=HEAD. • PC/SC Lite is a free implementation of PC/SC, a specification for SmartCard integration is

released under the BSD license. • Postfix, an open source mail transfer agent (MTA), is released under

the IBM Public License 1.0, available at http://www.opensource.org/licenses/ibmpl.php. • PostgreSQL,

a free software object-relational database management system, is released under a BSD-style license,

available at http://www.postgresql.org/about/licence. • PostgreSQL JDBC driver, a free Java program

used to connect to a PostgreSQL database using standard, database independent Java code, (c)

1997-2005, PostgreSQL Global Development Group, is released under a BSD-style license, available

at http://jdbc.postgresql.org/license.html. • PostgreSQL Regular Expression Library, a free software

object-relational database management system, is released under a BSD-style license, available at

http://www.postgresql.org/about/licence. • 21.vixie-cron is the Vixie version of cron, a standard UNIX

by permission. • JacORB, a Java object used to facilitate communication between processes written in

Java and the data layer, is open source licensed under the GNU Library General Public License (LGPL)

ORB) is an open-source implementation of a CORBA Object Request Broker (ORB), and is used for

Douglas C. Schmidt and his research group at Washington University, University of California, Irvine, and

Vanderbilt University. The open source software license is available at http://www.cs.wustl.edu/~schmidt/

ACEcopying. html. • libcURL, a library for downloading files via common network services, is open source

Notices

- 5 -

software provided under a MIT/X derivate license available at http://curl.haxx.se/docs/copyright.html.

released under a BSD-style license, available at http://thunk.org/hg/e2fsprogs/?file/fe55db3e508c/lib/uuid/

is released under the terms of the GNU Free Documentation License available at http://directory.fsf.org/

tool for Windows clients to communicate with the Intel Corporation AMT chipset on a motherboard, is

distributed under the GNU Public License, available at http://www.cs.fsu.edu/~engelen/soaplicense.html.

• Windows Template Library (WRT) is used for developing user interface components and is distributed

under the Common Public License v1.0 found at http://opensource.org/licenses/cpl1.0.php. • The Perl Kit

provides several independent utilities used to automate a variety of maintenance functions and is provided

under the Perl Artistic License, found at http://www.perl.com/pub/a/language/misc/Artistic.html.

Export Information

Export of this software and documentation may be subject to compliance with the rules and regulations

promulgated from time to time by the Bureau of Export Administration, United States Department of

Commerce, which restricts the export and re-export of certain products and technical data.

Limitations

The software provided with this documentation is licensed to you for your individual use under the terms of

the End User License Agreement provided with the software. The information in this document is subject

to change without notice. PGP Corporation does not warrant that the information meets your requirements

or that the information is free of errors. The information may include technical inaccuracies or typographical

errors. Changes may be made to the information and incorporated in new editions of this document, if and

when made available by PGP Corporation.

PGP Endpoint

- 6 -

- 7 -

Table of Contents

Preface: About This Document..................................................................9

Typographical Conventions............................................................................................ 9

Getting Assistance..........................................................................................................9

Chapter 1: Planning Your Installation.....................................................11

Recommended Security Rules.....................................................................................11

System Requirements...................................................................................................13

Minimum Hardware Requirements........................................................................13

Supported Operating Systems.............................................................................. 14

Supported Databases............................................................................................15

Other Software Requirements...............................................................................16

Recommended Configuration................................................................................16

Client Supported Languages.................................................................................17

Licensing PGP Endpoint Products...............................................................................18

Chapter 2: Installing PGP Endpoint Components..................................19

Installation Overview.....................................................................................................20

Installation Checklist.....................................................................................................21

Installing the PGP Endpoint Database.........................................................................23

Generating a Key Pair..................................................................................................26

Installing the Administration Server .............................................................................28

Installing the PGP Endpoint Management Server Console .........................................39

Installing the PGP Endpoint Client...............................................................................43

Chapter 3: Upgrading PGP Endpoint Components................................53

Upgrade Overview........................................................................................................54

Upgrading the PGP Endpoint Database...................................................................... 55

Upgrading the PGP Endpoint Administration Server....................................................60

Upgrading the PGP Endpoint Management Server Console ......................................64

Upgrading the PGP Endpoint Client.............................................................................66

Table of Contents

- 8 -

Chapter 4: Installation Checklist..............................................................73

Installation Checklist.....................................................................................................73

Chapter 5: Using the Tool........................................................................75

PGP Endpoint Client Deployment Window.................................................................. 76

Packages Panel.....................................................................................................76

Packages Menu.....................................................................................................77

Computers Panel...................................................................................................78

Computers Menu...................................................................................................78

Creating Deployment Packages...................................................................................79

Adding Computers........................................................................................................82

Deploying Packages.....................................................................................................84

Querying Client Status..................................................................................................88

Appendix A: Configuring DCOM Settings for the Administration Server91

Setting Up Distributed Component Object Model (DCOM)..........................................91

Set Access Control List Security Permissions............................................................. 95

Appendix B: Installing the Client for Windows XP Embedded..............99

Windows XPe Client Limitations.................................................................................100

Supported Devices......................................................................................................100

Installing the Client for Windows XPe........................................................................100

- 9 -

Preface

About This Document

This Setup Guide is a resource written for all users of PGP Endpoint 4.4 SR1. This document

defines the concepts and procedures for installing, configuring, implementing, and using PGP

Endpoint 4.4 SR1.

Tip:

PGP documentation is updated on a regular basis. To acquire the latest version of this or

any other published document, please refer to the PGP Support Portal Web Site (https://

support.pgp.com).

Typographical Conventions

The following conventions are used throughout this documentation to help you identify various

information types.

Convention Usage

bold Buttons, menu items, window and screen objects.

bold italics Wizard names, window names, and page names.

italics New terms, options, and variables.

UPPERCASE SQL Commands and keyboard keys.

monospace File names, path names, programs, executables, command

syntax, and property names.

Getting Assistance

Getting Product Information

Unless otherwise noted, the product documentation is provided as Adobe Acrobat PDF files

that are installed with PGP Endpoint. Online help is available within the PGP Endpoint product.

Release notes are also available, which may have last-minute information not found in the

product documentation.

Preface

- 10 -

Contacting Technical Support

• To learn about PGP support options and how to contact PGP Technical Support, please visit

the PGP Corporation Support Home Page (http://www.pgp.com/support).

• To access the PGP Support Knowledge Base or request PGP Technical Support, please visit

PGP Support Portal Web Site (https://support.pgp.com).

Note:

You may access portions of the PGP Support Knowledge Base without a support agreement;

however, you must have a valid support agreement to request Technical Support.

• For any other contacts at PGP Corporation, please visit the PGP Contacts Page (http://

www.pgp.com/company/contact/index.html).

• For general information about PGP Corporation, please visit the PGP Web Site (http://

www.pgp.com).

• To access the PGP Support forums, please visit PGP Support (http://

forums.pgpsupport.com). These are user community support forums hosted by PGP

Corporation.

- 11 -

Chapter

Planning Your Installation

In this chapter:

• Recommended Security

Rules

• System Requirements

• Licensing PGP Endpoint

Products

To assist in gathering the information required for a smooth

installation, PGP recommends that you use the Installation

Checklist on page 21.

Recommended Security Rules

PGP recommends that you define certain administrative security rules before installing PGP

Endpoint.

The recommended security settings are specific to Microsoft

Windows

and complement

operation of PGP Endpoint.

Table 1: Recommended Security Rules

Security Rule Description

Hard Disk Encryption Encrypts computer disk drives to prevent

unauthorized user access to the computer hard

disk drive.

Password Protect the BIOS Prevents administrative user access when using a

CMOS reset jumper, in combination with password

protection for the BIOS and seal/chassis intrusion

protection.

Seal/Chassis Intrusion Protector Uses seal and/or chassis intrusion protection

hardware to prevent administrative user access

using an external boot device to bypass

workstation security software.

PGP Endpoint

- 12 -

Security Rule Description

Administrative Rights Remove local users from the local Administrators

group to prevent unrestricted local user computer

access.

Power Users Remove local users from the Power Users group

to prevent users from tampering or bypassing

standard Windows security policies.

Access Policy Restrict network and file access as much as

possible, including use restriction only to NTFS

partitions.

NTFS Partition Use of NTFS partitioning is required for installation

of PGP Endpoint product solutions.

Recovery Console Password protect user access to the Recovery

Console, which is available for the Windows DVD/

CD-ROM or MSDN subscription.

Service Pack and Hot Fixes Always install the latest service packs and hot

fixes for the operating system supported by PGP

Endpoint product solutions.

Firewalls Use traditional perimeter-based security systems,

like firewalls, to complement PGP Endpoint product

solutions.

Password Policies Maintain strong password security policies.

Private and Public Key Generation Deploy PGP Endpoint product solutions using

secure public and private key pairs.

Planning Your Installation

- 13 -

System Requirements

The following sections describe the minimum system requirements necessary for successful

installation of PGP Endpoint 4.4 SR1 and the languages supported by the client.

Important: For installation or upgrade to PGP Endpoint version 4.4 SR1:

• You must have a new license file that is valid specifically for version 4.4.

• Existing license files issued before PGP Endpoint version 4.4 will not work with the PGP

Endpoint Administration Server and may cause your Administration Servers to stop working.

The PGP Endpoint 4.4 license must be installed before you install or upgrade the PGP

Endpoint database, and then the Administration Server.

• Request a new license file using the Downloads tab on the PGP Licensing and Entitlement

Management System (LEMS) ( https://lems.pgp.com/account/login) .

Minimum Hardware Requirements

The minimum PGP Endpoint hardware requirements depend upon your service network

environment, including the type of database supported, the number of Administration Servers

you need support a distributed network, and the number of subscribed clients.

The hardware requirements for PGP Endpoint 4.4 SR1 vary depending upon the number of

servers and clients you manage. The following minimum hardware requirements will support up

to:

• 200 connected PGP Endpoint clients for PGP Endpoint Device Control

• 50 connected PGP Endpoint clients for PGP Endpoint Application Control

Table 2: Minimum Hardware Requirements

PGP Endpoint Component Requirement

Database

• 1 GB (4 GB recommended) memory

•

Pentium

Dual-Core CPU processor or AMD equivalent

• 3 GB minimum hard disk drive

• 100 MBits/s NIC

Administration Server

• 512 MB (1 GB recommended) memory

•

Pentium

Dual-Core CPU or AMD equivalent

• 3 GB minimum hard disk drive

• 100 MBits/s NIC

PGP Endpoint

- 14 -

PGP Endpoint Component Requirement

Management Server Console

• 512 MB (1 GB recommended) memory

• 15 MB hard disk drive for installation, and 150 MB

additional for application files

• 1024 by 768 pixels for display

Client

• 256 MB (1 GB recommended) memory

• Pentium Dual-Core CPU or AMD equivalent

• 10 MB hard disk drive for installation, and several

additional GB for full shadowing feature of PGP Endpoint

Device Control

• 100 MBits/s NIC

Supported Operating Systems

PGP Endpoint supports multiple Microsoft Windows operations systems for the Administration

Server, Management Server Console, database, and client.

The operating system requirements for PGP Endpoint 4.4 SR1 components are outlined as

follows.

Table 3: Operating System Requirements

PGP Endpoint Component Requirement

Database

One of the following:

•

Microsoft Windows

XP Professional Service Pack 2 or

higher (SP2+) (32-bit)

• Microsoft Windows XP Service Pack 2 (SP2) (64-bit)

•

Microsoft Windows Server

2003 Service Pack 2 (SP2)

(32- and 64-bit)

• Microsoft Windows Server 2008 (32-bit and 64-bit)

• Microsoft Windows Server 2008 R2 (64 bit only)

Administration Server One of the following:

• Microsoft Windows Server 2003 SP2 (32-bit)

• Microsoft Windows Server 2008 (32-bit and 64-bit)

• Microsoft Windows Server 2008 R2 (64 bit only)

Planning Your Installation

- 15 -

PGP Endpoint Component Requirement

Management Server Console One of the following:

• Microsoft Windows XP Professional SP2+ (32-bit)

• Microsoft Windows Server 2003 SP2 (32-bit)

• Microsoft Windows Server 2008 (32-bit and 64-bit)

• Microsoft Windows Server 2008 R2 (64 bit only)

•

Microsoft Windows Vista

™

SP1+ (32- and 64-bit)

• Microsoft Windows 7 (32- and 64-bit)

Client One of the following:

•

Microsoft Windows

Server 2000 Service Pack 4 or higher

(SP4+) (32-bit)

• Microsoft Windows 2000 Professional SP4+ (32-bit)

• Microsoft Windows XP Professional Service Pack 2 or

higher (SP2+) (32- and 64-bit)

• Microsoft Windows Server 2003 SP2 (32- and 64-bit)

• Microsoft Windows Server 2008 (32-bit and 64-bit)

• Microsoft Windows Server 2008 R2 (64 bit only)

• Microsoft Windows Vista SP1+ (32- and 64-bit)

• Microsoft Windows 7 (32- and 64-bit)

• Microsoft Windows XP Embedded (XPe) Service Pack 2

(SP2) (32-bit)

• Microsoft Windows Embedded Point of Service (WEPOS)

(32-bit)

• Microsoft Windows XP Tablet PC Edition (32-bit)

•

Citrix Access Gateway

™

4.5

•

Citrix Presentation Server

™

4.0 for Windows Server 2003

SP1/SR2+ (32-bit)

• Citrix Presentation Server 4.5 for Windows Server 2003

SP1/SR2+ (32- and 64-bit)

Supported Databases

PGP Endpoint supports multiple releases of Microsoft

SQL Server

. You should choose

the database instance required by your network operating environment and the number of

Administration Server s and subscribed clients the application must support.

The database requirements for PGP Endpoint 4.4 SR1 components are outlined as follows.

PGP Endpoint

- 16 -

Table 4: Database Requirements

PGP Endpoint

Component

Requirement

Database One of the following:

•

Microsoft SQL Server

2005 Service Pack 2 or higher (SP2+)

(32-bit and 64-bit)

• Microsoft SQL Server 2005 Express Edition SP2+ (32-bit and

64-bit)

• Microsoft SQL Server 2008

• Microsoft SQL Server 2008 Express Edition

Other Software Requirements

The PGP Endpoint 4.4 SR1 release requires the following additional software.

Additional software requirements for PGP Endpoint 4.4 SR1 components are outlined as

follows.

Table 5: Other Software Requirements

PGP Endpoint Component Requirement

Database No additional software requirements.

Administration Server

Install Microsoft

Certificate Authority for PGP Endpoint

Device Control encryption, if you will be encrypting Windows

user accounts. See Microsoft Certificate Authority (http://

technet.microsoft.com/en-us/library/cc756120.aspx) for

additional information about certificates.

Management Server Console Microsoft Visual C++ 2008 Redistributable Package.

Client No additional software requirements.

Recommended Configuration

To maximize PGP Endpoint 4.4 SR1 for operation in a Microsoft Windows environment, you

should configure your network environment database and client components using the following

suggested configurations.

The recommended configurations for PGP Endpoint 4.4 SR1 components are outlined as

follows. These settings represent the usual default settings, but should be confirmed before

beginning PGP Endpoint installation.

Planning Your Installation

- 17 -

Table 6: Recommended Configuration

PGP Endpoint Component Requirement

Database

• Change the Windows Event Viewer settings to 1024 KB

and choose to overwrite events as necessary.

• Change Windows Performance settings to prioritize for

background applications.

Administration Server None recommended.

Management Server Console None recommended.

Client

• If you are using Active Directory, configure a

corresponding Domain Name System (DNS) server as

Active Directory (AD) integrated and create a reverse

lookup zone, to provide for name resolution within the

PGP Endpoint Management Server Console.

• Configure NIC to receive IP from DHCP service.

• Change the Windows Event Viewer settings to 1024 KB

and choose to overwrite events as necessary.

Client Supported Languages

The PGP Endpoint 4.4 SR1 client supports multiple languages in text format.

The PGP Endpoint 4.4 SR1 client is supported in the following languages:

• English

• French

• Italian

• German

• Spanish

• Japanese

• Simplified Chinese

• Traditional Chinese

• Russian

• Dutch

• Portuguese

• Swedish

PGP Endpoint

- 18 -

Licensing PGP Endpoint Products

The following types of licenses are available for PGP Endpoint product solutions:

• An Evaluation License provides you with a fully functioning PGP Endpoint product solution

for a limited time.

• A Perpetual License provides full capacity for an unlimited period.

• A Subscription License provides full capacity for the time period specified by the terms of

your license.

- 19 -

Chapter

Installing PGP Endpoint Components

In this chapter:

• Installation Overview

• Installation Checklist

• Installing the PGP

Endpoint Database

• Generating a Key Pair

• Installing the

Administration Server

• Installing the PGP

Endpoint Management

Server Console

• Installing the PGP

Endpoint Client

Successful installation of PGP Endpoint 4.4 SR1 requires

you to install components in the following order:

1. Install the database.

2. Generate and save a public and private key pair.

This action is not required, however, PGP strongly

recommends the use of a public-private key pair to

provide the highest level of security.

3. Install the Administration Server(s).

4. Install the Management Server Console.

5. Install and deploy the client.

PGP Endpoint

- 20 -

Installation Overview

PGP Endpoint component installation requires that you follow a series of interdependent tasks

in a prescribed order. Before you begin, you must have a valid license key for each software

application(s) that your are installing.

Use the following process to identify tasks for installing components installing PGP Endpoint 4.4

SR1, for your convenience this process refers to the Installation Checklist on page 21.

Figure 1: PGP Endpoint Product Solution Installation Process Flow

Page is loading ...

PGP Endpoint 4.4 SR1 Installation guide

Brand: PGP

Model: Endpoint 4.4 SR1

Category: Software

Type: Installation guide

Download PDF

report

PGP Endpoint 4.4 SR1 Installation guide

PGP Endpoint 4.4 SR1 Installation guide

Related papers

Other documents