Sophos 6 Mobile Control Installation guide
Below you will find brief information for Mobile Control 6. This guide explains how to install and set up Sophos Mobile Control version 6. It describes how to update an existing installation of Sophos Mobile Control. The Sophos Mobile Control system consists of a server and a client component. The server is the core component of the Sophos Mobile Control product. It provides a web interface to administer Sophos Mobile Control and to manage the registered mobile devices. The client is an app to be installed on the mobile devices. It supports over-the-air setup and configuration through the web interface of the Sophos Mobile Control server.
Advertisement
Advertisement
Sophos Mobile Control
Installation guide
Product version:
Document date:
6
December 2015
2
Contents
Installation guide
1 About this guide
This guide explains how to install and set up Sophos Mobile Control version 6. It also describes how to update an existing installation of Sophos Mobile Control.
Unless otherwise noted, all procedures must be executed as an administrator of Microsoft Windows
Server or as a user of the relevant group.
3
4
Sophos Mobile Control
2 About Sophos Mobile Control
Sophos Mobile Control
Sophos Mobile Control is a management tool for mobile devices like smartphones and tablets. It helps to keep corporate data safe by managing apps and security.
The Sophos Mobile Control system consists of a server and a client component.
The server is the core component of the Sophos Mobile Control product. It provides a web interface to administer Sophos Mobile Control and to manage the registered mobile devices.
The client is an app to be installed on the mobile devices. It supports over-the-air setup and configuration through the web interface of the Sophos Mobile Control server.
With the Sophos Mobile Control Self Service Portal for your users, you can reduce IT effort by allowing users to register their own devices and carry out other tasks without contacting the helpdesk.
Sophos Mobile Control can also be used to manage the Sophos Mobile Security, Sophos Secure
Workspace and Sophos Secure Email mobile apps. This requires an SMC Advanced license.
Sophos Mobile Security
Sophos Mobile Security is a security app for Android phones and tablets. Using up-to-the-minute intelligence from SophosLabs, your apps will be automatically scanned as you install them. This antivirus functionality protects you from malicious software which can lead to data loss and unexpected costs.
Sophos Secure Workspace
Sophos Secure Workspace is an app for Apple iOS and Android devices that provides a secure workspace where you can browse, manage, edit, share, encrypt and decrypt documents from various storage providers or distributed by your company. It is designed to prevent any data loss even when your device is lost or stolen or when you send a document to an unintended destination.
Files can be decrypted and viewed in a seamless way. Encrypted files can be handed over by other apps and uploaded to one of the supported cloud storage providers. Alternatively the documents can be stored locally within the app.
With Sophos Secure Workspace you can read files encrypted by SafeGuard Cloud Storage or
SafeGuard Data Exchange. Both are modules of SafeGuard Enterprise or one of its different editions.
Sophos Secure Workspace also includes Corporate Browser, a web browser that lets you securely access corporate intranet pages and other allowed pages, as defined by a Sophos Mobile Control policy.
Installation guide
Sophos Secure Email
Sophos Secure Email is an app for Apple iOS and Android devices that provides a secure container for managing your email, calendar and contacts. All data is encrypted and is protected from third-party access.
5
6
Sophos Mobile Control
3 Sophos Mobile Control licenses
Sophos Mobile Control offers two types of licenses:
■
SMC Standard license
■
SMC Advanced license
An SMC Advanced license adds functionality by enabling you to manage Sophos Mobile Security,
Sophos Secure Workspace and Sophos Secure Email, see
About Sophos Mobile Control (page
4).
For further information on managing Sophos Mobile Security, Sophos Secure Workspace and
Sophos Secure Email through the Sophos Mobile Control web console, see the Sophos Mobile
Control administrator help .
As a super administrator, you can activate your purchased licenses in the super administrator customer and assign the required number of licensed users to individual customers.
3.1 Trial licenses
Sophos offers a free trial for Sophos Mobile Control. You can register for the trial on the Sophos website: http://www.sophos.com/en-us/products/free-trials/mobile-control.aspx
.
A trial license allows you to manage up to five users and is valid for 30 days.
All you will need when you set up Sophos Mobile Control for evaluation is the email address you used to register when downloading the installer.
3.2 Upgrading trial licenses to full licenses
To upgrade trial licenses to full licenses you only have to enter your full license key in the Sophos
Mobile Control web console. For further information, see the Sophos Mobile Control administrator help .
3.3 Updating licenses
To update your licenses you only have to enter the new license key in the Sophos Mobile Control web console. For further information, see the Sophos Mobile Control super administrator guide.
Installation guide
4 Sophos Mobile Control architecture
4.1 Architecture examples
The following graphics show how the Sophos Mobile Control server (SMC server) can be integrated into a company’s infrastructure.
Figure 1: Communication overview
7
Sophos Mobile Control
Figure 2: Sophos Mobile Control in demilitarized zone (DMZ)
8
Figure 3: Sophos Mobile Control in DMZ with incoming and outgoing traffic protection
Installation guide
Figure 4: Sophos Mobile Control in backend with incoming and outgoing traffic protection
Figure 5: Sophos Mobile Control cluster setup with Sophos UTM Web Application Firewall
9
Sophos Mobile Control
4.2 Ports and protocols
From the internet to the SMC server
Port forwarding, NAT, WAF, Reverse Proxy are supported
Protocol TCP Port Destination
HTTP
HTTPS
80
443
<SMC server>
<SMC server>
Comment Optional?
Forwards to HTTPS port
Access to admin console, self service portal and device sync,
UTM, NAC
Yes
From the internal network to the SMC server
Protocol TCP Port Destination
HTTP
HTTPS
80
443
<SMC server>
<SMC server>
Comment Optional?
Forwards to HTTPS port
Access to admin console, self service portal and device sync,
UTM, NAC
Yes
From the SMC server to the Internet
Note: A proxy can be used for this traffic. Make sure it can access the APNs servers and keeps the client certificate for services.sophosmc.com intact.
Protocol TCP Port Destination
HTTPS with client cert.
443
HTTPS 443 services.sophosmc.com
(85.22.154.49) android.googleapis.com
Comment
Used for SMC App Push - Apple
(APNs) and Microsoft (MPNS)
Optional?
Google Cloud Messaging for
Android devices
10
Installation guide
Protocol TCP Port Destination
APNS with client cert.
2195
HTTPS 443
HTTPS 443
HTTPS 443
HTTPS 443 gateway.push.apple.com
(17.0.0.0/8) vpp.itunes.apple.com (17.0.0.0/8) itunes.apple.com (17.0.0.0/8)
Comment
Apple Push Notification service
Apple Volume Purchase Program
Apple App identifier search
Optional?
Yes deviceservices-external.apple.com
(17.0.0.0/8)
Apple Activation Lock Bypass for supervised devices
Yes login.live.com, db3.notify.windows.com
Windows Push Notification service
From the SMC server to the following internal hosts
Protocol TCP Port Destination
MS SQL or MySQL
1433 or
3306
<your database host>
SMTP
(Plain,
SSL or
TLS)
25, 465 or
587
LDAP or
LDAPS
389 or
636
<your SMTP host>
<your LDAP host>
HTTPS
HTTPS
443
443
<your Exchange server>
<your SGN server>
Comment
If not on same computer as SMC
Optional?
Mails for enrollment and maintenance
To your directory server. Plain or
SSL
Yes
For ActiveSync traffic
For SGN integration
Yes
Yes
From the devices to the Internet
For the mobile devices, while connected to the WLAN, the following ports to the Internet should be open.
11
Sophos Mobile Control
Service TCP Port Destination
APNs 5223 17.0.0.0/8
GCM 5228,
5229,
5230
Internet
Comment
Apple Push Notification service for iOS devices
Google Cloud Messaging for
Android devices
Optional?
4.3 Sizing guidelines
The Sophos knowledge base article Sophos Mobile Control - Sizing guide provides guidance on the dimensioning of a Sophos Mobile Control server installation in terms of hardware (e.g. CPU, memory) and software (e.g. database, virtualisation) requirements.
You can access the knowledge base article at http://www.sophos.com/support/knowledgebase/122741.aspx
.
12
Installation guide
5 Set up Sophos Mobile Control
The key steps to set up Sophos Mobile Control are:
■
Request an SSL Certificate, see Request an SSL certificate for Sophos Mobile Control (page
13).
■
After the installation there are a few initial configuration steps that you need to perform:
■
■
■
Log in to the Sophos Mobile Control web console for the first time to run the configuration wizard.
For iOS devices, you need to get an Apple Push Notification service certificate.
Optionally, you can set up a standalone EAS Proxy for email filtering that has the following advantages over the internal EAS Proxy that is automatically installed with Sophos Mobile
Control:
■
■
■
Support for certificate-based client authentication.
Lotus Traveler client support for non-iOS devices.
Support for multiple Exchange and Lotus Traveler servers.
See the Sophos Mobile Control Startup guide for details regarding these configuration tasks.
5.1 Request an SSL certificate for Sophos Mobile Control
In order to set up Sophos Mobile Control, you need an SSL web server certificate. In the setup process, you can select between creating a self-signed certificate and using a PKCS #12 with
certificate, private key and certificate chain. For further information, see Install and set up the
Sophos Mobile Control server (page 14).Your Sophos product delivery includes an SSL Certificate
Wizard in the
%MDM_HOME%\tools\Wizard
folder which you can use to request your certificate or you can download the wizard from MySophos.
Note: If you plan to manage Windows Phone 8 or Windows 10 Mobile devices, we recommend that you use an official SSL certificate. Otherwise you need to install the self-signed certificate manually on the devices.
To request your SSL certificate:
■
Start the SSL Certificate Wizard by double-clicking the file Sophos Mobile Control SSL
Certificate Wizard.exe.
13
Sophos Mobile Control
The wizard guides you through installation. Enter the required information, considering the following instructions: a) On the Upload CSR page, you can click the Open CSR button to open the
.csr
file if your certificate vendor supports copy and paste.
b) On the Import Certificate Files page, enter the CA certificate downloaded on the Upload
CSR page into the Select CA certificate file field.
c) On the Certificate created page, the location of the certificate created is shown. You need
to refer to this location when setting up Sophos Mobile Control, see Install and set up the
Sophos Mobile Control server (page 14).
Note: You should create a backup of the folder containing the certificate files.
5.2 Install and set up the Sophos Mobile Control server
■
■
If you plan to connect Sophos Mobile Control to an existing database, make sure you have the logon credentials for the database available before starting the installation, and that you have sufficient permissions to create new data stores, user accounts and data records.
If the database is not held locally, you need access to TCP port 3306 for MySQL and 1433 for Microsoft SQL Server. In addition, you need an admin account that can log in from the
Sophos Mobile Control server.
1. Run the Sophos Mobile Control installer as administrator, and review and agree to the License
Agreement.
2. On the System Property Checks page, click Check to run the tests to verify that your system environment fulfills all necessary requirements for Sophos Mobile Control.
You can click Report to generate a report of the test results.
3. On the Choose Install Location page, choose the destination folder for Sophos Mobile Control server.
4. On the Database Type Selection page, select the database type you want to use:
■
■
■
Install and use Microsoft SQL Server 2014 Express: Will immediately install SQL Server
2014 Express and configure it to be used with Sophos Mobile Control
Use existing Microsoft SQL database
Use existing MySQL
5. On the Database Settings page, enter the logon credentials for the database.
Note: If you select the Use SQL Server Authentification option, you need to make sure that
the SQL login language is set to English. See Change the SQL login language (page 16) for
details.
6. On the Database Selection page, click Create a new database named and enter a name for the database to be created, for example SMCDB.
7. On the Database Configuration page, progress messages are displayed during the database creation.
When the database has been successfully created and populated, click Next to continue.
14
Installation guide
8. If you have selected Windows authentication for the database access, there is a page Set
service credentials where you set the Windows account under which the Sophos Mobile
Control service runs.
You can use the Local System account or a user account. In the latter case, specify the user account either as
<computer name>\<user name>
or as
<domain>\<user name>
.
The installer will assign the database access rights to that account.
Note: Also see
Run the Sophos Mobile Control service with limited access rights
(page 30).
9. On the Configure super admin account page, enter a name for the Super admin customer
(a special customer that is only used by the super administrator), the Super admin login (the super administrator login name) and a Super admin password.
The super administrator is primarily intended for customer management and should not be used for routine management of mobile devices. In Sophos Mobile Control, customers are the tenants that manage the devices of their users. The super administrator logs in to the super administrator customer and can, for example, predefine settings for new customers and push settings and configurations to existing customers. For further information, see the Sophos
Mobile Control super administrator guide.
Note:
■
The super admin credentials are required for the first login to the Sophos Mobile Control web console.
■
After installation, additional super administrators can be added in the Sophos Mobile Control web console.
10. On the Configure external server name page, enter a Sophos Mobile Control server name
(for example smc.mycompany.com).
Note: The server name must be resolvable by the Mobile Control client components.
11. On the Configure server certificate page, create or import a certificate for secure (HTTPS) access to the web server.
Note: Your Sophos product delivery includes an SSL Certificate Wizard that you can use to
(page 13).
■
■
If you do not have a trusted certificate yet, select Create self-signed certificate.
If you have a trusted certificate, click Import a certificate from a trusted issuer and an option from the drop-down list.
12. On the next page, enter the relevant certificate information, depending on the type of certificate that you selected.
Note: For a self-signed certificate, you need to specify a server that is accessible from the client devices.
13. On the Server Information page, verify the server information, then click Next to confirm the server and configuration process.
15
Sophos Mobile Control
14. After installation has finished, the Sophos Mobile Control - Installation finished dialog is displayed. Make sure that the check box Start Sophos Mobile Control server now is selected and click Finish to start the Sophos Mobile Control service for the first time.
Note: After the service has been started it can take a few minutes before the Sophos Mobile
Control web interface is available.
After the installation there are a few initial configuration steps that you need to perform:
■
■
Log in to the Sophos Mobile Control web console for the first time to run the configuration wizard.
For iOS devices, you need to get an Apple Push Notification service certificate.
■
Optionally, you can set up a standalone EAS proxy for email filtering that has the following advantages over the internal EAS proxy that is automatically installed with Sophos Mobile
Control:
■
■
■
Support for certificate-based client authentication.
Lotus Traveler client support for non-iOS devices.
Support for multiple Exchange and Lotus Traveler servers.
See the Sophos Mobile Control Startup guide for details of these configuration tasks.
5.3 Change the SQL login language
If you have configured Sophos Mobile Control Server to use SQL Server authentication to connect to the database, the SQL login language must be set to English. Otherwise, an error occurs when the Sophos Mobile Control service is started.
This topic describes how to change the SQL login language to English.
1. Stop the Sophos Mobile Control service.
2. Open SQL Server Management Studio on the server and select Security > Logins.
3. On the General page of the Login Properties, set Default language to English, then click
OK to save the changes.
4. Restart the Sophos Mobile Control service.
16
Installation guide
6 Set up a standalone EAS proxy
6.1 Standalone EAS proxy
With Sophos Mobile Control, you can set up an EAS proxy to filter email traffic from mobile devices to an email server.
The mobile devices must be configured to use the EAS proxy as email server for incoming and outgoing emails. The EAS proxy will only forward traffic to the actual email server if the device is known in Sophos Mobile Control and matches the required policies. This guarantees higher security as the email server does not need to be accessible from the Internet and only devices that are authorized (correctly configured, for example with passcode guidelines) can access it.
Also, you can configure the EAS proxy to block access from specific devices.
There are two types of EAS proxy:
■
■
The internal EAS proxy that is automatically installed with Sophos Mobile Control. It supports incoming ActiveSync traffic as used by Microsoft Exchange or Lotus Traveler for iOS and
Samsung SAFE/KNOX devices.
A standalone EAS proxy that can be downloaded and installed separately. It communicates with the Sophos Mobile Control server through an HTTPS web interface.
Features
The standalone EAS proxy has additional features compared to the internal version:
■
Support for Lotus Traveler for non-iOS devices (for example, Android). The Traveler client for these devices uses a protocol (not ActiveSync) that is not supported by the internal EAS proxy.
■
■
■
Support for multiple Microsoft Exchange or Lotus Traveler email servers. You can set up one
EAS proxy instance per email server.
Load balancer support.You can set up standalone EAS proxy instances on several computers and then use a load balancer to distribute the client requests among them.
Support for certificate-based client authentication.You can select a certificate from a certification authority (CA), from which the client certificates must be derived.
6.2 Usage scenarios for the standalone EAS proxy
A standalone EAS proxy server should be used for the following scenarios.
You use Lotus Traveler for non-iOS devices
The internal EAS proxy is not suitable for this scenario because it only supports the ActiveSync protocol, which is used by Microsoft Exchange and by Lotus Traveler for iOS devices. Lotus
17
Sophos Mobile Control
Traveler for non-iOS devices (for example, Android) uses a different protocol that is supported by the standalone EAS proxy.
For non-iOS devices, dedicated Traveler client software is required. This software is available through
<traveler-server>/servlet/traveler
or the Traveler file system. The Install App and Uninstall App features of Sophos Mobile Control can be used to install and uninstall the
Traveler client software. Configuration has to be performed manually.
Figure 6: EAS proxy for Lotus Traveler
You want to support multiple backend servers
With the standalone EAS proxy you can set up multiple instances of backend mail systems. Each instance needs an incoming TCP port. Each port can connect to a different backend. You need one URL per EAS proxy instance.
18
Installation guide
Figure 7: SMC and multiple EAS proxy instances on the same computer
Figure 8: SMC and multiple EAS proxy instances on different computers
You want to set up load balancing for EAS
You can set up standalone EAS proxy instances on several computers and then use a load balancer to distribute the client requests among them.
For this scenario an existing load balancer for HTTP is required.
19
Sophos Mobile Control
20
Figure 9: Load-balanced EAS proxies (can also be used behind reverse proxy)
You want to use client certificate based authentication
For this scenario an existing PKI is required and the public part of the CA certificate has to be set in the EAS proxy.
Installation guide
Figure 10: EAS proxy with client certificate authentication
6.3 Download the EAS proxy installer
1. Log on to the Sophos Mobile Control web console as a super administrator.
2. On the menu sidebar, under SETTINGS, click Setup and then click System setup.
The System setup view is displayed.
3. Go to the EAS proxy tab and click the download link in the External section.
6.4 Install the standalone EAS proxy
Prerequisite:
■
■
Sophos Mobile Control has been installed and set up. See the Sophos Mobile Control installation
guide.
Sophos Mobile Control has been installed and set up.
■
■
Log in to the Sophos Mobile Control web console as a super administrator. This is required because during the configuration process described below you will need to upload certificate files to the Sophos Mobile Control server.
During the configuration of the EAS proxy instances, the installer will check if the specified mail servers are accessible. You need to make sure that these servers are available before running the installer.
To install and configure the standalone EAS proxy:
1. Run the
Sophos Mobile Control EAS Proxy Setup.exe
as administrator to launch the Sophos Mobile Control EAS Proxy - Setup Wizard.
21
Sophos Mobile Control
2. Review and agree to the license terms.
3. On the Choose Install Location page, choose the destination folder and click Install to start installation.
After the installation has been completed, the Sophos Mobile Control EAS Proxy -
Configuration Wizard is launched automatically and guides you through the configuration steps.
4. In the SMC Server configuration dialog, enter the URL of the SMC server that the EAS proxy will connect with. You should also select Use SSL for incoming connections (Clients to
EAS Proxy) to secure the communication between clients and the EAS proxy. Optionally, select Use client certificates for authentication if you want the clients to use a certificate in addition to the EAS proxy credentials for authentication. This adds an additional layer of security to the connection.
5. If you selected Use SSL for incoming connections (Clients to EAS Proxy) before, the
Configure server certificate page is displayed. On this page you create or import a certificate for the secure (HTTPS) access to the EAS proxy.
Note: Your Sophos product delivery includes an SSL Certificate Wizard that you can use to request your SSL certificate for the Sophos Mobile Control EAS proxy. For further information,
see Request an SSL certificate for Sophos Mobile Control
(page 13).
■
■
If you do not have a trusted certificate yet, select Create self-signed certificate.
If you have a trusted certificate, click Import a certificate from a trusted issuer and select one of the following options from the list box:
■
■
PKCS12 with certificate, private key and certificate chain (intermediate and CA)
Separate files for certificate, private key, intermediate and CA certificate
6. On the next page, enter the relevant certificate information, depending on the type of certificate that you selected.
Note: For a self-signed certificate, you need to specify a server that is accessible from the client devices.
7. If you selected Use client certificates for authentication before, the SMC client
authentication configuration page is displayed. On this page, you select a certificate from a certification authority (CA), from which the client certificates must be derived.
When a client tries to connect, the EAS proxy will check if the certificate that the client provides is derived from the CA that you specify here.
22
Installation guide
8. On the EAS Proxy instance setup page, configure one or more EAS proxy instances. For every instance, enter an Instance name, the relevant Server port for incoming traffic and the
ActiveSync server with which the proxy instance will connect. Select Enable traveler client
access to enable Lotus Traveler client access. If required, you can enable SSL or client certificate authentication for certain instances.
Note: If you set up more than one proxy instance, each of these must use a different server port.
9. After entering the instance information, click Add to add the instance to the Instances list.
For every proxy instance, the installer will create a certificate that you need to upload to the
Sophos Mobile Control server. After you have clicked Add, a message window will open, explaining how to upload the certificate.
10. In the message window, click OK.
This will open a dialog, showing the folder in which the certificate has been created.
Note: You can also open the dialog by selecting the relevant instance and clicking the Export
config and upload to SMC link on the EAS Proxy instance setup page.
11. Using the Sophos Mobile Control web console as super administrator, navigate to Setup >
System setup > EAS proxy.
23
Sophos Mobile Control
12. In the External section, click Upload a file and select the certificate file that has been created for the EAS proxy instance. Do not forget to save these changes to the EAS proxy settings.
Note: You need to upload the certificate before you start the EAS proxy. If the certificate is not available at startup, Sophos Mobile Control rejects the connection and the service will not be started.
13. If required, repeat steps 8 to
to configure additional instances of the EAS proxy. When finished, click Next.
The server ports that you entered are tested and Inbound Rules for the Windows Firewall are configured.
14. On the Sophos Mobile Control EAS Proxy - Configuration Wizard finished page, click
Finish to close the Configuration Wizard and return to the Setup Wizard.
15. In the Setup Wizard, make sure that Start Sophos Mobile Control EAS Proxy server now is selected, then click Finish to complete the configuration and to start the Sophos Mobile
Control EAS proxy for the first time.
Note: Every day, the EAS proxy log entries are moved to a new file, using the naming pattern
EASProxy.log.yyyy-mm-dd
. These daily log files are not deleted automatically and thus may cause disk space issues over time. We recommend that you set up a process to move the log files to a backup location.
24
Installation guide
7 Load balancing and high availability
Sophos Mobile Control (SMC) makes it possible to set up a high-availability environment. This ensures that the SMC service remains externally accessible and tasks can be further processed even after failure of a Sophos Mobile Control node. To achieve this, load balancing, that distributes client and browser sessions by using DNS Round Robin to the available nodes, is required.
The following describes setting up clustering for Sophos Mobile Control and configuring load balancing by means of Sophos UTM.
7.1 Requirements
■
■
■
■
One separate Windows server for each Sophos Mobile Control node.
All nodes must be on the same network.
One Microsoft SQL or MySQL database server or cluster.
Sophos UTM or Apache Reverse Proxy (mod_proxy) for load balancing. Load balancer must support permanent session cookies and official SSL web server certificates.
Note: For detailed information about the installation requirements see http://downloads.sophos.com/readmes/readsmc_6_eng.html
and https://www.sophos.com/en-us/medialibrary/PDFs/documentation/smc_6_s_eng_supplement.pdf
.
Architecture
For an example of a three-node Sophos Mobile Control cluster see Architecture examples (page
7).
For multicast communication between the individual Sophos Mobile Control nodes, optionally a separate network can be used. The network interface to be used can be selected during cluster configuration, as described in
(page 26). It may also be a VLAN.
Note: If you want to operate a second Sophos Mobile Control cluster for test purposes, a separate network is needed.
Ports and protocols
The following table shows the required ports and protocols for communication between the individual nodes of a Sophos Mobile Control server cluster.
Protocol
TCP
TCP
Ports
7600, 54200, 57600
7600, 57600
Destination
<Incoming>
<Outgoing>
25
Sophos Mobile Control
26
Protocol
UDP
Ports
54200, 55200
Destination
<Incoming>
7.2 Set up cluster nodes
To set up a clustered environment you install the first node as described in
(page 14). Clustering itself is then activated using the Configuration
Wizard.
For all other nodes, the database created during installation of the first node has to be selected and clustering has to be activated.
Note: It is also possible to configure an existing SMC server for clustering and to extend the environment by adding additional nodes.
7.2.1 Set up the first node
be used for installing further nodes.
2. At the end of the installation deselect the Start Sophos Mobile Control server now option in the Sophos Mobile Control - Installation finished dialog.
Note: If the SMC service has already been started it will automatically be stopped and restarted during the configuration described below. Alternatively, you can manually stop the service from the menu of the Sophos Mobile Control system tray icon.
3. On the server, click Start, go to Sophos Mobile Control and click Configuration Wizard.
4. The Welcome page of the The Sophos Mobile Control - Configuration Wizard is displayed.
Click Next.
5. On the Database Selection page, select Skip database configuration and click Next.
6. On the Choose configuration steps page, select Configure cluster support and click Next.
7. On the Cluster Configuration page, use the drop-down list of available network interfaces to select the interface that will be used for multicasting communication between the server node that you are about to set up and the other nodes.
8. Click through the remaining pages of the configuration wizard. Make sure that you click Yes when asked to start the SMC service.
The configuration of the first SMC server node is now complete. Click Finish in the Sophos
Mobile Control - Configuration Wizard finished dialog.
7.2.2 Set up further nodes
1. Start the installation of Sophos Mobile Control as described in Install and set up the Sophos
(page 14).
Installation guide
2. On the Database selection page, select the database you created when you installed the first node and click Next.
The Database configuration dialog is displayed. It shows the progress of the configuration process.
3. On the Database configuration page, wait until the configuration process has finished, then click Next.
4. On the Choose configuration steps page, select Configure cluster support and click Next.
5. On the Configure server certificate page, create a self-signed certificate as described in
Install and set up the Sophos Mobile Control server
(page 14) and click Next.
6. On the Cluster Configuration page, use the drop-down list of available network interfaces to select the interface of the Sophos Mobile Control server node that you are about to set up, then click Next.
7. Click through the remaining pages of the configuration wizard. On the Sophos Mobile Control
- Installation finished page, select Start Sophos Mobile Control server now to start the cluster node that you just configured.
The configuration of the SMC node is now complete. If required, repeat this procedure to configure additional nodes.
7.3 Set up load balancing with Sophos UTM
This topic describes how to set up Sophos UTM as a load balancer for a cluster of Sophos Mobile
Control server nodes. For more information on configuring Sophos UTM, see the Sophos UTM documentation.
Note:
■
In order to use Sophos UTM for clustering you need a Sophos UTM license with a Sophos
Webserver Protection subscription.
■
In the procedure below, you specify a certificate to protect the communication between the mobile devices and the virtual web server that you set up in Sophos UTM. For simplicity, we recommend that you use the same certificate that you used for the Sophos Mobile Control
server (see Request an SSL certificate for Sophos Mobile Control
(page 13)). If you used a self-signed certificate, it is mandatory that you use that same certificate.
1. Log into WebAdmin of Sophos UTM.
2. From the WebAdmin menu section Webserver Protection, go to the Web Application
Firewall > Real Webservers tab.
3. Click New Real Webserver to create an SMC node.
4. In the Add Real Webserver dialog, enter the following settings: a) Name: Enter a descriptive name for the web server (for example
SMC node
).
b) Host: Select or add a host. Select a host by clicking the folder symbol next to the host edit field. Drag a host from the list of available hosts into the Host edit field.
For additional information on how to add a definition, see the topic Network Definitions in the UTM Administration Guide .
c) Type: Select Encrypted (HTTPS).
Click Save to save the configuration.
27
Sophos Mobile Control
Repeat the previous step for each Sophos Mobile Control server node.
5. From the WebAdmin menu section Webserver Protection, go to the Certificate
Management > Certificates tab.
6. Click New Certificate to upload an SSL web server certificate.
7. In the Add Certificate dialog, enter the following settings: a) Name: Enter a descriptive name for the certificate.
b) Method: Select Upload.
c) File type: Select PKCS#12(Cert+CA) d) Password: Enter the password for your certificate file.
e) File: Click the folder icon next to the File box, select the certificate you want to upload and click Start Upload.
Click Save to save the configuration. The certificate is added to the Certificates list.
8. From the WebAdmin menu section Webserver Protection, go to the Web Application
Firewall > Virtual Webservers tab.
9. Click New Virtual Webserver to add a virtual web server for the cluster.
10. In the Add Virtual Webserver dialog that opens, make the following settings: a) Name: Enter a descriptive name for the virtual web server (for example
SMC cluster
).
b) Interface: From the drop-down list, select the WAN interface over which the cluster should be accessible from outside.
c) Type: Select Encrypted (HTTPS) & redirect.
d) Certificate: From the drop-down list, select the web server’s certificate you uploaded beforehand.
e) Domains (only with wildcard certificate, i.e., a public key certificate that can be used with multiple subdomains): Enter the domains the web server is responsible for, for example
shop.example.com
, or use the Action icon to import a list of domain names.
Domains must be entered as fully qualified domain names (FQDN).
You can use an asterisk (*) as a wildcard for the domain prefix, for example,
*.mydomain.com
. Domains with wildcards are considered as fallback settings: The virtual web server with the wildcard domain entry is only used when no other virtual web server with a more specific domain name is configured.
Example: A client request to
a.b.c
will match
a.b.c
before
*.b.c
before
*.c
.
f) Real Webservers: Select the SMC nodes you created beforehand.
Important: Do not select a firewall profile.
Click Save to save the configuration. The server is added to the Virtual Webservers list.
11. Enable the virtual web server.
The new virtual web server is disabled by default. Click the toggle switch to enable the virtual web server. The toggle switch color should change from gray (disabled) to green (enabled).
12. Go to the Site Path Routing tab.
28
Installation guide
13. In the Virtual Webservers list, go to the virtual web server you added and click Edit.
14. In the Edit Site Path Route dialog that opens, click Advanced and select Enable sticky
session cookie.
Click Save to save the configuration.
29
Sophos Mobile Control
8 Run the Sophos Mobile Control service with limited access rights
For security reasons, we recommend that you run the SMC service as a user with limited access rights instead of an administrator.
Note: If you use Windows authentication for database access, you only have to perform step 3 of the following instructions.
1. On the computer on which Sophos Mobile Control is running, create a local, “regular” Windows user account with a password that does not expire.
2. Remove this user account from all groups. (By default, the user is in the users group.)
3. Grant this user account full access to the Sophos Mobile Control installation directory
(
C:\Programs\Sophos\Sophos Mobile Control
) including all subdirectories.
4. Use this user account to log on to the Sophos Mobile Control Service:
From the Windows Services window, open the Properties dialog for Sophos Mobile Control
Service and enter the account credentials of the user on the Log on tab.
30
Installation guide
9 Update Sophos Mobile Control
Sophos Mobile Control server installations can be updated directly from versions 5 or 5.1 to 6.
Older versions need to be updated to version 5 beforehand. Please see your Sophos Mobile
Control 5 documentation for details.
To update your Sophos Mobile Control server installation to version 6, run the Sophos Mobile
Control 6 installer and follow the instructions. The installer automatically detects that an existing installation is to be updated to version 6.
A system property check will be performed before the update starts. If all checks are passed you can proceed with the update. Database and files will be updated automatically without any user interaction. Once the update is complete, the Sophos Mobile Control service will be started again.
Note: If you used Windows Authentication during your initial Sophos Mobile Control server installation the Start Sophos Mobile Control server now option is grayed out. You have to start the service manually.
What to check after the update
In Sophos Mobile Control version 5.1 you could define lists of allowed, not allowed and mandatory apps for a compliance rule. Version 6 introduces a new feature App groups to simplify the management of these lists and to allow the import and export of lists.
During the update process, any list of apps that you defined for a compliance rule is converted to an app group, named after the compliance rule. That means, if you used the same list of apps for more than one compliance rule, it is converted to multiple app groups with the same content.
We recommend that you review the app groups that have been created by the update process and consolidate them as required.
For further information on app groups, see the Sophos Mobile Control administrator guide.
31
Sophos Mobile Control
10 Technical reference
10.1 Sophos Mobile Control server features
The core component of the Sophos Mobile Control product is the Sophos Mobile Control server.
Its main features include:
■
■
The server is connected to the Internet.
The server makes it possible to set up a high-availability environment.
■
■
■
■
■
The administrator controls the server using the web interface.
End users can register their devices by using the Self Service Portal, or get a device from the administrator that has already been prepared by means of auto enrollment.
The mobile devices synchronize with the server through HTTPS.
iOS clients get triggered by the server through APNs, Android clients through GCM. Windows 10
Mobile and Windows Phone 8.1 devices use Windows Notification Service (WNS).
You can use an existing Microsoft SQL Server or MySQL database to store device and application information. Alternatively, you can let the Sophos Mobile Control installer create a new database using Microsoft SQL Server 2014 Express.
■
■
The database can reside on the same or a separate computer. This allows the use of database clusters.
The server supports multi-tenant setups to allow different customers on the same server.
■
Email access is possible through an integrated or a standalone EAS proxy. For the standalone variant, HTTPS access to the SMC server is required.
The Sophos Mobile Control server has been developed for the Java enterprise environment (JEE).
It installs and runs inside the well-tested industry-standard WildFly application server.
The default environment for the Sophos Mobile Control server is Windows Server 2012 R2. The server may be installed in virtualized environments.
10.2 Sophos Mobile Control web interfaces
10.2.1 Mobile Control administration interface
Sophos Mobile Control is managed through a web interface that is secured by a login and a session mechanism. You can implement password policies. Access control allows different user roles. These roles have different sets of access rights. Each user can be assigned exactly one role.
For further information, see the Sophos Mobile Control Administrator guide.
32
Installation guide
10.2.2 Super administrator interface
The super administrator is primarily used to set up and manage customers for device management.
(page 14).
As a super administrator you log on to the super administrator customer which is also created during Sophos Mobile Control setup. For the super administrator customer, the Sophos Mobile
Control web console shows a specific view that is customized for super administrator tasks.
10.2.3 Self Service Portal
The Self Service Portal is secured by a login, session mechanism and a password policy. The account has to be set up by the Sophos Mobile Control administrator and can be associated with any tenant. The Self Service Portal is designed for end users to register their devices with Sophos
Mobile Control. The end users are also allowed to perform tasks for their devices, for example remote lock or remote wipe. The tasks they can perform vary according to device type and configuration. As an administrator you can configure the Self Service Portal functions available to end users in the Sophos Mobile Control web console.
For information on how to configure the Self Service Portal use for end users, see the Sophos
Mobile Control administrator help .
For information on how to use the Self Service Portal as an end user, see the Sophos Mobile
Control user help .
33
Sophos Mobile Control
11 Technical support
You can find technical support for Sophos products in any of these ways:
■
■
Visit the SophosTalk community at http://community.sophos.com/ and search for other users who are experiencing the same problem.
Visit the Sophos support knowledge base at http://www.sophos.com/en-us/support.aspx
.
■
■
Download the product documentation at http://www.sophos.com/en-us/support/documentation.aspx
.
Send an email to [email protected]
, including your Sophos software version number(s), operating system(s) and patch level(s), and the text of any error messages.
34
Installation guide
12 Legal notices
Copyright
©
2011 - 2015 Sophos Ltd. All rights reserved.
No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording or otherwise unless you are either a valid licensee where the documentation can be reproduced in accordance with the license terms or you otherwise have the prior permission in writing of the copyright owner.
Sophos is a registered trademark of Sophos Ltd. All other product and company names mentioned are trademarks or registered trademarks of their respective owners.
35
Download
Public link updated
The public link to your chat has been updated. You may view and manage your chat links after registration here.
Document public link
Advertisement
Key features
Manage mobile devices
Secure corporate data
Manage apps and security
Web interface for administration
Over-the-air setup and configuration
Self-Service Portal for users
Frequently asked questions
Sophos Mobile Control is a management tool for mobile devices like smartphones and tablets. It helps to keep corporate data safe by managing apps and security.
The Sophos Mobile Control system consists of a server and a client component. The server provides a web interface to administer Sophos Mobile Control and to manage the registered mobile devices. The client is an app to be installed on the mobile devices. It supports over-the-air setup and configuration through the web interface of the Sophos Mobile Control server.
Key features include managing mobile devices, securing corporate data, managing apps and security, web interface for administration, over-the-air setup and configuration, and a self-service portal for users.