Sophos Mobile Control Installation guide
Advertisement
Advertisement
Sophos Mobile Control
Installation guide
Product version:
Document date:
5
April 2015
2
Contents
Installation guide
1 Introduction
Sophos Mobile Control is a device management solution for mobile devices like smartphones and tablets. Sophos Mobile Control helps to keep corporate data safe by managing apps and security.
The Sophos Mobile Control system consists of a server and a client component which communicate through data connections.
The Sophos Mobile Control client is easily installed and managed with over-the air setup and configuration through the Sophos Mobile Control web console.
With the Sophos Mobile Control Self Service Portal for your users, you can reduce IT efforts by allowing users to register their own devices and carry out other tasks without having to contact the helpdesk.
This guide describes:
■
How to request a trial license for evaluating Sophos Mobile Control, see
4).
■
■
■
How to request an SSL certificate for Sophos Mobile Control with the SSL Certificate Wizard,
see Request an SSL certificate for Sophos Mobile Control
(page 5).
How to install and set up the Sophos Mobile Control server, see Set up Sophos Mobile Control
(page 5).
How to install the external EAS Proxy server, see External EAS Proxy server (page 22).
■
■
■
How to run the Sophos Mobile Control Service as a limited user, see Running the Sophos
Mobile Control Service as a limited user (page 32).
How to update Sophos Mobile Control, see
Updating Sophos Mobile Control
(page 33).
How to create and upload an APNs certificate, see
Apple Push Notification service
(page 34).
Note: All steps have to be executed as an administrator of Microsoft Windows Server or as a user of the relevant group. The database user needs sysadmin rights.
1.1 Sophos Mobile Control licenses
Sophos Mobile Control offers two types of license:
■
Standard license
■
SMC Advanced license
An SMC Advanced license adds functionality by enabling you to manage Sophos Mobile
Security and Sophos Secure Workspace.
■
Sophos Mobile Security is a security app for Android phones and tablets. The app protects your Android device and your privacy without impacting performance or battery life. Using up-to-the-minute intelligence from SophosLabs, your apps will be automatically scanned as you install them. This anti-virus functionality protects you from malicious software which
3
Sophos Mobile Control
■ can lead to data loss and unexpected costs. Moreover, if your device is lost or stolen, a remote lock or wipe will shield your personal information from prying eyes.
Sophos Secure Workspace is an app for iOS and Android phones that provides a secure workspace for your important documents: Browse, manage, edit, share, encrypt and decrypt documents from various storage providers or distributed by your company. It is designed to prevent any data loss even when your device gets stolen or you send a document to an unintended source.
Files can be decrypted and viewed in a seamless way. Encrypted files can be handed over by other apps and uploaded to one of the supported cloud storage providers. Alternatively the documents can be stored locally within the app.
With Sophos Secure Workspace you can read files encrypted by SafeGuard Cloud Storage or SafeGuard Data Exchange. Both are modules of SafeGuard Enterprise or one of its different editions. They allow you to encrypt files using a local key. These local keys are derived from a passphrase that is entered by a user. You can only decrypt a file when you know the passphrase that was used to encrypt the file.
For details of the SafeGuard Cloud Storage and SafeGuard Data Exchange modules please refer to the SafeGuard Enterprise 7.0 documentation on www.sophos.com
.
Note: You can activate your licenses in the Sophos Mobile Control configuration wizard. The wizard is launched automatically when you log in to the Sophos Mobile Control web console for the first time after installation.
1.1.1 Trial licenses
Sophos offers a free trial for Sophos Mobile Control. You can register for the trial on the Sophos website: http://www.sophos.com/en-us/products/free-trials/mobile-control.aspx
.
A trial license allows you to manage up to five users and is valid for 45 days.
All you will need when you set up Sophos Mobile Control for evaluation is the email address you used to register when downloading the installer.
1.1.2 Upgrading trial licenses to full licenses
For upgrading trial licenses to full licenses you only have to enter your full license key in the
Sophos Mobile Control web console. For further information, see the Sophos Mobile Control
administrator help.
1.1.3 Updating licenses
For updating you licenses you only have to enter the new license key in the Sophos Mobile Control web console. For further information, see the Sophos Mobile Control super administrator guide.
4
Installation guide
2 Set up Sophos Mobile Control
The key steps are:
■
Request an SSL Certificate
■
■
Execute the Sophos Mobile Control installer.
If you want to configure the EAS Proxy server separately, execute the Sophos Mobile Control
EAS Proxy installer, see
(page 22).
■
Log in to the Sophos Mobile Control web console as a super administrator. For further information see Sophos Mobile Control super administrator guide.
Before you can use the Sophos Mobile Control web console you need to configure certain server settings. Sophos Mobile Control provides a configuration wizard to guide you through this. The wizard is launched automatically when you log in to the Sophos Mobile Control web console for the first time after installation. You need to provide:
■
■
■
HTTP proxy credentials (optional)
A Standard license key and/or an Advanced license key
SMTP credentials
2.1 Databases
Sophos Mobile Control allows you to install Microsoft SQL Server 2014 Express during installation.
If you want to use existing database you will need the corresponding logon credentials during installation.
2.2 Request an SSL certificate for Sophos Mobile Control
For setting up Sophos Mobile Control, you need an SSL webserver certificate. In the setup process, you can select between creating a self-signed certificate and using a PKCS12 with certificate, private key and certificate chain. For further information, see
Install and set up the Sophos Mobile
(page 7). Your Sophos product delivery includes an SSL Certificate Wizard in the %MDM_HOME%\tools\Wizard folder which you can use to request your certificate or you can download the wizard from MySophos.
Note: If you plan to manage Windows Phone 8 devices, you need to use an official SSL certificate.
Otherwise you need to install the self-signed certificate manually on the devices.
To request your SSL certificate:
1. Start the SSL Certificate Wizard by double-clicking the file Sophos Mobile Control SSL
Certificate Wizard.exe.
The Certificate Wizard welcome dialog is displayed.
5
Sophos Mobile Control
2. Click Next.
The License Agreement dialog is displayed.
3. Click I Agree.
The Create Certificate Signing Request dialog is displayed.
4. Enter the Server Name (FQDN), the Company, City, State and Country code (for example
US or UK). These fields are mandatory.
5. Click Next.
The Upload CSR dialog is displayed.
6. In this step, you upload the Certificate Signing Request to the Certificate Authority (CA) for signing. Follow the instructions in the dialog: a) Go to the website of your Certificate Authority and log in.
b) Upload the file ServerCertificateSigningRequest.csr from the folder indicated on the Upload
CSR dialog of the SSL Certificate Wizard.
Note: If your certificate vendor supports copy and paste, you can open the .csr file with the Open CSR button in the Upload CSR dialog.
c) Save the certificate issued by the CA in Base 64 format (*.pem, *cer, *crt) in the folder indicated in the Upload CSR dialog.
d) Download the certificate chain and CA certificate of your certificate authority.
e) Click Next in the Upload CSR dialog.
The Import Certificate Files dialog is displayed.
7. In the Import Certificate Files dialog, you import the intermediate certificates file (depending on your CA vendor) and the downloaded CA certificate. You also need to define a password for the server certificate (PKCS12) that is to be created: a) In the Select intermediate certificates file, field browse for the intermediate certificate.
b) In the Select CA certificate file field, browse for the downloaded CA certificate.
c) In the Password for private key field, enter a password for the server certificate to be created. Confirm the password.
d) Click Next.
The Certificate created dialog is displayed.
8. In the Certificate created dialog, the location of the certificate created is shown. You can use it when setting up Sophos Mobile Control, see
Install and set up the Sophos Mobile Control
(page 7).
Note: Create a backup of the folder containing the certificate files.
Click Next.
The Sophos Mobile Control - SSL Certificate Wizard finished dialog is displayed.
9. Click Finish.
6
Installation guide
2.3 Install and set up the Sophos Mobile Control Server
Prerequisites:
■
If the database is not held locally, you need access to the TCP Port 3306 for MySQL and 1433 for Microsoft SQL Server. In addition, you need an admin account that can log in from the
Sophos Mobile Control Server.
1. Execute the Sophos Mobile Control installer as administrator, review and agree to the License
Agreement.
The System Property Checks dialog is displayed.
To check that the system environment fulfills all necessary requirements for Sophos Mobile
Control installation, click Check. If you want to generate a system check report after the check has been run, click Report.
7
Sophos Mobile Control
2. If all requirements are fulfilled, click Next.
The Choose Install Location dialog is displayed.
Choose the destination folder and click Install to start installation.
3. After the installation process the Sophos Mobile Control Configuration Wizard welcome dialog is displayed. Click Next.
The Database selection dialog is displayed.
8
4. In the Database selection select the database you want to use:
■
Install and use Microsoft SQL Server 2014 Express: Will immediately install SQL Server
2014 Express and configure it to be used with Sophos Mobile Control
■
■
Use existing Microsoft SQL database
Use existing MySQL
Installation guide
9
Sophos Mobile Control
5. Click Next to specify database server information and logon credentials in the Database
Settings dialog. This dialog offers the required options according to the option you have selected.
■
If you have selected install and use Microsoft SQL Server 2014 Express in the Database
selection dialog, the Database Settings dialog offers the following options.
Select Use SQL Server Authentication with the following password , enter a password and confirm it.
The installation of SQL Server 2014 Express starts.
10
Installation guide
■
If you have selected Use existing Microsoft SQL database in the Database selection dialog, the Database Settings dialog offers the following options:
To use the user credentials specified during SQL server installation, select Use SQL Server
Authentication with the following credentials and enter the required user name and password. Click Next.
■
If you have selected, Use existing MySQL database in the Database selection dialog, the Database Settings dialog offers the following options:
Under Authentication, enter the required user name and password and click Next.
11
Sophos Mobile Control
6. In the next step, you create the database. In the Database Selection dialog, select Create a
new database named, enter a name (for example SMCDB) and click Next.
The Database Configuration dialog is displayed. It shows the relevant progress messages.
After the database has been successfully created and populated, click Next.
12
Installation guide
7. In the next step, you create a super administrator account. The super administrator has specific rights and tasks and is primarily used for customer management. In Sophos Mobile Control, customers are the tenants that manage the devices of their users. The super administrator logs in to a super administrator customer and can, for example, predefine settings for new customers and push settings and configurations to existing customers. For further information, refer to the Sophos Mobile Control super administrator guide.
Note: These credentials are required for the first log in to the Sophos Mobile Control web console.
The super administrator should not be used in productive operation, but only for administrative purposes. The super administrator is primarily intended for customer management.
In the Configure super admin account dialog, enter the Super admin customer (the customer the super administrator will log on to), the Super admin login (the super administrator login name) and a Super admin password. Confirm the password and click Next.
Note: After installation additional super administrators can be added in the Sophos Mobile
Control web console.
13
Sophos Mobile Control
8. In the next step enter a client resolvable SMC server name (for example smc.mycompany.com) and click Next.
14
Installation guide
9. In the next step, a certificate for the secure (HTTPS) access to the web server needs to be created or imported.
Note: Your Sophos product delivery includes an SSL Certificate Wizard that you can use to
(page 5).
■
■
If you do not have a trusted certificate yet, select Create self-signed certificate, click Next and continue with step 10.
If you have a trusted certificate, click Import a certificate from a trusted issuer, select
PKCS12 with certificate, private key and certificate chain (intermediate and CA) from the drop-down list, click Next and continue with step 11. You can also select Separate
files for certificate, private key, intermediate and CA certificate from the drop-down list, click Next and continue with step 12.
15
Sophos Mobile Control
10. If you have selected Create self-signed Certificate, the following dialog is shown. Enter the appropriate certificate information.
After you have entered all necessary information click Next.
11. If you have selected PKCS12 with certificate, private key and certificate chain (intermediate
and CA) under Import a certificate from a trusted issuer, the following dialog is shown.
Select the appropriate file and enter the password.
16
Click Next.
Installation guide
12. If you have selected Separate files for certificate, private key, intermediate and CA
certificate under Import a certificate from a trusted issuer, the following dialog is shown.
Select the appropriate files and enter the password for the private key.
Click Next.
13. In the next step, you verify the server information.
Click Next to confirm the server and configuration process.
14. Configuration is now complete.
17
Sophos Mobile Control
15. After installation has finished, the Sophos Mobile Control - Installation finished dialog is displayed. Make sure that the check box Start Sophos Mobile Control server now is selected and click Finish to start the Sophos Mobile Control server for the first time.
If you have selected SQL server authentication during installation, the SMCSVC service is started automatically and the Sophos Mobile Control server is executed. If you have selected
Windows authentication, you first have to enter logon details in the service and start it afterwards.
Note: After the service has been started it can take a few minutes before the web interface is available.
Note: If a different language than English is used for the SQL login, an error occurs and an error message is displayed. To solve this problem, first stop the SMCSVC service. Then open
SQL Management Studio on the server and select Security followed by Logins. Edit the properties of the user that is used to start the SMC server and set the Default language for this acccount to English. Click OK and start the SMCSVC service again.
18
Installation guide
Continue with the following configuration steps:
■
Log in to the Sophos Mobile Control web console and complete the first steps wizard. The configuration wizard is launched automatically when you log in to the Sophos Mobile Control web console for the first time after installation. You need to provide:
■
■
■
HTTP proxy credentials (optional)
A Standard license key and/or an Advanced license key
SMTP credentials
■
■
During Installation you have created a super administrator for customer management. This setup does not support the LDAP connection to a directory service such as Active Directory and the self-registration of end users with the Self Service Portal. To support these
features, a customer must be created by the super administrator. For further information, refer to the Sophos Mobile Control super administrator guide.
If you have selected to configure the EAS Proxy server separately, configure the EAS Proxy
now, see External EAS Proxy server (page 22).
19
Sophos Mobile Control
3 Initial configuration of the Sophos Mobile
Control Server
Before you can use the Sophos Mobile Control web console you need to configure certain server settings. Sophos Mobile Control provides a fist steps configuration wizard to guide you through this.
The wizard is launched automatically when you log in to the Sophos Mobile Control web console for the first time after installation.
You need to provide:
■
HTTP proxy credentials (optional)
■
■
A Standard license key and/or an Advanced license key
SMTP credentials
Note: You can request a trial license when the configuration wizard is run.
3.1 Configuration wizard
Note: As a super administrator you can change these settings in the Sophos Mobile Control web console at any time after initial configuration.
1. After you have logged in to the Sophos Mobile Control web console the welcome dialog is displayed. Click Next.
2. If you use a HTTP proxy, enter the relevant server details in the HTTP proxy view:
■
■
■
Select Proxy enabled.
Enter the Proxy host.
Enter the Proxy port.
3. Click Next.
20
Installation guide
4. In the License view, enter your Sophos Mobile Control Standard license key or request a trial license:
■
Sophos Mobile Control Standard license key:
When you enter the Sophos Mobile Control Standard license key and click Activate, you are given the option to enter a Sophos Mobile Control Advanced license key. If you have purchased Advanced licenses, enter the key in the Advanced license key field.
■
Request a trial license:
If you are evaluating Sophos Mobile Control, see
Trial licenses (page 4), click Request
trial and enter the email address that you used during the registration process of your free trial, and then click Request trial again.
Note: You can change the license settings at any time in the Sophos Mobile Control web console. If you do not enter an Advanced license key here, you can do it in the web console later on.
Click Next.
5. SMTP has to be configured to enable emails to be sent to new users, providing them with logon credentials. It also needs to be configured to enable enrollment via email. In the SMTP view, enter SMTP information and logon credentials:
■
■
SMTP host
Connection Type (SSL, TSL or plain)
■
■
■
■
SMTP user
SMTP password
Email originator
Send error emails: Select this option if you want error mails to be sent, for example in case of an expired APNs certificate.
■
Email recipients: Enter the recipients of error emails here.
Note: To check sending of emails, click the Send test email button.
6. Click Finish
21
Sophos Mobile Control
4 External EAS Proxy server
With Sophos Mobile Control you can set up an external EAS Proxy server with several instances.
Sophos Mobile Control offers a separate EAS Proxy. You can download the installer from the
(page 25).
Features
Besides the features of the internal EAS Proxy, the external EAS Proxy offers the following features:
■
Lotus Traveler client support (which is not ActiveSync)
■
Support for multiple Microsoft Exchange and Lotus Traveler servers (one instance per mail server, one TCP port per instance)
Usage scenarios
Note: For Sophos Mobile Control as a Service, the following scenarios do not apply. In this scenario, the EAS Proxy server is suitable for installation in your own environment because the
EAS Proxy communicates through HTTPS with the Sophos Mobile Control Server. For further information on Sophos Mobile Control as a Service, refer to the Sophos Mobile Control as a
Service startup guide.
An external EAS Proxy server should be used for the following scenarios:
■
You use Lotus Traveler for non-iOS devices.
The internal EAS Proxy cannot handle this scenario as Active Sync is not used here.
The internal EAS Proxy supports iOS devices for Lotus Traveler as Traveler supports ActiveSync for iOS only. So for iOS devices you do not need to use the external EAS Proxy.
For other platforms (for example, Android), Lotus Notes Traveler is supported by the external
EAS Proxy. For these platforms, a dedicated Traveler client software is required. This software is available through <traveler-server>/servlet/traveler or the Traveler file system. Sophos
Mobile Control can install and uninstall the client software. Configuration has to be done manually.
22
Installation guide
■
You want to support multiple backend servers.
With the external EAS Proxy you can set up multiple instances of backend mail systems. Each instance needs an incoming TCP port. Each port can connect to a different backend.You need one URL per EAS instance.
23
Sophos Mobile Control
■
You want to set up load balancing for EAS
For this scenario an existing load balancer for http is required. You set up the external EAS
Proxy on different machines.
24
Setup
The following applies to installation and setup:
■
The external EAS Proxy can be installed on the same server, but needs to listen on different ports.
Installation guide
■
■
■
Each instance is secured by an automatically generated certificate that needs to be uploaded to the SMC server.
The external EAS Proxy can run on different (virtual and physical) machines.
Simple Windows setup
4.1 Download external EAS Proxy installer
1. Log on to the Sophos Mobile Control web console as a super administrator.
2. In the web console, under SYSTEM, click Setup and then click System setup.
The System setup view is displayed.
3. Go to the EAS proxy tab and click the download link in the External section.
4.2 Install external EAS Proxy server
Prerequisite:
■
Sophos Mobile Control has been installed and set up, see
Install and set up the Sophos Mobile
To configure the EAS Proxy server separately:
1. Execute the Sophos Mobile Control EAS Proxy Setup.exe.
The Sophos Mobile Control EAS Proxy Setup welcome dialog is displayed. Click Next.
2. In the License Agreement dialog, review the license terms and click I Agree.
3. In the Choose Install Location dialog, choose the destination folder and click Install to start installation.
25
Sophos Mobile Control
4. After Sophos Mobile Control EAS Proxy has been installed, the EAS Proxy Configuration
Wizard welcome dialog is displayed. Click Next.
5. In the SMC Server configuration dialog, select the SMC Server to be used. Optionally, select
Use SSL for incoming connections (Clients to EAS Proxy). If you do not select this option, continue with step 10.
Click Next.
26
Installation guide
6. In the next step, a certificate for the secure (HTTPS) access to the EAS Proxy needs to be created or imported.
Note: Your Sophos product delivery includes an SSL Certificate Wizard that you can use to request your SSL certificate for Sophos Mobile Control EAS Proxy. For further information,
see Request an SSL certificate for Sophos Mobile Control
(page 5).
■
■
If you do not have a trusted certificate yet, select Create self signed certificate, click Next and continue with step 7.
If you have a trusted certificate, click Import a certificate from a trusted issuer, select
PKCS12 with certificate, private key and certificate chain (intermediate and CA) from the dropdown list, click Next and continue with step 8. You can also select Separate files
for certificate, private key, intermediate and CA certificate from the dropdown list, click
Next and continue with step 9.
27
Sophos Mobile Control
7. If you have selected Create self-signed Certificate, the following dialog is shown. Enter the appropriate certificate information.
After you have entered all necessary information click Next.
8. If you have selected PKCS12 with certificate, private key and certificate chain (intermediate
and CA) under Import a certificate from a trusted issuer, the following dialog is shown.
Select the appropriate file and enter the password.
28
Click Next.
Installation guide
9. If you have selected Separate files for certificate, private key, intermediate and CA
certificate under Import a certificate from a trusted issuer, the following dialog is shown.
Select the appropriate files and enter the password for the private key.
Click Next.
29
Sophos Mobile Control
10. In the next step, you configure the EAS Proxy instances. In the EAS Proxy instance setup dialog, enter an Instance name, the relevant Server port (incoming traffic) and the ActiveSync
server (target). Select Enable traveler client access to enable Lotus Traveler client access.
After entering the instance information, click Add to add the instance to the Instances list.
After you have added an instance a message like the following is displayed:
30
Click OK.
A window with the certificate that needs to be uploaded to Sophos Mobile Control opens.
11. In the next step, you need to upload the certificate in the Sophos Mobile Control web console as a super administrator. For further information on Sophos Mobile Control super administrators, see the Sophos Mobile Control super administrator guide.
a) Log in to the Sophos Mobile Control web console as a super administrator.
b) In the web console under SYSTEM, click Setup and then click System setup.
c) Go to the EAS proxy tab.
d) On the EAS Proxy tab, in the External section, click Upload a file.browse for the certificate and click Upload.
e) Browse for the certificate, select it and click Open.
Installation guide
The certificate is uploaded and shown in the EAS Proxy tab.
f) Click the Save button.
Note: Upload the certificate before you start the EAS proxy server. If the certificate is not available at startup, Sophos Mobile Control rejects the server and the service will not be started.
12. In the EAS Proxy instance setup dialog of the EAS Proxy Configuration Wizard, click Next.
The server port you entered is checked and an Inbound Rule for the Windows Firewall is configured. Then the Sophos Mobile Control EAS Proxy - Configuration Wizard finished dialog is displayed.
13. Configuration is now complete. Click Finish to close the Configuration Wizard.
14. After installation has finished, the Sophos Mobile Control EAS Proxy Installation finished dialog is displayed. Make sure that the check box Start Sophos Mobile Control EAS Proxy
server now is selected and click Finish to start the Sophos Mobile Control EAS Proxy server for the first time.
The Sophos Mobile Control EAS Proxy server has been installed and configured.
Note: Every day a new EAS Proxy log file will be created. The old file is renamed
(EASProxy.log.yyyy-mm--ttt). Old EAS Proxy log files are not deleted automatically. To prevent problems, delete or backup these files manually or by using a script.
31
Sophos Mobile Control
5 Running the Sophos Mobile Control
Service as a limited user
For security reasons, you may want to run the SMC service as a limited user instead of an administrator.
Note: If you use Windows Authentication for database access, you only have to carry out step
3 of the following description.
1. On the computer, on which Sophos Mobile Control is running, create a local, “regular” Windows user account with a password that does not expire.
2. Remove this user account from all groups. (By default, the user is in the “users” group.)
3. Grant this user account full access to the Sophos Mobile Control installation directory
(C:\Programs\Sophos\Sophos Mobile Control) including all subdirectories.
4. In the SMCSVC service properties, change the user to this user account with the relevant password.
32
Installation guide
6 Updating Sophos Mobile Control
Sophos Mobile Control server installations can be directly updated from version 4 to 5.
Older versions need to be updated to version 4 beforehand. Please see your Sophos Mobile
Control 4 documentation for details.
Updating from version 4 to version 5
Note: Before you update make sure that all you devices have the Sophos Mobile Control 5.0
app installed. You cannot manage devices with lower version with Sophos Mobile Control 5.
To update your Sophos Mobile Control server installation to version 5, execute the Sophos Mobile
Control 5 installer and follow the instructions.
The installer automatically detects that an existing installation is to be updated to version 5 and performs an update check:
■
Information on decommissioned features is displayed. You must accept to update Sophos
Mobile Control.
■
The update check displays issues that you may want to resolve before the actual update is performed. A link for guidelines to do so is provided.
Note: Please check the highlighted issues carefully. For example, if some of your devices have Sophos Mobile Control apps lower than 5.0 installed, you cannot manage them with the new version of the Sophos Mobile Control server,
After the update check is completed installation of the new version starts with a system property check. If all checks are passed installation starts.
Note: You will need the administrator user credentials of your database.
33
Sophos Mobile Control
7 Apple Push Notification service
To use the built-in Mobile Device Management (MDM) protocol of devices running Apple iOS 4
(or higher), Sophos Mobile Control must use Apples Push Notification service (APNs) to trigger the iOS devices. The following sections describe the requirements that have to be fulfilled and the steps you must take to get access to the APNs servers with your own client certificate. Sophos
Mobile Control offers an APNs Certificate Wizard for creating your APNs certificate. The wizard is included in your product delivery. It is also available for download in the web console.
Note: Do NOT use the Internet Explorer for any Apple websites. Apple recommends their own
Safari browser, but Mozilla Firefox, Opera or Google Chrome also work.
7.1 Requirements
For silent operations all devices must have at least iOS version 4 installed.
To notify iOS devices, the Sophos Mobile Control server needs to connect to the Apple Push
Notification service. The notifications are sent SSL-encrypted to
■
■ gateway.push.apple.com:2195 TCP (17.0.0.0/8) but not to the iOS devices directly.
iOs devices itself need a connection to Apple via port 5233 since Apple forwards the notification.
Note: iOS devices with Wi-Fi only need access to APNs as usually in corporate networks only http and https are accepted. This has to be enabled in the company Wi-Fi network.
■
Wi-Fi iOS device -> *.push.apple.com:5223 TCP (17.0.0.0/8)
7.2 Create and upload an APNs certificate
Prerequisites:
■
You can use the APNs Certificate Wizard to create an APNs certificate. The wizard is included in your product delivery. It is also available for download in the web console. In the web console menu bar, under SYSTEM, click Setup and then System setup,and go to the iOS APNS tab.
To download the wizard, click the download link available under APNS.
To start the APNs Certificate Wizard:
1. Double-click the file Sophos Mobile Control APNs Certificate Wizard.exe.
The APNs Certificate Wizard welcome dialog is displayed.
2. Click Next.
The License Agreement dialog is displayed.
3. Click I Agree.
The Create Certificate Signing Request dialog is displayed.
34
Installation guide
4. Enter your Company Name and your Country code (for example US or UK). These fields are mandatory.
Note: Below these fields, the dialog shows where all data of the process is stored. Make a note of this information.
5. Click Next.
The Upload PLIST dialog is displayed.
6. In this step, you upload the Certificate Signing Request to Apple. Follow the instructions in the dialog: a) Open the Apple site indicated in the dialog in your browser.
Note: Do not use Internet Explorer to open the Apple site as this may cause problems.
Use Firefox, Chrome or Safari instead. We recommend that you use the latest browser versions.
b) Log in with your Apple ID. If you do not have an Apple ID, create one.
We recommend you create a Corporate Apple ID and not a personal one.
c) In the first dialog of the Apple Push Certificates Portal, click Create a Certificate.
d) Accept the terms and conditions.
e) Browse for your Certificate Signing Request (*.plist) and click Upload.
You find the file name and the path in the Upload PLIST dialog of the Sophos APNs
Certificate Wizard.
Your APNs certificate is created.
f) Download and save the certificate file (*.pem) in the directory indicated in the Upload PLIST dialog.
7. Click Next.
The Create P12 dialog is displayed.
8. In this step, you create your APNs certificate for Sophos Mobile Control. Enter a password for the APNs certificate. You need this password later, when you upload the .P12 certificate file to Sophos Mobile Control.
Note: The Create P12 dialog shows the directory the certificate will be stored in. Make a note of this information. We recommend that you create a backup of the folder that contains the certificate files.
9. Click Next.
The Sophos Mobile Control APNs Certificate Wizard finished dialog is displayed.
10. Click Finish.
11. In the web console return to the iOS APNs tab.
12. Click on Upload a file. Browse for the .p12 certificate file you have created and enter your password. Optionally you can enter your Apple ID for future reference.
After the file has been uploaded successfully, a confirmation message is displayed and the
Topic, Type and Expiry date information of your APNs certificate is shown.
35
Sophos Mobile Control
13. Click Save.
36
Installation guide
8 Technical support
You can find technical support for Sophos products in any of these ways:
■
■
Visit the SophosTalk community at http://community.sophos.com/ and search for other users who are experiencing the same problem.
Visit the Sophos support knowledgebase at http://www.sophos.com/en-us/support.aspx
.
■
■
Download the product documentation at http://www.sophos.com/en-us/support/documentation.aspx
.
Send an email to [email protected]
, including your Sophos software version number(s), operating system(s) and patch level(s), and the text of any error messages.
37
Sophos Mobile Control
9 Legal notices
Copyright
©
2011 - 2014 Sophos Ltd. All rights reserved.
No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording or otherwise unless you are either a valid licensee where the documentation can be reproduced in accordance with the license terms or you otherwise have the prior permission in writing of the copyright owner.
Sophos is a registered trademark of Sophos Ltd. All other product and company names mentioned are trademarks or registered trademarks of their respective owners.
38
Download
Public link updated
The public link to your chat has been updated. You may view and manage your chat links after registration here.
Document public link
Advertisement