Dell v9.8 Security Management Server Virtual Installation Guide
Реклама
Реклама
Dell Data Security
Security Management Server Virtual - Quick Start and
Installation Guide v9.8
Notes, cautions, and warnings
NOTE: A NOTE indicates important information that helps you make better use of your product.
CAUTION: A CAUTION indicates either potential damage to hardware or loss of data and tells you how to avoid the problem.
WARNING: A WARNING indicates a potential for property damage, personal injury, or death.
© 2017 Dell Inc. All rights reserved.Dell, EMC, and other trademarks are trademarks of Dell Inc. or its subsidiaries. Other trademarks may be trademarks of their respective owners.
Registered trademarks and trademarks used in the Dell Encryption, Endpoint Security Suite Pro, Endpoint Security Suite Enterprise, and
Data Guardian suite of documents: Dell™ and the Dell logo, Dell Precision™, OptiPlex™, ControlVault™, Latitude™, XPS®, and KACE™ are trademarks of Dell Inc. Cylance®, CylancePROTECT, and the Cylance logo are registered trademarks of Cylance, Inc. in the U.S. and other countries. McAfee® and the McAfee logo are trademarks or registered trademarks of McAfee, Inc. in the US and other countries. Intel®,
Pentium®, Intel Core Inside Duo®, Itanium®, and Xeon® are registered trademarks of Intel Corporation in the U.S. and other countries.
Adobe®, Acrobat®, and Flash® are registered trademarks of Adobe Systems Incorporated. Authen Tec® and Eikon® are registered trademarks of Authen Tec. AMD® is a registered trademark of Advanced Micro Devices, Inc. Microsoft®, Windows®, and Windows
Server®, Internet Explorer®, MS-DOS®, Windows Vista®, MSN®, ActiveX®, Active Directory®, Access®, ActiveSync®, BitLocker®,
BitLocker To Go®, Excel®, Hyper-V®, Silverlight®, Outlook®, PowerPoint®, OneDrive®, SQL Server®, and Visual C++® are either trademarks or registered trademarks of Microsoft Corporation in the United States and/or other countries. VMware® is a registered trademark or trademark of VMware, Inc. in the United States or other countries. Box® is a registered trademark of Box. DropboxSM is a service mark of Dropbox, Inc. Google™, Android™, Google™ Chrome™, Gmail™, YouTube®, and Google™ Play are either trademarks or registered trademarks of Google Inc. in the United States and other countries. Apple®, Aperture®, App StoreSM, Apple Remote
Desktop™, Apple TV®, Boot Camp™, FileVault™, iCloud®SM, iPad®, iPhone®, iPhoto®, iTunes Music Store®, Macintosh®, Safari®, and
Siri® are either servicemarks, trademarks, or registered trademarks of Apple, Inc. in the United States and/or other countries. GO ID®,
RSA®, and SecurID® are registered trademarks of Dell EMC. EnCase™ and Guidance Software® are either trademarks or registered trademarks of Guidance Software. Entrust® is a registered trademark of Entrust®, Inc. in the United States and other countries.
InstallShield® is a registered trademark of Flexera Software in the United States, China, European Community, Hong Kong, Japan, Taiwan, and United Kingdom. Micron® and RealSSD® are registered trademarks of Micron Technology, Inc. in the United States and other countries. Mozilla® Firefox® is a registered trademark of Mozilla Foundation in the United States and/or other countries. iOS® is a trademark or registered trademark of Cisco Systems, Inc. in the United States and certain other countries and is used under license.
Oracle® and Java® are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.
SAMSUNG™ is a trademark of SAMSUNG in the United States or other countries. Seagate® is a registered trademark of Seagate
Technology LLC in the United States and/or other countries. Travelstar® is a registered trademark of HGST, Inc. in the United States and other countries. UNIX® is a registered trademark of The Open Group. VALIDITY™ is a trademark of Validity Sensors, Inc. in the United
States and other countries. VeriSign® and other related marks are the trademarks or registered trademarks of VeriSign, Inc. or its affiliates or subsidiaries in the U.S. and other countries and licensed to Symantec Corporation. KVM on IP® is a registered trademark of Video
Products. Yahoo!® is a registered trademark of Yahoo! Inc. This product uses parts of the 7-Zip program. The source code can be found at
7-zip.org
. Licensing is under the GNU LGPL license + unRAR restrictions ( 7-zip.org/license.txt
). Security Management Server Virtual and
Data Guardian Web Client use third-party libraries from "urwid" under the terms of GNU Lesser General Public License. The copyright notice and GNU Lesser General Public License can be found in the AdminHelp on the Attributions, Copyrights, and Trademarks page.
Security Management Server Virtual - Quick Start and Installation Guide
2017 - 07
Rev. A01
Contents
Security Management Server Virtual - Quick Start and Installation Guide v9.8
Contents
3
4 Security Management Server Virtual - Quick Start and Installation Guide v9.8
Contents
1
Security Management Server Virtual Quick Start
Guide
This Quick Start Guide is for more experienced users, to get the Dell Server up and running fast. As a general rule, Dell recommends installing the Dell Server first, followed by installation of clients.
For more detailed instructions, see the Security Management Server Virtual Installation Guide
.
Prerequisites , and Proxy Mode Prerequisites
.
For information on how to update an existing Dell Server, see
Update Security Management Server Virtual .
Install Security Management Server Virtual
1 Browse to the directory where the Dell Data Security files are stored and double-click to import into VMware the Security
Management Server Virtual v9.x.x Build x.ova.
2 Power on Security Management Server Virtual.
3 Follow the on-screen instructions.
Configure Security Management Server Virtual
Before you activate users, you must complete the following Configuration tasks at the Security Management Server Virtual Terminal:
•
Set or Change the Database Password
•
•
Import an Existing Certificate or Enroll a New Server Certificate
•
Update Security Management Server Virtual
•
Install an FTP client that supports SFTP on port 22, and Set up File Transfer (FTP) Users
.
If your organization has external facing devices, see Install and Configure Proxy Mode .
NOTE: If your Dell Data Security clients will be entitled from the factory or you purchase licenses from the factory, set the
GPO on the domain controller to enable entitlements (this may not be the same server running Security Management
Server Virtual). Ensure that outbound port 443 is available to communicate with the Dell Server. If port 443 is blocked
(for any reason), the entitlement functionality will not work.
Open Remote Management Console
Open the Remote Management Console at this address: https://server.domain.com:8443/webui/
The default credentials are superadmin/changeit.
For a list of supported web browsers, see
Remote Management Console Prerequisites .
Security Management Server Virtual - Quick Start and Installation Guide v9.8
Security Management Server Virtual Quick Start Guide
5
Administrative Tasks
If you have not launched the Dell Server Remote Management Console, do so now. The default credentials are superadmin/changeit.
Click "?" in the upper right corner of the Remote Management Console to launch Dell Data Security AdminHelp. The Get Started page displays. Click Add Domains.
Baseline polices have been set for your organization but may need to be modified depending on your specific needs, as follows (licensing and entitlements guide all activations):
• Windows computers will be encrypted
• Computers with self-encrypting drives will be encrypted
• BitLocker Management is not enabled
• Advanced Threat Prevention is not enabled
• Threat Protection is enabled
• External media will not be encrypted
• Devices connected to ports will not be encrypted
• Data Guardian is enabled
See the AdminHelp topic Manage Policies to navigate to Technology Groups and policy descriptions.
Quick Start tasks are complete.
6 Security Management Server Virtual - Quick Start and Installation Guide v9.8
Security Management Server Virtual Quick Start Guide
2
Security Management Server Virtual Installation
Guide
This Installation Guide is for less experienced users, to install and configure Security Management Server Virtual. As a general rule, Dell recommends installing the Security Management Server Virtual first, followed by installation of clients.
For information on how to update an existing Security Management Server Virtual, see
Update Security Management Server Virtual
.
About Security Management Server Virtual
Security Management Server Virtual is the security administration piece of Dell's solution. The Security Management Server Virtual Remote
Management Console allows administrators to monitor the state of endpoints, policy enforcement, and protection across the enterprise.
Proxy Mode provides a front-end DMZ Mode option for use with Security Management Server Virtual.
Security Management Server Virtual has the following features:
• Centralized management of up to 3,500 devices
• Role-based security policy creation and management
• Administrator-assisted device recovery
• Separation of administrative duties
• Automatic distribution of security policies
• Trusted paths for communication between components
• Unique encryption key generation and automatic secure key escrow
• Centralized compliance auditing and reporting
• Auto-generation of self-signed certificates
Contact Dell ProSupport
Call 877-459-7304, extension 4310039 for 24x7 phone support for your Dell product.
Additionally, online support for Dell products is available at dell.com/support . Online support includes drivers, manuals, technical advisories,
FAQs, and emerging issues.
Be sure to help us quickly connect you to the right technical expert by having your Service Code available when you call.
For phone numbers outside of the United States, check Dell ProSupport International Phone Numbers .
Requirements
Security Management Server Virtual Prerequisites
Hardware
The recommended disk space for Security Management Server Virtual is 80 GB.
Security Management Server Virtual - Quick Start and Installation Guide v9.8
Security Management Server Virtual Installation Guide
7
Virtualized Environment
Security Management Server Virtual v9.8 has been validated with the following virtualized environments.
Virtualized Environments
• VMware Workstation 12.5
• 64-bit CPU required
• 44 GB RAM recommended
• See http://www.vmware.com/resources/compatibility/search.php?deviceCategory=software&testConfig=17 for a complete list of supported Host Operating Systems
• Hardware must conform to minimum VMware requirements
• 4 GB minimum RAM for dedicated image resource
• See http://pubs.vmware.com/workstation-11/index.jsp
for more information
• VMware Workstation 11
• 64-bit CPU required
• 4 GB RAM recommended
• See http://www.vmware.com/resources/compatibility/search.php?deviceCategory=software&testConfig=17 for a complete list of supported Host Operating Systems
• Hardware must conform to minimum VMware requirements
• 4 GB minimum RAM for dedicated image resource
• See http://pubs.vmware.com/workstation-11/index.jsp
for more information
• VMware ESXi 6.5
• 64-bit x86 CPU required
• Host computer with at least two cores
• 8 GB RAM minimum recommended
• An Operating System is not required
• See http://www.vmware.com/resources/compatibility/search.php for a complete list of supported Host Operating Systems
• Hardware must conform to minimum VMware requirements
• 4 GB minimum RAM for dedicated image resource
• See http://pubs.vmware.com/vsphere-65/index.jsp
for more information
• VMware ESXi 6.0
• 64-bit x86 CPU required
• Host computer with at least two cores
• 8 GB RAM minimum recommended
• An Operating System is not required
• See http://www.vmware.com/resources/compatibility/search.php for a complete list of supported Host Operating Systems
• Hardware must conform to minimum VMware requirements
• 4 GB minimum RAM for dedicated image resource
• See http://pubs.vmware.com/vsphere-60/index.jsp
for more information
• VMware ESXi 5.5
• 64-bit x86 CPU required
• Host computer with at least two cores
• 8 GB RAM minimum recommended
• An Operating System is not required
• See http://www.vmware.com/resources/compatibility/search.php for a complete list of supported Host Operating Systems
8 Security Management Server Virtual - Quick Start and Installation Guide v9.8
Security Management Server Virtual Installation Guide
Virtualized Environments
• Hardware must conform to minimum VMware requirements
• 4 GB minimum RAM for dedicated image resource
• See http://pubs.vmware.com/vsphere-55/index.jsp
for more information
• Hyper-V Server (Full or Core installation)
• 64-bit x86 CPU required
• Host computer with at least two cores
• 8 GB RAM minimum recommended
• An Operating System is not required
• Hardware must conform to minimum Hyper-V requirements
• 4 GB minimum RAM for dedicated image resource
• Must be run as a Generation 1 Virtual Machine
• See https://technet.microsoft.com/en-us/library/hh923062.aspx
for more information
Remote Management Console Prerequisites
Internet Browsers
NOTE:
Your browser must accept cookies.
The following table details supported Internet browsers.
Internet Browsers
• Internet Explorer 11.x or later
• Mozilla Firefox 41.x or later
• Google Chrome 46.x or later
Proxy Mode Prerequisites
Hardware
The following table details the minimum hardware requirements for Proxy Mode.
Processor
2 GHz Core 2 Duo or better
RAM
+-2 GB minimum dedicated RAM / 4 GB dedicated RAM recommended
Free Disk Space
+-1.5 GB free disk space (plus virtual paging space)
Network Card
Security Management Server Virtual - Quick Start and Installation Guide v9.8
Security Management Server Virtual Installation Guide
9
10/100/1000 network interface card
Miscellaneous
TCP/IP installed and activated
Software
The following table details the software that must be in place before installing Proxy Mode.
Prerequisites
• Windows Installer 4.0 or later
Windows Installer 4.0 or later must be installed on the server where the installation is taking place.
• Microsoft Visual C++ 2010 Redistributable Package
If not installed, the installer will install it for you.
• Microsoft .NET Framework Version 4.5
Microsoft has published security updates for .NET Framework Version 4.5
The following table details the software requirements for the Proxy Mode server.
NOTE:
Always disable UAC when using Windows Server 2008. After disabling UAC, the server must be rebooted for this change to take effect.
Registry location for Windows Servers: HKLM\SOFTWARE\Dell.
Operating System
• Windows Server 2008 R2 SP0-SP1 64-bit
- Standard Edition
- Enterprise Edition
• Windows Server 2008 SP2 64-bit
- Standard Edition
- Enterprise Edition
• Windows Server 2012 R2
- Standard Edition
- Datacenter Edition
• Windows Server 2016
- Standard Edition
- Datacenter Edition
10 Security Management Server Virtual - Quick Start and Installation Guide v9.8
Security Management Server Virtual Installation Guide
Download Security Management Server Virtual
At initial installation, Security Management Server Virtual is delivered as an OVA file, an Open Virtual Application used to deliver software that runs on a virtual machine. The Dell Server OVA file is available at www.dell.com/support, on the Product Support pages for the following Dell Data Security products:
Encryption or
Endpoint Security Suite Pro or
Endpoint Security Suite Enterprise or
Data Guardian
To download the OVA file:
1 Navigate to the Product Support page for Encryption , Endpoint Security Suite Pro , Endpoint Security Suite Enterprise , or Data
Guardian .
2 Click Drivers & downloads.
3 Next to "View all available updates for <OS version>," click Change OS, and select one of the following: VMware ESXi 6.5, VMware
ESXi 6.0, or VMware ESXi 5.5.
4 Under "View by:" select Show All.
5 Under Dell Data Security, select Download.
Install Security Management Server Virtual
Before you begin, ensure that all system and virtual environment Requirements are met.
1 Locate the Dell Data Security files in the installation media and double-click to import into VMware the Security Management Server
Virtual v9.x.x Build x.ova.
2 Power on Security Management Server Virtual.
3 Select the language for the license agreement, and select Display EULA.
4 Read the agreement, and select Accept EULA.
5 If an update is available, select Accept.
6 Select Connected Mode or Disconnected Mode.
NOTE:
If you select Disconnected Mode, the Dell Server can never be changed to Connected Mode.
Disconnected mode isolates the Dell Server from the Internet and an unsecured LAN or other network. All updates must be performed manually. For more information about Disconnected Mode functionality and policies, refer to AdminHelp.
7 At the default password change prompt, select Yes.
8 In the Set ddpuser Password screen, enter the current (default) password, ddpuser, then enter a unique password, re-enter the unique password, and select OK.
Passwords must include the following:
• At least 8 characters
Security Management Server Virtual - Quick Start and Installation Guide v9.8
Security Management Server Virtual Installation Guide
11
• At least 1 uppercase letter
• At least 1 digit
• At least 1 special character
9 In the Configure Hostname dialog, use the Backspace key to remove the default hostname. Enter a unique hostname and select OK.
10 In the Configure Network Settings dialog, choose either option below, then select OK.
• (Default) Use DHCP.
• (Recommended) In the Use DHCP field, press the Spacebar to remove the X and manually enter these addresses, as applicable:
Static IP Network Mask Default Gateway DNS Server 1 DNS Server 2 DNS Server 3
NOTE: When using a static IP, you must also create a host entry in the DNS server.
11 In the Time Zone screen, use the arrow keys to highlight your time zone and select Enter.
12 At the time zone confirmation prompt, select OK.
13 When the message displays to indicate that initial configuration is completed, select OK.
14
Set or Change the Database Password
.
15
.
16
Import an Existing Certificate or Enroll a New Server Certificate
.
17
Update Security Management Server Virtual .
18 Install an FTP client that supports SFTP on port 22, and
Set up File Transfer (FTP) Users .
Security Management Server Virtual installation tasks are complete.
Open Remote Management Console
Open the Remote Management Console at this address: https://server.domain.com:8443/webui/
The default credentials are superadmin/changeit.
For a list of supported web browsers, see
Remote Management Console Prerequisites .
Install and Configure Proxy Mode
Proxy Mode provides a front-end (DMZ Mode) option for use with the Dell Server. If you intend to deploy Dell components in the DMZ, ensure that they are properly protected against attacks.
NOTE: The Beacon Service is installed as part of this installation to support Data Guardian callback beacon, which inserts a callback beacon into every file protected by Data Guardian when running Protected Office mode. This allows communication between any device in any location and the Dell Front End Server. Ensure that necessary network security is configured before using the callback beacon. The Enable Callback Beacon policy is enabled by default.
To perform this installation, you will need the fully-qualified hostname of the DMZ server.
1 In the Dell installation media, navigate to the Security Management Server directory. Unzip (DO NOT copy/paste or drag/drop)
Security Management Server-x64 to the root directory of the server where you are installing Security Management Server Virtual.
Copying/pasting or dragging/dropping will produce errors and an unsuccessful installation.
2 Double-click setup.exe.
3 In the InstallShield Wizard dialog, select the language for installation, then click OK.
4 If prerequisites are not already installed, a message displays to inform you of which prerequisites will be installed. Click Install.
5 In the Welcome dialog, click Next.
6 Read the license agreement, accept the terms, then click Next.
7 Enter the 32-character Product Key and then click Next. The Product Key is located in the EnterpriseServerInstallKey.ini file.
8 Select Front End Install and click Next.
12 Security Management Server Virtual - Quick Start and Installation Guide v9.8
Security Management Server Virtual Installation Guide
9 To install the Front End Server to the default location of C:\Program Files\Dell, click Next. Otherwise, click Change to select a different location, then click Next.
10 You have a choice of digital certificate types to use. It is highly recommended that you use a digital certificate from a trusted certificate authority.
Select option "a" or "b" below: a To use an existing certificate that was purchased from a CA authority, select Import an existing certificate and click Next.
b To create a self-signed certificate, select Create a self signed certificate and import it to key store and click Next.
At the Create Self-Signed Certificate dialog, enter the following information:
Fully qualified computer name (example: computername.domain.com)
Organization
Organizational Unit (example: Security)
City
State (full name)
Country: Two-letter country abbreviation
Click Next.
NOTE:
The certificate expires in one year, by default.
11 In the Front End Server Setup dialog, enter the fully qualified hostname or DNS alias of the Back End Server, select Dell Security
Management Server, and click Next.
12 From the Front End Server Install Setup dialog, you can view or edit hostnames and ports.
• To accept the default hostnames and ports, in the Front End Server Install Setup dialog, click Next.
• To view or edit hostnames, in the Front End Server Setup dialog, click Edit Hostnames. Edit hostnames only if necessary. Dell recommends using the defaults.
NOTE:
A hostname cannot contain an underscore character ("_").
Deselect a proxy only if you are certain that you do not want to configure it for installation. If you deselect a proxy in this dialog, it will not be installed.
When finished, click OK.
• To view or edit Ports, in the Front End Server Setup dialog, click either dit External Facing Portsor Edit Internal Connecting
Ports. Edit ports only if necessary. Dell recommends using the defaults.
If you deselect a proxy in the Edit Front End Host Names dialog, its port does not display in the External Ports or Internal Ports dialogs.
When finished, click OK.
13 In the Ready to Install the Program dialog, click Install.
14 When the installation is completed, click Finish.
Security Management Server Virtual - Quick Start and Installation Guide v9.8
Security Management Server Virtual Installation Guide
13
Security Management Server Virtual Terminal - Basic
Configuration Tasks
Basic configuration tasks are accessed from the Main Menu.
Change Hostname
This task can be completed at any time. It is not required to begin using Security Management Server Virtual. It is a best practice to restart the services any time a settings change is made.
1 From the Basic Configuration menu, select Hostname.
2 Use the Backspace key to remove the existing Security Management Server Virtual hostname then replace it with a new hostname and select OK.
Change Network Settings
This task can be completed at any time. It is not required to begin using Security Management Server Virtual. It is a best practice to restart the services any time a settings change is made.
1 From the Basic Configuration menu, select Network Settings.
2 In the Configure Network Settings screen, choose either option below then select OK.
• (Default) Use DHCP.
• (Recommended) In the Use DHCP field, press the Spacebar to remove the X and manually enter these addresses, as applicable:
Static IP
Network Mask
Default Gateway
DNS Server 1
DNS Server 2
DNS Server 3
NOTE:
When using a static IP, you must create a host entry in the DNS server.
Set DMZ Hostname
This task can be completed at any time. It is not required to begin using Security Management Server Virtual. It is a best practice to restart the services any time a settings change is made.
1 From the Basic Configuration menu, select DMZ Hostname.
2 Enter the fully qualified domain name of the DMZ server and select OK.
NOTE: To use Proxy Mode (DMZ Mode), you must Install and Configure Proxy
Mode.
14 Security Management Server Virtual - Quick Start and Installation Guide v9.8
Security Management Server Virtual Installation Guide
Change Time Zone
This task can be completed at any time. It is not required to begin using Security Management Server Virtual. It is a best practice to restart the services any time a settings change is made.
1 From the Basic Configuration menu, select Time Zone.
2 In the Time Zone screen, use the arrow keys to highlight your time zone and select Enter.
3 At the time zone confirmation prompt, select OK.
Update Security Management Server Virtual
For information about a specific update, see Security Management Server Virtual Technical Advisories, located on the Dell Support website at http://www.dell.com/support . To see the version and installation date of an update that is already applied, from the Basic Configuration menu, select Update Dell Security Management Server Virtual > Last successful update applied.
To receive email notifications when Dell Server updates are available, see Configure SMTP Settings
.
NOTE: In Connected Mode, an update should be performed after initial installation of the Dell Server and also before clients are activated.
If policy changes have been made but not committed in the Remote Management Console, apply policy changes before updating the Dell
Server:
1 As a Dell Administrator, log in to the Remote Management Console.
2 In the left menu, click Management > Commit.
3 Enter a description of the change in the Comment field.
4 Click Commit Policies.
5 When the commit is complete, log off the Remote Management Console.
Update Security Management Server Virtual (Connected Mode)
1 Dell recommends performing a regular backup. Before updating, ensure that the backup process has been functioning properly. See
.
2 From the Basic Configuration menu, select Update Dell Security Management Server Virtual.
3 Select the desired action:
• Set Update Server - Select this option to set or change the server location of the Dell Server update packages. In the Set Update
Server screen, use the Backspace key to remove the existing Server Hostname or IP address. Enter the new fully qualified domain name or IP address and select OK.
The default update server is act.credant.com.
• Set Proxy Settings - Select this option to set the Proxy Settings for downloading updates.
In the Configure Proxy Settings screen, press the Spacebar to enter an X in the Use Proxy field. Enter the HTTPS, HTTP, and FTP
Proxy addresses. If firewall authentication is required, press the Spacebar to enter an X in the Authentication Required field. Enter the username and password, and press OK.
NOTE: To update from an FTP site, enter the FTP user name and password, followed by the URL.
• Check for Update - Select this option to check the Update Server for a Dell Server update package.
• Download Update - Select this option to download an update after it is discovered by Check for Update.
• Apply Update - Select this option if you want to apply a Dell Server update package that you have downloaded. In the Select an
Update (.deb) File screen, select the update package you want to install and press Enter.
Security Management Server Virtual - Quick Start and Installation Guide v9.8
Security Management Server Virtual Installation Guide
15
• Last successful update applied - Select this option to see the version and installation date of the current Dell Server version.
Update Security Management Server Virtual (Disconnected Mode)
1 Dell recommends performing a regular backup. Before updating, ensure that the backup process has been functioning properly. See
.
2 Obtain the .deb file that contains the latest Dell Server update from the Dell Support website.
Security Management Server Virtual downloads are located in the Drivers & downloads folder at www.dell.com/support/home/us/en/04/product-support/product/dell-data-protection-encryption/research or www.dell.com/support/home/us/en/04/product-support/product/dell-dp-endpt-security-suite/research?rvps=y or www.dell.com/support/home/us/en/19/product-support/product/dell-dp-endpt-security-suite-enterprise/research or www.dell.com/support/home/us/en/19/product-support/product/dell-data-guardian/research
3 Store the .deb file in the /updates folder on the secure FTP server of the Dell Server.
.
4 From the Basic Configuration menu, select Update Security Management Server Virtual.
5 Select Apply Update and press Enter.
If the .deb file does not display, ensure that
the .deb file is stored in the proper location
.
6 Select the .deb update file you want to install and press Enter.
Change User Passwords
This task can be completed at any time. It is not required to begin using Security Management Server Virtual. It is a best practice to restart the services any time a settings change is made.
You can change passwords for these users:
• ddpuser (Security Management Server Virtual Terminal Administrator) - This user has access to the Dell Server Terminal and its menus.
• ddpconsole (Security Management Server Virtual shell access) - This user has Dell Server shell access. Shell access is available for a network administrator to check and troubleshoot network connectivity.
• ddpsupport (Dell ProSupport Administrator) - This user exists for Dell ProSupport use only. For security purposes, you control the password for this account.
1 From the Basic Configuration menu, select Change User Passwords.
2 In the Change User Passwords screen, select user password to change and select Enter.
3 In the Set Password screen, enter the current password, enter the new password, re-enter the new password, and select OK.
Passwords must include the following:
• At least 8 characters
• At least 1 uppercase letter
• At least 1 digit
• At least 1 special character
16 Security Management Server Virtual - Quick Start and Installation Guide v9.8
Security Management Server Virtual Installation Guide
Set up File Transfer (FTP) Users
This task can be completed at any time. It is not required to begin using Security Management Server Virtual. It is a best practice to restart the services any time a settings change is made.
You can give up to three users access to the secure FTP server of the Dell Server for backup and restore tasks. The secure FTP server can also be used to store or upload Dell Server updates.
1 From the Basic Configuration menu, select File Transfer (FTP) Users.
2 In the Configure FTP Users screen, to enable an FTP User, press the Spacebar to enter an X in the Status field for the user. To disable an FTP User, press the Spacebar to remove the X in the Status field for the user.
3 Enter a user name and password for the SFTP User.
Passwords must include the following:
• At least 8 characters
• At least 1 uppercase letter
• At least 1 digit
• At least 1 special character
4 When you are finished entering SFTP users, select OK.
Enable SSH
This task can be completed at any time. It is not required to begin using Security Management Server Virtual. It is a best practice to restart the services any time a settings change is made.
You can enable SSH for the Support Administrator login, Security Management Server Virtual shell access, and the Security Management
Server Virtual Terminal command-line interface.
1 From the Basic Configuration menu, select SSH Settings.
2 Highlight the user for which you want to enable SSH, press the Spacebar to enter an X in its field, and select OK.
Start or Stop Services
Perform this task only if needed. It is a best practice to restart the services any time a settings change is made.
1 To simultaneously start or stop all Services, from the Basic Configuration menu, select either Start Application or Stop Application.
2 At the confirmation prompt, select Yes.
NOTE: Server state changes may require up to two minutes to complete.
Reboot the Appliance
Perform this task only if needed.
1 From the Basic Configuration menu, select Reboot Appliance.
2 At the confirmation prompt, select Yes.
3 After restart, log in to Security Management Server Virtual.
Security Management Server Virtual - Quick Start and Installation Guide v9.8
Security Management Server Virtual Installation Guide
17
Shut down the Appliance
Perform this task only if needed.
1 From the Basic Configuration menu, scroll down and select Shutdown Appliance.
2 At the confirmation prompt, select Yes.
3 After restart, log in to Security Management Server Virtual.
Security Management Server Virtual Terminal -
Advanced Configuration Tasks
Advanced configuration tasks are accessed from the Main Menu.
Set or Change the Database Password
This task can be completed at any time. It is not required to begin using Security Management Server Virtual. It is a best practice to restart the services any time a settings change is made.
1 From the Advanced Configuration menu, select Database Password.
2 Enter a password to access the database and select OK.
Passwords must include the following:
• At least 8 characters
• At least 1 uppercase letter
• At least 1 digit
• At least 1 special character
NOTE: Dell recommends that you back up passwords after installation is completed.
Configure SMTP Settings
To receive Security Management Server Virtual email notifications or to use Data Guardian, follow the steps in this section to configure
SMTP settings. Dell Server email notifications inform recipients of Dell Server status error states, password updates, availability of Dell
Server updates, and client license issues.
It is a best practice to restart the services any time a settings change is made.
To configure SMTP settings, follow these steps:
1 From the Advanced Configuration menu, select Email Notifications.
2 In the Set up Email Notifications screen, to enable email alerts, press the Spacebar to enter an X in the Enable Email Alerts field.
3 Enter the SMTP Server fully qualified domain name.
4 Enter the SMTP Port.
5 In the From User field, enter the email account ID that will send email notifications.
6 In the Enter User field, enter an email account ID for access to change configured email notifications.
7 In the Password field, enter a password for access to change configured email notifications.
8 In the Mail IDs fields for Security Management Server Virtual Status, Password Updates, and Updates Availability, enter lists of recipients for each notification type. Follow these conventions when listing recipients:
• Email address format is [email protected].
18 Security Management Server Virtual - Quick Start and Installation Guide v9.8
Security Management Server Virtual Installation Guide
• Recipients are separated with commas or semicolons.
9 In the Service alert reminder field, to enable reminders, press the Spacebar to enter an X in the field then set the reminder interval in minutes. A Service alert reminder is triggered when the reminder interval has passed after a notification is sent about a system health issue and the host or service remains in the same state.
10 In the Summary Report field, to enable reports of notifications, select the desired interval (Daily, Weekly, or Monthly) and then press the Spacebar to enter an X in the field.
11 Select OK.
Import an Existing Certificate or Enroll a New Server
Certificate
Certificates must be in place before you can activate users against Security Management Server Virtual.
You can import an existing certificate or create a certificate request through Security Management Server Virtual.
It is a best practice to restart the services any time a settings change is made.
Import an Existing Server Certificate
1 Export the existing certificate and its full chain of trust from its keystore.
NOTE: Keep the export password because you will enter it when you import the certificate into Security Management
Server Virtual.
2 On the FTP Server of the Dell Server, store the certificate to /opt/dell/vsftpd/files/certificates.
3 From the Dell Server Advanced Configuration menu, select Server Certificates.
4 Select Import Existing Certificate.
5 Select a certificate file to be installed on the Dell Server.
6 When prompted, enter the certificate export password and select OK.
7 When the import is complete, select OK.
Enroll a New Server Certificate
1 From the Advanced Configuration menu, select Server Certificates.
2 Select New Server Certificate.
3 Select Create Certificate Request.
4 Complete the fields in the Generate Certificate Request screen:
• Country Name: Two-letter country code.
• State/Province: Enter the unabbreviated state or province name (example, Texas).
• Locality Name/City. Enter the appropriate value (example, Dallas).
• Organization: Enter the appropriate value (example, Dell).
• Organizational Unit: Enter the appropriate value (example, Security).
• Common Name: Enter the fully qualified domain name of the server where the Dell Server is installed. This fully qualified name includes the hostname and the domain name (example, server.domain.com).
• Email ID: Enter the email address to which your CSR will be sent.
5 Follow your organizational process for acquiring an SSL server certificate from a Certificate Authority. Send the contents of the CSR file for signing.
6 When you receive the signed certificate, export the certificate as a .p7b file, and download the full chain of trust in .der format.
7 Make backup copies of the certificate and chain of trust.
8 Upload the certificate file and its full chain of trust to the FTP Server of the Dell Server.
Security Management Server Virtual - Quick Start and Installation Guide v9.8
Security Management Server Virtual Installation Guide
19
9 From the Advanced Configuration menu, select Server Certificates.
10 Select New Server Certificate.
11 Select Complete Certificate Enrollment.
12 Select the certificate file to be installed on the Dell Server.
13 If prompted, enter the Certificate Password: changeit.
To enable trust validation on Windows-based Encryption clients, see Enable Manager Trust Chain Check.
Create and Install a Self-signed Certificate
1 From the Dell Server Advanced Configuration menu, select Server Certificates.
2 Select Create and Install Self-signed Certificate.
3 To confirm that you want to replace the pre-installed certificate with a new certificate, click Yes.
4 Enter the Certificate Password: changeit.
5 After the new certificate is installed, select OK and wait for services to restart.
The services automatically restart.
Configure Log Rotation
This task can be completed at any time. It is not required to begin using Security Management Server Virtual. It is a best practice to restart the services any time a settings change is made.
Daily log rotation is enabled by default. To change the default log rotation, from the Advanced Configuration menu, select Logrotate
Configuration.
To disable log rotation, use the Spacebar to enter an X in the No rotation field and select OK.
To enable log rotation, follow these steps:
1 To enable daily, weekly, or monthly rotation, use the Spacebar to enter an X in the appropriate field. For weekly or monthly rotation, enter the appropriate day of the week or month as a numeral, where Monday=1.
2 Enter a time for rotation in the Logrotate Time field.
3 Select OK.
Backup and Restore
Backups can be configured or performed at any time and are not required to begin using Security Management Server Virtual. Dell recommends that you configure a regular backup process.
Backups can be stored to an external secure FTP server (recommended) or to the Dell Server. If stored on the Dell Server, when the disk is at 90 percent capacity, no new backups are stored. You will receive an email notification that disk allocation space is low.
NOTE:
To preserve disk partition space and prevent automatic deletion of backups, remove unnecessary backups from the Dell Server.
Backups are run daily, by default. Dell recommends storing backups to an external secure FTP server at a frequency that meets requirements of the organization for backups and appropriate use of storage space.
To configure a backup schedule, from the Advanced Configuration menu, select Backup and Restore > Configuration and follow these steps:
20 Security Management Server Virtual - Quick Start and Installation Guide v9.8
Security Management Server Virtual Installation Guide
1 To enable daily, weekly, or monthly backups, use the Spacebar to enter an X in the appropriate field. For weekly or monthly backups, enter the appropriate day of the week or month as a numeral, where Monday=1. To disable backups, use the Spacebar to enter an X in the No backups field and select OK.
2 Enter a time for backup in the Backup Time field.
3 Select OK.
To perform an immediate backup, from the Advanced Configuration menu, select Backup and Restore > Backup now. When the backup confirmation displays, select OK.
NOTE:
restart services. For more information, see Start or Stop Services . Begin to Restore
only
when
all
services are Running.
To restore from a backup, from the Advanced Configuration menu, select Backup and Restore > Restore and select the backup file to be restored. At the confirmation screen select Yes.
The Dell Server reboots, and the backup is restored.
Store backups to a secure FTP server
To store backups to an FTP server, the FTP client must support SFTP on port 22.
According to backup requirements of the organization, backups can be downloaded in the following ways:
• Manually
• Through automated script
• Through the organization's approved backup solution
To download backups using the organization's backup solution, obtain detailed instructions from your backup solution vendor.
NOTE:
The Dell Server is based on Linux Debian Ubuntu x64.
Log on to the Dell Server as ddpsupport, and use the sudo command to configure your backup solution: sudo <instructions from backup solution vendor>
Back up contents of the following folders:
/opt/dell/vsftpd/files/backup (required)
/opt/dell/vsftpd/files/certificates (strongly recommended)
/opt/dell/vsftpd/files/support (optional)
When the sudo process is complete, type exit and press Enter until the login prompt displays.
Enable Database Remote Access
This task can be completed at any time. It is not required to begin using Security Management Server Virtual. It is a best practice to restart the services any time a settings change is made.
Security Management Server Virtual - Quick Start and Installation Guide v9.8
Security Management Server Virtual Installation Guide
21
NOTE: Dell recommends that you enable database remote access only if necessary.
1 From the Advanced Configuration menu, select Database Remote Access.
2 Use the Spacebar to enter an X in the Enable Database Remote Access field and select OK. If the database password has not yet been configured, a prompt for the database password displays.
3 Enter the database password.
4 Re-enter the database password.
Dell Data Security application components stop automatically.
Enable DMZ Server Support
This task can be completed at any time. It is not required to begin using Security Management Server Virtual. It is a best practice to restart the services any time a settings change is made.
1 From the Advanced Configuration menu, select Enable DMZ Server Support.
2 Use the Spacebar to enter an X in the Enable DMZ Server Support field and select OK.
NOTE:
To use Proxy Mode (DMZ Mode), you must Install and Configure Proxy
.
22 Security Management Server Virtual - Quick Start and Installation Guide v9.8
Security Management Server Virtual Installation Guide
3
Administrator Tasks
Set or Change Terminal Language
It is a best practice to restart the services any time a settings change is made.
1 In the Main Menu, select Set Language.
2 Use the arrow keys to select the preferred language.
Check Server Status
To check the status of Dell Server Services, in the Main Menu, select Server Status.
The following table describes each Service and its function.
Name
Dell Message Broker
Dell Identity Server
Dell Compatibility Server
Dell Security Server
Dell Compliance Reporter
Dell Core Server
Dell Core Server HA
(High Availability)
Dell Inventory Server
Dell Forensic Server
Description
Enterprise Server Bus
Handles domain authentication requests.
A service for managing the enterprise architecture.
Provides the mechanism for controlling commands and communication with Active Directory. Used to communicate with the Dell Policy Proxy.
Provides an extensive view of the environment for auditing and compliance reporting.
A service for managing the enterprise architecture.
A high-availability service that allows for increased security and performance of HTTPS connections when managing the enterprise architecture.
Processes the inventory queue.
Provides web services for Forensic API.
Dell Policy Proxy Provides a network-based communication path to deliver security policy updates and inventory updates.
Dell Server monitors and restarts its services, if necessary.
NOTE: If the databasecustomizer process fails, servers move to the Execution Failed state. To check the Databasecustomizer log, in the Main Menu, select View Logs.
View Logs
To check the following logs, in the Main Menu, select View Logs.
Security Management Server Virtual - Quick Start and Installation Guide v9.8
Administrator Tasks
23
Syslog Log Mail Log Auth Log (SSH) Postgres Log Monitor Log
• System Logs
Syslog Log
Mail Log
Auth Log (SSH)
Postgres Log
Monitor Log
• Server Logs
Compatibility Server
Security Server
Message Broker
Core Server
Core Server HA
Compliance Reporter
Identity Server
Inventory Server
Forensic Server
Policy Proxy
• Databasecustomizer Log
Open the Command-line Interface
To open the command-line interface, in the Main Menu, select Launch Shell.
To exit the command-line interface, type exit and press Enter.
Generate a System Snapshot Log
To generate a System Snapshot Log for Dell ProSupport, in the Main Menu, select Support Tools.
1 From the Support Tools menu, select Generate System Snapshot Log.
2 At the indication that the file is created, select OK.
If the ddpsupport user is activated, Dell ProSupport can retrieve the log from the Security Management Server Virtual SFTP server. If
.
24 Security Management Server Virtual - Quick Start and Installation Guide v9.8
Administrator Tasks
4
Maintenance
You must remove unnecessary Security Management Server Virtual backups.
Only the ten most recent backups are retained. If disk partition space is at ten percent or less, no more backups are stored. If this condition occurs, you will receive an email notification that disk allocation space is low.
Security Management Server Virtual - Quick Start and Installation Guide v9.8
Maintenance
25
5
Troubleshooting
If an error occurs, and you have configured email notifications, you will receive an email notification. Based on the information in the email notification, follow these steps:
1 Check applicable log files.
2 Restart services, as needed. It is a best practice to restart the services any time a settings change is made.
3
Generate a System Snapshot Log .
4 Contact Dell ProSupport. For more information, see
.
26 Security Management Server Virtual - Quick Start and Installation Guide v9.8
Troubleshooting
6
Post-Installation Configuration Tasks
After installation, some components of your environment may need to be configured, based on the Dell Data Security solution used by your organization.
Configure Security Management Server Virtual for
Data Guardian
To configure the Dell Server to support Data Guardian, in the Remote Management Console, set one or both of these policies to On:
Protected Office Documents and Cloud Encryption.
For instructions to install the Data Guardian client, refer to the Data Guardian Administrator Guide or Data GuardianUser Guide.
Enable Manager Trust Chain Check
If a self-signed certificate is used on the Security Management Server Virtual for SED or BitLocker Manager, SSL/TLS trust validation must remain
disabled
on the client computer. Before enabling SSL/TLS trust validation on the client computer, the following requirements must be met:
• A certificate signed by a root authority (for example, Entrust or Verisign) must be imported into the Dell Server. See
Certificate or Enroll a New Server Certificate .
• The full chain of trust of the certificate must be stored in the Microsoft keystore on the client computer.
To enable SSL/TLS trust validation, on the client computer, change the value of the following registry entry to 0:
[HKLM\System\CurrentControlSet\Services\DellMgmtAgent\Parameters]
DisableSSLCertTrust=REG_DWORD (32-bit):0
Security Management Server Virtual - Quick Start and Installation Guide v9.8
Post-Installation Configuration Tasks
27
7
Remote Management Console Administrator
Tasks
Assign Dell Administrator Role
1 As a Dell Administrator, log in to the Remote Management Console at this address: https://server.domain.com:8443/webui/ The default credentials are superadmin/changeit.
2 In the left pane, click Populations > Domains.
3 Click a domain that you want to add a user to.
4 On the Domain Detail page, click the Members tab.
5 Click Add User.
6 Enter a filter to search the User Name by Common Name, Universal Principal Name, or sAMAccountName. The wild card character is
*.
A Common Name, Universal Principal Name, and sAMAccountName must be defined in the enterprise directory server for every user.
If a user is a member of a Domain or Group but does not appear in the Domain or Group Members list in the Management, ensure that all three names are properly defined for the user in the enterprise directory server.
The query will automatically search by common name, then UPN, and then sAMAccount name until a match is found.
7 Select users from the Directory User List to add to the Domain. Use <Shift><click> or <Ctrl><click> to select multiple users.
8 Click Add.
9 From the menu bar, click the Details & Actions tab of the specified user.
10 Scroll across the menu bar, and select the Admin tab.
11 Select the administrator roles to add to this user.
12 Click Save.
Log in with Dell Administrator Role
1 Log out of the Remote Management Console.
2 Log in to the Remote Management Console and login with Domain user credentials.
Click "?" in the upper right corner of the Remote Management Console to launch Dell Data Security AdminHelp. The Get Started page displays. Click Add Domains.
Baseline polices have been set for your organization but may need to be modified depending on your specific needs, as follows
(licensing and entitlements guide all activations):
• Windows computers will be encrypted
• Computers with self-encrypting drives will be encrypted
• Windows computers with Hardware Crypto Accelerators will be encrypted
• BitLocker Management is not enabled
• Advanced Threat Protection is not enabled
• Threat Protection is enabled
• External media will not be encrypted
• Devices connected to ports will not be encrypted
28 Security Management Server Virtual - Quick Start and Installation Guide v9.8
Remote Management Console Administrator Tasks
• Data Guardian is enabled
See the AdminHelp topic Manage Policies to navigate to Technology Groups and policy descriptions.
Commit Policies
Commit policies when installation is completed.
To commit polices after installation or, later, after policy modifications are saved, follow these steps:
1 In the left pane, click Management > Commit.
2 Enter a description of the change in the Comment field.
3 Click Commit Policies.
Security Management Server Virtual - Quick Start and Installation Guide v9.8
Remote Management Console Administrator Tasks
29
8
Security Management Server Virtual Ports
The following table describes each component and its function.
Name Description
Compliance Reporter
Default
Port
HTTP(S)/
8084
Provides an extensive view of the environment for auditing and compliance reporting.
A component of the Security Management
Server Virtual.
Required For
Reporting
Remote Management Console
Core Server
Core Server HA
(High Availability)
Security Server
HTTPS/
8888
HTTPS/
8888
HTTPS/
8443
Administration console and control center for the entire enterprise deployment.
A component of the Security Management
Server Virtual.
All
Manages policy flow, licenses, and registration for Preboot Authentication, SED
Management, BitLocker Manager, Threat
Protection, and Advanced Threat
Prevention. Processes inventory data for use by Compliance Reporter and the Remote
Management Console. Collects and stores authentication data. Controls role-based access.
All
A component of the Security Management
Server Virtual.
A high-availability service that allows for increased security and performance of
HTTPS connections with the Remote
Management Console, Preboot
Authentication, SED Management, BitLocker
Manager, Threat Protection, and Advanced
Threat Prevention.
All
A component of the Security Management
Server Virtual.
Communicates with Policy Proxy; manages forensic key retrievals, activations of clients,
Data Guardian products, and SED-PBA communication.
All
A component of the Security Management
Server Virtual.
Compatibility Server TCP/
1099
(closed)
A service for managing the enterprise architecture. Collects and stores initial inventory data during activation and policy data during migrations. Processes data based on user groups in this service.
All
30 Security Management Server Virtual - Quick Start and Installation Guide v9.8
Security Management Server Virtual Ports
Name
Message Broker Service
Identity Server
Forensic Server
Inventory Server
Policy Proxy
LDAP
Default
Port
Description Required For
A component of the Security Management
Server Virtual.
TCP/
61616
Handles communication between services of the Security Management Server Virtual.
Stages policy information created by the
Compatibility Server for policy proxy queuing.
All and
STOMP/
61613
(closed or, if configured for DMZ,
61613 is open)
A component of the Security Management
Server Virtual.
8445 Handles domain authentication requests, including authentication of the SED
Manager.
Requires an Active Directory account.
A component of the Security Management
Server Virtual.
All
HTTPS/
8448
8887
Allows administrators that have appropriate privileges to get encryption keys from the
Remote Management Console for use in data unlocks or decryption tasks.
Forensic API
A component of the Security Management
Server Virtual.
Processes the inventory queue.
A component of the Security Management
Server Virtual.
All
TCP/
8000/8090
Provides a network-based communication path to deliver security policy updates and inventory updates.
A component of the Security Management
Server Virtual.
Encryption Enterprise for Mac
Encryption Enterprise
389/636,
3268/3269
RPC - 135,
49125+
Port 389 - This port is used for requesting information from the local domain controller.
LDAP requests sent to port 389 can be used to search for objects only within the global catalog's home domain. However, the requesting application can obtain all of the attributes for those objects. For example, a request to port 389 could be used to obtain a user's department.
All
Port 3268 - This port is used for queries specifically targeted for the global catalog.
LDAP requests sent to port 3268 can be used to search for objects in the entire forest. However, only the attributes marked for replication to the global catalog can be
Security Management Server Virtual - Quick Start and Installation Guide v9.8
Security Management Server Virtual Ports
31
Name
Client Authentication
Callback beacon
Client communication with Advanced
Threat Prevention
Default
Port
Description Required For returned. For example, a user's department could not be returned using port 3268 since this attribute is not replicated to the global catalog.
HTTPS/
8449
Allows client servers to authenticate againstSecurity Management Server Virtual.
Server Encryption
HTTP/TCP
8446
Allows a callback beacon to be inserted into each protected Office file, when running
Data Guardian Protected Office mode.
Optional, used with Data Guardian
HTTPS/TC
P/443
Client communication if using Advanced
Threat Prevention
Advanced Threat Prevention
32 Security Management Server Virtual - Quick Start and Installation Guide v9.8
Security Management Server Virtual Ports
Скачать
Общедоступная ссылка обновлена
Общедоступная ссылка на ваш чат была обновлена. Вы можете просматривать и управлять своими ссылками на чат после регистрации здесь.
Общедоступная ссылка на документ
Реклама