Nokia Secure Access System Administrator Guide

PDF

مستند

Nokia Secure Access System

Administrator Guide

Version 1.0

Part No. N450868001 Rev A

Published June 2003

COPYRIGHT

Rights reserved under the copyright laws of the United States.

RESTRICTED RIGHTS LEGEND

Use, duplication, or disclosure by the United States Government is subject to restrictions as set forth in subparagraph (c)(1)(ii) of the Rights in Technical Data and Computer Software clause at

DFARS 252.227-7013.

Notwithstanding any other license agreement that may pertain to, or accompany the delivery of, this computer software, the rights of the United States Government regarding its use, reproduction, and disclosure are as set forth in the Commercial Computer Software-Restricted

Rights clause at FAR 52.227-19.

IMPORTANT NOTE TO USERS

This software and hardware is provided by Nokia Inc. as is and any express or implied warranties, including, but not limited to, implied warranties of merchantability and fitness for a particular purpose are disclaimed. In no event shall Nokia, or its affiliates, subsidiaries or suppliers be liable for any direct, indirect, incidental, special, exemplary, or consequential damages (including, but not limited to, procurement of substitute goods or services; loss of use, data, or profits; or business interruption) however caused and on any theory of liability, whether in contract, strict liability, or tort (including negligence or otherwise) arising in any way out of the use of this software, even if advised of the possibility of such damage.

Nokia reserves the right to make changes without further notice to any products herein.

This product includes software developed by the Apache Software Foundation

(http://www.apache.org/).

TRADEMARKS

Nokia is a registered trademark of Nokia Corporation. Other products mentioned in this document are trademarks or registered trademarks of their respective holders.

2 Nokia Secure Access System Administrator Guide

Nokia Contact Information

Corporate Headquarters

Web Site

Telephone

Fax

Mail

Address

http://www.nokia.com

1-888-477-4566 or

1-650-625-2000

1-650-691-2170

Nokia Inc.

313 Fairchild Drive

Mountain View, California

94043-2215 USA

Regional Contact Information

Americas

Europe,

Middle East, and Africa

Nokia Internet Communications.

313 Fairchild Drive

Mountain View, CA 94043-2215

USA

Tel: 1-877-997-9199

Outside USA and Canada: +1 512-437-7089 email: [email protected]

Nokia House, Summit Avenue

Southwood, Farnborough

Hampshire GU14 ONG UK

Asia-Pacific 438B Alexandra Road

#07-00 Alexandra Technopark

Singapore 119968

Tel: UK: +44 161 601 8908

Tel: France: +33 170 708 166 email: [email protected]

Tel: +65 6588 3364 email: [email protected]

Nokia Customer Support

Web Site:

Email:

Fax:

Asia-Pacific

https://support.nokia.com/ [email protected]

Americas Europe

Voice:

1-888-361-5030 or

1-613-271-6721

Voice:

1-613-271-8782

Fax:

Voice:

Fax:

+65-67232999

+65-67232897

+44 (0) 125-286-8900

+44 (0) 125-286-5666

021216

Nokia Secure Access System Administrator Guide 3

4 Nokia Secure Access System Administrator Guide

About This Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13

In This Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Conventions This Guide Uses . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

Notices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

Command-Line Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

Text Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

Web User Interface Conventions . . . . . . . . . . . . . . . . . . . . . . . . 19

1 Introducing the Nokia Secure Access System . . . . . . . . . . . . . 21

Overview of the Nokia Secure Access System . . . . . . . . . . . . . . . 21

Operational Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

Fundamental Concepts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

User Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

Authentication Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

Variables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

Access Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

Client Integrity Scanning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

Basic Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

Network Integration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

Opening Ports on the Border Firewall . . . . . . . . . . . . . . . . . . . 38

Configuring DNS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

Configuring the IPSO Appliance. . . . . . . . . . . . . . . . . . . . . . . . 40

Installing and Enabling the Gateway Software . . . . . . . . . . . . . 40

Nokia Secure Access System Administrator Guide 5

Selecting IP Addresses and Ports . . . . . . . . . . . . . . . . . . . . . . 41

Configuring the Server Certificate . . . . . . . . . . . . . . . . . . . . . . 42

Nokia Secure Access System Requirements. . . . . . . . . . . . . . . . . 43

Supported Operating Systems . . . . . . . . . . . . . . . . . . . . . . . . . . 43

Web Browsers Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

Supported Email Clients . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

Nokia Secure Access System Configuration Menu . . . . . . . . . . . . 45

2 Installing the Nokia Secure Access System . . . . . . . . . . . . . . . 47

Installing the Nokia Secure Access System Gateway . . . . . . . . . . 49

Before You Start . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

Installation Worksheet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

Installing the Hardware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50

Configuring the Appliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50

Installing the Package by Using Voyager . . . . . . . . . . . . . . . . . . 51

Enabling the Nokia Secure Access System . . . . . . . . . . . . . . . . 55

Signing On to the Gateway . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56

3 Configuring General Gateway Settings . . . . . . . . . . . . . . . . . . 61

Viewing Gateway Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61

Using Gateway Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63

General Gateway Logging. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64

Audit Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66

Configuring the Gateway Log Settings . . . . . . . . . . . . . . . . . . . . 67

Viewing the Gateway Log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69

Viewing the Audit Log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72

Exporting and Importing the Gateway Configuration File. . . . . . . . 75

Configuring the License . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78

4 Configuring Global Properties . . . . . . . . . . . . . . . . . . . . . . . . . . 81

Configuring Network Settings. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81

Configuring HTTPS Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82

Nokia Secure Access System Administrator Guide

Configuring Windows Networking . . . . . . . . . . . . . . . . . . . . . . . . 84

Customizing the Appearance of the User Interface . . . . . . . . . . . . 86

Configuring Global Access Control Settings . . . . . . . . . . . . . . . . . 87

Configuring Global Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88

Configuring Sign-On Page Rules . . . . . . . . . . . . . . . . . . . . . . . . 91

Configuring Access Control Settings . . . . . . . . . . . . . . . . . . . . . . 93

Viewing Access Control Rules . . . . . . . . . . . . . . . . . . . . . . . . . . 96

Configuring SNMP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97

Configuring SNMP traps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99

Downloading MIB Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101

Using Variables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102

Managing Variables. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104

Using Client Integrity Scanning . . . . . . . . . . . . . . . . . . . . . . . . . . 107

Client Integrity Scanning System Requirements . . . . . . . . . . . . 107

Using Client Integrity Scan Scripts . . . . . . . . . . . . . . . . . . . . . . 110

Deleting a Client Integrity Script . . . . . . . . . . . . . . . . . . . . . . . . 113

5 Configuring Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115

Configuring Server Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . 116

Managing Server Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116

Generating a New Server Certificate. . . . . . . . . . . . . . . . . . . . . 118

Adding a Certificate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121

Importing a Server Certificate . . . . . . . . . . . . . . . . . . . . . . . . . . 122

Configuring CA Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124

6 Configuring Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127

Managing Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128

Adding a New User . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128

Configuring User Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . 131

Specifying General User Properties . . . . . . . . . . . . . . . . . . . . 131

Specifying User Portal Properties . . . . . . . . . . . . . . . . . . . . . 135

Specifying User Session Properties . . . . . . . . . . . . . . . . . . . . 138

Nokia Secure Access System Administrator Guide 7

Disabling or Deleting a User . . . . . . . . . . . . . . . . . . . . . . . . . . . 141

Importing User Lists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143

Requirements for the User List File Format . . . . . . . . . . . . . . . 145

7 Configuring User Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147

Managing User Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147

Adding a New User Group . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148

Adding or Removing Members to a User Group . . . . . . . . . . . . 149

Specifying User Group Portal Properties . . . . . . . . . . . . . . . . . 151

Specifying User Group Session Properties . . . . . . . . . . . . . . . . 153

8 Configuring Authentication Methods . . . . . . . . . . . . . . . . . . . 157

Authenticating Users at Sign-On . . . . . . . . . . . . . . . . . . . . . . . . . 158

Automatic Handling of Password-Based Methods . . . . . . . . . . 159

Automatic Handling of Certificate-Based Methods . . . . . . . . . . 160

Authenticating the admin User . . . . . . . . . . . . . . . . . . . . . . . . . 162

Managing Authentication Methods . . . . . . . . . . . . . . . . . . . . . . . . 163

Adding an Authentication Method . . . . . . . . . . . . . . . . . . . . . . . 164

Disabling or Deleting an Authentication Method . . . . . . . . . . . . 166

Adding Group Membership . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167

Configuring Static Group Assignment . . . . . . . . . . . . . . . . . . . . 168

Specifying Local Password Settings . . . . . . . . . . . . . . . . . . . . . . 171

Authenticating with External Servers . . . . . . . . . . . . . . . . . . . . . . 173

Configuring an LDAP Authentication Method . . . . . . . . . . . . . . 174

Configuring LDAP User Authentication . . . . . . . . . . . . . . . . . 179

Configuring LDAP Group Retrieval Settings . . . . . . . . . . . . . 183

Configuring an NTLM Authentication Method . . . . . . . . . . . . . . 186

Configuring NTLM Group Retrieval Settings . . . . . . . . . . . . . 188

Configuring a RADIUS Authentication Method . . . . . . . . . . . . . 190

Specifying RADIUS Group Retrieval Settings . . . . . . . . . . . . 192

Configuring an NIS Authentication Method . . . . . . . . . . . . . . . . 194

Specifying NIS Group Retrieval Settings . . . . . . . . . . . . . . . . 196

Authenticating with Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . 198

Nokia Secure Access System Administrator Guide

Configuring the Local Certificate Authentication Method . . . . . 199

Specifying Local Certificate Group Retrieval Settings . . . . . . 202

Configuring a PKI Certificate Authentication Method . . . . . . . . 204

Specifying Username Mapping . . . . . . . . . . . . . . . . . . . . . . . 206

Specifying PKI Group Retrieval Settings . . . . . . . . . . . . . . . . 208

9 Configuring Web Resources . . . . . . . . . . . . . . . . . . . . . . . . . . 213

Using Predefined Web Resources . . . . . . . . . . . . . . . . . . . . . . . . 214

Managing Web Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215

Adding a New Web Resource . . . . . . . . . . . . . . . . . . . . . . . . . . 215

Disabling or Deleting a Web Resource . . . . . . . . . . . . . . . . . . . 219

Configuring the Default Web Proxy . . . . . . . . . . . . . . . . . . . . . . 220

10 Configuring File Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . 223

Using Default File Resources. . . . . . . . . . . . . . . . . . . . . . . . . . . . 224

Managing File Resources. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225

Configuring Windows File Resources . . . . . . . . . . . . . . . . . . . . 226

Adding a New Windows File Resource . . . . . . . . . . . . . . . . . 226

Disabling or Deleting a Windows File Resource . . . . . . . . . . 229

Configuring NFS File Resources . . . . . . . . . . . . . . . . . . . . . . . . 230

Adding an NFS File Resource . . . . . . . . . . . . . . . . . . . . . . . . 230

Disabling or Deleting a NFS File Resource . . . . . . . . . . . . . . 234

Configuring FTP File Resources . . . . . . . . . . . . . . . . . . . . . . . . 236

Adding an FTP File Resource . . . . . . . . . . . . . . . . . . . . . . . . 236

Disabling or Deleting an FTP File Resource . . . . . . . . . . . . . 238

11 Configuring Email Resources . . . . . . . . . . . . . . . . . . . . . . . . . 241

Supported Email Clients. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242

Supported Email Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243

Configuring Client-Side Email Settings . . . . . . . . . . . . . . . . . . . . 243

Specifying Interfaces, Protocols, and Port Settings for Email

Connections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243

Entering IMAP and POP Capability Strings. . . . . . . . . . . . . . . . 247

Nokia Secure Access System Administrator Guide 9

Entering IMAP Capability Strings . . . . . . . . . . . . . . . . . . . . . . 247

Entering POP Capability Strings . . . . . . . . . . . . . . . . . . . . . . 248

Configuring Email Resource Authentication Settings. . . . . . . . . . 248

Managing Email Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 252

Adding a New Email Resource . . . . . . . . . . . . . . . . . . . . . . . . . 253

Disabling or Deleting an Email Resource . . . . . . . . . . . . . . . . . 255

12 Configuring Port-Forwarding Resources . . . . . . . . . . . . . . . . 257

Managing Port-Forwarding Resources . . . . . . . . . . . . . . . . . . . . 258

Port-Forwarding Requirements . . . . . . . . . . . . . . . . . . . . . . . . . 258

Adding a New Port-Forwarding Resource. . . . . . . . . . . . . . . . . 259

Using Port-Forwarding with Lotus Notes . . . . . . . . . . . . . . . . 263

Disabling or Deleting a Port-Forwarding Resource . . . . . . . . . . 264

13 Configuring Access Control Rules . . . . . . . . . . . . . . . . . . . . . 265

Configuring Simple Access Control Rules . . . . . . . . . . . . . . . . . . 266

Configuring Advanced Access Control Rules . . . . . . . . . . . . . . . 268

Configuring Complex Access Control Rules . . . . . . . . . . . . . . . 272

Entering a Rule Manually . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 276

Using Variables for Access Control Rules . . . . . . . . . . . . . . . . . . 277

Descriptions of Predefined Variables . . . . . . . . . . . . . . . . . . . . 277

A Using the admin_unlock Script . . . . . . . . . . . . . . . . . . . . . . . . 281

B Options for Installing Packages . . . . . . . . . . . . . . . . . . . . . . . 285

Obtaining the Nokia Secure Access System Package. . . . . . . . . 285

Installing the Package with the newpkg Command . . . . . . . . . . . 287

Deactivating or Deleting Packages with Voyager . . . . . . . . . . . . 290

Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 293

Nokia Secure Access System Administrator Guide

Tables

Table 1 Command-Line Conventions . . . . . . . . . . . . . . . . . . . . . 16

Table 2 Text Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

Table 3 Authentication Method Types . . . . . . . . . . . . . . . . . . . . . 28

Table 4 Firewall Ports to Open for Gateway Traffic . . . . . . . . . . 39

Table 5 Description of Configuration Menu . . . . . . . . . . . . . . . . . 46

Table 6 Severity Levels for General Gateway Logging

Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64

Table 7 Description of SNMP Traps . . . . . . . . . . . . . . . . . . . . . . 99

Table 8 Variable Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103

Table 9 Description of Predefined Client Integrity Scripts . . . . . 110

Table 10 Description of Distinguished-Name Field Attributes . . 121

Table 11 Locally Defined and Externally Defined Users . . . . . . 128

Table 12 Password-Based and Certificate-Based

Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158

Table 13 Authentication Method Types Using External Servers 173

Table 14 Description of Predefined Web Resources . . . . . . . . 214

Table 15 Types of File Servers . . . . . . . . . . . . . . . . . . . . . . . . . 223

Table 16 Advanced Rule Types . . . . . . . . . . . . . . . . . . . . . . . . 269

Table 17 Variables for Access Control Rules . . . . . . . . . . . . . . 277

Table 18 newpkg Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289

Nokia Secure Access System Administrator Guide 11

12 Nokia Secure Access System Administrator Guide

About This Guide

This guide describes how to configure and manage the Nokia Secure Access

System. It is intended for the system administrator who is responsible for installing and configuring the system for secure, remote user access.

This preface provides the following information:

In This Guide

Conventions This Guide Uses

In This Guide

This guide is organized into the following chapters:

Chapter 1, “Introducing the Nokia Secure Access System” provides an

introduction of the Nokia Secure Access System, system requirements, and an overview of the Nokia Secure Access Configuration menu.

Chapter 2, “Installing the Nokia Secure Access System” describes how to

install the gateway, including hardware installation, installing the package by using Voyager, and signing on to the gateway.

Chapter 3, “Configuring General Gateway Settings”

describes how to configure general gateway settings, including gateway logging, exporting and importing the gateway configuration file, configuring licenses, and viewing gateway status.

Nokia Secure Access System Administrator Guide 13

Chapter 4, “Configuring Global Properties” describes how to configure

global properties, including configuring network settings, customizing the appearance of the user interface, configuring global access control settings, configuring SNMP, using variables, and using client integrity scanning.

Chapter 5, “Configuring Certificates”

describes how to configure certificates for use in authenticating to the gateway, including configuring server certificates, managing server certificates, and configuring CA certificates.

Chapter 6, “Configuring Users” describes how to configure users

including adding a user, configuring user properties, disabling or deleting a user, and importing user lists.

Chapter 7, “Configuring User Groups” describes how to configure user

groups including adding a user group, configuring a user group, and disabling or deleting a user group.

Chapter 8, “Configuring Authentication Methods” describes how to

authenticate users and groups for secure access by using local passwords, local certificates, PKI certificates, and external servers such as LDAP,

NTLM, RADIUS, and UNIX-NIS servers.

Chapter 9, “Configuring Web Resources” describes how to configure

resources for secure access to enterprise Web servers, including adding a

Web resource, specifying a Web proxy server, configuring Web resource properties, and disabling or deleting a Web resource.

Chapter 10, “Configuring File Resources” describes how to configure

resources for secure access to Windows, NFS, and FTP file servers.

Chapter 11, “Configuring Email Resources” describes how to configure

the gateway secure email proxy that enables remote users to send and receive email by using the POP, IMAP, and SMTP protocols.

Chapter 12, “Configuring Port-Forwarding Resources” describes how to

configure a port-forwarding proxy that allows TCP, UDP, and Microsoft

Outlook traffic between the client and backend servers to be channeled over a protected HTTPS connection.

Nokia Secure Access System Administrator Guide

Conventions This Guide Uses

Chapter 13, “Configuring Access Control Rules”

describes how to configure access control rules for gateway resources including configuring simple and advanced access control rules and using variables.

Appendix A, “Using the admin_unlock Script”

describes how to run the admin_unlock script to gain access to the gateway configuration pages if an administrator is accidently locked out.

Appendix B, “Options for Installing Packages” describes additional

options for installing packages on the Nokia Secure Access gateway.

Conventions This Guide Uses

The following sections provide the document conventions including notices, menu items, and IP address notation conventions used throughout this guide.

Notices

Warning

Warnings advise the user that bodily injury might occur because of a physical hazard.

Caution

Cautions indicate potential equipment damage, equipment malfunction, loss of performance, loss of data, or interruption of service.

Note

Notes provide information of special interest or recommendations.

Nokia Secure Access System Administrator Guide 15

Command-Line Conventions

This section defines the elements of commands that are available in Nokia

Internet Communications products. You might encounter one or more of the following elements on a command-line path.

Table 1 Command-Line Conventions

Convention Description

command

Italics

This required element is usually the product name or other short word that invokes the product or calls the compiler or preprocessor script for a compiled Nokia product. It might appear alone or precede one or more options. You must spell a command exactly as shown and use lowercase letters.

Indicates a variable in a command that you must supply. For example: delete interface if_name angle brackets < >

Supply an interface name in place of the variable.

For example: delete interface nic1

Indicates arguments for which you must supply a value: retry-limit <1–100>

Square brackets [ ]

Supply a value. For example: retry-limit 60

Indicates optional arguments.

delete [slot slot_num]

For example: delete slot 3

16 Nokia Secure Access System Administrator Guide

Conventions This Guide Uses

Table 1 Command-Line Conventions (continued)

Convention Description

Vertical bars, also called a

pipe

(|)

Separates alternative, mutually exclusive elements. framing <sonet | sdh>

-flag

.ext

( . , ; + * - / )

' '

To complete the command, supply the value. For example: framing sonet or framing sdh

A flag is usually an abbreviation for a function, menu, or option name, or for a compiler or preprocessor argument. You must enter a flag exactly as shown, including the preceding hyphen.

A filename extension, such as .ext, might follow a variable that represents a filename. Type this extension exactly as shown, immediately after the name of the file. The extension might be optional in certain products.

Punctuation and mathematical notations are literal symbols that you must enter exactly as shown.

Single quotation marks are literal symbols that you must enter as shown.

Nokia Secure Access System Administrator Guide 17

Text Conventions

Table 2 describes the text conventions this guide uses.

Table 2 Text Conventions

Convention Description

monospace font

Indicates command syntax, or represents computer or screen output, for example:

Log error 12453

bold monospace font

Indicates text you enter or type, for example:

# configure nat

Key names

Menu commands

The words enter and type

Italics

Keys that you press simultaneously are linked by a plus sign (+):

Press Ctrl + Alt + Del.

Menu commands are separated by a greater than sign (>):

Choose File > Open.

Enter indicates you type something and then press the Return or Enter key.

Do not press the Return or Enter key when an instruction says type.

• Emphasizes a point or denotes new terms at the place where they are defined in the text.

• Indicates an external book title reference.

• Indicates a variable in a command: delete interface

if_name

18 Nokia Secure Access System Administrator Guide

Related Product Documentation

Web User Interface Conventions

Throughout this guide, a greater than sign (>), with spaces before and after the sign, is used to indicate navigation through the Web user interface by clicking menu options and links. For example, to configure a new user group, choose

Users > User Configuration > New User Group.

Note

When providing information in the Nokia Secure Access System configuration fields, click Save Settings before selecting tabs or buttons to ensure your changes are saved before going to a new configuration page.

Introducing the Nokia Secure

Access System

This chapter provides an introduction to the Nokia Secure Access System, including:

Overview of the Nokia Secure Access System

Nokia Secure Access System Requirements

Nokia Secure Access System Configuration Menu

Overview of the Nokia Secure Access System

The Nokia Secure Access System enables an enterprise to securely extend

Intranet services to its users, who can then access these services from a variety of Web-capable platforms and locations. You can rapidly deploy this system without new software installed on each client computer. Purpose-built for the hardened IPSO network appliance platform, the Nokia Secure Access System easily integrates into the network infrastructure of the enterprise.

This section provides an overview of the Nokia Secure Access system. It describes the basic concepts underlying the system as well as the steps necessary to deploy it in an enterprise network environment.

Nokia Secure Access System Administrator Guide 21

Introducing the Nokia Secure Access System

You must be familiar with the use of SSL for securing network applications and have a general understanding of the operation and use of Web, email, and file servers to use the Nokia Secure Access System.

This overview includes the following sections:

Operational Model

Fundamental Concepts

Basic Configuration

Operational Model

The Nokia Secure Access appliance acts as a gateway for authorized remote users to securely access network services on the enterprise Intranet. All communication between users and the gateway is protected by SSL or TLS.

The gateway communicates with backend servers while it authenticates remote users and services user requests. Essentially, the gateway acts as a reverse application proxy; it is the intermediary between the remote user and the backend Web servers, file servers, and email servers to which the remote user is allowed access.

Figure 1 Network Integration of Nokia Secure Access System

Wired

Client

Home

Internet Cafe

’

Customer Site

Authentication

Servers

Enterprise

Intranet

Web

File

Firewall

Internet

DMZ

Nokia Secure

Access System

00375

22 Nokia Secure Access System Administrator Guide

Overview of the Nokia Secure Access System

Remote users access the gateway from the Internet by using SSL-capable

Web browsers (or email clients). Users sign on to the gateway by using a username and password or by using a digital certificate. Once signed on, the user requests Intranet services through the gateway. These services are organized and configured on the gateway as four types of resources: Web, file, email, and port-forwarding. Typically, the user accesses resources by clicking on links or typing URLs into the portal page that the user sees after signing on to the gateway. Also on this portal page, the gateway users can store favorite links and manage their preferences. For example, a user can visit their preferences page and select whether or not the gateway should persistently save the user’s passwords for use with backend Web, file, and email servers (to achieve single sign on to the enterprise Intranet).

The gateway enforces the access control policies that the administrator configures. A rule list that specifies an access control policy is associated with each resource, and a global rule list for specifying restrictions can apply to all resource requests. Each rule list can include expressions of the conditions for allowing or denying access, using the gateway variables to reference characteristics of a user’s session. The gateway also supports a simple interface for configuring resource access control lists by specifying the allowed or denied user groups for each resource.

The gateway administrator can define user groups and configure the gateway so that users are assigned group memberships by one of two mechanisms:

Permanent assignment––the administrator explicitly configures a user to be a member of a given group.

Group assignment from authentication method––when a user signs on, the user may be temporarily assigned to particular groups associated with the method employed to validate the user's sign-on credentials. The administrator can configure which group memberships (if any) are assigned in this way by each authentication method. For authentication methods based on LDAP or RADIUS, the gateway can also be configured to dynamically add group memberships by querying the LDAP or

RADIUS server for groups to which the authenticated user belongs.

Nokia Secure Access System Administrator Guide 23

Introducing the Nokia Secure Access System

This flexible scheme for managing and assigning group memberships lends itself well to an approach of using group membership to convey an ability or permission. Similar to UNIX and Windows NT/2000, you can specify a resource access control policy in terms of the groups allowed to access it.

Additional access rights can then be given to a user by adding that user to particular groups that are allowed access to the resource.

The administrator can define multiple authentication methods for use during user sign on, thereby accommodating a wide range of scenarios for authenticating remote users. Think of each authentication method as an instance of a certain type of authentication, with configuration settings specific to that authentication type. For instance, an administrator might define two authentication methods of type RADIUS, with each method configured to communicate with its own RADIUS server. During user sign on, the gateway automatically determines which authentication method applies for the credentials that the user supplies— regardless of whether the user enters a username and password or selects a digital certificate present in the user's Web browser.

Fundamental Concepts

This section describes the fundamental concepts of the Nokia Secure Access

System, including:

Users

User Groups

Authentication Methods

Resources

Variables

Access Control

Client Integrity Scanning

24 Nokia Secure Access System Administrator Guide

Overview of the Nokia Secure Access System

Users

The gateway administrator uses the gateway configuration system to define users that the gateway recongnizes. The two types of gateway user accounts are:

Locally-defined user––corresponds to a particular individual. That person signs on to the gateway with the username that the administrator specifies (for instance, username jsmith). The gateway possesses all relevant settings for this type of user locally in its configuration database.

Externally-defined user––the administrator can define a class of users such that an external authentication server verifies the identity of each user at the time the user signs on. This scheme allows the gateway to be quickly configured to recognize the existing user base of an enterprise.

For instance, the administrator can create a gateway user class with username ext-partner1 that uses a RADIUS authentication method to

externally define each user. At sign on, when a user types the username and password for their account on the RADIUS server (for instance, username mjones), the gateway recongnizes the user as a member of the ext-partner1 class of users. The gateway still references each user by the username specified at sign on (mjones) when it records the user’s preferences, evaluates access control policies, and so on.

Externally defined users can greatly reduce the effort involved in configuring the gateway for a large number of users. Instead of defining each user individually, you can create one externally defined user class that includes all users that authenticate in the same way.

The gateway does not limit the number of users that the administrator can define. The gateway license does include a limit on the number of users that are allowed to access the gateway concurrently.

Nokia Secure Access System Administrator Guide 25

Introducing the Nokia Secure Access System

Note

The administrator (username admin) is the only gateway user who has an account on the IPSO appliance. None of the users defined through the gateway configuration system can access the IPSO appliance by using

Telnet or SSH and obtain a command shell on the appliance itself.

User Groups

The administrator can define user groups and configure how users are assigned to those groups. As with UNIX or Windows NT/2000, gateway users can belong to multiple groups, and these group memberships are typically used to facilitate the management of access control policies. Thus, a user’s set of privileges can grow as the user gains more group memberships.

Users can be explicitly assigned to groups, using either the General properties tab for a user or the General properties tab for a group. In the former case, the administrator specifies the group memberships for a given user; in the latter case, the administrator specifies the members of a given group.

Group memberships can also be associated with authentication methods, so that all users who successfully authenticate with a given method can be assigned to particular groups for the duration of each user session. For instance, the administrator could configure two certificate-based authentication methods to add membership to a group named Cert Users, which could yield special privileges because of this group’s recognition in the access control policies that the administrator configures

In the case of authentication methods that use LDAP servers, RADIUS servers or client certificates (PKI Certificate methods), the gateway can also be configured to add temporary group memberships by using dynamic information retrieved when the user signs on. For instance, when authenticating a user against a RADIUS server, the gateway can retrieve group membership information for the authenticated user from attributes in the RADIUS reply. As another example, the gateway could obtain group membership information by examining the distinguished name attributes in the user’s client certificate.

26 Nokia Secure Access System Administrator Guide

Overview of the Nokia Secure Access System

In addition to helping manage access control, group memberships can be used to determine which resource links are seen on a user’s portal page. A user can also be configured to use session settings (for example, time-limit restrictions on user sessions) from a particular group or from a combination of groups.

The Admin group is defined initially on the gateway, for convenience.

However, the gateway does not handle this group in any special way.

Authentication Methods

Multiple authentication methods can be defined, named, and configured by the gateway administrator. An authentication method can be thought of as an instance of a particular authentication type, with configuration settings appropriate for that type. For instance, the administrator could define a method named Our Rad that is configured to authenticate users by communicating with a particular RADIUS server.

The two predefined authentication methods are:

Local password––the gateway can store a password for each locally defined user. A user’s local password can be set by the administrator using the configuration system, or by the user through the preferences page of the user portal. The configuration settings pertaining to the local password authentication method govern how the gateway uses this scheme to authenticate locally defined users.

Local certificate––the gateway can store a single digital certificate for each locally defined user. The administrator can set a user’s local certificate by pasting the certificate data into a page of the configuration system. A user can also set his or her own local certificate by visiting the preferences page of the user portal and then performing the certificate authentication with the user’s Web browser. The configuration settings pertaining to the local certificate authentication method govern how the gateway uses this scheme to authenticate locally defined users.

The local certificate authentication method does not require any enterprise public key infrastructure (PKI). Users can use certificates obtained by practically any method, including personal certificates obtained from public Certificate Authorities (CAs).

Nokia Secure Access System Administrator Guide 27

Introducing the Nokia Secure Access System

The administrator defines all other authentication methods by choosing the type for the new authentication method and then configuring the settings for the new method.

Table 3

shows the available authentication method types.

Table 3 Authentication Method Types

Method type Description

LDAP

NTLM

RADIUS

NIS

PKI Cert

Authenticating with LDAP servers, such as ActiveDirectory or

OpenLDAP

Authenticating with Windows NT primary domain controllers

Authenticating with RADIUS servers, including ACE servers through the RADIUS interface (for SecurID authentication)

Authenticating with UNIX NIS domain servers

Authenticating with client certificates issued to users in a Public Key

Infrastructure

In the case of LDAP, NTLM, RADIUS and NIS authentication, the user enters a username and a password (or passcode) to authenticate to the backend authentication server through the gateway. RADIUS authentication also allows for challenge-response authentication, in which the user must provide a response to a challenge issued by the RADIUS server.

When processing a username and password that the user supplies at the signon page, the gateway automatically determines which authentication method succeeds for the supplied credentials. This can involve attempting to use multiple password-based authentication methods in an order that the administrator configures.

The PKI certificate methods function similarly to the local certificate method, in that the user authenticates by selecting a certificate from those already installed in the user’s browser. The PKI certificate methods are more sophisticated than the local certificate method, however, in that they enable the gateway to authenticate users with certificates that are not configured on the gateway. Instead, the administrator configures the trusted root CAs for the

28 Nokia Secure Access System Administrator Guide

Overview of the Nokia Secure Access System

PKI certificate method, as well as settings that govern the mapping of certificates to gateway usernames.

In the special case of the admin user, the gateway can also be configured to use the same authentication scheme as other IPSO access methods. Thus, the gateway administrator can use the same password as used when accessing the appliance through Voyager or through Telnet.

Resources

A resource is an abstraction of an Intranet service made available to remote users. Every service that the gateway proxies to its users corresponds to some resource that exists in the gateway configuration, and each configured resource has an access control policy associated with it.

The gateway administrator can define new resources and configure their settings. Links to these resources can be made to show up in the resources section of the user portal by configuring the portal properties for users or user groups.

The four types of resources are Web, file, email, and port forwarding. The following sections describe these resources.

Web Resources

A Web resource represents proxied access to a particular backend HTTP or

HTTPS server. For example, a Web resource can be created to give users access to a backend Web mail system such as Microsoft Outlook Web Access.

The administrator configures the base URL of the Web resource to specify the

Web server (or the subsection of the Web server document space) to use. An example base URL is: http://servername.example.com/projects/

Users can access a Web resource by clicking on its link in the resources section of the user portal. The administrator can also allow users to type Web

URLs into a text box on the user portal.

Multiple Web resources can point to different document areas on the same backend Web server. This can be useful when, for example, the gateway

Nokia Secure Access System Administrator Guide 29

Introducing the Nokia Secure Access System

access control policy for requests to a sensitive_docs subdirectory must be different than the access control policy for requests to all other areas of the same Web server.

When processing requests for Web services from a user’s browser, the gateway determines the corresponding Web resource as follows:

The gateway attempts to match the requested URL against the base URL of each of the configured Web resources. The preceding example base

URL would match a user request for the URL: http://servername.example.com/projects/eng/index.html

If multiple base URLs match the requested URL (when one base URL is a substring of another base URL), the gateway chooses the Web resource with the most specific match.

If the requested URL does not match any of the base URLs for administrator defined Web resources, the request corresponds to the default Web resource.

The default Web resource is therefore the catch-all for requests that do not correspond to any other Web resource in the gateway configuration. The default Web resource can be used to enable access to any Intranet Web site, which can be particularly valuable in installations with a large number of backend Web servers.

The administrator can configure the use of HTTP or HTTPS proxies for Web resources, either on a global or a per-resource basis. The gateway must also be configured with the CA certificates that are trusted for the purpose of validating the server certificates of HTTPS Web servers.

File Resources

File resources allow users to securely access backend NFS, FTP, or Windows file servers through the gateway Web interface. Regardless of the type of backend file server, the gateway presents the same Web-based file browsing interface for viewing directories, uploading or downloading files, creating directories, and so on.

As with Web resources, users can access a file resource by clicking on its link in the resources section of the user portal. The administrator can also allow

30 Nokia Secure Access System Administrator Guide

Overview of the Nokia Secure Access System

users to request browsing of a file server by specifying its hostname (and optionally, a subdirectory of the file server) into a text box on the user portal.

Also like Web resources, file resources use base URLs and the gateway associates user requests with the file resources that have the most specific base URL match. When a request does not match the base URL of any administrator-defined file resource, the gateway associates the request with either the default FTP, NFS, or Windows resource, depending on the type of file server requested.

The access control rules for a file resource can be configured to take into account whether the request corresponds to a read operation (list a directory, download a file) or a write operation (create a directory, delete or upload a file).

Email Resources

Email resources allow gateway users to access their backend email by using email clients that support POP, IMAP, or SMTP with SSL/TLS protection.

Standards-based email clients such as Microsoft Outlook Express, Netscape

Navigator, and Qualcomm Eudora are supported.

This scheme involves the use of the gateway secure email proxy, which accepts secure connections from users’ email clients, authenticates the users, enforces access control policies, and proxies the connection between the email clients and the desired backend POP, IMAP, and SMTP servers.

To enable this use of the gateway, the administrator defines email resources for the desired backend email servers and also configures settings that govern the general operation of the secure email proxy (the client-side ports on which to listen, how to authenticate users, and so on). Users can then configure their email clients to communicate with the gateway rather than with the backend servers themselves. The usernames and passwords they supply to their email clients can also be different, since users must authenticate to both the gateway and the backend email servers.

Users can select from multiple email resources by clicking on the appropriate link in the Resources section of the user portal. This amounts to the user instructing the gateway as to which of several email accounts is to be handled by the secure email proxy for that user.

Nokia Secure Access System Administrator Guide 31

Introducing the Nokia Secure Access System

Port-Forwarding Resources

To allow the use of client-server applications that are not Web-enabled, the gateway supports the ability to forward communication between a client application and a backend server through an HTTPS connection to the gateway. A downloadable Java applet performs the forwarding by listening on particular ports on the client and relaying TCP or UDP traffic between the connecting client applications and backend servers. All such communication is intermediated by the gateway and protected by SSL or TLS.

The gateway administrator can define port-forwarding resources, specifying the ports on which the applet is to listen, as well as the hostname or IP address and port number for the corresponding backend servers. A port-forwarding resource can also be configured to forward all ports required for Microsoft

Outlook to communicate with a Microsoft Exchange server.

A user uses a port-forwarding resource by clicking its link on the resources section of the user portal. That triggers the download of the digitally signed

Java applet from the gateway. Once the applet initializes, the user launches the client application in question. Typically, the user reconfigures the client application so that it communicates with localhost rather than the usual backend server.

As an additional option, the administrator can specify that the applet modify the hosts file on each Windows client so that hostnames of backend servers resolve to the localhost address when client applications attempt to connect to those servers. In this way, the user is spared the inconvenience of reconfiguring the client application to use the gateway port-forwarding solution.

The user can select multiple port-forwarding resources during a single session, and the same Java applet dynamically handles all such selections. As with all resources, a request for a port-forwarding resource is only allowed when the resource access control policy permits it.

32 Nokia Secure Access System Administrator Guide

Overview of the Nokia Secure Access System

Variables

Variables are used to reference the real-time properties of a user session or request. For example, the USERNAME variable represents the username string specified by the user at sign on. The TIME_OF_DAY variable references the local time at the moment a user request is processed. These variables, and several others, are predefined on the gateway. Most gateway variables take on string values; for instance, the DAY_OF_WEEK variable can be set to one of seven string values (Monday, Tuesday, ..., Sunday). Some variables, such as CLIENT_IP, take on numeric values.

The main utility of variables is to facilitate specification of access control policies. When configuring access control rule lists, the gateway administrator specifies the conditions for allowing or denying access in terms of variables and their values.

The administrator can also define new variables that are used to hold the

results of client integrity scans. See “Client Integrity Scanning” on page 35.

Access Control

The gateway employs a flexible access control scheme that allows the administrator to configure policies on the services offered to gateway users.

Each policy is specified in terms of a rule list (sometimes called an access control list, or ACL) that is evaluated at runtime in a sequential, first-match manner.

A rule includes an action (typically ALLOW or DENY) and the conditions under which this action is to be taken. Consider this example rule list:

DENY IF USERNAME = “jsmith”

ALLOW IF (CLIENT_IP = “192.168.3.0/24”) OR (USER_GROUP = “Eng”)

Default: DENY

This rule list denies access to the user with username jsmith. Other users are allowed access, provided their client IP address matches 192.168.3.* or their group memberships include the Eng user group. Access is denied under all other conditions, because of the default action specified at the end of the rule list.

Nokia Secure Access System Administrator Guide 33

Introducing the Nokia Secure Access System

Resource Access Control

The gateway access control scheme is primarily resource-oriented. For each resource in the gateway configuration, the administrator specifies the access control policy by using one of two available views of the resource rule list:

Simple View––using the Simple View, the allowed or denied user groups can be easily selected from pick lists. The corresponding ALLOW or

DENY rules are automatically added or removed from the rule list. This view expedites access control configuration in situations where access privileges are managed in terms of group memberships.

Advanced View––displays the full rule list and allows the administrator to add, delete, disable, reorder, and edit the rules. New rules can be created using one of three methods: manually typing the rule text, using a graphical user interface (GUI) to create a rule with a single condition, or using a richer graphical interface to create a complex rule with Boolean combinations of conditions.

Note

The resource access control policy governs whether or not the gateway allows the user to communicate with the backend server. The backend server itself might require that the user authenticate to the server and might also deny access based on its own access control restrictions.

Global Rules

To facilitate enforcement of access control policies that can apply to all resources, the gateway also uses a global rule list. This rule list also accommodates administrators that prefer to have all access control rules managed in a single location.

The global rules list is evaluated first when processing any user request. The global rules can allow or deny access to a requested resource; the global rules also include a defer action that causes the gateway to base the access control decision to the requested resource access control policy.

34 Nokia Secure Access System Administrator Guide

Overview of the Nokia Secure Access System

A rule in the global rules list can be configured to apply to a single resource.

In this way, the global rules list can also be used for resource access control

(instead of the rule lists for each resource), if desired.

Sign-On Rules

The administrator can configure restrictions on access to the gateway sign-on page. This can be useful, for example, in preventing users from entering their sign-on passwords on computers that are thought to be insecure, based on the results of a client integrity scan. See

“Client Integrity Scanning” on page 35.

The sign-on rules function like other rule lists configured on the gateway, with the exception of some variables being unavailable. For instance, the

USERNAME variable is not available for sign-on rules, since the user identity is not known at the time the user requests the sign-on page.

Client Integrity Scanning

Client Integrity Scanning is a way to check for security vulnerabilities on a user’s client platform, so that this information can be considered in the gateway access control policies. Effective use of this feature can help preserve the security of an enterprise network even when the gateway is accessed from a wide variety of client computers on the Internet.

The administrator can specify in the scan rules whether a client integrity scan occurs before or after user sign on. The scan rules can trigger scans based on browser version, client IP address, and so on. The actual scan is performed by a Java applet downloaded at runtime by the user’s browser. The applet itself establishes a secure connection to the gateway and downloads a script (the particular script that the scan rules specify) that details the scan actions to be taken by the applet. These actions can include:

Checking for the presence of particular files

Checking the file size of particular files

Calculating the checksum of the contents of a particular file

Checking whether or not particular programs are running

Nokia Secure Access System Administrator Guide 35

Introducing the Nokia Secure Access System

The scan script also specifies how the results of these checks are conveyed to the gateway. Specifically, the scan results are assigned as string values to variables that are defined by the administrator for this purpose. Once assigned values, these variables allow access control decisions to be made based on the results of the client integrity scan. In particular, the sign-on rules can be configured to deny access to the sign-on page if the value of a certain variable indicates that the client integrity scan found security vulnerabilities. In this way, the user can be discouraged from entering sign-on passwords on computers determined to be insecure.

Basic Configuration

The following sections outline the typical steps for installing and initially configuring the Nokia Secure Access System. You can find further detail on many of these procedures in the relevant chapters in this guide.

Network Integration

The gateway must be positioned on the enterprise network so that Internet clients can connect to the gateway and the gateway can connect to all necessary backend servers. Different networking configurations can fulfill this requirement.

One-armed mode on internal network––a single gateway network interface is connected to the internal network and given an IP address on that network. To allow Internet clients to connect to this internal IP address, the gateway hostname is associated with an external (public) IP address in the enterprise DNS services made available to the Internet. The border firewall is then configured to use Network Address Translation

(NAT) to route Internet client connections destined for the gateway external IP address to the gateway internal IP address.

36 Nokia Secure Access System Administrator Guide

Overview of the Nokia Secure Access System

Figure 2 One-Armed Mode on Internal Network

Wired

Client

Home

Internet Cafe

’

Customer Site

Authentication

Servers

Enterprise

Intranet

Web

File

Firewall

Internet

Nokia Secure

Access System

00382

Two-armed mode––one gateway network interface is connected to the internal network and given an IP address on that network. A second interface is connected to a firewall DMZ and configured with an IP address that is accessible to Internet clients. The gateway IP address on the DMZ is the address associated with the gateway hostname in the enterprise DNS. The gateway does not route any packets between these two interfaces.

Figure 3 Two-Armed Mode

Wired

Client

Home

Internet Cafe

’

Customer Site

Authentication

Servers

Enterprise

Intranet

Web

File

Firewall

Internet

DMZ

Nokia Secure

Access System

00381

Nokia Secure Access System Administrator Guide 37

Introducing the Nokia Secure Access System

One-armed mode on DMZ––a single gateway network interface is connected to a firewall DMZ. The IP address assigned to this interface is associated with the gateway hostname in the enterprise DNS. The firewall is configured to allow connections to the gateway from either the Internet or the internal network, as well as connections from the gateway to servers on the internal network.

Figure 4 One-Armed Mode on DMZ

Wired

Client

Home

Customer Site

Internet

Authentication

Servers

Enterprise

Intranet

Web

File

Firewall

DMZ

Nokia Secure

Access System

00383

Regardless of the network configuration, enterprise users can access the gateway from computers on the internal network as well as from computers on the Internet.

Opening Ports on the Border Firewall

When the gateway is configured and ready for access by enterprise users on the Internet, ports should be opened on the border firewall for traffic between the gateway and the Internet. At a minimum, the HTTPS port (443, by default) must be opened. If the gateway secure email proxy is used, additional ports should be opened.

38 Nokia Secure Access System Administrator Guide

Overview of the Nokia Secure Access System

Table 4 Firewall Ports to Open for Gateway Traffic

Protocol

Default port number Description

HTTPS

HTTP

POP over SSL

IMAP over SSL

443

995

993

SMTP (with STARTTLS) 25

POP (with STLS) 110

IMAP (with STARTTLS) 143

Secure communication with Web browsers

(Optional) Redirection of insecure Web requests to secure equivalents. That is, redirect requests for http:// URLs to https:// URLs.

(Optional) Secure email communication with POP clients using designated SSL port

(Optional) Secure email communication with IMAP clients using designated SSL port

(Optional) Secure email communication with SMTP clients supporting STARTTLS

(Optional) Secure email communication with POP clients supporting STARTTLS

(Optional) Secure email communication with IMAP clients supporting STARTTLS

Configuring DNS

The hostname of the IPSO appliance must be specified as the public, fully qualified domain name for the gateway. Additionally, the enterprise DNS should be configured to map the appliance hostname to the desired gateway

IP address (see

“Network Integration” on page 36). These actions are

necessary for proper operation of the Nokia Secure Access System.

Nokia Secure Access System Administrator Guide 39

Introducing the Nokia Secure Access System

Configuring the IPSO Appliance

The Nokia Secure Access System software is installed as a package on the

IPSO appliance. Follow the instructions in Chapter 2, “Installing the Nokia

Secure Access System” to perform initial configuration of the IPSO appliance

and installation of the software package. Typically, this process involves the following general steps:

Use the serial interface to initially configure the appliance, if necessary:

Set the hostname, which must be a fully qualified domain name.

Specify the IP address, netmask, and default gateway address for at least one network interface.

Use Nokia Network Voyager, the IPSO Web-based configuration interface, to configure appliance settings relevant to gateway operation:

Specify DNS servers so that the gateway can resolve names of both internal and external hosts.

Specify the default domain name.

Set the local time on the appliance.

Configure static routes, if necessary.

Installing and Enabling the Gateway Software

After the appliance is initially configured, the Nokia Secure Access System software package must be installed and enabled.

If the nsas-v1.0-<timestamp>.tgz package is not present in /opt/packages, download it from the Nokia support Web site and transfer it to the /opt/ packages directory by FTP (using Voyager or the appliance CLI).

Install and activate the package using either Voyager or the newpkg CLI command.

If the package is already installed on the appliance, it must be activated

(turned on) using the Manage Packages page in Voyager.

40 Nokia Secure Access System Administrator Guide

Overview of the Nokia Secure Access System

Once the package is activated, you might still need to enable the gateway software.

This happens in cases where the Voyager Web server must be moved from port 80 to 8080 or from port 443 to 8443 so that the gateway Web server can use ports 80 and 443. This move occurs when the gateway is enabled by using the Nokia Secure Access System page in Voyager.

After the gateway software is enabled, the administrator can sign on to the gateway and use the gateway Web-based configuration system.

For detailed information about these procedures, see

Chapter 2, “Installing the

Nokia Secure Access System.”

Selecting IP Addresses and Ports

The IPSO appliance that runs the gateway has multiple network interfaces and the gateway software can be configured to accept secure connections on any combination of these interfaces.

The IP addresses for the appliance network interfaces are configured with

Voyager (not using the gateway configuration interface). The same is true for all settings pertaining to routing. The gateway software, however, disables forwarding IP packets between interfaces on the appliance. This ensures that no packet is forwarded between an interface connected to a firewall DMZ and another interface connected to the internal network.

Once the network interface IP addresses are configured with Voyager, the gateway can be configured to listen for connections on the desired interface addresses. The Global Properties > Network > HTTPS Settings page in the gateway configuration system lists the appliance network interfaces and their

IP addresses. The administrator can enable or disable listening for Web connections on each interface with check boxes on that configuration page.

By default, the gateway is set to listen for HTTPS connections on all network interfaces.

Nokia Secure Access System Administrator Guide 41

Introducing the Nokia Secure Access System

If the gateway secure email proxy is used, the administrator must also enable listening for secure email connections on the desired network interface addresses to make email resources available to users. The Email Resources >

Client-side Settings configuration page includes check boxes to specify which network interfaces accept secure email connections. By default, the gateway does not listen for email connections on any network interfaces.

On each of the configuration pages mentioned in this section are settings for the port numbers used for each purpose. The standard ports for each protocol are used initially.

The gateway Web server can listen for nonsecure HTTP connections and redirect all client HTTP requests to their equivalent HTTPS URLs. By default, this redirection is enabled with the default port for HTTP, port 80.

Configuring the Server Certificate

When the gateway package is first installed, a temporary server key pair and certificate is created for the gateway secure Web server to use. This selfsigned certificate is intended for initial gateway configuration only and is not suitable for deployment of the gateway in the enterprise.

Early in the process of configuring the gateway, the administrator should configure a server certificate to be used instead of the temporary certificate created during installation. For testing purposes, the server certificate can be a self-signed certificate that the gateway generates. However, for actual gateway deployment, Nokia strongly recommends that a certificate be obtained from a trusted CA. To achieve this, the administrator can use the

Server Certificates > New Server Cert configuration page to create a request for a certificate that an external CA signs. The certificate request data can be provided to the external CA by email or other means. Once the CA issues the certificate, the certificate data is supplied to the gateway with the Server

Certificates > Add Cert page.

42 Nokia Secure Access System Administrator Guide

Nokia Secure Access System Requirements

Caution

Man-in-the-middle attacks against SSL applications can only be prevented by using a server certificate issued from a trusted CA.

Self-signed certificates or certificates issued from CAs that are not trusted by the browsers of enterprise users are not suitable for gateway deployment because of these potential attacks.

When you create a server certificate, the Common Name field of the subject name should match the hostname that Web clients request. Generally, this means that the Common Name field should be set to the fully qualified domain name of the gateway.

If the server certificate common name does not match the hostname requested by Web browsers, a security warning is displayed by the browser. The user can elect to proceed despite the name mismatch, though this warning message will likely be confusing to users.

Nokia Secure Access System Requirements

This section describes the requirements needed to run the Nokia Secure

Access System.

Supported Operating Systems

The Nokia Secure Access System was tested with the following operating systems:

Microsoft Windows 98, ME, XP, NT, and 2000

Red Hat Linux v7.3 and v8.0

Nokia Secure Access System Administrator Guide 43

Introducing the Nokia Secure Access System

Web Browsers Requirements

The Nokia Secure Access System is compatible with any Web browser platform that supports HTTPS. To access the gateway configuration system, the administrator must JavaScript enabled in their browser. The Sun Java

1.4.1 plug-in is needed for client integrity scanning or port forwarding resources. Use one of the following tested Web browsers:

Microsoft Internet Explorer v5.0 and later

Netscape v6.2 and later

Mozilla v1.0

Supported Email Clients

The Nokia secure email proxy should work with any standards-compliant client that implements the POP3, IMAP4, or SMTP protocols with SSL/TLS.

The following email clients were tested and verified to work with the gateway:

Outlook Express v6.0

Outlook 2000 and Outlook 2002

Lotus Notes v5.0.11 (with port-forwarding)

44 Nokia Secure Access System Administrator Guide

Nokia Secure Access System Configuration Menu

Nokia Secure Access System Configuration

Installing the Nokia Secure

Access System

This chapter describes how to install the Nokia Secure Access System. This system provides authorized users with secure, remote access to enterprise

Intranet servers, such as internal Web servers, Web-based applications, email, and file servers. This system requires no additional software to be installed on client computers because it uses the SSL/TLS features standard in Web browsers.

The Nokia Secure Access System consists of the following main components:

Appliance hardware platform, for example the IP350 or IP380.

IPSO v3.7 operating system running on the appliance, configured by the

Web-based interface, Voyager, or the command-line interface.

Nokia Secure Access System software package; once installed, it is configured by its own Web-based interface.

The combination of these three main components is referred to as a gateway, because that is the logical function it performs.

Installing the gateway involves the following procedures:

Physically connecting the hardware and using a serial interface to perform initial configuration of the appliance, such as setting the hostname, IP addresses, and so forth.

Nokia Secure Access System Administrator Guide 47

Installing the Nokia Secure Access System

Installing the Nokia Secure Access System software package.

Signing on to the gateway as the administrator and configuring the gateway appliance by using the gateway Web-based configuration interface. For configuration details and examples, refer to the appropriate chapters in this guide.

When you configure the gateway application, you define user accounts, create user groups, specify user authentication methods, define resources for backend services and specify the access control policies for these resources.

You can also customize the appearance of the Web pages that remote users see. For example, the enterprise logo can appear on these pages.

Once the gateway is configured, a user can access the gateway by entering the

URL of the sign-on page (for example, https://gateway.example.com) with any SSL/TLS-capable Web browser. The gateway authenticates the user by the methods that the administrator configured, using either a username and password or a digital certificate from the user’s Web browser. After they sign on, the user sees a portal page that shows links to resources that the administrator configured. The user’s portal also keeps track of the user’s favorite links as well as the user’s preferences; for example, whether or not the gateway should store the user’s passwords for backend Web, file, and email servers.

Users can also access email through their Web browser by using a Web mail system such as Outlook Web Access running on an Intranet server, or by using standards-compliant email applications such as Outlook Express,

Netscape Navigator, or Eudora. In the latter case, email is securely transferred by using the gateway secure email proxy. This proxy communicates with the email client with SSL/TLS-protected connections and forwards connections to specified backend mail servers upon successful authentication.

The remainder of this chapter describes how to install the Nokia Secure

Access System.

48 Nokia Secure Access System Administrator Guide

Installing the Nokia Secure Access System Gateway

Installing the Nokia Secure Access System

Gateway

This section describes how to install the Nokia Secure Access gateway, including:

Before You Start

Installing the Hardware

Installing the Package by Using Voyager

Signing On to the Gateway

Before You Start

This section provides information to help you plan your deployment and collect the information you need during the installation.

Installation Worksheet

Use the following worksheet to enter the information you need to install and configure the Nokia Secure Access gateway.

Description

Hostname

Use a fully-qualified domain name.

For example, gateway.example.com

Your Settings

IP address

Netmask

Nokia Secure Access System Administrator Guide 49

Installing the Nokia Secure Access System

Description

Default gateway address

(i.e., next hop)

License file

If you do not have a license file, contact your Nokia sales representative or visit the License

Center at: https://support.nokia.com/license

Your Settings

Installing the Hardware

For information about how to physically connect your device to the network, refer to the documentation for your specific device. For example, if you are installing an IP350 or IP380, see the installation guide for your appliance.

Configuring the Appliance

Note

If your appliance was preconfigured, skip this section and continue to

“Signing On to the Gateway” on page 56.

To configure initial settings by using the serial interface, see the installation guide for your appliance. That process includes configuring the following settings:

Hostname of the appliance. Use a fully qualified domain name, such as

gateway.example.com.

Initial password for the administrator account. Username is admin.

IP address and netmask bit length for at least one network interface

Default route address

50 Nokia Secure Access System Administrator Guide

Installing the Nokia Secure Access System Gateway

After you complete the initial configuration, you can access the Voyager configuration tool for the appliance by using your Web browser. To verify this, enter the URL of the appliance into your Web browser, using either the appliance IP address or hostname (for example, http://gateway.example.com).

When prompted, authenticate to Voyager with the username admin and the password you specified during the initial configuration.

For the Nokia Secure Access System to function properly, configure the following appliance settings in Voyager:

Set the local time so that time stamps on logging messages are accurate.

Set the default domain suffix such as example.com.

Specify a valid DNS server so that the gateway can resolve hostnames.

The gateway Network Information System (NIS) client also needs DNS.

Installing the Package by Using Voyager

Note

If your system is preconfigured for use with the Nokia Secure Access

System, skip this section and continue to “Signing On to the Gateway” on page 56.

The Nokia Secure Access System package is a software distribution for the

IPSO 3.7 operating system. This package might not be preinstalled on the

IPSO appliance; in this case, you must install the package according to the following instructions. After the package is installed and activated, you can sign on to the gateway from your Web browser to access the gateway configuration interface.

Note

You must deactivate any active firewall and VPN packages before you install the Nokia Secure Access System package.

Nokia Secure Access System Administrator Guide 51

Installing the Nokia Secure Access System

Note

The Nokia Secure Access System requires that you have IPSO v3.7 installed on your appliance. If your appliance is running an earlier version of IPSO, upgrade to IPSO v3.7 by obtaining the IPSO v3.7 installation file from http://support.nokia.com and installing it using Voyager.

To determine if the Nokia Secure Access System is already installed on your appliance

From the Voyager main page, select System Configuration.

From the Voyager Configuration page, select Manage Installed Packages.

The Manage Packages page opens.

If the list of installed packages does not include a package named Nokia

Secure Access System, install the package.

See “To install the Nokia Secure Access System package.”

Nokia Secure Access System Administrator Guide

Installing the Nokia Secure Access System Gateway

If the list of the installed packages does include a package named Nokia

Secure Access System:

If the button for that package is set to Off, activate the package by clicking On.

Click Apply.

The Nokia Secure Access System package is installed and activated.

Continue to “Enabling the Nokia Secure Access System” on page 55.

To install the Nokia Secure Access System package

From the Voyager main page, select System Configuration.

From the Voyager Configuration page, select Manage Installed Packages.

The Manage Packages page opens.

From the Manage Packages page, select FTP and Install Packages.

The FTP Packages page opens.

Nokia Secure Access System Administrator Guide 53

Installing the Nokia Secure Access System

Select the gateway package to unpack.

Under Select a package to unpack, select opt/packages/nsas-v1.0-

<timestamp>.tgz. If this option is not present in the list, see

“Obtaining the Nokia Secure Access System Package” on page 285.

Click Apply to unpack the package.

Note

The package is first unpacked to the /opt/tmp directory.

This operation can take several seconds to complete. When the package is successfully unpacked, the Package Installation and Upgrade page refreshes and displays the package name, class, version, and description.

On some platforms, you might see the message “Timeout waiting for response from database server” when completing this step. If this occurs, click Up to return to the Manage Packages page, then select FTP and

Install Packages. The link to install and upgrade the package will be visible on the FTP Packages page.

To go to the page to install the unpacked package, click the following link:

Click here to install/upgrade /opt/packages/nsas-v1.0-<timestamp>.tgz

The Package Installation and Upgrade page opens.

Click Install Yes.

Make sure Upgrade is set to No.

Click Apply to install the package.

The screen refreshes and indicates the operation was successful.

To go to the page to enable the package, click the following link:

Click HERE to finish the initial configuration

The Nokia Secure Access page opens. To enable the newly installed package, continue to

“Enabling the Nokia Secure Access System” on page 55.

54 Nokia Secure Access System Administrator Guide

Installing the Nokia Secure Access System Gateway

Enabling the Nokia Secure Access System

If you are not already on the Nokia Secure Access page (by following the link after you install the package), access this page from the Voyager main page.

To enable the Nokia Secure Access System

From the Voyager main page, select Security and Access Configuration.

The Voyager Configuration page opens.

From the Configuration page, select Nokia Secure Access System.

The Nokia Secure Access System page opens.

Note

The Nokia Secure Access System displays the status of the gateway application. The status is disabled when the Voyager Web server is using port 80 or port 443. In this case, enabling the Nokia Secure

Access System gateway includes automatically changing the

Voyager Web server to use either port 8080 instead of port 80 or port

8443 instead of port 443. The latter occurs when the Voyager Web server is configured to use SSL.

If the status on this page shows as disabled, continue to the following steps to enable the Nokia Secure Access System.

Nokia Secure Access System Administrator Guide 55

Installing the Nokia Secure Access System

Click the following link:

Click here to initialize NSAS

The resulting page advances you to the Voyager Web server on the new port, which is either 8080 or 8443.

If necessary, log in to Voyager again using the username admin and the same administrator password as before.

The Nokia Secure Access System page now shows that the status is enabled. You can now sign on to the gateway.

Signing On to the Gateway

When the gateway package is installed, activated, and the gateway status enabled, you can sign on to the gateway by entering the gateway URL into your Web browser, or, from Voyager, you can access the gateway sign-on page by using the link on the Nokia Secure Access System page.

To access the gateway by entering the URL

Enter the URL into your Web browser.

The URL for the gateway configuration is the gateway hostname or IP address preceded with https:// and ending with get/config. For example:

https://gateway.example.com/get/config

After you successfully sign on to the gateway, the Sign-On page is displayed for the admin user.

To sign on to the gateway and access the gateway configuration system, continue to “To authenticate at the Sign-On page” on page 58.

56 Nokia Secure Access System Administrator Guide

Installing the Nokia Secure Access System Gateway

To sign on to the gateway from Voyager

From the Voyager main page, click Security and Access Configuration.

The Configuration page opens.

Note

If Nokia Secure Access System does not appear in the links under the Security and Access Configuration heading, the package is not installed and activated. See

“Installing the Package by Using

Voyager” on page 51.

Click Nokia Secure Access System.

The Nokia Secure Access System page opens.

Nokia Secure Access System Administrator Guide 57

Installing the Nokia Secure Access System

Click the following link:

Click here to sign onto NSAS

This link points to the gateway configuration system. You are taken directly to the gateway configuration system after you sign on to the gateway, instead of seeing the portal page after you sign on.

To authenticate at the Sign-On page

Enter username admin in the Username text box.

At the gateway Sign-On page, authenticate to the gateway as the administrator.

Enter the administrator password in the Password text box.

As an administrator, you can sign on using the username admin and the same password you used to access Voyager or the IPSO CLI.

Click Sign On.

Note

You can sign on by using a certificate only after you configure the gateway for certificate authentication.

Nokia Secure Access System Administrator Guide

Installing the Nokia Secure Access System Gateway

The Nokia Secure Access System configuration page opens.

From the Nokia Secure Access System configuration pages, you can configure the gateway using the procedures described in this guide. For example steps including configuring a user, configuring a group, adding a user to a group, configuring a Web resource, or specifying user portal settings, see the Nokia Secure Access System Getting Started Guide.

Note

Upon initial installation of the Nokia Secure Access System, no license file is present on the gateway. To configure the license, see

“Configuring the License” on page 78

Nokia Secure Access System Administrator Guide 59

Installing the Nokia Secure Access System

60 Nokia Secure Access System Administrator Guide

Configuring General Gateway

Settings

This chapter describes how to configure general settings for the Nokia Secure

Access gateway, including:

Viewing Gateway Status

Using Gateway Logging

Exporting and Importing the Gateway Configuration File

Configuring the License

Viewing Gateway Status

When you first sign on to the gateway, the portal page opens. From this page, you can access the configuration pages to view general status information or detailed information about the gateway.

Nokia Secure Access System Administrator Guide 61

Configuring General Gateway Settings

To view gateway status

From the main portal page, choose Configuration System.

The Gateway Status Overview page opens.

The Status Overview page contains a summary of the gateway status including software version, uptime, number of users signed on, percentages for log and application disk use, the SSL Server Certificate

ID, and license information.

To view the current certificate information, click the SSL Server

Certificate ID link.

The Server Certificate Details page opens. The Server Certificates

Details page contains detailed information about the certificate. You can also access tabs for generating a new certificate, adding a server certificate, and importing a server certificate. See

“Configuring

Certificates” on page 115.

Nokia Secure Access System Administrator Guide

Using Gateway Logging

To view the license file, click the License link (for instance, devel.lic

The Configure License page opens. From the Configure License page you can view the current license or upload a new license. See

“Configuring the License” on page 78.

To view detailed gateway information, click the Details tab.

The Gateway Status Details page opens. The Gateway Status Details page contains complete information about users, user status, memory usage, disk usage, and system information.

Using Gateway Logging

The gateway logging system allows you to configure a variety of options for enabling different amounts of logging information for particular users, resources, authentication methods, and gateway components. The gateway logging messages are stored on the appliance in log files that only the gateway application uses. The logging messages can also be sent to the syslog daemon that runs on the gateway appliance, which can be configured to send its logging messages to a remote server.

The two types of logging produced by the gateway are:

General Gateway Logging—provides general information about gateway activity, including debug messages used to troubleshoot problems.

Audit Logging—contains information about user events, such as user sign on, sign off, authentication failures, and resource accesses.

To view entries in the gateway log and audit log, you can use the View

Gateway Log and View Audit Log pages. From these pages, you can specify query strings, usernames, resource names, and so forth when you search for relevant entries in each log.

Nokia Secure Access System Administrator Guide 63

Configuring General Gateway Settings

General Gateway Logging

General gateway logging messages are produced by many subsystems within the gateway software during the course of gateway operation. Some logging messages occur when authenticating users, while others occur while handling user resource requests or during gateway startup, and so on.

Each general gateway logging message has a gateway component and a severity level associated with it. The component identifies the gateway subsystem that produces the logging message; for example, the

Authentication – LDAP component generates logging messages whenever an

LDAP authentication method is used during user sign on. The logging message severity level indicates the severity of the message, following the

same basic scheme as the severity levels that the syslog uses. Table 6 lists the

severity levels that the gateway uses.

Table 6 Severity Levels for General Gateway Logging Messages

Gateway log level

Description Corresponding syslog level

Emergency

Error

Warning

Notice

Debug-Low

Debug-High

Indicates a critical failure that demands immediate attention.

Indicates a problem or misconfiguration, though the gateway operation can still proceed.

LOG_EMERG

LOG_ERR

Warning conditions exist. Might indicate a potential problem, though gateway operation can still proceed.

Normal, but significant, conditions exist.

LOG_WARNING

LOG_NOTICE

LOG_DEBUG Debug message intended for help in debugging or diagnosing a problem.

Verbose debug message intended for use in debugging or diagnosing a problem with Nokia support.

LOG_DEBUG

64 Nokia Secure Access System Administrator Guide

Using Gateway Logging

You can configure the gateway to send all general gateway logging messages at or above a specified severity level to the syslog daemon running on the appliance. When a log message is sent to the syslog daemon, the gateway uses

the syslog severity level shown in the third column of Table 6 . Note that both

levels for gateway logging messages are sent at the LOG_DEBUG level that syslog recognizes.

All general gateway logging messages are stored in the gateway log file, /var/ log/nsas_log. The debug logging messages are also stored in the log file if debug logging is enabled for a particular user, resource, authentication method, or gateway component.

You can enable debug logging for a particular user, resource, or authentication method by checking the Enable debug logging check box on the General properties tab for the user, resource, or authentication method. When debug logging is enabled in this way, all logging messages at the Debug-Low level are stored for any gateway component involved in activity related to the user, resource, or authentication method in question. This record can be useful for investigating problems that a particular user experiences or problems related to the operation of a particular resource or authentication method.

You can also enable debug logging for one or more specific gateway components. To do so, set the desired Component Debug Logging levels to

Debug-Low or Debug-High on the General > Logging > Settings page. This log can be useful for investigating problems that are specific to particular gateway functions (for example, authenticating with client certificates) but independent of the gateway user, resource, or authentication method.

Nokia Secure Access System Administrator Guide 65

Configuring General Gateway Settings

Audit Logging

Audit logging messages are produced when particular events occur because of user activity. For most audit events, you can enable the logging of each event for particular users and particular resources. The gateway supports the following audit events:

User sign on

Inactivity time-out in user session

Sign off or session expiration after inactivity time-out

The preceding three events are logged when audit logging is enabled for the user in question. These events occur when the user accesses the gateway through either the gateway Web interface or the secure email proxy.

Resource request allowed

Resource request denied

The preceding two events are logged when either audit logging is enabled for the requested resource or when audit logging is enabled for the user who makes the request. These events occur when a user accesses Web, file, or portforwarding resources through the gateway Web interface as well as when the user accesses email servers for requested email resources that the secure email proxy handles.

User authentication failure

Access attempt (HTTP request)

The preceding two events are always logged, regardless of the user or HTTP request.

Gateway audit logging messages are stored in the file /var/log/nsas_audit. You can configure the gateway to also send audit logging messages to the syslog daemon running on the appliance. In this case, you must specify the syslog severity level at which the audit logging messages are sent to syslog.

66 Nokia Secure Access System Administrator Guide

Using Gateway Logging

Configuring the Gateway Log Settings

Use the Settings page to configure general log settings and debug levels for individual modules.

To configure general log settings

From the configuration menu, choose General > Logging.

The View Gateway Log page opens.

Click the Settings tab.

The Configure Log Settings page opens.

Nokia Secure Access System Administrator Guide 67

Configuring General Gateway Settings

Specify the General Logging Configuration settings.

You can enable or disable the following:

Send logging messages to syslog in addition to gateway log file.

Send audit messages to syslog in addition to audit log file.

Include time stamp for each log message sent to syslog.

Nokia Secure Access System Administrator Guide

Using Gateway Logging

Choose a component and select one of the following options to specify the amount of debug logging for that component:

No debug logging

Log all messages at severity level DEBUG-Low or higher

Log all messages at severity level DEBUG-High or higher

Note

When debug logging is enabled for a particular user, resource, or authentication method, the gateway stores all logging messages at the Debug-Low level generated by any gateway component involved in activity for the particular user, resource, or authentication method.

Click Save Settings.

Note

To set the log settings back to their default values, click Set All to

None.

Viewing the Gateway Log

Use the View Gateway Log page to search and display gateway logging messages. You can filter the logging messages by limiting the displayed messages to those pertaining to a particular username, resource, authentication method, or gateway component. You can also specify the minimum severity level for messages, as well as an optional query string used to further limit the displayed log messages.

Nokia Secure Access System Administrator Guide 69

Configuring General Gateway Settings

Note

When searching the gateway log, all specified filter options are joined with the AND operator, rather than the OR operator. For example, if you specify both a username and a gateway component, the logging messages displayed are only those that the specified component produces when servicing the specified user.

To view the gateway log

From the configuration menu, choose General > Logging.

The View Gateway Log page opens.

Select a minimum severity level from the Minimum Log Level list box.

Logging messages with severity levels at or above the selected level are displayed on the results page.

Nokia Secure Access System Administrator Guide

Using Gateway Logging

If desired, filter the displayed logging messages by selecting a gateway component.

Only logging messages produced by the selected component are displayed.

If desired, filter the displayed logging messages by specifying a username, resource name, or authentication method name.

If these strings are specified, only logging messages pertaining to the user, resource and authentication method are displayed.

Specify a search pattern, if desired.

If the search pattern is specified, only logging messages containing the specified string are displayed. To make the string comparison case sensitive, check the Case Sensitive box.

Specify the Time Range for the logging messages.

Select Do not limit output by time stamp to see all relevant messages regardless of the time they were logged.

To limit the displayed messages to that those occur during a range of dates, enter the month, date, and year in the mm/dd/yy fields, or click the ellipses (...) to insert a date from the popup calendar.

To limit the displayed messages to those that occur within a particular time range from the current time, select the bottom option and specify the time range by typing the number and selecting the time units.

Specify the log files to search.

Once a day, the appliance rotates the gateway log files if the size of the current /var/log/nsas_log file exceeds 5 MB. When rotating the log files, the gateway compresses the files and keeps the nine most recent compressed log files as archives.

Nokia Secure Access System Administrator Guide 71

Configuring General Gateway Settings

By default, the gateway only examines the current log file for logging messages. To specify that archived log files also be examined, check the

Include archived logs check box under File Selection. You can also specify the number of archived log files to examine by using the dropdown list below that check box. Up to nine archived log files can be examined.

Specify the Output settings.

Enter the maximum number of lines per block. When messages are generated, they are displayed and grouped into text blocks. The default block size is 100 lines per block.

To allow unlimited message output, click Don’t limit output size.

Click Go to perform the search.

The gateway displays logging messages that match the specified criteria.

Note

To set the logging values back to the default settings, click Reset.

Viewing the Audit Log

Use the View Audit Log page to search and display audit logging messages.

You can filter the audit log messages by limiting the displayed messages to those pertaining to a particular username or resource. You can also select audit event types and specify an optional query string used to further limit the displayed audit log messages.

Note

When searching the audit log, all specified filter options are joined with the AND operator, rather than the OR operator. For example, if you specify both a username and a search pattern, the audit logging

72 Nokia Secure Access System Administrator Guide

Viewing the Audit Log

messages displayed are only those that concern the specified user and contain the specified search string.

To view the audit log

From the configuration menu, choose General > Logging.

The View Gateway Log page opens.

Click the View Audit Log tab.

The View Audit Log page opens.

Enter the username or resource name in the appropriate text box.

Check the audit event check boxes for events.

Nokia Secure Access System Administrator Guide 73

Configuring General Gateway Settings

Specify a search pattern, if desired.

If the search pattern is specified, only audit log messages containing the specified string are displayed. To make the string comparison case sensitive, check Case Sensitive.

Specify the time range for the logging messages.

Select Do not limit output by time stamp to see all relevant audit log messages regardless of the time they were logged.

To limit the displayed audit log messages to those occurring during a range of dates, enter the month, date, and year in the mm/dd/yy fields, or click the elipses (...) to insert a date from the popup calendar.

To limit the displayed audit log messages to those that occur within a particular time range from the current time, select the bottom option and specify the time range by typing a number and selecting the time units.

Specify the log files to search.

Once a day, the appliance rotates the gateway audit log files if the size of the current /var/log/nsas_audit file exceeds 5 MB. When rotating the audit log files, the gateway compresses the files and keeps the nine most recent compressed audit log files as archives.

By default, the gateway only examines the current audit log file for audit messages. To specify that archived audit log files also be examined, check the Include archived logs check box under File Selection. You can also specify the number of archived audit log files to examine by using the drop-down list below that check box. Up to nine archived audit log files can be examined.

Specify Output.

Enter the maximum number of lines per block. When messages are generated, they are displayed and grouped into text blocks. The default block size is 100 lines per block.

To allow unlimited output of messages, click Don’t limit output size.

74 Nokia Secure Access System Administrator Guide

Exporting and Importing the Gateway Configuration File

Click Go to perform the search.

The gateway displays audit logging messages that match the specified criteria.

Note

To set the audit log query settings back to their defaults, click Reset.

Exporting and Importing the Gateway

Configuration File

Use the Config Export/Import pages to save the current gateway configuration externally and import it to the gateway at a later time. The configuration is downloaded to your browser as a single text file and includes the contents of the gateway configuration database.

The configuration database contains:

All defined resources.

All defined users and user groups.

Nokia Secure Access gateway key pairs and certificates.

User local passwords and certificates.

User passwords and cookies for backend servers.

The gateway key pairs, user passwords, and cookies are stored in an encrypted form in the configuration file.

Exporting and saving the gateway configuration can be a useful way to quickly back up the state of the gateway before you make major configuration changes. It provides the administrator with an easy means to return to a particular configuration state.

You can also use configuration export and import to migrate the gateway configuration from one appliance to another, in cases such as hardware upgrade. When you import the configuration on the new appliance, you might

Nokia Secure Access System Administrator Guide 75

Configuring General Gateway Settings

want to enable the check box that causes the gateway to ignore the devicespecific network interface information, since the new appliance might have different interfaces with different IP addresses.

Note

The Config file only saves the gateway configuration information.

What is not saved:

The current set of locked-out users (from the auth failure lockout)

The active user session information. For example, if the user is signed on when the Config Export happens, that same user is not considered as signed on after the config file is imported.

System settings that Voyager manages, including IP addresses for network interfaces.

To export the gateway configuration to a file

From the main menu, choose General > Config Export/Import.

The Export Gateway Config page opens.

76 Nokia Secure Access System Administrator Guide

Exporting and Importing the Gateway Configuration File

Click Export Configuration.

You can open and view the file from its current location or save the file to disk. The file is saved as a .htm file. Except when using Internet Explorer v5.5 or Mozilla v1.3, the default file name is export.txt.

Click OK to export the file.

To import the gateway configuration file

On the Config Export/Import page, click the Import tab.

The Import Gateway Configuration page opens.

Enter the gateway configuration filename or click Browse to locate the file.

Nokia Secure Access System Administrator Guide 77

Configuring General Gateway Settings

To omit information that pertains to a specific device, check Don’t import device-specific interface information.

Caution

Importing the configuration file overwrites your current gateway configuration. Nokia recommends that you back up your current configuration by using Config Export before you proceed.

Click Import Configuration.

The file is uploaded to the gateway.

An MD5 hash is generated when the file is created by using export. The

MD5 hash is checked when the file is imported to ensure it has not been modified or corrupted.

Note

The gateway configuration is automatically backed up whenever a system backup is performed on your appliance. You can back up and restore gateway configuration files by using the Voyager interface. See the Nokia

Network Voyager Reference Guide.

Configuring the License

Use the Configure License page to configure the license for the gateway, including uploading a new license or viewing the current license. Upon initial installation of the Nokia Secure Access System, no license file is present on the gateway.

To manage the server license

From the configuration menu, choose General > License.

The Configure License page opens.

78 Nokia Secure Access System Administrator Guide

Configuring the License

Note

If you do not have a license file, contact your Nokia sales representative or visit the License Center either at: https://support.nokia.com/license or choose a link from the

Configure License page.

The current license information is displayed, including the host identifier, license file name, and features of the license.

To view the current license information, click the License File link.

The File Download dialog box opens and prompts you to open or save the license file.

To upload a new license, enter the file name in the File Name text box, or click Browse to locate the file.

Nokia Secure Access System Administrator Guide 79

Configuring General Gateway Settings

Click Upload New License.

The license is uploaded to the gateway and the Configure License page refreshes.

The license Feature details show the number of simultaneous users that the gateway supports, the expiration time of the license, and the license status. The license status is authenticated when the license is valid for the appliance, as identified by the Host Identifier.

80 Nokia Secure Access System Administrator Guide

Configuring Global Properties

This chapter describes how to configure global properties for the gateway, including:

Configuring Network Settings

Customizing the Appearance of the User Interface

Configuring Global Access Control Settings

Configuring SNMP

Using Variables

Using Client Integrity Scanning

Configuring Network Settings

This section describes how to configure network settings for the gateway, including HTTP settings and Microsoft Windows Networking settings.

Note

For information about how to configure system interfaces, see the Nokia

Network Voyager Reference Guide.

Nokia Secure Access System Administrator Guide 81

Configuring Global Properties

Configuring HTTPS Settings

Hypertext Transfer Protocol over Secure Socket Layer, or HTTP over SSL

(HTTPS) is a Web protocol that encrypts and decrypts user page requests and pages that the Web server returns. HTTPS is the main port that the client computer uses to contact the Nokia Secure Access System on the Web interface.

When the gateway initially starts up, it listens on the TCP socket for connections from the client computer. By default, it listens to the standard

HTTPS port, 443, and redirects requests from the standard HTTP port, 80, to

443 on all interfaces.

Use the HTTPS settings page to specify HTTPS listening addresses, port settings, and settings for SSL support.

To configure HTTPS settings

From the configuration menu, choose Global Properties > Network.

The HTTPS Settings page opens.

82 Nokia Secure Access System Administrator Guide

Configuring Network Settings

Specify the interfaces on which to listen for HTTPS connections.

By default, all interfaces are checked. The gateway responds to requests from any addresses that are checked.

To disable an address, uncheck the box next to the address to disable.

Note

The gateway always listens for connections on the loopback interface

127.0.0.1. This cannot be disabled.

Specify the port settings.

The gateway listens for incoming SSL Web requests on port 443 by default. Edit this value to have the gateway listen on a different port.

The gateway can redirect ASCII text (non-SSL) Web requests to the secure port, if desired. This is most useful on port 80, where Web requests arrive by default. Specify the port from which to redirect.

Requests are redirected to the secure port you specified.

The redirect setting is useful because it allows the gateway to handle a plaintext request (perhaps accidental, for example the user forgot to add https:// to the URL, and entered nsas.company.com) by redirecting it to the correct place, the secure port. This option should always be enabled.

Specify the SSL settings.

The SSL protocol allows the client and the gateway to authenticate to each other and to establish a secure encrypted connection:

To enable support for the SSL protocol version 2, click Enable SSLv2 support.

To specify SSL encryption strength, select an encryption strength from the drop-down list.

Encryption strength refers to the size of the keys that perform the encryption and is measured in bits. The default setting is set for high

(128 bits or higher), which provides maximum security. Select a low

Nokia Secure Access System Administrator Guide 83

Configuring Global Properties

encryption strength (40, 56, or 64 bit), if the users are allowed to access the gateway using browsers with export-strength encryption.

Click Save Settings.

Note

After you save the HTTPS settings, the system automatically restarts and all users must sign on to the gateway again.

Configuring Windows Networking

You use WINS servers to resolve NetBIOS names for Windows file servers to their corresponding IP addresses.

The gateway must use this type of name resolution to browse the Intranet for

Windows file shares. The gateway does not display the Open Windows File

Share text box in the browse area of the user’s portal unless a WINS server is configured and the user in question is allowed to see this text box. For information about this text box, see the portal properties page for Users and

User Groups.

When the gateway browses the network for Windows file shares, it broadcasts the Windows workgroup of the remote client. The Default Windows

Workgroup setting specifies this workgroup and ensures that the file shares for the desired domain or workgroup are seen when the user is browsing the network.

Note

The gateway uses the default Windows workgroup only when browsing the network for Windows file shares. The gateway does not need it to connect to a particular Windows file share specified as a Windows file resource.

84 Nokia Secure Access System Administrator Guide

Configuring Network Settings

To configure WINS servers for Windows Networking

From the configuration menu, choose Global Properties > Network.

The HTTPS Settings page opens.

Click the Windows Networking tab.

The Microsoft Windows Networking page opens.

Check Enable WINS name resolution.

Enter the IP address of the WINS server.

Enter the name of the Default Windows Workgroup (optional).

Click Save Settings.

The new WINS server is added to the configuration.

Nokia Secure Access System Administrator Guide 85

Configuring Global Properties

Customizing the Appearance of the User

Interface

Use the Appearance pages to customize the appearance of the gateway signon page, user-portal page, and configuration pages. The Appearance page allows you to:

Change or specify a custom logo.

Personalize the welcome message for the user portal.

Specify the error message that appears if password or certificate authentication fails.

To customize the appearance of the user interface

From the configuration menu, choose Global Properties > Appearance.

The Configure User Portal Appearance page opens.

86 Nokia Secure Access System Administrator Guide

Configuring Global Access Control Settings

Configure the logo that appears on the user portal.

This image appears on the gateway Sign-On page and user portal pages.

To upload a new image file, check Upload a new image. Enter the filename to upload or click Browse to locate the file. Recommended file types are .jpg, .gif, and .png. File sizes up to 64 K are supported.

To delete the current image, check Delete current image, then click

Save Settings.

Configure the text that appears on the user portal.

You can configure the following:

Banner message

Error message when password authentication fails

Error message when certificate authentication fails

Click Save Settings.

Configuring Global Access Control Settings

This section describes how to configure global access control settings for gateway resources, including:

Configuring Global Rules

Configuring Sign-On Page Rules

Configuring Access Control Settings

Viewing Access Control Rules

Use the Global Access Control pages to configure access control settings for gateway resources, lock-out times for user and client authentication, restriction parameters for group membership, and access control lists (ACLs) for the gateway Sign On page.

Nokia Secure Access System Administrator Guide 87

Configuring Global Properties

Configuring Global Rules

Use the Configure Global Rules page to configure global access rules for gateway resources.

Global rules simplify management of access control polices by allowing you to create rules on a global basis rather than creating individual rules. The global rules take precedence over individual resource rules and are checked for every resource request.

The global ACL is always consulted for every request. If the global ACL result is ALLOW, the request is allowed and the ACL on the requested resource is not consulted. Similarly, if the global ACL result is DENY, the request is denied and the ACL on the request resource is not consulted.

Only in the case that the global ACL returns a DEFER result is the ACL for the requested resource consulted. Initially, the default action in the global

ACL is DEFER.

You can use the global ACL for a number of different purposes:

To configure specific exceptions to group-based access control by using the simple access control pages.

To enforce a rule that the administrator wants enforced globally, without having to add it to each individual resource.

For all access control on the gateway, for instance, if the administrator does not want to use the resource access control pages at all, but instead wants to configure all access control rules in a single place.

If the global ACL is not used, it always defers to resource ACLs.

For administrators who prefer to work with one large list of access control rules, the global ACL default action can be set to something other than

DEFER, and each rule can be specified by using the global ACL pages. If no

DEFER actions are returned, the resource ACLs are ignored.

88 Nokia Secure Access System Administrator Guide

Configuring Global Access Control Settings

To configure global rules

From the configuration menu, choose Global Properties > Access

Control.

The Configure Global Rules page opens.

The Configure Global Rules page lists the global rules for all resources currently defined on the gateway. The default setting and action for all global rules is DEFER. When a resource is requested, the global rules are processed in order. If any of the rules are satisfied, the specific action is taken. If the action is DEFER, the access control rules for the specific resource is consulted. If none of the specific global rules are satisfied, the default action is taken.

Note

To view or edit an existing rule, click the rule in the global rule list box.

Nokia Secure Access System Administrator Guide 89

Configuring Global Properties

Click Add Rule

The New Global Rule page opens.

From the New Global Rules page you can add a global rule for a resource.You can apply one of the following actions to the rule:

Deny

— deny access to the resource if the rule is satisfied.

Allow

— allow access to the resource if the rule is satisfied.

Defer

— use the access control policy configured for the requested resource.

Note

Global rules take precedence over resource ACLs. When a resource is accessed, the global rules are consulted before ACLs for the given resource.

Select a resource from the Resource drop-down list.

Select an action to apply to the resource.

The default action is DEFER.

You can also configure complex global rules or manually enter a rule.

Complex rules consist of one or more ordered rules that specify all conditions under which access to a resource is denied or allowed.

Nokia Secure Access System Administrator Guide

Configuring Global Access Control Settings

To create a complex rule, see

“Configuring Complex Access Control

Rules” on page 272.

To manually enter a rule, see

“Entering a Rule Manually” on page 276.

Click Save New Rule.

The New Rule is added to the Configure Global Rules list box.

Note

To view the rule list at any time, click Return to rule list.

Configuring Sign-On Page Rules

Use the Configure Rules for Sign-On page to configure ACLs for the gateway

Sign-On page. The Sign-On ACL is configured the same way that Resource

ACLs are specified using the Access Control – Advanced pages. See

“Configuring Advanced Access Control Rules” on page 268. However, unlike

resource ACLs, the set of variables that are used have additional constraints.

The user’s identity, group membership, and authentication method are not known before the user signs on.

Sign-on rules (or the sign-on ACL) control access to the sign-on screen. When a user fails the sign-on ACL, a message is returned to the user informing them that their connection is denied. That user does not see the sign-page and so is prevented from entering their username and password. See

“Sign-On Rules” on page 35.

Sign-on rules are useful for two reasons:

If the administrator wants to prevent users from entering their username and password in known insecure environments, they can configure the sign-on ACL so that it returns DENY if the user’s IP address is contained in the known insecure network.

If the administrator configures client integrity scanning to occur before sign on, they might write a rule in the sign-on ACL to return DENY if a certain test in the client integrity scan fails.

Nokia Secure Access System Administrator Guide 91

Configuring Global Properties

To configure sign-on page ACLs

From the configuration menu, choose Global Properties > Access

Control.

The Configure Global Rules page opens.

Click the Sign-On Page tab.

The Configure Rules for Sign-On Page opens.

The Configure Rules for Sign-On Page Access page lists all the sign-on rules currently defined on the gateway.

Note

To view an existing rule, click the rule from the list. To disable or delete a rule, check the box, then click Save Settings.

Specify the default action for the new sign-on rule.

The action specifies if user access is allowed or denied. The default action is allow.

Nokia Secure Access System Administrator Guide

Configuring Global Access Control Settings

Click Add Rule.

The New Rule for Sign-On page Access page opens.

From the New Rule for Sign-On Access page you can configure advanced sign-on rules for users who are signing on to the gateway.

For information about how to configuring advanced access control rules, including creating complex rules and manually entering a rule, see

Chapter 13, “Configuring Access Control Rules.”

Configuring Access Control Settings

Use the Configure Access Control page to configure the following settings:

The initial default action for ACLs

Lock-out times for user and client authentication

Restriction parameters for group membership

Note

For information about admin lockout and the admin_unlock script, see

Appendix A, “Using the admin_unlock Script.”

Nokia Secure Access System Administrator Guide 93

Configuring Global Properties

To configure access control settings

From the configuration menu, choose Global Properties > Access

Control.

The Configure Global Rules page opens.

Click the Settings tab.

The Configure Access Control page opens.

Specify the initial default action for resource access control from the drop-down list.

When a new resource is created, the default action for the resource access control policy is initially obtained from this setting.

The initial default action setting is Deny.

Specify the Authentication Failure Lockout settings.

Lockouts prevent attackers from trying an excessive number of passwords. The goal of lockouts is to prevent real attacks while still giving the user room to forget. The administrator can configure the criteria for locking out a user by setting how many failures are allowed in a specified amount of time.

Nokia Secure Access System Administrator Guide

Configuring Global Access Control Settings

When a user is locked out, they cannot sign on successfully, even with the correct password. If the unlock after x minutes setting is enabled, the user is automatically unlocked after the number of minutes specified. If the number of minutes is not specified, the user is locked out indefinitely until the administrator manually unlocks them.

If the lock out client IP address as well setting is enabled, when the user gets locked out, the gateway refuses all requests from the IP address the user was using, until the lockout expires or is manually cleared.

Note

All lockouts are cleared if the gateway is rebooted.

Use the lockout settings to deny gateway access when multiple authentication failures occur and to protect the gateway against passwordguessing attacks. Check the box to enable the following:

Lock out users when multiple authentication attempts fail. To show the lockout values, click Show Lockouts.

Lock out users by IP address.

Unlock the lock out settings.

Note

When you specify multiple authentication lockout or unlock settings, you must also enter a time in minutes.

Select restriction settings for multiple group membership.

This setting applies to the calculation of a user’s session parameters when they sign on for a new session. The setting only applies if the user is configured to get their session settings from all of their user groups (the

Use settings as determined by User Groups option on the user’s Session tab.)

When a user gets their session settings from all of their user groups, those groups might each have different settings. This setting gives the

Nokia Secure Access System Administrator Guide 95

Configuring Global Properties

administrator the choice of whether to apply the most restrictive settings or the least restrictive settings.

For example, if one user group has a session inactivity time out of

10 minutes, and a second user group has an inactivity time out of 20 minutes, when a user signs on who is configured to get session settings from all of their user groups, and they belong to both groups, the least restrictive setting chooses the 20 minute value, whereas the most restrictive setting chooses the 10 minute value.

Check the box to enable the following:

Most restrictive session parameters

Least restrictive session parameters

Click Save Settings.

Viewing Access Control Rules

Use the View Access Control Rules page to view all ACLs defined on the gateway.

To view access control rules

From the configuration menu, choose Global Properties > Access

Control.

The Configure Global Rules page opens.

96 Nokia Secure Access System Administrator Guide

Click the View All Rules tab.

The View All Access Control Rules page opens.

Configuring SNMP

The View All Access Control Rules page contains a table of all access control rules defined on the gateway. The terms, status, and associated resource are displayed for each rule.

Configuring SNMP

The Simple Network Management Protocol (SNMP), provides a common framework for managing, monitoring, and configuring network devices. The gateway includes support for SNMP traps that alert you when particular events occur during the gateway operation.

You must configure the IPSO SNMP agent from Voyager or the CLI to use the SNMP traps. From the Nokia Secure Access System SNMP configuration page, click the Click here to go to system SNMP configuration link. The

Secure Access gateway tells the IPSO SNMP agent whenever an enabled trap event occurs. The IPSO SNMP agent is responsible for performing the SNMP

Nokia Secure Access System Administrator Guide 97

Configuring Global Properties

communication to the network management station, based on the Voyager

SNMP settings.

For the definitions of the SNMP traps, you can download the Nokia Secure

Access System MIB file. This file defines the object identifiers that the gateway uses. Once you place this file on the network management station, the station can interpret the traps that the gateway sends through the IPSO

SNMP agent.

This section describes how to configure SNMP, including:

Configuring SNMP traps

Downloading MIB Files

Note

The gateway includes support for SNMP traps but does not support gets or puts.

98 Nokia Secure Access System Administrator Guide

Configuring SNMP

Configuring SNMP traps

Use the Configure SNMP Traps page to configure SNMP traps for the

gateway. Table 7 describes the types of available traps.

Table 7 Description of SNMP Traps

SNMP type Description

Authentication lockout

Authentication failure

Connection overload

Session overload

Number of authentication failures that can occur before a trap is sent. The default number is 25.

Click Settings to view the authentication lockout settings. Lockout settings are configured from the Access Control page in Global Properties.

See

“Configuring Global Access Control

Settings” on page 87

The IPSO SNMP agent sends this trap whenever a sign on to the gateway fails.

Number of active client-side HTTPS connections has exceeded the configured threshold. The conditions for this trap are checked on every request. The trap is thrown at most every 30 seconds. Email connections to the secure email proxy are included in the count of active connections. The default number is 500 connections.

Number of active user sessions has exceeded the configured threshold. The conditions for this trap are checked whenever a new session is authenticated. It is sent a maximum of every 30 seconds. The number of active user sessions value does not take into account portforwarding sessions or email connections to the secure email proxy. The default number is 100 sessions.

Nokia Secure Access System Administrator Guide 99

Configuring Global Properties

To configure SNMP traps

From the configuration menu, choose Global Properties > SNMP.

The Configure SNMP Traps page opens.

100

Specify the traps.

Check the box to enable or disable a particular trap.

If you are enabling the authentication lockout trap, click Settings to set the threshold values. The Sign-On Rules page opens. From this page, you can view or change authentication lockout settings. See

“Configuring Access Control Settings” on page 93.

If you are enabling traps for connection overload and session overload, select the number of concurrent connections or concurrent sessions from the drop-down list. The default number is 500.

Nokia Secure Access System Administrator Guide

Configuring SNMP

Note

For convenience, you can configure SNMP system settings such as trap destination and community strings, by clicking the Click here to go to system SNMP configuration link. For information about these settings, see the Nokia Network Voyager Reference Guide or click

Help from the SNMP Voyager page.

Click Save Settings.

Downloading MIB Files

Use the MIB file page to download the Nokia Secure Access System MIB file, MIB files that the system uses, and other IPSO SNMP MIB files.

Note

For the definitions of the SNMP traps, you can download the Nokia

Secure Access System MIB file.

To download the MIB files

From the configuration menu, choose Global Properties > SNMP.

The Configure SNMP Traps page opens.

Nokia Secure Access System Administrator Guide 101

Configuring Global Properties

Click the MIB Files tab.

The MIB Files page opens.

Click the link to download.

The Windows File Download dialog box opens and prompts you to either download or open the file.

Using Variables

For each remote user session, the gateway maintains a number of real-time properties called variables. Variables allow you to reference information about the user’s session and are primarily used when you create access control rules. For more information about why variables are used, see

“Variables” on page 33.

Table 8

describes the two types of variables that the gateway uses.

102 Nokia Secure Access System Administrator Guide

Using Variables

Table 8 Variable Types

Variable name Description

Predefined Values that the gateway provides automatically such as

TIME_OF_DAY

USERNAME

AUTH_METHOD, and so forth.

Predefined variables cannot be changed or deleted. For a description of all predefined variables, see

“Using Variables for

Access Control Rules” on page 277.

User defined Values that the system administrator defines. User-defined variables are used only for accessing outputs of client integrity scans. See

“Using Client Integrity Scanning” on page 107.

Each variable has a name, such as

TIME_OF_DAY.

User-defined variable names can use both uppercase and lowercase letters. Variable values are entered as strings but can contain different string values depending on the variable. Variables are assigned values at the following times:

When the request is made.

The following variables are added values for each client request:

DEST_URL

BROWSER_USER_AGENT

CLIENT_IP

SSL_STRENGTH

TIME_OF_DAY

DAY_OF_WEEK

ACCESS_MODE

Note

The

ACCESS

MODE

variable is only added for file resources requests.

Nokia Secure Access System Administrator Guide 103

Configuring Global Properties

At the start of a user session.

When a user signs on and successfully authenticates to the gateway, the following predefined values are assigned values

USERNAME

USER_GROUPS

AUTH_METHOD

At the end of a client integrity scan.

You can perform client integrity scans before or after the remote user signs on to the gateway. When the scan completes, the client integrity script calls gateway_return()

and sends the gateway an arbitrary number of Variable = Value pairs. Using this method, the client integrity scripts assign values to user-defined variables. Those values persist for the remainder of the user session, or until a subsequent client integrity scan replaces them.

Managing Variables

Use the Variables pages to manage variables, including adding a new userdefined variable, deleting a user-defined variable, and viewing variables.

To manage variables

From the configuration menu, choose Global Properties > Variables.

The Manage Variables page opens.

104 Nokia Secure Access System Administrator Guide

Using Variables

The Manage Variables page contains a list of both predefined and userdefined variables by name and description. From this page you can change the description or default value of a user-defined variable by clicking the variable to change.

To delete a user-defined variable, check the box next to the variable, then click Delete Selected Variables.

Note

You cannot delete or change Predefined variables.

Nokia Secure Access System Administrator Guide 105

Configuring Global Properties

To add a new user-defined variable, click New Variable.

The New Variable Definition page opens.

106

Enter the Variable Name, Description, and Default value.

Enter the default value as an arbitrary string. This is the value the variable obtains if it is not explicitly set when a client integrity script runs.

Click Save Settings.

The new variable is added to the Variables list box.

Note

To view and edit the properties of a user-defined variable, click the name of the variable in the Variables list box.

To delete a user-defined variable, click the delete check box next to the variable to delete.

Click Delete Selected Variables.

The selected variable is removed from the Variables list box.

Nokia Secure Access System Administrator Guide

Using Client Integrity Scanning

Using Client Integrity Scanning

The gateway provides a client-integrity scanning feature that assists you in making access-control decisions based on checks performed on the client platform. This checking is specified by using a simple scripting language that includes commands for examining the clients file system, running commands, reading files from disk, and so forth. Scripts are executed on the client system by a signed Java applet downloaded by the Web browser from the Nokia

Secure Access System. After the script runs, it reports the results back to the gateway by assigning values to variables already defined on the gateway. You

use variables when you configure access-control rules. See “Configuring

Access Control Rules” on page 265. The client-integrity scan then feeds this

information into the user’s session on the gateway and it is used in access control decisions.

Use the Client Integrity Scan pages to specify rules for client integrity scanning, and create or edit client-integrity scripts.

Note

For information about the pnuts script language for Java, see: http://www.pnuts.org

Client Integrity Scanning System Requirements

For the Nokia Secure Access System to support client integrity scanning, the following is required:

Windows 98, ME, XP, NT, or 2000

Internet Explorer v5.0 or later, Netscape v6.2 or later, or Mozilla v1.x with the Sun Java 1.4.1 plug-in

Nokia Secure Access System Administrator Guide 107

Configuring Global Properties

To perform client integrity scanning

From the configuration menu, choose Global Properties > Client Integrity

Scan.

The Client Integrity Scan Rules page opens.

108

The Scan Rules list box displays the rule list that governs when client integrity scanning is performed. Each rule contains the action, condition, and options for disabling or deleting the rule.

Apply the scan rules.

You can choose from the following:

Before user sign on

After user sign on

These rules determine if scanning occurs on the client platform before or after the user signs on to the gateway.

Nokia Secure Access System Administrator Guide

Using Client Integrity Scanning

Select a default rule from the drop-down list.

You can choose from the following:

Omit Scan

ScanUsingScript: good_files

ScanUsingScript: bad_files

ScanUsingScript: good_processes

ScanUsingScript: bad_ports

For script definitions, see Table 9 on page 110.

Click Add Rule.

The New Client Integrity Scan Rule for either before or after sign on page opens.

From this page you can configure advanced rules for client integrity scanning.

For information about how to configure advanced access control rules, including creating complex rules and manually entering a rule, see

Chapter 13, “Configuring Access Control Rules.”

Click Save New Rule.

Nokia Secure Access System Administrator Guide 109

Configuring Global Properties

Click Return to rule list.

The new rule is added to the Client Integrity rule list.

Note

Username, user groups, and auth_method variables can only be specified after a user signs on.

For information about how to add a complex rule, or manually enter a rule, see

“Configuring Complex Access Control Rules” on page 272.

Using Client Integrity Scan Scripts

Use the Client Integrity Scan Scripts page to specify scripts for client integrity scanning. You can add a new script or choose from the predefined scripts available on the gateway.

Table 9

describes the predefined scripts.

Caution

Use caution when you edit client integrity scripts or create new scripts. Nokia currently does not support the administrator writing and using their own scripts. Contact Nokia Support for guidance on adapting scan scripts to your needs.

Table 9 Description of Predefined Client Integrity Scripts

Script name Description

bad_files bad_ports

Scans for the presence of files that might indicate the presence of malicious programs on the client system.

Scans for open ports that might indicate malicious activity on the client.

110 Nokia Secure Access System Administrator Guide

Using Client Integrity Scanning

Table 9 Description of Predefined Client Integrity Scripts (continued)

Script name Description

good_files Scans for the presence of programs used to protect client systems, including firewall and virus scanning software.

good_processes Scans for active protective programs.

To add a new client integrity scan script

From the configuration menu, choose Global Properties > Client Integrity

Scan.

The Client Integrity Scan Rules page opens.

Nokia Secure Access System Administrator Guide 111

Configuring Global Properties

From the Client Integrity Scan Scripts page, you can view all of the scripts currently defined on the gateway by name and description. You can also delete an existing script. See

“Deleting a Client Integrity Script” on page 113.

To view or edit a predefined script, click the name of the script.

Click New Script

The New Client Integrity Scan Scripts page opens.

112

Enter the name and description of the new script.

Enter the script text into the Script Text pane.

Click Test Run to preview the script.

Nokia Secure Access System Administrator Guide

Using Client Integrity Scanning

Note

To use client integrity scanning, Java Runtime Environment

(JRE) v1.4.1. must be installed on both the client system and the client browser. If JRE is not present, the client is automatically prompted to download and install it on their system. Also, JavaScript needs to be enabled on the client browser.

Click Save Changes

Click Return to Scripts.

The new script is added to the Scan Scripts list box.

Deleting a Client Integrity Script

Use the Client Integrity Scan Script page to delete a client integrity script.

Note

If one of the client integrity scan rules is using a script, it cannot be deleted.

To delete a client integrity script

From the configuration menu, choose Global Properties > Client Integrity

Scan.

The Client Integrity Scan Rules page opens.

Click the Scripts tab.

The Client Integrity Scan Scripts page opens.

Nokia Secure Access System Administrator Guide 113

Configuring Global Properties

Check the Delete box next to the script to delete.

Click Delete Selected Scripts.

114 Nokia Secure Access System Administrator Guide

Configuring Certificates

This Nokia Secure Access gateway uses the SSL protocol to secure communication across the Internet. Certificates are required to facilitate this communication. This chapter describes how to configure server certificates to establish communications with clients and how to configure CA certificates to authenticate trusted backend resources. It includes the following sections:

Configuring Server Certificates

Configuring CA Certificates

When a client system, such as a Web browser, connects to the gateway, the gateway presents a server certificate, which the browser validates.

Specifically, the browser checks that the certificate is valid and that it is issued by a trusted source. If the certificate cannot be validated, the browser notifies the user and submits a request to either continue or cancel the connection.

The gateway, as part of its operation, might need to contact different backend servers, for instance an LDAP server or a Web server using SSL. To establish this communication, the gateway needs to validate the certificate that the backend server presents. To perform this validation, the gateway consults the set of trusted Certificate Authorities (CAs). Each CA is specified by the inclusion of its certificate in a list of trusted CA certificates on the gateway.

Nokia Secure Access System Administrator Guide 115

Configuring Certificates

Note

A certificate is a block of data composed of information about the holder and issuer, the public key of the holder, and the certificate subject. The issuer of the certificate signs all of this data.

Configuring Server Certificates

The gateway is shipped with an initial self-signed certificate for demonstration and boot strapping purposes. This certificate is not signed by a trusted authority and must be replaced before you can securely use the gateway over the Internet.

This section describes how to configure server certificates for the gateway, including:

Managing Server Certificates

Generating a New Server Certificate

Adding a Certificate

Importing a Server Certificate

Managing Server Certificates

Use the Manage Certificates page to manage server certificates and certificate requests, including viewing a certificate, deleting a certificate, and making a certificate active.

116 Nokia Secure Access System Administrator Guide

Managing Server Certificates

To manage server certificates

From the configuration menu, choose Certificates > Server Certificates.

The Manage Certificates page opens.

The Manage Certificates page shows all usable and pending server certificates on the gateway.

From this page you can do the following:

View a certificate

— click View in the Actions column to view detailed information about the certificate, including certificate label, subject name, issuer name, key length, serial number, UUID and validity status.

Delete a certificate—click Delete in the Actions column to remove the certificate or certificate request from the gateway.

You cannot delete a certificate that is currently the active server certificate. To delete such a certificate, you must first make another certificate the active server certificate.

Nokia Secure Access System Administrator Guide 117

Configuring Certificates

Make a certificate active—click Make Active in the Actions column, to set the selected certificate as the active certificate. The active certificate is the certificate that the gateway presents to clients when establishing an SSL connection.

Note

If you change the active certificate, the gateway automatically restarts and you must sign back on to the gateway.

Generating a New Server Certificate

Use the Generate New Server Certificate page to generate a new self-signed certificate or request a certificate from an external certification authority.

To generate a new server certificate

From the configuration menu, choose Certificates > Server Certificates.

The Manage Certificates page opens.

Click the New Server Cert tab.

The Generate New Server Certificate page opens.

118 Nokia Secure Access System Administrator Guide

Managing Server Certificates

Check the type of certificate to generate.

You can generate two types of certificates.

Self-signed certificate

Certificate signed by an external Certification Authority (CA).

Caution

Man-in-the-middle attacks against SSL applications can only be prevented by using a server certificate issued from a trusted CA. Selfsigned certificates or certificates issued from CAs that are not trusted by the browsers of enterprise users are not suitable for gateway deployment because of these potential attacks. Self-signed certificates are generally used for testing purposes only.

Nokia Secure Access System Administrator Guide 119

Configuring Certificates

Enter the Field values for each field name.

For a description of these fields, see

Table 10 on page 121.

Specify the certificate attributes.

Specify a certificate validity period.

You can specify in hours, days, weeks, months, or years. The maximum validity period is 30 years. Nokia recommends one or two years.

Note

The validity period only applies to self-signed certificates.

Select the public key size (in bits).

The recommended key length is 1024 bits.

Enter the certificate ID name.

The ID is a unique string that identifies the certificate on the gateway.

The name cannot contain punctuation or spaces.

Click Submit Request.

If you are generating a self-signed certificate, the certificate is automatically generated and added to the Usable Certificates list box.

If you are generating a certificate signed by an external CA, a certificate request appears in the gateway browser screen. You can copy and paste the certificate into the certificate text box. This request must be signed by the CA.

After the CA signs the certificate, you can add it to the gateway by

using the Add Cert tab. To add the certificate, see “Adding a

Certificate” on page 121.

120 Nokia Secure Access System Administrator Guide

Managing Server Certificates

Table 10 Description of Distinguished-Name Field Attributes

Attribute Description Example

st o c l ou cn

Country

Locality

State or province

Organization

Organizational unit

Common name

Santa Cruz

California

Nokia

Engineering

John Doe

ote

All server certificates must have a common name (CN) field. This field must contain the fully qualified hostname and can include wildcards.

e Email address [email protected]

All fields are limited to 64 characters except the country and email address fields. The country field is limited to 2 characters. The email address is limited to 40 characters.

Adding a Certificate

Use the Add Cert page to complete the external server certificate request.

After the CA generates and signs the certificate request, you can add the certificate to the gateway. When you add the certificate to the gateway, you can paste in a PEM-encoded certificate, which contains a single certificate, or a PKCS#7 object, which contains multiple certificates known as a certificate chain.

Nokia Secure Access System Administrator Guide 121

Configuring Certificates

To add a new certificate

From the configuration menu, choose Certificates > Server Certificates.

The Manage Certificates page opens.

Click the Add Cert tab.

The Add Server Certificate page opens.

Copy and paste the certificate into the certificate text box.

Paste the entire text file, including the BEGIN and END lines.

Click Process Certificate.

The certificate is added to the Usable Server Certificates list box.

Importing a Server Certificate

Use the import page to import an existing server certificate and private key into the gateway. Both the certificate and private key are pasted in using PEM based coding. If the key is encrypted, you must enter the password with which it is encrypted.

122 Nokia Secure Access System Administrator Guide

Managing Server Certificates

After the certificate is imported, the certificate is available for use in the list of installed server certificates.

To import a server certificate

From the configuration menu, choose Certificates > Server Certificates.

The Server Certs page opens.

Click the Import Key/Cert tab.

The Import Key Cert page opens.

Paste the certificate information into the Certificate Data text box.

Paste the private key into the Key Data text box.

Enter the Decryption Password.

This password is used to decrypt the private key and is optional. Leave this blank if no password is used to encrypt the private key.

Nokia Secure Access System Administrator Guide 123

Configuring Certificates

Enter the ID for the new certificate.

This ID is used locally on the gateway.

Click Import Certificate.

Configuring CA Certificates

The gateway uses backend servers, such as corporate Web servers, LDAP servers, and so forth. To establish SSL connections to these servers, the gateway must trust the certificate of the entity that issues the certificate for the resource (the CA certificate). The gateway is initially configured to trust the standard set of globally recognized certificate authorities (this is the same list that popular Web browsers are configured to trust). If the certificates of your backend servers are self-signed by CAs that are not on the list, you must add the CA certificates to the gateway.

This section describes how to add and remove trusted CA certificates from the gateway.

To configure CA certificates

From the configuration menu, choose Certificates > CA Certificates.

The CA Certificates page opens.

124 Nokia Secure Access System Administrator Guide

Configuring CA Certificates

The CA Certificates page shows a list of all CA certificates defined on the gateway.

To view a CA certificate, click the View link from the Actions column.

The CA certificate details are displayed.

To delete a CA certificate, click the Delete link from the Actions column.

Click Yes to delete the certificate.

To add a new CA certificate, click the Add CA Cert tab.

The Add CA Certificate page opens.

Copy and paste the CA certificate into the Add CA Certificate text box. Paste the entire text file including the BEGIN and END lines.

Enter the ID for the new certificate.

This name cannot contain spaces or punctuation.

Click Process Certificate.

The CA certificate is added to the CA Certificate ID list.

Nokia Secure Access System Administrator Guide 125

Configuring Certificates

126 Nokia Secure Access System Administrator Guide

Configuring Users

This chapter describes how to configure users for remote access to the Nokia

Secure Access gateway. It contains the following sections:

Managing Users

Importing User Lists

From the Users pages you can configure all users on the gateway. You can create locally defined or externally defined users and configure their settings on the User properties pages. On the User General properties page you can:

Specify allowed authentication methods.

Specify logging settings.

Add group memberships for the user.

You can customize the user portal for particular users by configuring the User

Portal properties page.

The User Session properties page contains settings related to session time limits, persistent credential storage and browser caching.

You can also import user lists to the gateway by using the Import User Lists page. This feature makes it convenient to create a large number of locally defined users from a file that contains a list of usernames and optional user information such as full names, passwords, and group memberships.

Nokia Secure Access System Administrator Guide 127

Configuring Users

Managing Users

From the Manage Users pages you can manage all users on the Nokia Secure

Access gateway, including:

Adding a New User

Configuring User Properties

Disabling or Deleting a User

Adding a New User

Use the Manage Users page to add a new user to the gateway. When you create a new user, you can choose between creating a new locally defined user

or a new externally defined user. Table 11 describes locally defined and

externally defined users.

Table 11 Locally Defined and Externally Defined Users

User type Description

Locally defined An individual identified by the specified username, with all of the user’s settings stored locally in the gateway configuration.

You can allow one or more authentication methods for locally defined users, including local password, local certificate, and authentication methods that use external servers for user validation (LDAP, RADIUS, NIS or NTLM).

Externally defined A class of users individually defined by a specified authentication method. A single externally defined user class can encompass many individual users. Each user signs on with a different username, although each is considered a member of the externally defined user class if the specified authentication method successfully validates the user credentials at sign on. When you create a new externally defined user, you must choose an authentication method to define the users in this class.

128 Nokia Secure Access System Administrator Guide

Managing Users

To add a new user

From the configuration menu, choose User Configuration > Users.

The Manage Users page opens.

The Manage Users page shows a list of all users defined on the gateway.

To specify the number of users shown on each page, enter the number in the Show field. A page can show from 5 to 100 users. Twenty users each page is the default number. Click Prev or Next to navigate through each page.

Note

To view or edit the user properties for an existing user, click

Username.

Nokia Secure Access System Administrator Guide 129

Configuring Users

Click New User.

The General Properties for User page opens.

130

Identify the user:

To create a locally defined user, click Locally Defined and enter the

Username. For example: jsmith

To create an externally defined user and select an authentication method to define the user, click Externally Defined.

Enter the Username (for example, user1), and define an authentication method for the user from the drop-down list. See

“Configuring

Authentication Methods” on page 157.

Nokia Secure Access System Administrator Guide

Managing Users

Enter the full name of the user.

For example, John Smith

Specify logging for this user.

Check the check box to enable the following:

Enable debug logging for this user.

Enable auditing messages for this user.

For information about logging, see

“Using Gateway Logging” on page

63.

Click Save Settings.

The General Properties page for the new user opens. To configure these settings, see

“Configuring User Properties.”

Configuring User Properties

This section describes how to configure user properties including:

Specifying General User Properties

Specifying User Portal Properties

Specifying User Session Properties

Specifying General User Properties

Use the General Properties for User page to specify general settings for user authentication, group membership, and logging.

Note

To view or change user properties, click the username of the user from the Username list box.

Nokia Secure Access System Administrator Guide 131

Configuring Users

132 Nokia Secure Access System Administrator Guide

Managing Users

To specify general user properties

Specify the user authentication method.

For a locally defined user:

You can allow multiple authentication methods for the locally defined user. All available password-based and certificate-based methods are listed in separate tables, each with a check box to allow or disallow the method for the user. The method listing also displays the group memberships that are statically configured for each authentication method. In the example shown, a membership to the Admin group is added for all users that sign on using the Local Password method. The

User Group Added information appears only for an authentication method when the method is allowed.

Note

I f you are specifying general properties for the admin user, you can select whether the admin is authenticated by using the same mechanism that IPSO uses or by using the authentication methods defined on the gateway. For detailed information, see

“Authenticating the admin User” on page 162

Locally defined users can authenticate with the local password and local certificate methods, if allowed. You can click Set Local

Password or Set Local Certificate to set or change the user’s credentials for these methods.

For an externally defined user:

An externally defined user class is defined by a single authentication method. Moreover, the gateway requires that no two externally defined user classes use the same authentication method (so that a given user can be unambiguously determined to be a member of no more than one class).

The authentication method used to define the user is shown in the

Defined by Authentication Method drop-down list in the Identification box. That drop-down list also includes other authentication methods

Nokia Secure Access System Administrator Guide 133

Configuring Users

that can be selected to define the externally defined user. Methods used to define other externally defined users are excluded from this list.

The User Groups Added by Authentication Method displays the group memberships that are statically configured for the method that defines the externally defined user class.

Specify User Group Membership.

Click Edit List.

The Edit the User Groups of User page for the specified user opens.

134 Nokia Secure Access System Administrator Guide

Managing Users

From the Edit the User Groups of User page you can add or remove user groups that the user belongs to.

Select the user group, then click Add or Remove.

Click Save Settings.

Click Return to Users General.

Specify logging.

Check the check box to:

Enable debug logging for this user.

Enable auditing messages for this user.

Click Save Settings.

Specifying User Portal Properties

Access the User Portal pages to specify user portal properties. These settings determine the list of resources on the Main page of the user portal.

Note

To view or edit user portal properties, click the name of the user from the

Username list box and click the Portal tab from the General properties for

User page.

Nokia Secure Access System Administrator Guide 135

Configuring Users

136 Nokia Secure Access System Administrator Guide

Managing Users

To specify the user portal settings

Select the sources for the user portal settings.

A user’s portal settings can be determined from the portal settings of all groups to which the user belongs, from a particular group’s portal settings, or from custom settings specified for the user. At least one of these sources must be selected. If more than one source is selected, the gateway determines the user’s portal settings by combining all resource links and all text box features that the portal settings include from the various sources. For example, a user’s portal might contain resource links specified in the user’s custom settings as well as resource links configured for a particular user group.

Select one or more of the following:

Use combined settings of User Groups

— the user’s portal settings include the portal settings of all user groups to which the user belongs.

Use settings of User Group

— the user’s portal settings include the portal settings of the particular group specified in the User Group drop-down list.

Use custom settings

—

the user’s portal settings include the settings configured specifically for the user.

Specify the custom settings, if desired.

Specify the Resource links for the user portal.

The Portal Properties for User page displays the lists of Web, file, email, and port-forwarding resources that are to be displayed as links on the Resources pane of the user’s portal. For each listed resource, the resource name and link text appears. In the case of the email resources, you can also configure the initial default email resource for the user.

Click Edit List to add or remove resource links from each list.

Nokia Secure Access System Administrator Guide 137

Configuring Users

To enable text boxes for typing destination URLs or destination file servers, check the appropriate box.

To allow the user to type URLs for Web requests, check Enable text box for typing destination URLs.

To allow the user to type names or addresses of file servers, check the box next to the server type. You can enable text boxes for FTP,

NFS, and Windows file servers.

Note

The Windows file server text box only displays in the user portal if a

WINS server was defined. A Windows file server is required to allow a user to also browse the Windows network. For information on how to configure a WINS server, see

“Configuring Windows Networking” on page 84.

Click Save Settings.

Specifying User Session Properties

Use the Session Properties for User page to specify session properties for a user, including time limits for Web, email, and port-forwarding sessions, persistent credentials settings, and browser caching.

Note

To view or edit user session properties, click the name of the user from the Username list box and click the Session tab from the General properties for User page.

138 Nokia Secure Access System Administrator Guide

Managing Users

To specify user session properties

Select the source for the user session settings.

Choose from the following:

Use settings as determined by User Groups

— session properties for that user are selected based on session properties of the groups that the user belongs to, as well as the Multiple Group Membership setting on

Nokia Secure Access System Administrator Guide 139

Configuring Users

the Global Properties > Access Control > Settings page. For more information about restrictions for multiple groups, see

“Configuring

Access Control Settings” on page 93.

Use settings of User Group

— session settings for that user are based on session settings for the group specified in the User Group dropdown list.

Use custom settings

— session settings are set to specific values, which are explained in the following steps.

Specify the custom settings, if desired.

Specify the time limits (in minutes), for Web, email, and portforwarding sessions.

Enter the time limits for inactivity, maximum duration, and Web reauthentication.

Specify persistent credentials.

Check the check box to enable the following:

Allow persistent cookies for Web Resources—saves cookies for use in subsequent sessions.

Allow persistent username/passwords for Web Resources—

saves the username and password to access Web resources in subsequent sessions.

Allow persistent username/passwords for File Resources— saves the username and password to access file resources in subsequent sessions.

Allow persistent username/passwords for Email Resources—if enabled, the secure email proxy tries to retrieve a stored username and password for the backend server. In addition, the email proxy saves the username and password for accessing backend email servers.

140 Nokia Secure Access System Administrator Guide

Managing Users

Specify browser caching.

Check the check box to enable the following:

Allow caching of HTML content from Web servers—enables caching of HTML content that backend servers deliver.

Allow caching of inline images within Web pages—enables caching of inline images associated with HTML content.

Note

Disabling caching can increase download times for remote users.

Click Save Settings.

Disabling or Deleting a User

From the Manage Users page you can disable or delete an existing user from the gateway. Disabling a user prevents a user from signing on to the gateway.

If you disable an externally defined user class many individual users might be prevented from signing on to the gateway.

To disable or delete a user

From the configuration menu, choose User Configuration > Users.

The Manage Users page opens.

Nokia Secure Access System Administrator Guide 141

Configuring Users

142

The Manage Users page includes a list box of all users currently defined on the gateway:

To disable a user, choose a Username and check the Disable check box.

To delete a user, choose a Username and check the Delete check box.

Click Save Settings.

The user is disabled or removed from the list of available users.

Note

If you click Next or Prev before Save Settings, the settings are not saved.

Nokia Secure Access System Administrator Guide

Importing User Lists

Importing User Lists

The gateway supports the import of users specified in a user list text file. This feature can be useful in cases where a large database of enterprise users exists in some form and can be exported to a text file. Once the user list text file is in the required form, you can import the list to the gateway, thereby creating a locally defined user for each user in the list.

The user list is a multilined text file, and each line must be of the form:

<username>:[<password>]:[<group1>[,<group2>,...]]:[<full name>]

The password, group, and full name fields can be empty strings.

Note

All delimiters are required, even if the field is empty. See “Requirements for the User List File Format” on page 145.

To import a user list

From the configuration menu, choose User Configuration > Users.

The Manage Users page opens.

Click the Import Users tab.

The Import Users page opens.

Nokia Secure Access System Administrator Guide 143

Configuring Users

144

Select the user list file to import.

Enter the name of the text file or click Browse to locate the file.

Select whether or not to overwrite existing users with imported users.

During import, the gateway might encounter usernames in the user list that already exist on the gateway. In this event, the gateway can either ignore the relevant line of the user list or overwrite the existing user with the information supplied by the user list. In the case of overwriting the user, all of the properties configured for the existing user are reset to their initial defaults (the same values as for a newly-created user).

Nokia Secure Access System Administrator Guide

Importing User Lists

Click Import User List.

The gateway performs the user import and creates a report that contains information about:

The number of users imported.

Users ignored in the user list, if any.

Users defined on the gateway that were overwritten by the file.

Invalid groups encountered or ignored in the user list.

Note

All user groups referenced in the user list file must be defined on the gateway before the user list is imported. During the import, unrecognized groups are ignored.

After the user import, all successfully imported users are added to specified groups, have default portal and session parameter settings, and are allowed to use local password for authentication.

Requirements for the User List File Format

The user list file is a multiline, ASCII text file. An user list looks like the following example: user1:password1::User 1 user2:password2:group1:User2 user3::group1,group3,group5:User3 user4:::User 4 user5:::

When you create a user list file, the format must meet the following requirements:

UNIX or Windows line termination are accepted. Acceptable line delineators are LF or CRLF.

The password field, groups field, and full name can be empty.

Nokia Secure Access System Administrator Guide 145

Configuring Users

Usernames should not contain spaces, control characters, or any of the following characters:

‘ “ \ : & # + [ ] { } < >

Alphanumeric characters in addition to the hyphen (-) and underscore ( _ ) characters are allowed.

The password must not contain spaces, colons, or control characters.

Group names use the same allowed characters as usernames, with the addition that spaces are allowed in group names. For example: group 1, group 2, group 3.

Group names are case-insensitive.

Passwords, when supplied, must be in ASCII text form.

146 Nokia Secure Access System Administrator Guide

Configuring User Groups

This chapter describes how to configure user groups for remote access to the

Nokia Secure Access gateway.

Members of user groups can sign in to the gateway and use the features that you enable for the user group.

Managing User Groups

From the Manage Users Group pages you can manage all users on the Nokia

Secure Access gateway, including:

Adding a New User Group

Specifying User Group Portal Properties

Specifying User Group Session Properties

Nokia Secure Access System Administrator Guide 147

Configuring User Groups

Adding a New User Group

Use the Manage Users Group page to add a new user group to the gateway and associate members with that particular group.

To add a new user group

From the Configuration menu, choose User Configuration > User Groups

> Manage User Groups.

The Manage User Groups page opens.

148

The Manage User Groups page shows a list of all user groups defined on the gateway.

Note

To view or edit the properties of an existing user group, click the group name.

Nokia Secure Access System Administrator Guide

Click New User Group.

The General Properties for User Group page opens.

Managing User Groups

Enter the Group Name and Description for the new group.

Click Save Settings.

You can now manage the users that belong to the group.

Adding or Removing Members to a User Group

From the Edit Members of User Group page you can add or remove members of the group.

To add or remove members to a user group

From the configuration menu, choose User Configuration > User Groups.

The Manage User Groups page opens.

Click the group name from the Group Name list box.

The General Properties for User Group page opens.

Nokia Secure Access System Administrator Guide 149

Configuring User Groups

Click Edit list to add members to the user group.

The Edit Members of User Group page opens.

150

From the Edit Members of User Group page you can add or remove members of the group.

Select a user name, then click Add or Remove.

Click Save Settings.

Nokia Secure Access System Administrator Guide

Managing User Groups

Click Return to User Group General to return to the previous screen.

The added members appear in the Members list.

Note

To view or edit member properties, click the name of the member in the members list.

Specifying User Group Portal Properties

Access the User Group Portal page to specify portal properties for a user group. These settings determine the list of resource links seen on the user portal by members of the group, provided that each user is configured to obtain portal settings from the settings of the user group.

Note

To view or edit user group portal properties, click the name of the group from the Group Name list box and click the Portal tab from the General properties for User Group page.

Nokia Secure Access System Administrator Guide 151

Configuring User Groups

152 Nokia Secure Access System Administrator Guide

Managing User Groups

To configure user group portal settings

Specify resources associated with the User Group.

You can specify settings for Web, file, email, and port-forwarding resources.

To add or remove resources from the user portal, click Edit List next to the resource type to use.

Select the resource to add or remove, then click Save Settings.

To enable text boxes for the user to specify destination URLs or destination hosts, check the check box under the appropriate resource.

If you are specifying Web resources, check Enable text box for typing destination URLs.

If you are specifying file resources, check the check box next to the server type. You can enable text boxes for FTP, NFS, and Windows servers. If the Windows text box is enabled and a WINS server is defined, the user can also browse the Windows network. For a description of FTP, NFS, and Windows file servers, see

“Configuring

File Resources” on page 223.

Click Save Settings.

Continue to “Specifying User Group Session Properties”

Specifying User Group Session Properties

Use the Session Properties for User Group page to specify session properties for a user group, including time limits for Web, email, and port-forwarding sessions, persistent credentials settings, and browser caching.

Nokia Secure Access System Administrator Guide 153

Configuring User Groups

154 Nokia Secure Access System Administrator Guide

Managing User Groups

To specify user group session properties

Specify the time limits (in minutes), for Web, email, and port-forwarding sessions.

Enter the time limits for inactivity, maximum duration, and Web reauthentication.

Specify persistent credentials.

Check the check box to enable the following:

Allow persistent cookies for Web Resources—saves cookies for use in subsequent sessions.

Allow persistent username passwords for Web Resources—saves the username and password to access Web resources in subsequent sessions. This applies to the username and password popup dialog box.

Allow persistent username passwords for File Resources—saves the username and password to access file resources in subsequent sessions.

Allow persistent username passwords for Email Resources—if enabled, the secure email proxy tries to retrieve a stored username and password for the backend server. In addition, the email proxy saves the username and password for accessing backend email servers.

Nokia Secure Access System Administrator Guide 155

Configuring User Groups

Specify browser caching.

Check the check box to enable the following:

Allow caching of HTML content from Web servers—enables caching of HTML content delivered by backend servers.

Allow caching of inline images within Web pages—enables caching of inline images associated with HTML content.

Note

If you disable caching, download times for remote users might increase.

Click Save Settings.

156 Nokia Secure Access System Administrator Guide

Configuring Authentication

Methods

This chapter describes the methods used to authenticate remote users to the

Nokia Secure Access gateway, including:

Authenticating Users at Sign-On

Managing Authentication Methods

Adding Group Membership

Specifying Local Password Settings

Authenticating with External Servers

Authenticating with Certificates

Modern enterprises use a variety of user authentication systems. To accommodate the multitude of enterprise solutions in use, the Nokia Secure

Access System supports several standard authentication schemes, organized on the gateway as authentication methods. As the administrator, you can define new authentication methods, name each new method, and configure the authentication method properties. For detailed information about authentication methods and how they work, see

“Authentication Methods” on page 27.

Nokia Secure Access System Administrator Guide 157

Configuring Authentication Methods

Authenticating Users at Sign-On

This section describes how the gateway authenticates users at sign-on, including:

Automatic Handling of Password-Based Methods

Automatic Handling of Certificate-Based Methods

Authenticating the admin User

When a user accesses the gateway Sign-On page, they can authenticate to the gateway either by entering a username and password or by selecting a client certificate for authentication. In either case, you can configure the gateway to process user credentials by attempting to authenticate users with one or more authentication methods. These types of authentication are referred to as password-based authentication and certificate-based authentication as

described in Table 12

Table 12 Password-Based and Certificate-Based Authentication

Authentication style Methods supported Description

Password-based Local password

NTLM

NIS

RADIUS

LDAP

The user enters a username and password to validate user sign-on information. When the gateway receives this information, it validates the user’s identity by either checking its local password database or by communicating to an external authentication server (such as RADIUS,

NIS, or LDAP). See

“Authenticating with External

Servers” on page 173.

Authentication by using either a local certificate or a PKI certificate.

PKI certificate

158 Nokia Secure Access System Administrator Guide

Authenticating Users at Sign-On

Automatic Handling of Password-Based Methods

When processing a username and password string that a user enters at the sign-on page, the gateway automatically finds the appropriate gateway user properties and authentication method by performing the following steps:

The gateway attempts to match the supplied username string against the usernames of all locally defined users configured on the gateway.

The gateway uses case-sensitive comparisons when it attempts to match username strings.

If the user-supplied username corresponds to a locally defined user:

The gateway determines the administrator-configured user’s list of allowed, password-based authentication methods.

The gateway attempts to authenticate the user by cycling through the list of allowed authentication methods in the order specified on the

Manage Authentication Methods page.

If the user-supplied password string successfully authenticates the user with a given method on the list of allowed methods for the user, the gateway concludes that the sign-on is successful with the method in question.

If none of the methods allowed for the user successfully authenticate the user, the gateway waits three seconds and then displays an authentication failure message to the user. The user can retry authenticating at that point.

If the user-supplied username does not correspond to a locally defined user, the gateway attempts to authenticate the user as a member of an externally defined user class.

The gateway determines the administrator-configured list of all password-based authentication methods used to define externally defined user classes.

Cycling through the method list in the order configured on the Manage

Authentication Methods page, the gateway attempts to authenticate the user with each relevant authentication method.

Nokia Secure Access System Administrator Guide 159

Configuring Authentication Methods

If the user-supplied username and password string successfully authenticates the user with a given method on the list, the gateway concludes that sign on is successful with the method in question. The remote user is therefore signed on as a member of the externally defined user class that is defined by this authentication method.

If none of the methods used to define externally defined users successfully authenticate the user, the gateway waits three seconds and then displays an authentication failure message to the user. The user can retry authenticating at that point.

Automatic Handling of Certificate-Based Methods

When a user clicks Sign On With Certificate on the gateway Sign-On page, the gateway requests that the user’s Web browser perform certificate authentication. When that occurs, the user’s Web browser prompts the user to select a certificate for use in this authentication. Depending on the Web browser settings, the user might also be prompted to enter a password to unlock the browser secure storage of the private keys corresponding to these certificates.

After the user selects a certificate, the Web browser and the gateway perform the authentication with the client certificate. Authentication is achieved by using the SSL/TLS capability to perform a new SSL handshake in mid session. Once the SSL handshake completes, the user has demonstrated the ability to authenticate with the selected certificate. For this to constitute a successful sign on to the gateway, a valid certificate-based authentication method must correspond to the user’s certificate. Additionally, the gateway must be able to determine the gateway username from the user’s certificate.

The gateway automatically finds the appropriate gateway user properties and certificate-based authentication method by performing the following steps:

The gateway attempts to match the user’s certificate against any of the local certificates configured on the gateway. If a match is found and the corresponding locally defined user is allows to use the local certificate

160 Nokia Secure Access System Administrator Guide

Authenticating Users at Sign-On

method allowed, the gateway concludes that the sign on is successful with the local certificate method.

If PKI certificate authentication methods exist in the gateway configuration, the gateway determines which method (if any) is valid for the user’s certificate. The gateway attempts to match the client’s certificate chain against the trusted CAs configured for each PKI certificate authentication method.

If the gateway finds a PKI certificate authentication method that validates the user certificate, the gateway determines the username corresponding to the certificate.

The configuration settings of the PKI certificate authentication method dictate how this certificate-to-username mapping is performed.

If the username mapping fails, the gateway reports failure of the signon authentication. Failure can happen, for example, when the method specifies that the username be obtained from a DN attribute that is not present in the certificate subject DN.

If the resulting username corresponds to a locally defined user, and the

PKI certificate method in question is allowed for that user, the gateway concludes sign on is successful.

If the resulting username does not correspond to a locally defined user, and the PKI certificate method in question is used to define an externally defined user class, the gateway concludes sign on is successful. In other words, the certificate user is considered a member of the externally defined user class defined by the PKI certificate.

If the gateway does not find a PKI certificate authentication to validate the user’s certificate, the sign on authentication fails and the user sees an error message.

Nokia Secure Access System Administrator Guide 161

Configuring Authentication Methods

Authenticating the admin User

You can configure the gateway to authenticate the gateway administrator either by using the same authentication scheme that the IPSO operating system for the appliance uses, or by using the gateway’s configured authentication methods of the gateway.

The gateway administrator (username admin) is the only user that is both recognized by the gateway application and also has an account on the IPSO appliance. All other users defined on the gateway lack IPSO accounts and thus they are unable to access the appliance through Voyager, Telnet, SSH and similar applications.

The IPSO operating system uses pluggable authentication modules (PAM) to authenticate the admin user when the user logs in to the appliance. When the gateway is configured to authenticate the admin user by using the standard

IPSO authentication system, the gateway uses PAM when it processes the sign on of the administrator. In this configuration, therefore, the administrator uses the same password when signing on to the gateway as when logging on to the appliance.

Alternatively, the gateway can use the same authentication methods to authenticate the admin user as used to authenticate other gateway users. For instance, the administrator can sign on to the gateway by using a client certificate, or by using a password recognized by a RADIUS or NIS server. In this configuration, the gateway admin user can sign on with different credentials than those used when the admin user logs in to the IPSO appliance.

You can specify which scheme to use to authenticate the gateway administrator by setting the General properties on the admin user account.

162 Nokia Secure Access System Administrator Guide

Managing Authentication Methods

To configure the admin authentication scheme

From the configuration menu, choose User Configuration > Users.

The Manage Users page opens.

Click the username of the admin user.

The General Properties for the admin user page opens.

Choose one of the options for Admin User Authentication:

Authenticate admin user using the standard IPSO authentication.

Authenticate admin user using the general authentication methods. For information about general authentication methods, see

“Managing

Authentication Methods.”

Managing Authentication Methods

This section describes how to manage and configure all authentication methods on the gateway, including:

Adding an Authentication Method

Disabling or Deleting an Authentication Method

Nokia Secure Access System Administrator Guide 163

Configuring Authentication Methods

Adding an Authentication Method

Use the Manage Authentication Methods page to add an authentication method to the gateway.

To add a new authentication method

From the Configuration menu, choose User Configuration >

Authentication.

The Manage Authentication Methods page opens.

164 Nokia Secure Access System Administrator Guide

Managing Authentication Methods

The Manage Authentication Methods page includes a list box of all authentication methods currently defined on the gateway.

Note

To view or change authentication properties, click the name of the authentication method from the Authentication Method list boxes.

To specify a new authentication method, select an authentication type from the drop-down list.

The page for the selected method opens.

Click Save Settings.

The new authentication method is added to the Authentication Methods list box.

Nokia Secure Access System Administrator Guide 165

Configuring Authentication Methods

Disabling or Deleting an Authentication Method

Use the Manage Authentication Methods page to disable or delete an authentication method from the gateway.

To disable or delete an authentication method

From the configuration menu, choose User Configuration >

Authentication.

The Manage Authentication Methods page opens.

166 Nokia Secure Access System Administrator Guide

Adding Group Membership

The Manage Authentication Methods page includes a list box of all authentication methods currently defined on the gateway.

To disable a method, check the Disable check box.

To delete a method, click the Delete check box.

Click Save Settings.

Note

The Local Certificate and Local Password methods are predefined and cannot be deleted.

Adding Group Membership

For each gateway authentication method, you can configure the method that adds temporary group memberships to a user’s session whenever the user signs on to the gateway by using that method. The gateway authentication methods support two schemes for group assignment:

Static group assignment––for a given authentication method, the administrator specifies particular user groups. All users that sign on with the method in question are given temporary memberships in the specified groups. In other words, a static set of group memberships are added to each user’s session. All gateway authentication methods support static group assignment.

Nokia Secure Access System Administrator Guide 167

Configuring Authentication Methods

Dynamic group assignment––for LDAP, RADIUS and PKI certificate authentication methods, you can configure the gateway to determine the user’s group memberships from an external LDAP or RADIUS server or from the user’s certificate. In this scheme, the set of group memberships that are added to a particular user’s session are determined dynamically at the time the user signs on. LDAP, RADIUS and PKI certificate authentication methods support dynamic group assignment.

Note

Group memberships that are added by authentication methods are only valid during the user’s session. The user is not permanently added to these groups.

Configuring Static Group Assignment

Static group assignment is supported by all gateway authentication methods.

To configure static group assignment

From the configuration menu, choose User Configuration >

Authentication.

The Manage Authentication Method page opens.

From the Method Name list box, click the name of the desired authentication method.

The General properties page for the chosen authentication method opens.

168 Nokia Secure Access System Administrator Guide

Adding Group Membership

Click on the Group Retrieval tab (for PKI certificate methods, click the

Username Mapping tab).

The page that contains the group retrieval settings opens.

The Static Group Membership panel of the Group Retrieval page shows the groups for which temporary memberships are given to all users that successfully authenticate with the chosen method.

Nokia Secure Access System Administrator Guide 169

Configuring Authentication Methods

Click Edit List to add or remove user groups from the Static Group membership list.

The Members page opens.

170

Move groups between the Selected and Available list by highlighting the desired group names and clicking Add or Remove.

Click Save Settings.

Nokia Secure Access System Administrator Guide

Specifying Local Password Settings

Specifying Local Password Settings

This section describes how to specify the settings of the local password method, including settings for requirements on user passwords and logging.

The local password authentication method enables locally defined users to sign on to the gateway by using a password stored on the gateway itself. A user’s local password can be set two ways:

You can set the user’s local password when you configure user properties.

See

“Configuring User Properties” on page 131.

Locally defined users can set their own local password from the

Preferences page on the user portal.

Note

The local password authentication method cannot be deleted. However, you can disable the local password method.

To specify local password settings

From the configuration menu, choose User Configuration >

Authentication.

The Manage Authentication Method page opens.

From the Method Name list box, click Local Password.

The Local Password page opens.

Nokia Secure Access System Administrator Guide 171

Configuring Authentication Methods

172

Configure the General Local Password Settings.

Enter the minimum password length.

The password must contain at least the specified number of characters.

If you require user passwords to contain nonalphanumeric characters, check the Required box.

Specify logging.

Check the check box to enable debug logging for local passwords.

Click Save Settings.

Nokia Secure Access System Administrator Guide

Authenticating with External Servers

Authenticating with External Servers

This section describes how to configure authentication methods that use external servers for authenticating users during sign on, including:

Configuring an LDAP Authentication Method

Configuring an NTLM Authentication Method

Configuring a RADIUS Authentication Method

Configuring an NIS Authentication Method

Table 13 briefly decribes these authentication methods. Configuration

procedures for each authentication method follow.

Table 13 Authentication Method Types Using External Servers

Method type Description

LDAP

NTLM

NIS

RADIUS

Authenticates users by communicating with a Lightweight

Directory Access Protocol (LDAP) server, such as OpenLDAP or

Active Directory.

Authenticates users by using the Windows NT Lan Manager

(NTLM) protocol to communicate to a domain controller of a

Windows NT or Windows 2000 domain.

Authenticates users UNIX environments with an NIS server.

Authenticates users by communicating with Remote

Authentication Dial In User Service (RADIUS) servers. This communication can involve validation of passwords (or passcodes generated from a hardware token), or challenge-response authentication.

Nokia Secure Access System Administrator Guide 173

Configuring Authentication Methods

Configuring an LDAP Authentication Method

Use the LDAP authentication method pages to add an LDAP authentication method to the gateway. You can also add dynamic group membership based on information you retrieve from the LDAP server.

Whenever an LDAP client (the gateway, in this case) connects to an LDAP server, the client can bind (log in) to the server by using a bind username and bind password. Alternatively, the client can bind anonymously without a username and password. Once bound to the server, the client can retrieve entries from the LDAP hierachically organized directory.

To authenticate a gateway user using an LDAP server, the gateway must first determine the user’s distinguished name (DN) in the directory, using one of two techniques:

If the user’s DN is known to be of a particular form that includes the username (the string that the user types at the gateway sign-on page), you can specify a DN template that indicates how the gateway forms the DN from the username string. For instance, if the template is specified as: cn=%u,ou=Eng,ou=People,o=ExampleCorp,c=US and the user types jsmith as the username on the sign-on page, the gateway determines the user’s DN as:

cn=jsmith,ou=Eng,ou=People,o=ExampleCorp,c=US.

You can specify that the gateway bind to the LDAP server as an admin user and then search for entries that contain the username string as the value of a particular attribute.

Once the user’s DN is determined, the gateway authenticates the user in one of two ways:

The gateway attempts to bind to the LDAP server as the remote user, using the user’s DN and the user-supplied password.

The gateway binds to the LDAP server as an admin user, looks up the remote user’s LDAP entry (by DN), and compares the user-supplied password with the value of the specified password attribute in the user’s

LDAP entry.

174 Nokia Secure Access System Administrator Guide

Authenticating with External Servers

Once a user is authenticated with the LDAP server, the gateway might also add group memberships dynamically based on the information found in the

LDAP server. For a given LDAP authentication method, this can be done in one of three ways:

You can specify an attribute that contains the user’s group memberships in that user’s entry in the LDAP directory. Use this option when the

LDAP directory contains entries similar to the following example entry: dn: cn=John Smith,ou=Eng,ou=People,o=ExampleCorp,c=US objectclass: top objectclass: person cn: John Smith cn: John sn: Smith uid: smith title: nobody group: users developers employees

In this example, the group attribute contains the user’s group memberships. There can also be more than one attribute of this type (for instance, an entry can contain multiple group: lines).

You can specify which attribute in the user’s DN is to be examined for group membership. For example, the user’s DN can contain one or more

OU=groupname attributes, as in the example DN above.

On the LDAP server, each group can have an LDAP entry that lists all members of that group. To accommodate this case, you can configure the gateway to search the LDAP directory for entries that reference the user’s

DN. Once these entries are found, the gateway determines the group name that corresponds to each entry by checking the value of a specified

Nokia Secure Access System Administrator Guide 175

Configuring Authentication Methods

attribute. Use this option when the LDAP directory contains entries similar to the following example entry: dn: cn=developers,ou=Group,o=ExampleCorp,c=US objectclass: top objectclass: groupOfNames cn: developers member: cn=Tina,ou=Eng,ou=People,o=ExampleCorp,c=US member: cn=Craig,ou=Eng,ou=People,o=ExampleCorp,c=US member: cn=John,ou=Eng,ou=People,o=ExampleCorp,c=US

In this example, the cn attribute is used to determine the user group name for the group’s LDAP entry.

To add an LDAP authentication method

From the configuration menu, choose User Configuration >

Authentication Methods.

The Manage Authentication Methods page opens.

Select LDAP from the New Authentication method drop-down list.

The Properties for new LDAP Authentication Method page opens.

176 Nokia Secure Access System Administrator Guide

Authenticating with External Servers

Enter the Name and Description.

Nokia Secure Access System Administrator Guide 177

Configuring Authentication Methods

Enter the Server Properties.

Enter the hostname or IP address of the LDAP server.

Enter the server port number.

The default port is 389.

Note

If you configure the LDAP authentication method to use a secure connection, you must verify that the gateway CA certificates include the certificate of the CA that issued the server certificate to the LDAP server. For information about how to add CA certificates, see

“Configuring CA Certificates” on page 124. You must also verify that

the server hostname matches the CN field of the subject name in the

LDAP server’s certificate.

Specify a time-out value in seconds.

The default is 30 seconds.

Select the version of LDAP to use (v2 or v3).

Nokia recommends that you use the default v3. When v3 is selected, you can check Use secure connection to specify that TLS be used to securely communicate with the LDAP server.

Specify Username Case Sensitivity.

Click the button to enable one of the following:

Username character case is significant - do not alter it. This is the default setting.

Convert user-entered username to uppercase.

Convert user-entered username to lowercase.

Specify logging.

Check the check box to enable debug logging for LDAP.

178 Nokia Secure Access System Administrator Guide

Authenticating with External Servers

Click Save Settings.

The User Authentication tab and Group Retrieval tabs appear.

Click the User Authentication tab to configure LDAP user authentication. See

Configuring LDAP User Authentication

Click the Group Retrieval tab to configure settings for user groups using LDAP. See

“Configuring LDAP Group Retrieval Settings” on page 183.

Configuring LDAP User Authentication

Use the LDAP User Authentication page to configure settings for authenticating users to the gateway by using LDAP.

To configure LDAP user authentication

From the configuration menu, choose User Configuration >

Authentication Methods.

The Manage Authentication Methods page opens.

Select LDAP from the New Authentication method drop-down list or click an existing LDAP authentication method.

The General Properties page for LDAP authentication opens.

Click the User Authentication tab.

The User Authentication page opens.

Nokia Secure Access System Administrator Guide 179

Configuring Authentication Methods

180

Specify the settings for the user’s DN and select the user’s LDAP entry.

You can select from the following:

Using the entry DN––determines the user DN by using the username and

DN template.

Nokia Secure Access System Administrator Guide

Authenticating with External Servers

The gateway forms the user’s DN by inserting the username that the remote user supplies into the appropriate place in the DN template.

Search the LDAP directory––finds the user’s DN and LDAP entry by searching the LDAP directory for an entry that contains an attribute whose value matches the supplied username. If you choose this option, you must specify:

User attribute––enter the name of the attribute that holds the username. The gateway looks for an entry that has the value of this attribute equal to the supplied username. Example attributes are UID and CN.

Binding method––select a binding option by clicking the appropriate box. This specifies the way that the gateway binds to the LDAP server to perform the search for the user’s entry. The gateway can either bind anonymously or bind as a particular user with the specified DN and password. For example, the gateway can be configured to bind to the

LDAP server as the LDAP root administrator. Binding as a certain, privileged user might be required for the gateway to search for the remote user’s LDAP entry.

Scope of the LDAP search––specify the base DN and choose a scope option. Consider the following example LDAP directory information tree

(DIT):

C=US

O=ExampleCorp

OU=Marketing

CN=Fred

OU=Engineering

CN=Tina

OU=John

An example base DN is O=ExampleCorp, C=US. For the scope option, you can choose from:

Nokia Secure Access System Administrator Guide 181

Configuring Authentication Methods

Base: Check only this DN.

With the example base DN, this option causes the gateway to search only the single entry with the following DN:

O=ExampleCorp, C=US.

One Level: Search one level below the DN.

With the example base DN, this option causes the gateway to search the entries with the following DNs:

OU=Marketing, O=ExampleCorp, C=US.

OU=Engineering, O=ExampleCorp, C=US.

Note that this option does not include searching the entry with DN equal to the base DN.

Subtree: Search all entries including and below this DN.

With the example base DN, this option causes the gateway to search the entries with the following DN’s:

O=ExampleCorp, C=US.

OU=Marketing, O=ExampleCorp, C=US.

CN=Fred, OU=Marketing, O=ExampleCorp, C=US.

OU=Engineering, O=ExampleCorp, C=US.

CN=Tina, OU=Engineering, O=ExampleCorp, C=US.

CN=John, OU=Engineering, O=ExampleCorp, C=US.

Authenticate the User.

You can authenticate the user by:

Attempting to bind (login) with the DN selected above––the DN is obtained from either the DN template or the DN of the user’s entry found by searching the LDAP directory.

Comparing the password found in the entry’s password—the gateway looks up the user’s entry in the LDAP directory and compares the supplies password against a password contained in a specified attribute within that directory.

Click Save Settings.

182 Nokia Secure Access System Administrator Guide

Authenticating with External Servers

Configuring LDAP Group Retrieval Settings

Use the Group Retrieval page to dynamically add group memberships based on information retrieved from the LDAP server.

To configure LDAP group retrieval settings

From the configuration menu, choose User Configuration >

Authentication.

The Manage Authentication Methods page opens.

Select LDAP from the New Authentication method drop-down list or click an existing LDAP authentication method from the Method Name list box.

Click the Group Retrieval tab.

The Group Retrieval page for LDAP opens.

Nokia Secure Access System Administrator Guide 183

Configuring Authentication Methods

184

Specify Static User Group Membership.

This box lists the user groups to which temporary memberships are added for all users that successfully authenticate with the LDAP authentication method. For information about how to add static groups, see

“Configuring

Static Group Assignment” on page 168.

Nokia Secure Access System Administrator Guide

Authenticating with External Servers

Specify Dynamic Group Membership Retrieval.

You can choose from the following settings:

Do not get group memberships from the directory.

Add the value of the RDN attribute from the user’s DN as the user’s group membership.

Specify the DN attribute to be used to obtain group memberships. For example, if you specify the OU attribute, the gateway adds a membership to the Marketing group for the user with the following

DN:

CN=Fred, OU=Marketing, O=ExampleCorp, C=US.

Search the directory for group entries.

With this option selected, the gateway searches the LDAP directory for group entries that contain the authenticated user’s DN. When a group entry of this sort is found, the gateway obtains the group name from a specified attribute in the group’s LDAP entry.

If you choose this option you must specify the base DN and a scope option for the search. For the search scope you can choose from:

Base: Check only this DN.

One Level: Search one level below DN

Subtree: Search all entries below this DN.

To view examples associated with each search scope option, see

“Configuring LDAP User Authentication” on page 179.

This option also requires that you specify the attribute of the group

LDAP entry to be used to obtain the name of the user group. The values of this attribute should match the group names configured for gateway User Groups.

Nokia Secure Access System Administrator Guide 185

Configuring Authentication Methods

Bind (log in) to the directory.

To search the LDAP directory for group entries that contain the user’s

DN, the gateway must know how to bind the LDAP server to perform the search. To bind the server, select from the following options:

Use the same bind used for User Authentication. This is the most efficient option.

Anonymously.

As the following user. If you select this option you must enter the user’s DN and password.

Click Save Settings.

Configuring an NTLM Authentication Method

Use the NTLM authentication method pages to add an NTLM authentication method to the gateway.

To add an NTLM authentication method

From the configuration menu, choose User Configuration >

Authentication Methods.

The Authentication Methods page opens.

Select NTLM from the Authentication method drop-down list.

The Properties for new NTLM Authentication Method page opens.

186 Nokia Secure Access System Administrator Guide

Authenticating with External Servers

Enter the Method Name and Description.

Enter the IP address or hostname of the NTLM server (also referred to as the Windows domain controller).

Specify Username Case Sensitivity.

Click the button to enable one of the following:

Username character case is significant - do not alter it. This is the default setting.

Convert user-entered username to uppercase

Convert user-entered username to lowercase

Nokia Secure Access System Administrator Guide 187

Configuring Authentication Methods

Note

Username handling is case insensitive on NTLM servers. Therefore, authentication results are the same if the user types either jsmith or

JSMITH, for example. However, username processing is case sensitive on the gateway, when matching username strings while evaluating access control policies, retrieving user preferences, and so on. Nokia recommends that you configure NTLM authentication methods so that usernames are converted to either uppercase or lowercase. This ensures that a gateway user is recognized uniquely regardless of whether upper or lower case is used when typing the username at the sign-on page.

Specify logging.

Check the check box to enable debug logging for the NTLM authentication method.

Click Save Settings.

The new NTLM authentication method is added to the gateway. The

Group Retrieval tab appears on the NTLM page.

Configuring NTLM Group Retrieval Settings

Use the Group Retrieval page to dynamically add group memberships based on information retrieved from the NTLM server.

To configure NTLM group retrieval settings

From the configuration menu, choose User Configuration >

Authentication.

The Manage Authentication Methods page opens.

Select NTLM from the New Authentication method drop-down list or click an existing NTLM authentication method from the Method Name list box.

188 Nokia Secure Access System Administrator Guide

Authenticating with External Servers

Click the Group Retrieval tab.

The Group Retrieval page for NTLM opens.

Specify Static User Group Membership.

The Static User Group Membership box lists the user groups to which temporary memberships are added for all users that successfully authenticate with the NIS authentication method. For information about static group membership. see

“Configuring Static Group Assignment” on page 168.

Click Save Settings.

Nokia Secure Access System Administrator Guide 189

Configuring Authentication Methods

Configuring a RADIUS Authentication Method

Use the RADIUS page to configure a RADIUS authentication method.

To configure a RADIUS authentication method

From the configuration menu, choose User Configuration >

Authentication.

The Manage Authentication Methods page opens.

Select RADIUS from the New Authentication method drop-down list.

The Properties for new RADIUS Authentication Method page opens.

190

Enter the Method Name and Description.

Nokia Secure Access System Administrator Guide

Authenticating with External Servers

Specify the server settings.

Enter the hostname or IP address of the RADIUS server in the Primary

Server text box. You can define up to three RADIUS servers. If more than one server is defined, the primary server is always used first.

Enter the authentication port number of the RADIUS server.

Enter and confirm the Shared Secret. The shared secret is used to authenticate transactions with the RADIUS server.

Specify the server time-out value in seconds.

This value defines the length of time that the gateway attempts to communicate with a given RADIUS server. During that time, the gateway retries its exchange with the RADIUS server every 5 seconds

(if the time-out is greater than 5 seconds). Once this time-out period elapses, the gateway switches to the next RADIUS server in the list.

Authentication failure results when the timeout occurs while attempting to communicate with the last RADIUS server in the list.

Specify Username Case Sensitivity.

Click the button to enable one of the following:

Username character case is significant - do not alter it. This is the default setting.

Convert user-entered username to uppercase

Convert user-entered username to lowercase.

Specify logging.

Check the check box to enable debug logging for the RADIUS authentication method.

Click Save Settings.

The Group Retrieval tab appears on the RADIUS page.

Nokia Secure Access System Administrator Guide 191

Configuring Authentication Methods

Specifying RADIUS Group Retrieval Settings

Use the RADIUS Group Retrieval page to configure the retrieval of the Nokia

Secure Access System User Group names from RADIUS attributes.

To specify group retrieval settings for RADIUS

From the configuration menu, choose User Configuration >

Authentication.

The Manage Authentication Methods page opens.

Select RADIUS from the Authentication method drop-down list or click the existing RADIUS server in the Method Name list box.

Click the Group Retrieval tab

The Group Retrieval page for RADIUS opens.

192 Nokia Secure Access System Administrator Guide

Authenticating with External Servers

Specify Static User Group Membership

This box lists the user groups to which temporary memberships are added for all users that successfully authenticate with the

RADIUS authentication method. For information about static group membership, see

“Configuring Static Group Assignment” on page 168.

Select the desired option for dynamic group retrieval.

You can select from the following options:

Do not get group memberships from RADIUS.

Select this option to disable retrieval of group names from RADIUS attributes.

Nokia Secure Access System Administrator Guide 193

Configuring Authentication Methods

Add group memberships from a RADIUS attribute.

Select this option to enable the retrieval of group names from the

RADIUS attribute specified in the list box. The list box contains all standard RADIUS attributes that are of the type string.

If your RADIUS server returns the specified attribute formatted as a distinguished name, the gateway extracts the first relative distinguished name (RDN) from that DN if the check box is enabled.

Add group membership from the Nokia (94) Vendor Specific attribute with vendor type 101.

Select this option to enable retrieval of group names from the

RADIUS vendor specific attribute assigned to Nokia. The vendor type that the gateway uses is 101.

Click Save Settings.

Configuring an NIS Authentication Method

Use the NIS page to configure a NIS authentication method to the gateway.

To add an NIS authentication method

From the configuration menu, choose User Configuration >

Authentication Methods.

The Manage Authentication Methods page opens.

Select UNIX-NIS from the Authentication method drop-down list.

The Properties for the NIS Authentication page opens.

194 Nokia Secure Access System Administrator Guide

Authenticating with External Servers

Enter the Method name and Description.

Specify the Server Properties.

Enter the hostname or IP address of the new NIS server, the NIS domain name, and the server time-out value.

Nokia Secure Access System Administrator Guide 195

Configuring Authentication Methods

Specify Username Case Sensitivity.

Click the button to enable one of the following:

Username character case is significant - do not alter it. This is the default setting.

Convert user-entered username to uppercase.

Convert user-entered username to lowercase.

Specify logging.

Check the check box to enable debug logging for NIS.

Click Save Settings.

The new NIS authentication method is added to the gateway. The Group

Retrieval tab appears on the NIS page.

Specifying NIS Group Retrieval Settings

Use the Group Retrieval page to configure group memberships added for each user that successfully signs on to the gateway with the chosen NIS authentication method.

To specify NIS group retrieval settings

From the configuration menu, choose User Configuration >

Authentication.

The Manage Authentication Methods page opens.

Select NIS from the Authentication method drop-down list or select the existing NIS server in the Method Name list box.

Click the Group Retrieval tab.

The NIS Group Retrieval page opens.

196 Nokia Secure Access System Administrator Guide

Authenticating with External Servers

Specify Static User Group Membership.

This box lists the user groups to which temporary memberships are added for all users that successfully authenticate with the NIS authentication method. For information about static group membership, see

“Configuring Static Group Assignment” on page 168.

Click Save Settings.

Nokia Secure Access System Administrator Guide 197

Configuring Authentication Methods

Authenticating with Certificates

Users can authenticate to the gateway with client certificates present in their

Web browsers. The gateway offers two systems for certificate-based authentication:

Local certificates––a client certificate can be stored on the gateway for each locally defined user. Local certificates are set by the administrator from the configuration system or by the remote user from the user portal

Preferences page. Once a user’s local certificate is set, the user can authenticate with that certificate, provided that the administrator allows the use of the local certificate authentication method for the user. Trusted

CA certificates or other PKI-related settings do not need to be configured since the gateway can compare a client’s certificate against the local certificates in its configuration.

PKI certificates––in a traditional PKI environment, an application can establish trust with a peer even when the peer’s certificate has not been seen before by the application. Trust is established by validating the peer’s certificate chain using a set of CAs that are trusted by the application.

You can create and configure PKI certificate authentication methods so that remote users can authenticate using client certificates that are not stored on the gateway. For each PKI certificate method you must configure the trusted CA certificates and the mechanism to determine a user’s gateway username from a given client certificate.

Use the Authentication pages to configure certificate-based authentication methods, including:

Configuring the Local Certificate Authentication Method

Configuring a PKI Certificate Authentication Method

198 Nokia Secure Access System Administrator Guide

Authenticating with Certificates

Configuring the Local Certificate Authentication

Method

For each locally defined user, the gateway can store a single local certificate in the gateway configuration database. Once a local certificate is specified for a given user, that user can use the certificate to sign on to the gateway. The local certificate authentication method is a predefined method that enables this type of sign-on authentication.

You can configure a user’s local certificate two ways:

You can specify the user’s certificate by adding it to the gateway with the configuration system. You can add the certificate from either the General

User Properties page (see

“Specifying General User Properties” on page

131) or the authentication method properties page for the Local

Certificate method (see

“Configuring the Local Certificate Authentication

Method” on page 199).

Users can set their own local certificate from the user portal Preferences page. This method uses the predefined SetLocalCert Web resource. You can specify the access control policy for that Web resource so that the appropriate restrictions are fulfilled when a user sets a local certificate.

For example, you can require that users connect from the internal enterprise network to set local certificates.

To configure the local certificate authentication method

From the Configuration menu, choose User Configuration >

Authentication.

The Manage Authentication Methods page opens.

From the Method Name list box, click Local Certificate.

The Local Certificate page opens.

Nokia Secure Access System Administrator Guide 199

Configuring Authentication Methods

200

The Local Certificate page displays the settings for the local certificate method and lists all the local certificates currently stored on the gateway.

For each local certificate, the corresponding username appears, along with check boxes that allow you to disable or delete the local certificate.

From this page you can:

Specify logging

Check the check box to enable debug logging for the local certificate method.

View details of local certificates.

Click on the View Cert link to view details of a particular local certificate.

Nokia Secure Access System Administrator Guide

Authenticating with Certificates

View user properties for usernames associated with local certificates.

Click on the username to open the User Properties page for the user. If the username text is not a link, the local certificate is associated with a username that is currently not defined on the gateway. In this case, the

Name field displays user not defined instead of the Name configured for the user.

Disable a local certificate.

Check the Disable check box for the certificate. Once you click Save

Settings, the gateway is prevented from accepting the specified certificate during user sign on.

Delete a local certificate.

Check the Delete check box for the certificate. Once you click Save

Settings, the specified certificate is deleted from the gateway.

Use Prev and Next to navigate through the list of local certificates.

Enter a number in the Show field to specify the number of local certificates to show in one page of this listing. A page can show from 5 to 200 local certificates. Twenty certificates per page is the default.

When changes are complete, click Save Settings.

To add a local certificate to the gateway

From the Configuration menu, choose User Configuration >

Authentication.

The Manage Authentication Methods page opens.

From the Method Name list box, click Local Certificate.

The Local Certificate page opens.

Click the Add Cert tab.

The Add Cert page opens.

Copy and paste the client certificate into the Add Certificate box. Paste the entire certificate data text, including the BEGIN and END lines.

Nokia Secure Access System Administrator Guide 201

Configuring Authentication Methods

Specify the username in the Bind certificate to this username box.

The username string should match the user’s gateway username exactly.

The user’s username does not need to be in the gateway configuration to add a user’s local certificate.

Click Save Settings.

The new local certificate is added to the gateway configuration.

Specifying Local Certificate Group Retrieval

Settings

Use the Group Retrieval page to configure group memberships added for each user that successfully signs on with the Local Certificate authentication method.

To specify local certificate group retrieval settings

From the configuration menu, choose User Configuration >

Authentication.

The Manage Authentication Methods page opens.

Select Local Certificate from the Authentication method drop-down list or click the existing local certificate in the Method Name list box.

Click the Group Retrieval tab.

The Local Certificate Group Retrieval page opens.

202 Nokia Secure Access System Administrator Guide

Authenticating with Certificates

Specify Static User Group Membership.

This box lists the user groups to which temporary memberships are added for all users that successfully authenticate with the local certificate authentication method. For information about static group membership, see

“Configuring Static Group Assignment” on page 168.

Click Save Settings.

Nokia Secure Access System Administrator Guide 203

Configuring Authentication Methods

Configuring a PKI Certificate Authentication Method

A PKI certificate authentication method enables the gateway to integrate with an enterprise’s public-key infrastructure. In this scheme, the gateway does not store a certificate for each user. Instead, you configure the gateway with the desired set of trusted CA certificates as well as the mechanism for determining a gateway username from a given client certificate. You can also specify dynamic group membership retrieval for PKI certificate authentication methods, so that the gateway can find group membership information in a user’s certificate during sign on.

Note

Each PKI certificate authentication must have a distinct set of trusted CA certificates. In other words, you cannot trust any CA certificate for more than one PKI certificate authentication method.

To configure a PKI certificate authentication method

From the Configuration menu, choose User Configuration >

Authentication.

The Manage Authentication Methods page opens.

Select PKI Certificate from the drop-down list.

The properties page for the new PKI Authentication Method page opens.

204 Nokia Secure Access System Administrator Guide

Authenticating with Certificates

The PKI properties page shows all CA certificates that are trusted for use with the authentication method, with each CA certificate listed by its certificate ID. For a new PKI certificate authentication method, this list is initially empty. Once trusted CA certificates are added for a PKI certificate method, you can use this page to view the certificate details or delete the certificate by clicking the appropriate links in the Actions column.

Enter the Method Name and Description of the new authentication method.

Specify logging.

Check the check box to enable debug logging for the authentication method.

Click Save Settings.

The Add CA Cert tab and Username Mapping tabs appear.

To add a CA certificate for this PKI certificate authentication method, click the Add CA Cert tab. See

“Adding a Certificate” on page 121.

To map certificates to usernames, click the Username Mapping tab.

See

“Specifying Username Mapping” on page 206.

Nokia Secure Access System Administrator Guide 205

Configuring Authentication Methods

Specifying Username Mapping

Use the Username Mapping page to specify the settings for mapping client certificates to usernames and settings for group memberships added by the

PKI certificate authentication method.

When a user signs on to the gateway by authenticating with a PKI certificate authentication method, the gateway must determine the username associated with the user. You can map client certificates to gateway usernames in three ways. These are described in step 4 of the following procedure.

To specify username mapping

From the Configuration menu, choose User Configuration >

Authentication.

The Manage Authentication Methods page opens.

Click the name of the PKI certificate authentication method from the certificate-based Method Name list box.

The properties page for the specified PKI certificate authentication method opens.

Click the Username Mapping tab.

The Username Mapping page opens.

206 Nokia Secure Access System Administrator Guide

Authenticating with Certificates

Nokia Secure Access System Administrator Guide 207

Configuring Authentication Methods

Specify Username Mapping settings.

You can choose from the following:

Retrieve username from the following attribute in the subject

DN––the gateway examines the subject distinguished name (DN) of the certificate and extracts the username from the attribute chosen from the drop-down list. For instance, the CN attribute might contain the gateway username, as with the following example DN:

CN=jsmith, OU=Engineering, O=ExampleCorp, C=US

For a description of the DN attributes, see Table 10 on page 121.

Use explicit username mapping––you can configure a complete list of certificate distinguished names and their corresponding usernames.

This table explicitly maps DNs to usernames. Click Edit Mapping

Table to view the list of mappings. On the Edit Mapping Table page you can add new DN-to-username mappings or delete existing mappings.

Note

When you enter DNs in the mapping table, you must list the attributes of the DN in the correct order.

Use LDAP lookup––the gateway uses an LDAP server to map the subject DN of the certificate to a gateway username. The settings specifying the LDAP server, binding method, and so on are taken from the LDAP authentication method chosen from the drop-down list.

Click Save Settings.

Specifying PKI Group Retrieval Settings

The Username Mapping page also contains settings that govern the group membership retrieval for the PKI certificate authentication method.

As with all authentication method types, you can specify static group membership for PKI certificate methods. This adds temporary group

208 Nokia Secure Access System Administrator Guide

Authenticating with Certificates

memberships for all users that successfully sign on with the PKI certificate authentication method in question.

With PKI certificate authentication methods, you can also configure the gateway to retrieve group membership information dynamically by using the user’s certificate. You can perform dynamic group membership retrieval either by examining specified attributes of the certificate subject DN, or by using the dynamic group membership retrieval configured for a selected

LDAP authentication method.

To configure PKI certificate group retrieval settings

From the Configuration menu, choose User Configuration >

Authentication.

The Manage Authentication Methods page opens.

Click the name of the PKI certificate authentication method from the

Certificate-Based Method Name list box.

The properties page for the specified PKI certificate authentication method opens.

Click the Username Mapping tab.

The Username Mapping page opens.

Nokia Secure Access System Administrator Guide 209

Configuring Authentication Methods

210

Specify Static User Group Membership.

The Specify Static User Group Membership box lists the user groups to which temporary memberships are added for all users that successfully authenticate with the PKI certificate authentication method.

For information about static group membership. see

“Configuring Static

Group Assignment” on page 168.

Nokia Secure Access System Administrator Guide

Authenticating with Certificates

Specify Dynamic User Group Membership Retrieval.

Check the check box to enable the following:

Do not get group membership from the certificate.

Add group membership by using dynamic retrieval as configured for

LDAP authentication method.

The gateway can use the user's subject DN from the certificate to look up information about the user in an LDAP server that the selected

LDAP authentication method specifies.

The group information is retrieved according to the settings on the

Group Retrieval tab of the selected LDAP authentication method. For details about these settings, see

“Configuring an LDAP Authentication

Method” on page 174.

Add group membership from RDN attributes in the user’s certificate

DN.

You can use a user's certificate subject DN to convey group membership. For example, the following DN might indicate that the user jsmith belongs to both the management group and the engineering group:

CN=jsmith, OU=Mgnt, OU=Eng, O="Examples, Inc.",

C=US

These group memberships could be recognized by the gateway if the

Eng and Mgnt groups are defined on the gateway and the PKI certificate authentication method is configured to retrieve group memberships from the OU attribute.

You can enter multiple attributes in the text box for the Add group memberships from the RDN attributes in the user's certificate DN option. Separate these attributes by commas. For instance, typing OU,

O in this textbox specifies that both the OU and O attributes are to be used for dynamic group retrieval.

Click Save Settings.

Nokia Secure Access System Administrator Guide 211

Configuring Authentication Methods

212 Nokia Secure Access System Administrator Guide

Configuring Web Resources

This chapter describes how to configure Web resources for the Nokia Secure

Access gateway, including:

Using Predefined Web Resources

Managing Web Resources

Configuring the Default Web Proxy

The gateway provides secure access to enterprise Web servers determined by the gateway administrator. By configuring Web resources, the administrator can define exactly what Web servers a user can access. A Web resource defines a backend HTTP or HTTPS server based on a URL called the base

URL, for example: http://marketing.company.com/

A Web resource can also define a subset of a backend Web server, if the administrator allows user access to that subset only. For example, a Web resource could be defined by: https://hr.company.com/forms/

Nokia Secure Access System Administrator Guide 213

Configuring Web Resources

Using Predefined Web Resources

The Nokia Secure Access system provides several predefined Web resources, which cannot be deleted.

Table 14 describes each predefined Web resource.

Table 14 Description of Predefined Web Resources

Resource type Description

Default Web

Config

Set local password

Set local certificate

Used when a user requests a Web URL that does not match any resource configured by the administrator. The default Web resource allows the administrator to allow all Web requests, without having to define a Web resource for every backend server. The default Web resource can be disabled if the administrator desires tighter control. However, it cannot be deleted.

The config resource is the configuration system of the gateway. The configuration system is treated like any other resource, so the administrator can define access control rules as desired.

The config resource cannot be disabled or deleted.

Internal resource within the gateway that corresponds to the page a remote user can use to change their local password. The access control rules for this resource are used to determine whether a local user is allowed to change their local password. For example, the administrator might decide that users can only change their password from an internal network, and so might apply

IP-based restrictions here.

Users who are allowed to change their local password and are allowed to use local password authentication will see a link to do so on their portal page.

The set local password resource cannot be disabled or deleted.

Internal resource within the gateway that corresponds to the page a remote user can use to set their local certificate.

The access control rules on this resource are used to determine whether a local user is allowed to set their local certificate. For example, the administrator might decide that users can only set their local certificate from an internal network, and so might apply IP-based restrictions here.

Users who are allowed to set their local certificate and are allowed to use local certificate authentication see a link to do so on their portal page.

The set local certificate resource cannot be disabled or deleted.

214 Nokia Secure Access System Administrator Guide

Managing Web Resources

Managing Web Resources

Use the Manage Web Resources pages to manage and configure Web resources on the gateway, including:

Adding a New Web Resource

Disabling or Deleting a Web Resource

Adding a New Web Resource

Use the Manage Web Resources page to add a Web Resource to the gateway.

To add a Web resource

From the configuration menu, select Resources > Web.

The Manage Web Resources page opens.

Nokia Secure Access System Administrator Guide 215

Configuring Web Resources

216

The Manage Web Resources page lists all Web resources defined on the gateway.

Note

To view or change Web resource properties, click the name of the resource from the Resource Name list box.

Click New Resource.

The Properties for Web Resource page opens.

Nokia Secure Access System Administrator Guide

Managing Web Resources

Enter the Resource Name and Description.

All resources have unique names and cannot be duplicated. For example, a file resource cannot have the same name as a Web resource.

Nokia Secure Access System Administrator Guide 217

Configuring Web Resources

Enter the title to appear on the user portal in the Link Text field.

This text appears on the user portal page as a hyperlink for the Web resource.

For example, you can configure the resource name Enterprise Accounting to appear on the user portal as Click here to go to Enterprise Accounting.

Enter the base URL.

The base URL specifies the backend Web server URL that corresponds to the Web resource. The base URL must begin with either http:// or https//.

For example: http://hr.company.com/.

Specify the proxy settings.

You can configure Web resources to use:

No proxy. The gateway communicates directly with the Web server.

The default HTTP proxy.

A specific HTTP or HTTPS proxy. If you select this option, enter the

IP address and port number of the proxy server.

Specify logging.

Check the check box to:

Enable debug logging for this resource.

Enable auditing messages for this resource.

For information about logging, see

“Configuring the Gateway Log

Settings” on page 67.

Click Save Settings.

The Simple and Advanced Access Control tabs appear. Use these options to configure ACLs for the new resource. See

“Configuring Access

Control Rules” on page 265.

218 Nokia Secure Access System Administrator Guide

Managing Web Resources

Disabling or Deleting a Web Resource

Use the Web Resources page to disable or delete a Web resource from the gateway.

To disable or delete a Web resource

From the configuration menu, click Resources > Web.

The Manage Web Resources page opens.

The Manage Web Resources page includes a list box that contains all Web resources defined on the gateway.

To disable a resource, check the Disable check box.

Nokia Secure Access System Administrator Guide 219

Configuring Web Resources

To delete a resource, check the Delete check box.

Note

You cannot disable the config, local certificate and local password resources. You can only disable the default Web resource.

Click Save Settings.

Configuring the Default Web Proxy

Use the System-Wide Web Proxies page to configure Web proxy servers. A

Proxy server acts as an intermediary between the gateway and the HTTP or

HTTPS server. You can use proxy servers for caching, filtering, and auditing purposes. Proxy settings can be configured on a global and per-resource basis.

To specify a Web proxy

From the configuration menu, select Resources > Web.

The Manage Web Resources page opens.

Click the Proxies tab.

The System-Wide Web Proxies page opens.

220 Nokia Secure Access System Administrator Guide

Managing Web Resources

Configure the proxy settings.

Enter the IP address and port number for the default HTTP and

HTTPS proxies.

Click Save Settings.

Nokia Secure Access System Administrator Guide 221

Configuring Web Resources

222 Nokia Secure Access System Administrator Guide

Configuring File Resources

This chapter describes how to configure file resources for the Nokia Secure

Access gateway, including:

Using Default File Resources

Managing File Resources

The gateway provides remote users secure access to enterprise file servers through file resources. Using file resources, users can when their administrator permits, download and upload files, view files, delete files, and

create directories from the user portal page. Table 15 describes the types of

file servers that the gateway supports.

Table 15 Types of File Servers

Server type Description

Windows File servers using the SMB protocol (sometimes referred to as the CIFS protocol). File shares on machines running Windows are served using that protocol. UNIX machines running the Samba server are also supported.

The remote user authenticates to an SMB file server with a username and password.

Nokia Secure Access System Administrator Guide 223

Configuring File Resources

Table 15 Types of File Servers (continued)

Server type Description

Network File System (NFS)

File Transfer Protocol (FTP)

File servers using the Network File System (NFS) protocol. UNIX systems typically support NFS.

The remote user authenticates to an NFS file server by using a UID and GID.

File servers using the File Transfer Protocol

(FTP). FTP servers run on both UNIX and

Windows systems.

The remote user authenticates to an FTP file server with a username and password.

Regardless of the file server type, the remote user is presented with the same file-browsing interface from the user portal.

Using Default File Resources

Each file resource type (Windows, NFS, and FTP) has a default resource that resides on the gateway. If the client requests a URL that does not match any defined file resource, the gateway uses the default file resource of the requested type.

You can configure the properties of the default Windows, NFS, and FTP file resources. From each resource page, you can:

Disable the resource—If the resource is disabled, all client URL requests must match the file resources already defined.

Specify ACLs—Use ACLs to specify rules for file access. See

“Configuring Access Control Rules” on page 265.

Note

The default Windows, NFS, and FTP file resources are predefined on the gateway and cannot be removed. However, they can be disabled.

224 Nokia Secure Access System Administrator Guide

Managing File Resources

The Properties for Windows Resource screen shows an example of the properties page for the default Windows resource.

Managing File Resources

Use the Resource page to manage all file resources on the gateway, including:

Configuring Windows File Resources

Configuring NFS File Resources

Configuring FTP File Resources

Nokia Secure Access System Administrator Guide 225

Configuring File Resources

Configuring Windows File Resources

This section describes how to configure file resources for Windows file servers, including:

Adding a New Windows File Resource

Disabling or Deleting a Windows File Resource

Adding a New Windows File Resource

Use the Manage Windows Resource page to add a New Windows file resource to the gateway.

To add a new Windows file resource

From the configuration menu, choose Resources > File.

The Manage Windows Resources page opens.

226 Nokia Secure Access System Administrator Guide

Managing File Resources

The Manage Windows Resource page lists the Windows resources defined on the gateway.

Note

To view or change Windows resource properties, click the name of the resource from the Resource Name list box.

Click New Resource.

The Properties for Windows Resource page opens.

Nokia Secure Access System Administrator Guide 227

Configuring File Resources

Enter the Resource Name and Description.

Note

A Windows domain name is not required for the file resource.

Enter the title to appear on the user portal in the Portal Link Text field.

This text appears on the user portal page as a hyperlink under Resources.

Enter the base URL.

The base URL must include the protocol field (smb://) and specify the backend file server (or directory) that corresponds to the file resource. For example: smb://servername.example.com/home

Specify logging.

Check the check box to:

Enable debug logging for this resource.

Enable auditing messages for this resource.

For information about logging, see

“Configuring the Gateway Log

Settings” on page 67.

Click Save Settings.

The resource is added to the Resource Name list box.

The Simple and Advanced Access Control tabs appear. Use these tabs to configure ACLs for the new resource. See

“Configuring Access Control

Rules.”

228 Nokia Secure Access System Administrator Guide

Managing File Resources

Disabling or Deleting a Windows File Resource

Use the Windows Resource page to disable or delete a Windows file resource from the gateway.

To disable or delete a Windows file resource

From the configuration menu, click Resources > File.

The Manage Windows Resources page opens.

Do one of the following:

To disable a resource, check the Disable check box.

The resource remains on the gateway but is unavailable to the user.

To delete a resource, check the Delete check box.

The resource is permanently removed from the gateway.

Click Save Settings.

Nokia Secure Access System Administrator Guide 229

Configuring File Resources

Configuring NFS File Resources

This section describes how to configure NFS file resources for NFS file servers, including:

Adding an NFS File Resource

Disabling or Deleting a NFS File Resource

Adding an NFS File Resource

Use the File Resources page to add an NFS file resource to the gateway.

To add an NFS file resource

From the configuration menu, click Resources > File.

The Manage Windows Resources page opens.

Click the NFS tab.

The Manage NFS Resources page opens.

230 Nokia Secure Access System Administrator Guide

Managing File Resources

The Manage NFS Resources page lists all NFS resources defined on the gateway.

Note

To view or change NFS resource properties, click the name of the resource from the Resource Name list box.

Click New Resource.

The Properties for NFS Resource page opens.

Nokia Secure Access System Administrator Guide 231

Configuring File Resources

232 Nokia Secure Access System Administrator Guide

Managing File Resources

Enter the Resource Name and Description.

Enter the resource text in the Portal Link Text field.

This text appears on the user portal page as a hyperlink under Resources.

Enter the base URL.

The base URL must include the protocol field (nfs://) and specify the backend file server (or directory) that corresponds to the file resource. For example: nfs://servername.example.com/home

Specify UID Mapping.

For mounting NFS shares and determining file permissions, the gateway must pass the remote user’s UNIX UID and GID to the NFS server. The gateway uses two methods to determine the user’s UID and GID:

Use NIS server for mapping usernames to UIDs.

You can configure a NIS server to retrieve users UID and GIDs. Enter the hostname or IP address of the NIS server, domain name, and a server request timeout value.

The gateway receives the UID and GID during sign on if the following conditions are true:

The remote user signs on to the gateway by using an NIS authentication method.

The NIS server that is configured to use with the requested NFS file resource is the same as the NIS server in the authentication method.

Otherwise, when the user tries to gain access to the resource, the gateway sends the request to the NIS server that is configured for the

NIS file resources to find the UID and GID.

Nokia Secure Access System Administrator Guide 233

Configuring File Resources

Use default mapping.

Enter the default UID and GID. These values are passed to the NFS server for each user who tries to access the resource.

Note

The permissions that correspond to the specified UID and GID are restricted.

Specify logging.

Check the check box to:

Enable debug logging for this resource.

Enable auditing messages for this resource.

For information about logging, see

“Configuring the Gateway Log

Settings” on page 67.

Click Save Settings.

The resource is added to the Resource Name list box

The Simple and Advanced Access Control tabs appear. Use these options to configure ACLs for the new resource. See

“Configuring Access

Control Rules” on page 265.

Disabling or Deleting a NFS File Resource

Use the File Resources page to disable or delete an NFS file resource from the gateway.

To disable or delete an NFS file resource

From the configuration menu, click Resources > File.

The Manage Windows Resources page opens.

Click the NFS tab.

The Manage NFS Resources page opens.

234 Nokia Secure Access System Administrator Guide

Managing File Resources

Do one of the following:

To disable a resource, check the Disable check box.

The resource remains on the gateway but is unavailable to the user.

To delete a resource, check the Delete check box.

The resource is permanently removed from the gateway.

Click Save Settings.

Nokia Secure Access System Administrator Guide 235

Configuring File Resources

Configuring FTP File Resources

This section describes how to configure FTP file resources for FTP file servers, including:

Adding an FTP File Resource

Disabling or Deleting an FTP File Resource

Adding an FTP File Resource

Use the File Resources page to add an FTP file resource to the gateway.

To add an FTP file resource

From the Configuration menu, click Resources > File.

The Manage Windows Resources page opens.

Click the FTP tab.

The Manage FTP Resources page opens.

236 Nokia Secure Access System Administrator Guide

Managing File Resources

The Manage FTP Resources page lists all FTP resources defined on the gateway.

Note

To view or change FTP resource properties, click the name of the resource from the Resource Name list box.

Click New Resource.

The Properties for FTP Resource page opens.

Nokia Secure Access System Administrator Guide 237

Configuring File Resources

Enter the Resource Name and Description.

Enter the resource text in the Portal Link Text field.

This text appears on the user portal page as a hyperlink under Resources.

Enter the base URL.

The base URL must include the protocol field (ftp://) and specify the backend file server (or directory) that corresponds to the file resource.

For example: ftp://servername.example.com/home

Specify logging.

Check the check box to:

Enable debug logging for this resource.

Enable auditing messages for this resource.

For information about logging, see

“Configuring the Gateway Log

Settings” on page 67.

Click Save Settings.

The resource is added to the Resource Name list box.

The Simple and Advanced control tabs appear. Use these options to configure ACLs for the new resource. See

“Configuring Access Control

Rules” on page 265.

Disabling or Deleting an FTP File Resource

Use the File Resources page to disable or delete an FTP file resource from the gateway.

To disable or delete an FTP file resource

From the configuration menu, click Resources > File.

The Manage Windows Resources page opens.

Click the FTP tab.

The Manage FTP Resources page opens.

238 Nokia Secure Access System Administrator Guide

Managing File Resources

Do one of the following:

To disable a resource, check the Disable check box.

The resource remains on the gateway but is unavailable to the user.

To delete a resource, check the Delete check box.

The resource is permanently removed from the gateway

Click Save Settings.

Nokia Secure Access System Administrator Guide 239

Configuring File Resources

240 Nokia Secure Access System Administrator Guide

Configuring Email Resources

This chapter describes how to configure email resources for remote user access to the secure email proxy, including:

Supported Email Clients

Supported Email Servers

Configuring Client-Side Email Settings

Configuring Email Resource Authentication Settings

Managing Email Resources

The Nokia Secure Access gateway provides a secure email proxy that allows remote users to send and receive email by using email client software that supports POP3, IMAP4, and SMTP protected with SSL/TLS. This feature works in parallel with the Web-based services that the gateway provides through the Web browser interface.

An email resource is an abstraction that allows the user to select from multiple email accounts. Like other resource types, email resources specify the settings for the gateway to communicate with backend servers as well as the access control policy associated with this communication. The administrator can also configure the user portal to include links for selecting different email resources. In contrast to other resource types, a user can have a default email resource selected. The default email resource is the email resource that is loaded into the secure email proxy for the user at any given time. A user can select an email resource as their default resource by clicking on the email resource link in the user portal.

Nokia Secure Access System Administrator Guide 241

Configuring Email Resources

Configuring the secure email proxy requires three steps:

Configuring Client-Side Email Settings

Configuring Email Resource Authentication Settings .

Adding a New Email Resource

After you configure the secure email proxy on the gateway, you must configure the email client to connect to the gateway instead of the mail server.

This requires that you enter settings for hostname, protocol, ports, usernames and passwords, and security settings. For instructions on how to enter this information, see the documentation provided with your email client.

Supported Email Clients

The Nokia secure email proxy should work with any standards-compliant client that implements the POP3, IMAP4, or SMTP protocols with SSL/TLS.

The following email clients were tested and verified to work with the gateway:

Outlook Express v6.0

Outlook 2000 and Outlook 2002

Lotus Notes v5.0.11 (with port-forwarding)

Note

For information on how to setup a particular email client, see the documentation provided with your email client software.

242 Nokia Secure Access System Administrator Guide

Supported Email Servers

Supported Email Servers

The Nokia Secure Email Proxy should work with any standards-compliant server that implements the POP3, IMAP4, or SMTP protocols with SSL/TLS.

The following email servers were tested and verified to work with the gateway:

Eudora QPopper (POP only)

Microsoft Exchange (POP, IMAP, and SMTP)

Lotus Notes (POP and SMTP)

Configuring Client-Side Email Settings

This section describes how to configure settings for incoming email client connections, including:

Specifying Interfaces, Protocols, and Port Settings for Email Connections

Entering IMAP and POP Capability Strings

Specifying Interfaces, Protocols, and Port Settings for

Email Connections

Use the Email Resource Client-Side Settings page to configure the gateway to accept secure email connections. You can enable each email protocol, specify the ports to listen on, and select which method of SSL/TLS negotiation is used. The two ways that POP, IMAP, and SMTP clients can communicate securely to their corresponding servers are:

STARTTLS—the client connects to the same server port as that typically used for ASCII text exchange. After the initial handshake, the client sends the

STARTTLS command (or

STLS

in the case of POP), which initiates a

TLS handshake. When the handshake completes, the secure channel is established and the email protocol exchange continues over the encrypted channel.

Nokia Secure Access System Administrator Guide 243

Configuring Email Resources

SSL/TLS Port—the client connects to a port that is specifically intended for secure POP, IMAP, or SMTP communication. The SSL/TLS handshake is performed immediately after the TCP connection is established. Once the secure channel is established, the POP, IMAP, or

SMTP protocol exchange proceeds.

Note

By default, the gateway is not configured to accept email connections. To

configure the gateway, see “To specify client-side email settings.”

To specify client-side email settings

From the configuration menu, click Resources > Email.

The Manage Email Resources page opens.

Click the Client-Side Settings tab.

The Email Resource Client-Side Settings page opens.

244 Nokia Secure Access System Administrator Guide

Configuring Client-Side Email Settings

Specify the interfaces on which to listen for secure email connections.

The proxy listens on the specified ports on each enabled interface IP address. The network interfaces shown in the Client-Side Settings page

Nokia Secure Access System Administrator Guide 245

Configuring Email Resources

are those that the IPSO appliance configured and made active. The interface names might vary depending on the appliance model.

To configure the network interface and specify their IP addresses, click

System > Voyager to open the Voyager page and select Interface

Configuration.

Note

After you change interface configuration settings in Voyager, you must return to the Email Resources > Client-side Settings page to ensure that the gateway listens on the desired interface addresses.

Specify the ports to listen for secure email connections.

Check the check box to enable or disable STARTTLS or SSL/TLS ports for POP, IMAP, and SMTP and enter the corresponding port number.

Note

If you save changes on this page, the gateway restarts and requires that you sign on again.

Enter the capability strings.

See

“Entering IMAP and POP Capability Strings” on page 247. You can

enter strings for both IMAP and POP.

Specify a separator character in the username. The default character is @.

The user uses this character to specify which email resource to use. The character separates the username from the email resource name. For example: johndoe@myresource.

Note

In the example, johndoe@myresource, myresource refers to a Nokia

Secure Access Gateway email resource name. It is not a domain name.

246 Nokia Secure Access System Administrator Guide

Configuring Client-Side Email Settings

Click Save Settings.

The gateway automatically reboots and you must sign on to the gateway again.

Entering IMAP and POP Capability Strings

Use the Email Resource Client-Side Settings page to specify IMAP and POP capability strings. Capability strings are typically short strings that describe what capabilities are supported by the server. This section describes how to enter these strings.

Note

Because the email client connects to the secure email proxy directly, it might query the server for additional capabilities before the proxy connects to the backend server.

Entering IMAP Capability Strings

When you enter IMAP capability strings:

Enter a space-separated list of IMAP capability names that all of your backend servers support. The gateway returns to the client the capability names that you enter. They are subject to the following rules:

Unless the

IMAP4

IMAPrev1

names are specifically entered, the gateway always precedes the capabilities list with

IMAPrev1.

If capabilities are requested before TLS starts, the gateway adds the

LOGINDISABLED

and

STARTTLS

capability names.

If the

AUTH

capability name is entered, it is automatically removed.

The gateway does not support SASL authentication for IMAP.

Nokia Secure Access System Administrator Guide 247

Configuring Email Resources

Note

To check the capabilities that your backend servers support, see the server documentation. For details on IMAP formats, see RFC2060.

Entering POP Capability Strings

When you enter POP capability strings:

Enter the lists of POP capability names that all of your backend servers support. Each must be entered on a separate line. The gateway returns to the client the capability names that you configure. They are subject to the following rules:

If STLS and USER are not entered, the gateway automatically adds them to the string.

If SASL is entered, it is automatically removed. The gateway does not support SASL authentication for POP.

Note

To check the capabilities that your backend servers support, see the server documentation. For details on POP commands, see RFC2449.

Configuring Email Resource Authentication

Settings

Use the Authentication page to specify how the Secure Email Proxy obtains usernames and passwords used to authenticate the user to the backend email server.

When the gateway secure email proxy accepts a client email connection, the gateway first authenticates the user to the gateway itself. The gateway obtains the username and password from the username and password strings that the email client supplies. The gateway username and password are processed in

248 Nokia Secure Access System Administrator Guide

Configuring Email Resource Authentication Settings

the same way as when they are supplied at the sign-on page for the Web interface: the gateway uses the appropriate password-based authentication methods to validate the user.

Note

The secure email proxy does not support authentication using certificates.

Once the user authenticates to the gateway, the secure email proxy determines the username and password strings to use to authenticate the user to the backend email servers associated with the desired email resource. The gateway can be configured to obtain the backend username and password from up to three sources:

If enabled, the gateway attempts to obtain the backend credentials from the username and password strings that the email client supplies.

Specifically, the gateway attempts to break each string into two pieces, divided by a separator character (for example, the semicolon) that the gateway administrator chooses. This allows users to specify both their gateway username and password and their email server username and password, by typing into their email clients strings similar to the following examples:

Username: gateway_username;email_server_username

Password: gateway_password;email_server_password

If persistent passwords for email resources are allowed for the user, the gateway attempts to use the user's stored username and password for the email resource in question. See

“Configuring User Properties” on page 131.

If enabled, the gateway attempts to authenticate the user to the backend email server by using the same username and password that authenticated the user to the gateway itself.

These three methods are attempted in the preceding order. If the first option is disabled, users receive authentication errors when they supply username and password strings intended for use with that option.

Nokia Secure Access System Administrator Guide 249

Configuring Email Resources

If persistent passwords for the email resource is allowed, the gateway always saves a backend username and password that succeeds in authenticating the user to the email server in question. The user can also enter the backend username and password on the Web page that the user sees after they select the email resource.

Note

By default, persistent passwords for email resources are disabled. To enable persistent passwords, see

“Specifying User Session Properties” on page 138 or

“Specifying User Group Session Properties” on page 153.

To specify email authentication settings

From the configuration menu, click Resources > Email.

The Manage Email Resources page opens.

Click the Authentication tab.

The Email Resource Authentication page opens.

250 Nokia Secure Access System Administrator Guide

Configuring Email Resource Authentication Settings

Specify user authentication settings for the email server.

Nokia Secure Access System Administrator Guide 251

Configuring Email Resources

The gateway authenticates the user to the email server in this order:

Using a second username and password, if the email client supplies them.

If you enable this option, you might also want to enter the separator character. By default, the gateway looks for a semicolon (;) between username and password pairs. For example: gateway_username;email_server_username and gateway_password;email_password.

Using persistent passwords for the Email Resource, if allowed.

Using the same username and password from the email client that was used to authenticate the user to the gateway.

Note

You cannot disable email resources from the Authentication page. To disable email resources for both user and user group properties, see

“Specifying User Portal Properties” on page 135 or

“Specifying User

Group Portal Properties” on page 151.

Click Save Settings.

Managing Email Resources

Use the Manage Email Resources pages to manage and configure all email resources on the gateway, including:

Adding a New Email Resource

Disabling or Deleting an Email Resource

252 Nokia Secure Access System Administrator Guide

Managing Email Resources

Adding a New Email Resource

Use the Manage Email Resources page to add a new email resource to the gateway.

To add a new email resource

From the configuration menu, click Resources > Email.

The Manage Email Resources page opens.

The Manage Email Resources page lists all email resources defined on the gateway.

Click New Resource.

The Properties for Email Resource page opens.

Nokia Secure Access System Administrator Guide 253

Configuring Email Resources

254

Enter the Resource Name and Resource Description.

Enter the text for the resource in the Portal Link Text field.

This text appears on the user portal as a link for the email resource.

Specify Mail Servers.

Enter the host address and port number of the desired backend mail server used for the email resource. You can define settings for POP, IMAP, and

SMTP mail servers. At least one of these servers must be defined.

Nokia Secure Access System Administrator Guide

Managing Email Resources

Note

To view or change the email resource properties, click the name of the resource in the Resource Name list box.

Specify logging.

Check the check box to:

Enable debug logging for this resource.

Enable auditing messages for this resource.

Click Save Settings.

The Simple and Advanced Access Control tabs appear.

Use these options to configure ACLs for the new resource. See

“Configuring Access Control Rules.”

Click Save Settings again.

The resource is added to the Email Resources list box.

Disabling or Deleting an Email Resource

Use the Email Resources page to disable or delete an email resource from the gateway.

To disable or delete an email resource

From the configuration menu, choose Resources > Email.

The Manage Email Resources page opens.

Nokia Secure Access System Administrator Guide 255

Configuring Email Resources

The Manage Email Resources page includes a list box of all email resources currently defined on the gateway.

To disable an email resource, check the Disable check box.

To delete an email resource, check the Delete check box.

Click Save Settings

256 Nokia Secure Access System Administrator Guide

Configuring Port-Forwarding

Resources

The Nokia Secure Access Gateway is designed to allow external users to securely access an internal network. The main way the remote user obtains this access is by using the Web browser to connect to the gateway over an

SSL-protected HTTP channel (HTTPS). The Web browser makes it easy to access Web-based services and files on the internal network. However, it does not address client-server applications that are not Web-enabled.

For client-server applications that are not Web-enabled, you can configure a port-forwarding proxy. This proxy allows any TCP/UDP traffic between the client and backend servers to be channeled over the protected HTTPS connection. The port-forwarding proxy consists of a signed Java applet that runs on the client platform. Once it is running on the client, the proxy listens for connections on specified local ports. External applications connect to those ports and all subsequent data traffic is forwarded over the HTTPS connection by the proxy. A relay, which resides on the gateway, then sends the traffic that the proxy applet forwards to the appropriate address and port on the backend server.

Nokia Secure Access System Administrator Guide 257

Configuring Port-Forwarding Resources

You can configure port-forwarding functionality by using port-forwarding resources. These resources have settings that govern the ports that the client listens on, as well as the hostname and port for each forwarded channel. You can configure a port-forwarding resource so that a remote user can run multiple port-forwarding connections concurrently. You can also configure a port-forwarding resource to forward communication between Microsoft

Outlook clients and Exchange servers located on the intranet for your organization.

Managing Port-Forwarding Resources

Use the Manage Port-Forwarding pages to manage and configure all portforwarding resources on the gateway, including:

Port-Forwarding Requirements

Adding a New Port-Forwarding Resource

Disabling or Deleting a Port-Forwarding Resource

Port-Forwarding Requirements

For port-forwarding resources that support Microsoft Outlook and Exchange, the following is required:

Windows 98, ME, XP, NT, or 2000

Internet Explorer v5.0 or later, Netscape v6.2 or later, or Mozilla v1.x with the Sun Java 1.4.1 plug-in

Outlook 2000 or Outlook 2002

Microsoft Exchange Server 6

258 Nokia Secure Access System Administrator Guide

Managing Port-Forwarding Resources

If you are configuring a port-forwarding resource that is not using Outlook

Exchange, only Internet Explorer v5.0 or later, Netscape v6.2 or later, or

Mozilla v1.x with the Sun Java 1.4.1 plug-in is required.

Note

To use port-forwarding, Java Runtime Environment (JRE)1.4.1. must be installed on both the client system and the client browser. If JRE is not present, the client is automatically prompted to download and install it on their system.

Adding a New Port-Forwarding Resource

Use the Manage Port-Forwarding Resources page to add a new portforwarding resource to the remote users portal page. For each resource, you can specify a list of ports to forward and specify the destination addresses and ports for the backend connection. You can also specify which port-forwarding resources are available on the user portal page for users or user groups. See

“Specifying User Portal Properties”

on page 135 or “Specifying User Group

Portal Properties” on page 151.

To add a new port-forwarding resource

From the configuration menu, choose Resources > Port-Forwarding.

The Manage Port-Forwarding Resources page opens.

Nokia Secure Access System Administrator Guide 259

Configuring Port-Forwarding Resources

260

This page lists all port-forwarding resources defined on the gateway.

Note

To view or change port-forwarding resource properties, click the name of the resource from the Resource Name list box.

Click New Resource.

The Properties for Port-Forwarding Resource page opens.

Nokia Secure Access System Administrator Guide

Managing Port-Forwarding Resources

Enter the Resource Name and Resource Description.

Enter the resource text in the Portal Link text field.

This text appears on the user portal page as a hyperlink for the portforwarding resource.

Specify settings for Outlook-Exchange Forwarding, if desired.

Check the check box to enable the following:

Nokia Secure Access System Administrator Guide 261

Configuring Port-Forwarding Resources

Temporarily modify the hosts file on a Windows client to map all server names specified in the following steps to the 127.0.0.1 address on the client computer.

The forward port necessary for Outlook Exchange communication. If you enable this option, enter the hostname of the Exchange server.

Specify the port-forwarding settings.

Check the check box to enable or disable the following:

Select the type of traffic to forward, either TCP or UDP.

Enter the listening port number for the client computer.

Enter the destination hostname and port number of the remote server for each forwarded channel.

To delete a port, check Delete next to the specified port.

Click Add More Lines to add rows for additional port settings.

You must click Save Settings before you add more lines.

Specify logging.

Check the check box to enable the following:

Enable debug logging for this resource.

Enable auditing logging for this resource.

For more information, see “Using Gateway Logging” on page 63.

Click Save Settings.

The Access Control-Simple and Access Control-Advanced tabs appear.

Use these options to configure ACLs for the new resource. See Chapter

13, “Configuring Access Control Rules.”

262 Nokia Secure Access System Administrator Guide

Managing Port-Forwarding Resources

Using Port-Forwarding with Lotus Notes

You can create a port-forwarding resource that forwards traffic between a

Lotus Notes client and a particular Lotus Notes server.

To add a port-forwarding resource for Lotus Notes

Create a new port-forwarding resource.

See

“Port-Forwarding Requirements” on page 258.

From the Properties for Port-Forwarding Resource page, check the

Temporarily modify hosts file on Windows client check box.

Check Forward ports as follows:

Specify that TCP traffic on port 1352 be forwarded to the Lotus Notes server.

Select the TCP protocol.

Enter 1352 in the Listen on port text box.

Enter the Lotus Notes server hostname (not IP address) in the forward to host text box.

Enter 1352 in the text box for the server port number.

If desired, configure additional forwarding options for the resource.

Click Save Settings.

Nokia Secure Access System Administrator Guide 263

Configuring Port-Forwarding Resources

Disabling or Deleting a Port-Forwarding Resource

Use the Configure Port-Forwarding Resources page to disable or delete a port-forwarding resource from the gateway.

To disable or delete a port-forwarding resource

From the configuration menu, click Resources > Port-Forwarding.

The Manage Port-Forwarding Resources page opens.

264

The Properties for the Port-Forwarding Resource page includes a list box of all port-forwarding resources currently defined on the gateway.

To disable a resource, check the Disable check box.

To delete a resource, check the Delete check box.

Click Save Settings.

Nokia Secure Access System Administrator Guide

Configuring Access Control

Rules

This chapter describes how to configure access control rules for gateway resources, including:

Configuring Simple Access Control Rules

Configuring Advanced Access Control Rules

Using Variables for Access Control Rules

The Nokia Secure Access gateway employs a flexible access control scheme that allows the administrator to configure policies on the services offered to gateway users. Each policy is specified in terms of a rule list (sometimes called an access control list, or ACL) that is evaluated at runtime in a sequential, first-match manner.

The gateway access control scheme is primarily resource oriented. For each resource in the gateway configuration, you can specify the ACL by using a simple, group-oriented scheme or by using a fully featured rule-based scheme. In the rule-based scheme, you can define rules that express complex logic by using Booelean combinations of terms. This scheme provides you with greater control over the conditions under which resource access is denied or allowed.

Nokia Secure Access System Administrator Guide 265

Configuring Access Control Rules

To facilitate the enforcement of access control policies that can apply to all resources, the gateway also uses a global rule list. This rule list allows you to manage all access control rules from a single location. For information about

how to configure global ACLs, see “Configuring Global Access Control

Settings” on page 87.

Configuring Simple Access Control Rules

Use the Simple Access control pages to select which user groups are allowed or denied access to a particular resource. Because the gateway can add group membership dynamically, this style of access management is particularly effective for large enterprises where access rights are designed by group memberships and stored in RADIUS or LDAP servers.

The Simple Access Control option makes it easy for you to enable and disable resource access to a particular group. You can use Add or Remove to quickly add or remove groups from the list of allowed or denied user groups. You can toggle this view between managing the Allowed User Groups or the Denied

User Groups.

To configure simple access control rules

From the main configuration menu, choose Resources, then click a resource type.

From the Manage Resource page, click New Resource or click the name of the resource from the Resource name list box.

The Properties page for the specified resource opens.

266 Nokia Secure Access System Administrator Guide

Configuring Simple Access Control Rules

Click the Access Control-Simple tab.

The Access Control-Simple page for the resource opens.

The Access Control-Simple page provides a list of all user groups defined on the gateway and a list of all user groups allowed to access the specified resource.

To add or remove groups to and from a list of allowed and denied groups, click Add or Remove.

Nokia Secure Access System Administrator Guide 267

Configuring Access Control Rules

Select the default action.

The default setting of the default action is Deny.

To add a resource link to the portal, check Add portal link to this resource for each allowed group.

Click Save Settings.

Configuring Advanced Access Control Rules

Use the Access Control-Advanced pages to specify advanced access control rules for a resource. Advanced rules consist of one or more ordered rules that specify all conditions under which gateway access is denied or allowed.

All of the gateway ACLs are ordered and follow a first-match evaluation scheme. When the gateway receives a request for a resource, the gateway first checks the global ACL rules. If the action is Defer, the gateway obtains the

ACL for that resource and evaluates each rule in sequence. When it finds a rule that matches the request and all rule conditions are met, the gateway takes the action specified in the matching rule. If none of the ACL rules match, the gateway uses the default action configured for that ACL.

You can add, delete, disable, edit, and reorder rules. You can also select the default action (Allow or Deny) in this view.

Table 16 describes the rule types

used to create advanced rules.

268 Nokia Secure Access System Administrator Guide

Configuring Advanced Access Control Rules

Table 16 Advanced Rule Types

Rule type Description

Single Term Rules consisting of an action and a condition expressed as a single term. For example: “ALLOW IF (USER_GROUP = “Eng.

Complex

Manual

Rules consisting of an action along with a condition expressed as several terms linked with

AND

operators.

Option for manually entering a rule. If you are familiar with ACL rule syntax and term constraints, this entry mode might be the most efficient. By manually entering the rule, you can specify a complex rule within seconds.

To configure advanced access control rules

From the main configuration menu, choose Resources, then click a resource type.

From the Manage Resource page, click New Resource or click the name of the resource from the Resource name list box.

The Properties page for the specified resource opens.

Click the Access Control-Advanced tab.

The Access Control-Advanced page for the resource opens.

Nokia Secure Access System Administrator Guide 269

Configuring Access Control Rules

270

From this page you can see the entire ACL for the resource. Each rule contains an action and a condition, either ALLOW or DENY. If the ACL contains multiple rules, each rule displays an up and down button that you can use to reorder the rules.You can also disable a rule, delete a rule, or edit a rule by clicking Edit.

Note

Rules that you create in the simple view cannot be deleted or disabled in the Advanced view.

Nokia Secure Access System Administrator Guide

Configuring Advanced Access Control Rules

To add a new rule, click Add Rule.

The Access Control-Advanced page for the new rule opens.

From the Access Control-Advanced page, you can create a single term rule, and select options for creating a complex rule or manually entering a rule. Initially, this page shows only the action DENY and the condition

ALL. If you switch ALL to IF, the drop-down lists for variables appear as the following screen shows.

Nokia Secure Access System Administrator Guide 271

Configuring Access Control Rules

Note

The available choices for single-rule creation change when you choose different variables or if you change the condition modifier between ALL and IF. For information about variables and modifiers, see

“Using

Variables for Access Control Rules” on page 277.

If you are creating a single rule:

Click Save New Rule.

Click Return to Rule List.

The New Rule appears in the Access Control – Advanced list box.

Configuring Complex Access Control Rules

Use the Complex rules page to add multiple rules for a resource. Complex rules consist of one or more ordered rules that specify all conditions under which gateway access is denied or allowed. These consist of an action along with a condition expressed as several terms linked with AND or OR operators. For example:

ALLOW IF (USERNAME = “admin”) OR (USER_GROUP = “

Mgnt

” AND

CLIENT_IP = “10.0.77.0/24”)

To create complex rules, the gateway provides an interactive form that displays each term on a separate line, with the selectable Boolean operators between lines. You can add and remove parentheses on either side of each term. The user interface for specifying each term is the same as for singleterm rule creation.

272 Nokia Secure Access System Administrator Guide

Configuring Advanced Access Control Rules

To configure complex access control rules

From the Access Control-Advanced page, click Complex Rule Entry.

The Complex Rule Entry page opens.

From the Access Control-Advanced page you can add multiple rules for a resource and add terms to each rule.

Choose an action from the Action drop-down list, either ALLOW or

DENY.

Add a term to the rule.

Nokia Secure Access System Administrator Guide 273

Configuring Access Control Rules

Specify the rule terms from the New Term list box.

Select the term conditions from the following drop-down lists:

Conditional

— contains AND or OR operators.

Variable

—

contains a list of all predefined variables such as username, usergroup, and time of day.

Test

— allowed operators are = and ! For example:

(USERNAME

“julie”) or

(

USERNAME

! =

“admin”).

Value

— value refers to the value of the variable to test against. The value is usually expressed as a string. For instance, if the variable is

USERNAME

, the example variable would be “jsmith.”

Click Add Term.

The new term is added to the Rule list.

The following figure shows an example of multiple rules and their corresponding terms.

274 Nokia Secure Access System Administrator Guide

Configuring Advanced Access Control Rules

The Access Control – Advanced page refreshes and shows the list of terms specified for the new rule:

ALLOW IF USERNAME = “admin” OR (USER_GROUP = “Mgnt” AND

CLIENT_IP = “10.0.77.0/24”)

Once the rules are created you can specify the order in which the rule appears in the list. You can choose from the following:

Add to Bottom—adds the rule to the bottom of the rule list.

Add to Top—adds a rule to the top of the rule list.

Add to Line—allows you to insert the term at a specified line position.

Click Save New Rule, then click Return to Rule List.

The new rule and conditions are added to the rule list box.

Nokia Secure Access System Administrator Guide 275

Configuring Access Control Rules

Entering a Rule Manually

Use the Manual Entry page to manually enter a rule to the gateway. Once you are familiar with the access control rule syntax and the constraints upon each term (such as what values are allowed for each variable), this entry mode might be the most efficient. By manually entering the rule, you can specify a complex rule in significantly less time than by using the complex rule entry.

To manually enter a rule

From the Access Control-Advanced page, click Manually Enter Rule.

The Manual Entry Rule page opens.

Enter the rule syntax in the Enter Rule field.

Click Save Rule.

The rule is added to the Access Control – Advanced list box.

To view the new rule, click Return to Rule List.

The New Rule appears in the Access Control Advanced list box.

276 Nokia Secure Access System Administrator Guide

Using Variables for Access Control Rules

Using Variables for Access Control Rules

This section describes the predefined variables that access control lists use for defining Web resources, file resources, email resources, port-forwarding resources, and sign-on rules. These variables cannot be changed or deleted.

For detailed information about variables, see

“Using Variables” on page 102.

Descriptions of Predefined Variables

Table 17 contains detailed information about predefined variables, including

the variable name, description, and example values. Examples are also shown of how the variable is used when you configure access control rules.

Predefined variables are assigned values at the start of a user session, the end of a client integrity scan, and at the time the client request is made.

Table 17 Variables for Access Control Rules

Variable name Description

ACCESS_MODE

AUTH_METHOD

Requested operation for the file resource.

Applicable only for file resources.

Supported values:

• Read—includes directory listings and file download.

• Write—includes file deletion, directory creation, and file upload.

ACL examples:

Values are chosen from a drop-down list that contains all days of the week.

Operators allowed are = and !=.

Example values:

Our NIS, Local Cert

ACL examples:

Values are chosen from a drop-down list that contains the names of all authentication methods defined on the gateway.

Operators allowed are = and !=.

Nokia Secure Access System Administrator Guide 277

Configuring Access Control Rules

Table 17 Variables for Access Control Rules (continued)

Variable name Description

BROWSER_USER_AGENT Contents of the user-agent HTTP header from the remote user’s browser. You can use wildcards, but not spaces or special characters.

For example: *MSIE*, *mozilla*.

Example values:

• “Mozilla/4.04 [en] (WinNT;I;Nav)”

• “Mozilla/2.0 (compatible;MSIE 3.0;AK;Windows95)”

ACL examples:

Wildcard characters such as *win* are allowed.

CLIENT_IP IP address of the remote user or client. (This variable can also be defined as a network address.)

Example values:

192.168.1.2, 10.05.121 ; 10.4.104.0/24

ACL examples:

CLIENT_IP-192.168.12

DAY_OF_WEEK Day of the week.

Example values:

Sunday, Monday, …, Saturday

ACL examples:

Values are chosen from a drop-down list that contains all days of the week.

Operators allowed are = and !=.

278 Nokia Secure Access System Administrator Guide

Using Variables for Access Control Rules

Table 17 Variables for Access Control Rules (continued)

Variable name Description

DEST_URL Full URL for the backend URL.

Example values:

“http://hr.foo.com/docs/pto.html”

“smb//windows.foo.com/design_docs/”

ACL examples:

• Allow (

DEST_URL

= “http://hr.foo.xom/*”)

• Allow (

DEST_URL

= “http://hr.foo.xom/*”)

• Deny (

DEST_URL

= “http://hr.foo.xom/*”)

Wildcards are allowed in these values.

Operators allowed are = and !=.

INTERFACE_IP

SSL_STRENGTH

IP address of the network interface that received the connection from the client.

Example values:

“192.168.1.20”, “10.0.14.25”

ACL examples:

• allow (

INTERFACE_IP = “192.168.1.20”

)

• deny (

INTERFACE_IP = “192.168.1.20”

)

Values must be full IP addresses (not networks).

Operators allowed are = and !=.

Cipher strength of the SSL connection between the TLS gateway and the client.

Supported values:

• low (40-bit, 456-bit, and 64-bit cipher suites)

• high (128-bit, 168-bit cipher suites)

ACL examples:

Values are selected from a drop-down list that contains low and high.

Operators allowed are = and !=.

Nokia Secure Access System Administrator Guide 279

Configuring Access Control Rules

Table 17 Variables for Access Control Rules (continued)

Variable name Description

TIME_OF_DAY

USER_GROUP

Time of day.

Example values:

“09:23am”, “11:50pm”.

These values are never displayed, since all times are specified as time ranges.

ACL examples:

• Allow ( TIME_OF_DAY between “09:00am AND 05:30pm”).

• Deny ( TIME_OF_DAY between “11:30pm AND 00:30am”).

The only operator allowed is between.

Set of user groups to which the user belongs.

Example values:

• USER_GROUP = Group1, Group 2, Group3,

• USER_GROUP = GroupA, GroupB

ACL examples:

In ACLs, goup memberships are tested one at a time. In this context, the rule allows (USER_GROUP = “Group1”).

USERNAME Username of the user.

Example values: admin, julie, joem

ACL examples:

Operators allowed are = and ! =. For example:

(USERNAME = “julie”) or

(USERNAME != “admin”)

280 Nokia Secure Access System Administrator Guide

Using the admin_unlock Script

As an administrator, you can lock yourself out of the Nokia Secure Access

System configuration pages by performing certain configuration changes on the gateway. A lockout can occur by:

Adding a global or sign on rule that prevents administrator access.

Adding a client integrity scan rule that unsuccessfully performs a scan on the client machine.

Disabling the wrong interface in the HTTPS settings.

You can also be locked out if you are not using standard IPSO authentication, and no other authentication method is available (for instance, if you are using a RADIUS authentication method and the server is not responding).

If a lockout occurs and you cannot access the configuration pages, you can run the admin_unlock script to gain access to the gateway. This appendix describes how and when to run this script

The admin_unlock script does the following:

Adds rules to the gateway security database.

Restores all interfaces on the IPSO appliance to the listening state.

Resets the authentication method for the admin user to use standard IPSO authentication.

Nokia Secure Access System Administrator Guide 281

Using the admin_unlock Script

To run the admin_unlock script

From the IPSO command line, enter:

/opt/nsas/bin/admin_unlock

When the script runs, it sets the gateway database keys and adds rules to the gateway to allow administrator access. These rules enable you to access the config UI resource.

The following rules are added:

ALLOW ALL—added to the sign-on rules.

Omit ALL—added to client integrity scan rules.

ALLOW FOR ALL IF USERNAME = "admin"—added to global rules.

The script also sets the default authentication method to PAM (the IPSO default). After the script runs, you can sign on to the gateway by using the same user ID and password that you use to sign on to IPSO or Voyager.

The old value of the default authentication method is saved and restored when you click the Return system to normal state button. This button appears on the summary page the next time you access the configuration pages.

Note

When you run the admin_unlock script, the Nokia Secure Access

System restarts. This clears all user lockouts. For instance, if you are locked out by the user authentication failure lockout, the script clears the lockout and allows you to sign on to the gateway again.

After the script runs, you can access the configuration pages.

Note

Because the Nokia Secure Access System restarts, all active users must sign on to the gateway again.

282 Nokia Secure Access System Administrator Guide

To return the system to normal state

From your Web browser enter:

https://<server>/get/config

The Nokia Secure Access System Summary page opens and displays:

Warning

Emergency Admin Unlock is in effect.

Once normal admin access is restored click below to return the gateway to its normal state.

Note

Warnings can appear if the undo action encounters errors when removing rules that the admin_unlock script adds. These warnings only appear if you add, change, or remove a global, sign on, or client integrity rule. In this case, you receive a warning about which rules the script cannot remove and are instructed to edit the rules manually.

Click Return system to normal state.

After the script runs, the system is restored to the state it was in before the admin_unlock script was run.

Note

When the undo action executes, it restores all interfaces to the listen state. To reset the interfaces to the desired state, go to Global

Properties > Network from the configuration pages.

Nokia Secure Access System Administrator Guide 283

Using the admin_unlock Script

284 Nokia Secure Access System Administrator Guide

Options for Installing Packages

This chapter describes package installation options and includes:

Obtaining the Nokia Secure Access System Package

Installing the Package with the newpkg Command

Deactivating or Deleting Packages with Voyager

Note

For information about how to install the package using Nokia Network

Voyager, see

Chapter 2, “Installing the Nokia Secure Access System.”

Nokia recommends that you use Voyager.

Obtaining the Nokia Secure Access System

Package

If the Nokia Secure Access System software package is not on your appliance, you can obtain the package from the Nokia support site listed in

“Nokia

Contact Information” on page 3.

After you have downloaded the nsas-v1.0-<timestamp>.tgz package file, you can transfer the package to the appliance by using FTP, and then install the package.

Nokia Secure Access System Administrator Guide 285

Options for Installing Packages

To download the gateway package with Voyager

Download the nsas-v1.0-<timestamp>.tgz package file from the Nokia support site at https://support.nokia.com.

If the workstation on which you stored the package file does not allow

FTP access, transfer the package file to a computer that you can access with FTP.

From the Voyager main page, select System Configuration.

From the Voyager Configuration page, select Manage Installed Packages.

From the Manage Packages page, select FTP and Install Packages.

The FTP Packages page opens.

In the text boxes, provide the hostname or IP address of the FTP server and the directory path on that server.

Also, provide the username and the password for your account on the FTP server.

Click Apply.

The FTP Packages page refreshes and shows a list of packages (.tgz files) found on the FTP server in the Site Listing panel.

Select the nsas-v1.0-<timestamp>.tgz file from the Site Listing list.

Click Apply.

The package is unpacked on the appliance.

Continue installing the Nokia Secure Access System package by going to step 6 in the procedure

“To install the Nokia Secure Access System package” on page 53.

286 Nokia Secure Access System Administrator Guide

Installing the Package with the newpkg Command

Installing the Package with the newpkg

Command

The newpkg command installs software packages. Before you install the package, verify that the nsas-1.0.tgz file is in the opt/packages directory. If the package is not present, you can download it by using the Voyager FTP template. For information on how to user Voyager for FTP, see

“Obtaining the

Nokia Secure Access System Package” on page 285.

You can also download the package from the Nokia support site at https:// support.nokia.com. After you download it, you must transfer the file to the opt/packages directory on the Nokia Secure Access gateway.

The newpkg command automatically extracts the package files into the /opt directory and activates the package. When you enter newpkg, the script guides you through the installation process. You can also specify command

options, which are listed in Table 18 on page 289.

You can also install the package from the command-line interface (CLI). If you choose to use the CLI, you must use the Nokia Secure Access

Configuration software to configure the gateway. These settings cannot be configured from the command line.

To install the package with the newpkg command using the CLI

From the command line, enter:

newpkg -n/opt/packages/nsas-v1.0-<timestamp>.tgz

The following options appear:

Load new package from:

1. Install from CD-ROM.

2. Install from anonymous FTP server.

3. Install from FTP server with username and password.

4. Install from local filesystem.

5. Exit new package installation.

Nokia Secure Access System Administrator Guide 287

Options for Installing Packages

Enter

The following response appears:

End of new package installation cleaning up ..done

To enable the installed package:

From the Voyager main page, click Security and Access

Configuration.

Click Nokia Secure Access System.

Click the Click here to restart NSAS link to sign on to the gateway.

Note

If Voyager is running on port 80 or port 443, enable the package. If the

Voyager ports listed are different from 80 or 443, the Nokia Secure

Access System package is installed and already activated and it is not necessary to enable the package.

Note

If you use the

i argument with newpkg, you must activate the package.

To activate the package, open Voyager and go to the Manage Packages page. From there, click On next to the Nokia Secure Access System package in Applications.

288 Nokia Secure Access System Administrator Guide

Installing the Package with the newpkg Command

newpkg Options

Table 18 describes the options you can use with the newpkg command.

The syntax of newpkg is: newpkg [-d] [-h] [i] [-l

user_name

] [-m

media_type

]

[-n

path

] [-o

path

] [-p

password

] [-s

server_ipaddrs

]

[-S] [-v]

Table 18 newpkg Options

Option Description

-d

-h

-i

-l user_name

-m local

-m media_type

-n path

-o path

-p password

-s server_ipaddrs

-S

-v

Print debug messages to the screen.

Display help lines for command-line parameters.

Install only (do not activate).

User name for FTP.

Bypass menu for selecting FTP/CD-ROM/LOCAL.

Media type. For example, FTP/CD-ROM/LOCAL.

Full path to new package. For example, /pub/current/xxx.tgz.

Full path to old package for upgrade. For example, /opt/xxx.

Password for FTP.

Server IP address if media type is FTP.

Silent mode. Silent mode requires the following options:

-o, -m, -n

If the media type is FTP, silent mode also requires

-s

., l,-p

Verbose FTP.

Nokia Secure Access System Administrator Guide 289

Options for Installing Packages

Deactivating or Deleting Packages with Voyager

You can deactivate and delete installed packages by using Voyager. The

Delete Package page is available as a link on the Manage Packages page. This page enables you to view and delete packages that are installed on the system.

The Delete Package page lists only activated packages available for deletion.

Note

To delete a package, you must deactivate it first.

To deactivate and delete installed packages

Open Voyager and click System Configuration.

Click Manage Installed Packages.

The Manage Packages page opens.

290 Nokia Secure Access System Administrator Guide

Deactivating or Deleting Packages with Voyager

To deactivate the package, click Off, click Apply, then click Save.

To delete the package, click Delete Packages, select the package to delete click Apply, then click Save.

Note