Sophos Mobile
4
4 Set up Sophos Mobile
This section describes how to install a new Sophos Mobile server. For information on how to update an existing installation, see
Update Sophos Mobile (page 23).
4.1 Installation prerequisites
Check the following prerequisites before installing the Sophos Mobile server:
• You have read the Sophos Mobile server deployment guide . This document contains architecture examples for the integration of the Sophos Mobile server into your company’s infrastructure, dimensioning guidelines, and a list of required network ports and protocols.
• You have read the Sophos Mobile 9 release notes and verified that the computer that hosts the
Sophos Mobile server (server computer), the devices you want to manage, and other relevant components are supported by Sophos Mobile.
•
You have an SSL/TLS certificate for the Sophos Mobile server. See Request an SSL/TLS certificate
(page 5).
• No Internet Information Services (IIS) web server or other application using ports 80 or 443 is installed on the server computer.
• The DNS name of the server computer can be resolved over the internet.
• There are one or more LDAP groups containing the users allowed to use the Self Service Portal, if your user accounts are stored in an LDAP directory.
Prerequisites if you want to manage the Sophos Mobile database with an existing database server:
• Microsoft SQL Server or Microsoft SQL Server Express:
— Windows authentication or SQL Server authentication is used.
— TCP/IP is turned on.
— The SQL Server Browser service is enabled.
— The language of the account used to log in to SQL is set to English.
• Microsoft SQL Server Express:
— The SQL management tools are installed.
4.2 System environment requirements
The Sophos Mobile installer runs a series of test to verify that your system environment meets all the necessary requirements for Sophos Mobile.
These requirements are:
• You are an administrator on the computer.
• The computer's operating system is supported by Sophos Mobile.
• The computer has at least one network adapter.
• The computer has at least 4 GB of RAM.
Copyright © Sophos Limited
Sophos Mobile
• The Microsoft Internet Information Services (IIS) web server is disabled on the computer.
• The following HTTP/S ports are available on the computer: 80, 443, 8080, 8181
• The computer can connect to the Apple Push Notification service (APNs).
• The computer can connect to the Google Firebase Cloud Messaging (FCM) service.
• The computer can connect to the Google reCAPTCHA service.
• The computer can connect to the Windows Push Notification service.
• The computer can connect to the Sophos services.
• Optional: The computer can connect to the Apple Volume Purchase Program (VPP) web service.
• Optional: The computer can connect to the Apple Device Enrollment Program (DEP) web service.
• Optional: The computer can connect to the Apple iTunes web service.
• Optional: The computer can connect to the Apple Activation Lock Bypass web service.
• Optional: The computer can connect to the Google web service for Android enterprise.
• Optional: The computer can connect to the Microsoft web services for Intune app protection.
4.3 Request an SSL/TLS certificate
Your Sophos product delivery includes an SSL Certificate Wizard to request your SSL/TLS certificate for the Sophos Mobile EAS proxy. Run the wizard from the %MDM_HOME%\tools\Wizard folder, or download it from www.sophos.com/mysophos .
Note
If you use a self-signed certificate or a certificate that is issued by your own certificate authority
(CA), the following restrictions apply:
• You must manually install the self-signed certificate or your CA certificate on your devices before you enroll them with Sophos Mobile. If you do not do this, the Sophos Mobile Control app will not trust your server and will refuse to connect. Certificates issued by a globally trusted
CA do not require this manual installation.
• You can’t install Android apps from APK files that are hosted on the Sophos Mobile server.
• You can’t use Android zero-touch enrollment or Samsung Knox Mobile Enrollment.
To request your SSL/TLS certificate:
• Start the SSL Certificate Wizard by double-clicking the file Sophos Mobile SSL Certificate
Wizard.exe.
The wizard guides you through installation. Enter the required information, considering the following instructions: a) On the Upload CSR page, you can click the Open CSR button to open the CSR file if your certificate vendor supports copy and paste.
b) On the Import Certificate Files page, enter the CA certificate downloaded on the Upload CSR page into the Select CA certificate file field.
c) On the Certificate created page, the location of the certificate created is shown. You need to refer to this location when setting up Sophos Mobile.
Copyright © Sophos Limited 5
6
Sophos Mobile
Note
You should create a backup of the folder containing the certificate files.
4.4 Install and set up the Sophos Mobile server
Prerequisites:
• If you plan to connect Sophos Mobile to an existing database, make sure you have the logon credentials for the database available before starting the installation, and that you have sufficient permissions to create new data stores, user accounts and data records.
• If the database is not held locally, you need access to TCP port 1433 (for Microsoft SQL Server) or 3306 (for MySQL). In addition, you need an admin account that the Sophos Mobile server can use to log in to the database.
1. Sign in to Windows with a user account that has local administrator rights.
2. Start the Sophos Mobile installer.
3. On the System Property Checks page, click Check to run the tests to verify that your system
environment meets all the necessary requirements for Sophos Mobile. See System environment requirements (page 4).
You can click Report to generate a report of the test results.
4. On the Choose Install Location page, choose the destination folder for Sophos Mobile server.
5. On the Database Type Selection page, select the database type you want to use:
• Install and use Microsoft SQL Server Express: Installs Microsoft SQL Server Express and configures it to be used with Sophos Mobile.
• Use existing Microsoft SQL Server installation: Uses your existing installation of Microsoft
SQL Server and creates a new database for Sophos Mobile.
• Use existing MySQL installation: Uses your existing installation of MySQL and creates a new database for Sophos Mobile.
6. On the Database Settings page, enter the logon credentials for the database.
Note
If you select the Use SQL Server Authentification option, you need to make sure that the
SQL login language is set to English. See
Change the SQL login language
(page 9) for details.
7. On the Database Selection page, click Create a new database named and enter a name for the database to be created, for example SMCDB.
8. On the Database Configuration page, progress messages are displayed during the database creation.
When the database has been successfully created and populated, click Next to continue.
9. If you have selected Windows authentication for the database access, there is a page Set service
credentials where you set the Windows account under which the Sophos Mobile service runs.
You can use the Local System account or a user account. In the latter case, enter the user account either as <computer name>\<user name> or as <domain>\<user name> .
The installer will assign the database access rights to that account.
Copyright © Sophos Limited
Sophos Mobile
Note
For security reasons, we recommend that you run the Sophos Mobile service as a user with limited access rights. The user account should have the following properties:
• User account is a local Windows account on the computer on which Sophos Mobile is installed.
• User is not a member of any group, not even of the users group.
• User can access your SQL database with the necessary change rights. For an MS-
SQL database, this means that the user must be a member of the db_datareader and
db_datawriter roles.
10. On the Configure super admin account page, configure the account details of the super administrator.
The super administrator is primarily intended for customer management and should not be used for routine device management. The super administrator logs in to the super administrator customer and can, for example, predefine settings for new customers and push settings and configurations to existing customers. For further information, see the Sophos Mobile super administrator guide .
Note
The super administrator credentials are required for the first login to Sophos Mobile Admin.
After installation, additional super administrators can be added in Sophos Mobile Admin.
11. On the Configure external server name page, enter a Sophos Mobile server name (for example smc.mycompany.com).
Note
The server name must be resolvable by the managed devices.
12. On the Configure server certificate page, import a certificate for secure (HTTPS) access to the web server.
• If you have a trusted certificate, click Import a certificate from a trusted issuer and select an option from the drop-down list.
• If you do not have a trusted certificate yet, select Create self-signed certificate.
Note
Your Sophos product delivery includes the SSL Certificate Wizard to request your SSL/TLS certificate for Sophos Mobile. See
Request an SSL/TLS certificate
(page 5).
13. On the next page, enter the relevant certificate information, depending on the type of certificate that you selected.
Note
For a self-signed certificate, you need to specify a server that is accessible from the managed devices.
14. On the Server Information page, verify the server information, then click Next to confirm the server and configuration process.
Copyright © Sophos Limited 7
8
Sophos Mobile
15. After installation has finished, the Sophos Mobile Control - Installation finished dialog box is displayed. Make sure that the Start Sophos Mobile server now check box is selected and click
Finish to start the Sophos Mobile service for the first time.
Note
After the service has been started it can take a few minutes before the Sophos Mobile web interface is available.
After the installation there are a few initial configuration steps that you need to perform:
• Configure the Sophos Mobile web server to only accept requests directed to your domain name.
See
Configure the Sophos Mobile web server (page 8).
• Log in to Sophos Mobile Admin for the first time to start the First steps wizard. See the Sophos
Mobile startup guide .
• For iPhones, iPads, and Macs, you need to get an Apple Push Notification service certificate. See the Sophos Mobile startup guide .
•
Optionally, you can set up a standalone EAS proxy for email filtering. See Standalone EAS proxy
(page 10).
4.5 Configure the Sophos Mobile web server
Sophos Mobile includes a web server component for providing the content of the Sophos Mobile
Admin and Self Service Portal web applications. You can configure the web server to adjust it to your environment.
HTTP requests to a web server include a Host field in the request header, specifying the web application to process the request. An attacker can potentially manipulate the value of that Host field to provoke unintended behavior.
After installation, the web server component of Sophos Mobile doesn’t verify the value of the Host field. We recommend you configure the web server so that it only accepts requests directed to your domain name.
1. On the computer on which you’ve installed the Sophos Mobile server, run the script %MDM_HOME
%\tools\HostValidationUndertowFilter\addModule.bat
Replace %MDM_HOME% by your Sophos Mobile installation folder.
2. Open the file %MDM_HOME%\wildfly\standalone\configuration\smc-config.xml
in a text editor and search for the following section:
<filter name="hostheadervalidation" ...>
<param name="allowedHosts" value="localhost"/>
</filter>
3. After localhost , add your domain name for Sophos Mobile Admin and for the Self Service Portal.
For example if your domain name is smc.example.com
, change the line as follows:
<param name="allowedHosts" value="localhost,smc.example.com"/>
If your Sophos Mobile server can be accessed under more than one domain name, enter all names separated by commas.
4. Save the file smc-config.xml
5. Restart the Sophos Mobile service.
Copyright © Sophos Limited
Sophos Mobile
4.6 Change the SQL login language
If you have configured the Sophos Mobile server to use SQL Server authentication to connect to the database, the SQL login language must be set to English. Otherwise, an error occurs when the
Sophos Mobile service is started.
This topic describes how to change the SQL login language to English.
1. Stop the Sophos Mobile service.
2. Open SQL Server Management Studio on the server and select Security > Logins.
3. On the General page of the Login Properties, set Default language to English, then click OK to save the changes.
4. Restart the Sophos Mobile service.
Copyright © Sophos Limited 9
