Standalone EAS proxy. Sophos Mobile, Sophos Mobile

Sophos Mobile

5 Standalone EAS proxy

You can set up an EAS proxy to control the access of your managed devices to an email server.

Email traffic of your managed devices is routed through that proxy. You can block email access for devices, for example a device that violates a compliance rule.

The devices must be configured to use the EAS proxy as email server for incoming and outgoing emails. The EAS proxy will only forward traffic to the actual email server if the device is known in

Sophos Mobile and matches the required policies. This guarantees higher security as the email server does not need to be accessible from the Internet and only devices that are authorized

(correctly configured, for example with passcode guidelines) can access it. Also, you can configure the EAS proxy to block access from specific devices.

There are two types of EAS proxy:

• The internal EAS proxy that is automatically installed with Sophos Mobile. It supports incoming

ActiveSync traffic as used by Microsoft Exchange or IBM Notes Traveler for iOS and Samsung

Knox devices.

• A standalone EAS proxy that can be downloaded and installed separately. It communicates with the Sophos Mobile server through an HTTPS web interface.

Note

For performance reasons, we recommend you use the standalone EAS proxy server instead of the internal version when email traffic for more than 500 client devices must be managed.

Note

Because macOS doesn’t support the ActiveSync protocol, you can’t use the internal or the standalone EAS proxy to filter email traffic coming from Macs.

Features

The standalone EAS proxy has additional features compared to the internal version:

• Support for IBM Notes Traveler for non-iOS devices (for example, Android). The Traveler client for these devices uses a protocol (not ActiveSync) that is not supported by the internal EAS proxy.

• Support for multiple Microsoft Exchange or IBM Notes Traveler email servers. You can set up one

EAS proxy instance per email server.

• Load balancer support. You can set up standalone EAS proxy instances on several computers and then use a load balancer to distribute the client requests among them.

• Support for certificate-based client authentication. You can select a certificate from a certification authority (CA), from which the client certificates must be derived.

• Support for email access control through PowerShell. In this scenario, the EAS proxy service communicates with the email server through PowerShell to control the email access of your managed devices. Email traffic happens directly from the devices to the email server and is not

routed through a proxy. See Set up email access control through PowerShell (page 14).

Copyright © 2018 Sophos Limited 9

Sophos Mobile

10

Note

For non-iOS devices, filtering abilities of the standalone EAS proxy are limited due to the specifics of the IBM Notes Traveler protocol. Traveler clients on non-iOS devices do not send the device ID with every request. Requests without a device ID are still forwarded to the Traveler server, even though the EAS proxy is not able to verify that the device is authorized.

5.1 Usage scenarios for the standalone EAS proxy

Note

Additional to the information provided in this section, the Sophos Mobile server deployment guide contains schematic diagrams for the integration of the standalone EAS proxy into your company’s infrastructure. We recommend that you read the information before performing the installation and deployment of the standalone EAS proxy.

A standalone EAS proxy server should be used for the following scenarios.

You use IBM Notes Traveler (formerly IBM Lotus Notes Traveler) for noniOS devices

The internal EAS proxy is not suitable for this scenario because it only supports the ActiveSync protocol, which is used by Microsoft Exchange and by IBM Notes Traveler for iOS devices. IBM

Notes Traveler for non-iOS devices (for example, Android) uses a different protocol that is supported by the standalone EAS proxy.

For non-iOS devices, dedicated Traveler client software is required. This software is available through <traveler-server>/servlet/traveler or the Traveler file system. The Install App and Uninstall App features of Sophos Mobile can be used to install and uninstall the Traveler client software. Configuration has to be performed manually.

You want to support multiple backend servers

With the standalone EAS proxy you can set up multiple instances of backend email systems. Each instance needs an incoming TCP port. Each port can connect to a different backend. You need one

URL per EAS proxy instance.

You want to set up load balancing for EAS

You can set up standalone EAS proxy instances on several computers and then use a load balancer to distribute the client requests among them.

For this scenario an existing load balancer for HTTP is required.

You want to use client certificate based authentication

For this scenario an existing PKI is required and the public part of the CA certificate has to be set in the EAS proxy.

Copyright © 2018 Sophos Limited

Sophos Mobile

You need to manage more than 500 devices

For performance reasons, we recommend you use the standalone EAS proxy server instead of the internal version when email traffic for more than 500 client devices must be managed.

5.2 Download the EAS proxy installer

1. Log in to Sophos Mobile Admin as super administrator.

2. On the menu sidebar, under SETTINGS , click Setup > System setup and then click the EAS proxy tab.

3. Under External , click the link to download the EAS proxy installer.

The installer file is saved to your local computer.

5.3 Install the standalone EAS proxy

Prerequisites:

• Sophos Mobile has been installed and set up.

• All required email servers are accessible. The EAS proxy installer will not configure connections to servers that are not available.

• You are an administrator on the computer where you install the EAS proxy.

Note

The Sophos Mobile server deployment guide contains schematic diagrams for the integration of the standalone EAS proxy into your company’s infrastructure. We recommend that you read the information before performing the installation and deployment of the standalone EAS proxy.

1. Run Sophos Mobile EAS Proxy Setup.exe

to start the Sophos Mobile EAS Proxy - Setup

Wizard .

2. On the Choose Install Location page, choose the destination folder and click Install to start installation.

After the installation has been completed, the Sophos Mobile EAS Proxy - Configuration Wizard is started automatically and guides you through the configuration steps.

3. In the Sophos Mobile server configuration dialog, enter the URL of the SMC server that the EAS proxy will connect with.

You should also select Use SSL for incoming connections (Clients to EAS Proxy) to secure the communication between clients and the EAS proxy.

Optionally, select Use client certificates for authentication if you want the clients to use a certificate in addition to the EAS proxy credentials for authentication. This adds an additional layer of security to the connection.

Select Allow all certificates if your Sophos Mobile server presents varying certificates to the

EAS proxy, for example because there are several server instances behind a load balancer, and each instance uses a different certificate. When this option is selected, the EAS proxy will accept any certificate from the Sophos Mobile server.

Copyright © 2018 Sophos Limited 11

Sophos Mobile

Important

Because the Allow all certificates option reduces the security level of the server communication, we strongly recommend that you select it only if required by your network environment.

4. If you selected Use SSL for incoming connections (Clients to EAS Proxy) before, the

Configure server certificate page is displayed. On this page you create or import a certificate for the secure (HTTPS) access to the EAS proxy.

Note

Your Sophos product delivery includes the SSL Certificate Wizard to request your SSL/TLS

certificate for the Sophos Mobile EAS proxy. For further information, see Request an SSL/TLS certificate (page 5).

• If you do not have a trusted certificate yet, select Create self-signed certificate .

• If you have a trusted certificate, click Import a certificate from a trusted issuer and select one of the following options from the list:

— PKCS12 with certificate, private key and certificate chain (intermediate and CA)

— Separate files for certificate, private key, intermediate and CA certificate

5. On the next page, enter the relevant certificate information, depending on the type of certificate that you selected.

Note

For a self-signed certificate, you need to specify a server that is accessible from the client devices.

6. If you selected Use client certificates for authentication before, the SMC client authentication configuration page is displayed. On this page, you select a certificate from a certification authority

(CA), from which the client certificates must be derived.

When a client tries to connect, the EAS proxy will check if the client certificate is derived from the

CA that you specify here.

7. On the EAS Proxy instance setup page, configure one or more EAS proxy instances.

• Instance type : Select EAS proxy .

• Instance name : A name to identify the instance.

• Server port : The port of the EAS proxy for incoming email traffic. If you set up more than one proxy instance, each of these must use a different port.

• Require client certificate authentication : Email clients must authenticate themselves when connecting to the EAS proxy.

• ActiveSync server : The name or IP address of the Exchange ActiveSync Server instance with which the proxy instance will connect.

• SSL : Communication between the proxy instance and Exchange ActiveSync Server is secured by SSL or TLS (depending on what the server supports).

• Allow EWS subscription requests from Secure Email : Select this to allow the Sophos

Secure Email app on iOS to subscribe to push notifications through Exchange Web Services

(EWS). Push notifications inform the device when there are messages for Secure Email.

12 Copyright © 2018 Sophos Limited

Sophos Mobile

Note

— By default, the EAS proxy blocks all requests to the Exchange server’s EWS interface for security reasons. If you select this check box, subscription requests are allowed.

Other requests remain blocked.

— For information on how to configure EWS for your Exchange server, see Sophos knowledge base article 127137 .

• Enable Traveler client access : Only select this check box if you need to allow access by IBM

Notes Traveler clients on non-iOS devices.

8. After entering the instance information, click Add to add the instance to the Instances list.

For every proxy instance, the installer creates a certificate that you need to upload to the Sophos

Mobile server. After you have clicked Add , a message window opens, explaining how to upload the certificate.

9. In the message window, click OK .

This will open a dialog, showing the folder in which the certificate has been created.

Note

You can also open the dialog by selecting the relevant instance and clicking the Export config and upload to Sophos Mobile server link on the EAS Proxy instance setup page.

10. Make a note of the certificate folder. You need this information when you upload the certificate to

Sophos Mobile.

11. Optional: Click Add again to configure additional EAS proxy instances.

12. When you have configured all required EAS proxy instances, click Next .

The server ports that you entered are tested and inbound rules for the Windows Firewall are configured.

13. On the Allowed mail user agents page, you can specify mail user agents (i.e. email client applications) that are allowed to connect to the EAS proxy. When a client connects to the EAS proxy using an email application that is not specified, the request will be rejected.

• Select Allow all mail user agents to configure no restriction.

• Select Only allow the specified mail user agents and then select a mail user agent from the list. Click Add to add the entry to the list of allowed agents. Repeat this for all mail user agents that are allowed to connect to the EAS proxy.

14. On the Sophos Mobile EAS Proxy - Configuration Wizard finished page, click Finish to close the Configuration Wizard and return to the Setup Wizard.

15. In the Setup Wizard, make sure that the Start Sophos Mobile EAS Proxy server now check box is selected, then click Finish to complete the configuration and to start the Sophos Mobile EAS proxy for the first time.

To complete the EAS proxy configuration, upload the certificates that were created for every proxy instance to Sophos Mobile:

16. Log in to Sophos Mobile Admin as a super administrator.

17. On the menu sidebar, under SETTINGS , click Setup > System setup and then click the EAS proxy tab.

18. Under External , click Upload a file . Upload the certificate that the setup wizard created for the

PowerShell connection.

If you have set up more than one instance, repeat this for all instance certificates.

19. Click Save .

Copyright © 2018 Sophos Limited 13

Sophos Mobile

20. In Windows, open the Services dialog and restart the EASProxy service.

21. On the menu sidebar, under SETTINGS , click Setup > System setup and then click the EAS proxy tab.

22. Under External , click Upload a file . Upload the certificate that the setup wizard created for the

PowerShell connection.

If you have set up more than one instance, repeat this for all instance certificates.

23. Click Save .

24. In Windows, open the Services dialog and restart the EASProxy service.

This completes the initial setup of the standalone EAS proxy.

Note

Every day, the EAS proxy log entries are moved to a new file, using the naming pattern

EASProxy.log.yyyy-mm-dd . These daily log files are not deleted automatically and thus may cause disk space issues over time. We recommend that you set up a process to move the log files to a backup location.

5.4 Set up email access control through

PowerShell

You can set up a PowerShell connection to an Exchange or an Office 365 server. This means that the EAS proxy service communicates with the email server through PowerShell to control the email access for your managed devices. Email traffic is routed directly from the devices to the email server.

It is not routed through a proxy.

Note

For a schematic of the PowerShell communication, see the Sophos Mobile server deployment guide .

14

Note

Because macOS doesn’t support the ActiveSync protocol, you can’t use PowerShell to control email access by Macs.

The PowerShell scenario has these advantages:

• Devices communicate directly with the Exchange server.

• You do not need to open a port on your server for incoming email traffic from your managed devices.

Supported email servers are:

• Exchange Server 2013

• Exchange Server 2016

• Office 365 with an Exchange Online plan

To set up PowerShell:

1. Configure PowerShell.

2. Create a service account on the Exchange server or in Office 365. This account is used by Sophos

Mobile to execute PowerShell commands.

Copyright © 2018 Sophos Limited

Sophos Mobile

3. Set up one or more PowerShell connection instances to Exchange or Office 365.

4. Upload the instance certificates to Sophos Mobile.

Configure PowerShell

1. On the computer on which you are going to install the EAS proxy, open Windows PowerShell, as an administrator, and enter:

PS C:\Windows\system32> Set-ExecutionPolicy RemoteSigned

Note

If PowerShell is not available, install it as described in the Microsoft article Installing Windows

PowerShell (external link) .

2. If you want to connect to a local Exchange server, open Windows PowerShell as administrator on that computer and enter the same command as before:

PS C:\Windows\system32> Set-ExecutionPolicy RemoteSigned

Note

This step is not required for Office 365.

Create a service account

3. Log in to the relevant admin console:

• For Exchange Server 2013/2016: Exchange Admin Center

• For Office 365: Office 365 Admin Center

4. Create a user account. This account is used as a service account by Sophos Mobile to execute

PowerShell commands.

• Use a user name like smc_powershell that identifies the account purpose.

• Turn off the setting to make the user change their password the next time they log in.

• Remove any Office 365 license that was automatically assigned to the new account. Service accounts don’t require a license.

5. Create a new role group and assign it the required permissions.

• Use a role group name like smc_powershell .

• Add the Mail Recipients and Organization Client Access roles.

• Add the service account as a member.

Set up PowerShell connections

6. Use the setup wizard as if you would set up a standalone EAS Proxy. On wizard page EAS Proxy instance setup , configure the following settings:

• Instance type : Select PowerShell Exchange/Office 365 .

• Instance name : A name to identify the instance.

• Exchange server : The name or IP address of the Exchange server (for a local Exchange server installation) or outlook.office365.com

(for Office 365). Don’t include a prefix https:// or a suffix /powershell . These are added automatically.

• Allow all certificates : The certificate that the Exchange server presents is not verified.

Use this for example if you have a self-signed certificate installed on your Exchange

Copyright © 2018 Sophos Limited 15

Sophos Mobile server. Because the Allow all certificates option reduces the security level of the server communication, we strongly recommend that you select it only if required by your network environment.

• Allow EWS subscription requests from Secure Email : Select this to allow the Sophos

Secure Email app on iOS to subscribe to push notifications through Exchange Web Services

(EWS). Push notifications inform the device when there are messages for Secure Email.

Note

— By default, the EAS proxy blocks all requests to the Exchange server’s EWS interface for security reasons. If you select this check box, subscription requests are allowed.

Other requests remain blocked.

— For information on how to configure EWS for your Exchange server, see Sophos knowledge base article 127137 .

• Service account : The name of the user account you created in the Exchange or Office 365 admin console.

• Password : The password of the user account.

7. Click Add to add the instance to the Instances list.

8. Optional: Repeat the previous steps to set up PowerShell connections to other Exchange or Office

365 servers.

9. Complete the setup wizard as described in

Install the standalone EAS proxy (page 11).

Upload certificates

10. Log in to Sophos Mobile Admin as a super administrator.

11. On the menu sidebar, under SETTINGS , click Setup > System setup and then click the EAS proxy tab.

12. Optional: Under General , select Restrict to Sophos Secure Email to restrict email access to the

Sophos Secure Email app, available for Android and iOS.

This prevents other email apps from connecting to your email server.

13. Under External , click Upload a file . Upload the certificate that the setup wizard created for the

PowerShell connection.

If you have set up more than one instance, repeat this for all instance certificates.

14. Click Save .

15. In Windows, open the Services dialog and restart the EASProxy service.

This completes the initial setup of PowerShell connections. Email traffic between a managed device and the Exchange or Office 365 servers is blocked if the device violates a compliance rule. You can block an individual device by setting the email access mode for that device to Deny .

Note

Depending on the configuration of your Exchange server, devices receive a notification when their email access is blocked.

16 Copyright © 2018 Sophos Limited