3.4.5 Tutorial: Groups Setup. Sophos for UNIX

PureMessage for UNIX | Administrator’s Reference | 243

UI server>

--url=http://<fully qualified domain name of Groups UI server>

5. Ensure that the

SSLCertificateFile

option in the

/opt/pmx6/etc/manager/httpd2/ssl.conf

file is set to

/opt/pmx6/etc/manager/httpd2/pmx-cert.pem

6. Restart the HTTP (RPC/UI) service with: pmx-httpd stop; httpd

Related tasks

Configuring SSL

on page 162

Related information

OpenSSL Website pmx-cert

3.4.5 Tutorial: Groups Setup

PureMessage's groups management features allow an organization's global administrator to delegate administrative responsibility for certain groups of recipients or for specific domains. In this example, you will act as the global administrator for a university with two sub-domains, using the groups functionality to create groups and assign administrative roles to a variety of users within the institution. The institution in question will be known as Sophos University.

The university uses the following domains:

■ sophosu.example.com

■

■ business.sophosu.example.com

science.sophosu.example.com

The university has the following administrative roles and access rights:

■

Assistant Administrator: Full access rights for all domains

■

■

■

■

Business Administrator: Full access rights for business.sophosu.example.com

Science Administrator: Full access rights for science.sophosu.example.com

Helpdesk: Rights to allow and block lists for all domains

Human Resources Administrator: Rights to watch lists for all domains and limited quarantine search rights

To prepare the university to begin administering email with the groups model, the global administrator performs the following task in the order shown:

Important: All of the tasks described below must be performed on the central server (CSM).

3.4.5.1 Creating Groups

To start, create the groups to which email recipients will belong. In this case, Sophos University requires three groups: one for the primary domain (sophosu.example.com) and one for each of

244 | Administrator’s Reference | PureMessage for UNIX the two subdomains (business.sophosu.example.com and science.sophosu.example.com). You will create these groups from the command line on the central server (CSM). The groups will be named “sophos”, “business” and “science”.

To create the groups:

1. Log on to the central server as the “pmx6” user.

2. Run the following commands: pmx-group --add --group sophos --description "primary domain" pmx-group --add --group business --description "business domain" pmx-group --add --group science --description "science domain"

The newly created groups are stored in subdirectories of the

/opt/pmx6/etc/members-per-group

directory. When you add a group, single-letter subdirectories are automatically created based on the first two letters of the group name. This is done to ensure that the maximum files per directory limit is not exceeded in cases where organizations have large numbers of groups.

The newly created groups are stored in the following locations:

/opt/pmx6/etc/members-per-group/s/o/sophos

/opt/pmx6/etc/members-per-group/b/u/business

/opt/pmx6/etc/members-per-group/s/c/science

For additional information, see “Creating a Group”

Related tasks

Creating a Group on page 215

3.4.5.2 Adding Members to Groups

Email recipients are included in groups by adding address or domain information to the group.

When associating email users with groups, it is important that each group contain a unique list of recipients. Adding the same recipient address to more than one group may produce unpredictable results when the PureMessage policy processes the address.

You can add members to groups by either editing the group file directly or by using the

pmx-list

command, which is the method used in this tutorial. Notice that individual addresses are specified for the “sophos” group, while all addresses in the “business” and “science” groups are added by specifying these subdomains.

To add members to groups:

1. At the command line, as the “pmx6” user, run the following command: pmx-profile sync-from-db --resource=members-per-group

PureMessage for UNIX | Administrator’s Reference | 245

2. Run these commands to populate the groups with recipient addresses: pmx-list add members-per-group#sophos [email protected] BobS@example.

com\

[email protected] [email protected]

pmx-list add members-per-group#business @business.sophosu.example.

com pmx-list add members-per-group#science @science.sophosu.example.com

The addresses are added to the respective group files in subdirectories of the

/opt/pmx6/etc/members-per-group

directory.

3. Run

pmx-profile sync-to-db --resource=members-per-group

to synchronize the list data with the database.

4. Run

pmx-makemap --grouplist

to create a CDB list that can be synchronized with the database.

For additional information, see “Adding Members to a Group”

The next step is creating accounts for the university staff who will be responsible for administering the groups.

Related tasks

Adding Members to a Group on page 216

3.4.5.3 Creating Administrator Accounts

In this step you will create the accounts for the various administrators responsible for the groups created and populated in steps 1 and 2.

You will create accounts for the following administrative roles:

■

Assistant Administrator (George)

■

Business Administrator (Frank)

■

Science Administrator (Susan)

■

Helpdesk (Jerry)

■

Human Resources Administrator (Tanya)

To create the administrator accounts:

1. At the command line, as the “pmx6” user, run the following commands: pmx-user --add --username GeorgeC --fullname "George Cassidy" --email

[email protected] --passphrase sophos pmx-user --add --username FrankB --fullname "Frank Booth" --email

[email protected] --passphrase sophos pmx-user --add --username SusanS --fullname "Susan Summers" --email

[email protected] --passphrase sophos pmx-user --add --username JerryS --fullname "Jerry Sanders" --email

[email protected] --passphrase sophos

246 | Administrator’s Reference | PureMessage for UNIX pmx-user --add --username TanyaH --fullname "Tanya Harrison" --email

[email protected] --passphrase sophos

A confirmation message is displayed for each user added.

For additional information, see “Creating an Administrator Account”.

With groups and administrator accounts created, the next step is associating administrators with their appropriate group(s).

Related tasks

Creating an Administrator Account on page 218

3.4.5.4 Adding Administrator Accounts to Groups

Access rights are granted on the basis of group/administrator pairs. In this step you will create associations between the groups and administrator accounts set up in the previous steps. After you run each of the commands shown below, a message is displayed indicating that the user can administer the specified group.

You will create the following associations:

Role Username

Assistant Administrator

Business Administrator

Science Administrator

Helpdesk

GeorgeC

FrankB

SusanS

JerryS

Human Resources Administrator TanyaH

Associated Groups sophos, business, science business science sophos, business, science sophos, business, science

To add the administrator accounts to groups:

1. At the command line, as the “pmx6” user, run the following commands: pmx-group --add-admin --group sophos --user GeorgeC pmx-group --add-admin --group business --user GeorgeC pmx-group --add-admin --group science --user GeorgeC pmx-group --add-admin --group business --user FrankB pmx-group --add-admin --group science --user SusanS pmx-group --add-admin --group sophos --user JerryS pmx-group --add-admin --group business --user JerryS pmx-group --add-admin --group science --user JerryS

PureMessage for UNIX | Administrator’s Reference | 247 pmx-group --add-admin --group sophos --user TanyaH pmx-group --add-admin --group business --user TanyaH pmx-group --add-admin --group science --user TanyaH

For additional information, see “Adding an Administrator Account to a Group”

Related tasks

Adding an Administrator Account to a Group on page 219

3.4.5.5 Creating a Custom Group Policy List and Rule

Although the Configuration tab of the Groups Web Interface contains several default lists that can be used to determine how the policy deals with specified email addresses and domains, you can also create custom lists.

Note: Regardless of whether the list is a default list or a custom list, it must be combined with a rule in the PureMessage policy, as described in the second part of this procedure.

In this tutorial step you will create an "offensive" list that the policy will use to quarantine messages that contain keywords specified in this list. Then you will use the PureMessage Manager to configure a group-specific policy rule for messages containing offensive words. These messages will be quarantined with the reason "offensive". Finally, you will add an “offensive” option to the quarantine search criteria that will allow group administrators to search for messages that were quarantined for this reason.

Note: This step and steps 6 and 7 require that you edit the policy script using the policy constructor in the PureMessage Manager. It is recommended that you first create a backup of the existing policy that you can revert to when you have finished this tutorial.

First you must back up the policy. On the Policy tab of the Manager, next to Backups on the sidebar, click Create. A backup entry with the date and time is displayed.

■

To create the custom list: a) At the command line, as the “pmx6” user, run the following: pmx-group-list --add --id offensive-words-per-group --name

"Offensive Words (per group)"\

--description "Offensive Words" --match-type contains b) Run

pmx-profile sync-from-db

.

A list with the assigned name is added to

/opt/pmx6/etc

and list data is added to etc/multilists.conf

. If you use

pmx-group

with the --view-perm option, you will see that this list now appears among the permissions that can be enabled and disabled.

c) For each server that is running the group management web interface, at the command line, run: pmx-httpd restart

248 | Administrator’s Reference | PureMessage for UNIX

The list will be accessible the next time the group administrator views the Configuration tab.

■

To create the associated policy rule: a) In the PureMessage Manager, click the Policy tab.

The default PureMessage policy is displayed in constructor mode.

b) At the bottom left of the page, click add main rule.

A set of controls for creating a new rule is displayed.

c) Use the text box and drop-down lists to create a test that matches the one below. Then click add action and select the drop-down list options shown to complete the new rule.

d) Click Save.

e) Click Cut.

f) Click the existing policy rule, Quarantine mail containing suspicious attachments.

The details for this rule are displayed.

g) Click Paste.

The Check for offensive content (per group) rule is added beneath the existing rule.

h) Click Save.

■

To create the "offensive" quarantine search option: a) At the command line, as the “pmx6” user, run the following: pmx-group --add-perm --permission quarantine.reason.offensive

A message is displayed advising that the permission has been added. The Offensive reason will now appear on the Reason drop-down list on the Search Parameters sidebar of the Search tab.

PureMessage for UNIX | Administrator’s Reference | 249

For more information, see “Creating a Group List”, “Adding and Deleting Custom Reasons”, the

pmx-group-list

man page, and the

pmx-group

man page.

For more information about configuring the PureMessage policy, see “Policy Configuration” in the

Administrator's Reference and “Policy” in the Manager Reference.

Next, you will use

pmx-group

command to add a group policy setting, and then associate the setting with a group-specific policy rule.

Related concepts

Policy Configuration

on page 258

Policy Tab

on page 84

Related tasks

Creating a Group List

on page 222

Adding and Deleting Custom Quarantine Search Reasons on page 223

Adding and Deleting Custom Log Search Reasons on page 224

Related information

pmx-group pmx-group-list

3.4.5.6 Adding and Defining a Policy Setting

By default, the Policy: Policy Settings page of the Configuration tab has no settings configured.

Implementing a group policy option requires two steps. First, you will create a new policy setting, in the form of a check box, that gives group administrators the option of enabling/disabling spam checking. Second, you will use the PureMessage policy constructor to define a new policy rule and associate it with this setting.

■

To create the policy setting: a) At the command line, as the “pmx6” user, run the following: pmx-group-policy --add --id group-anti-spam-opt-outs --name "Antispam opt-outs (per group)"\

--type checkbox --style optin --description "Disable spam checking" b) Run

pmx-profile sync-from-db

.

A check box option, Disable spam checking, is now displayed on the Policy: Policy

Settings page of the Configuration tab. In addition, a new group list, Anti-spam opt-outs

(per group), is added to

/opt/pmx6/etc/lists.conf

and is also available in the drop-down list that is used for specifying lists in the PureMessage policy constructor.

■

■

To define the policy rule: a) In the PureMessage Manager, click the Policy tab.

The default PureMessage policy is displayed in constructor mode.

b) Click the existing policy rule, Deliver mail to anti-spam opt-outs.

250 | Administrator’s Reference | PureMessage for UNIX

The details for this rule are displayed.

c) Click add test.

Additional Tests drop-down lists are displayed.

d) Select the drop-down list options as shown below.

e) Click Save.

For additional information, see “Creating a Policy Setting”, and the

pmx-group-policy

man page.

For more information about configuring the PureMessage policy, see “Policy Configuration” in the

Administrator's Reference and “Policy” in the Manager Reference.

Next, you will learn how to configure a group-specific document that can be viewed by global administrators.

Related concepts

Policy Configuration

on page 258

Policy Tab

on page 84

Related tasks

Creating a Policy Setting

on page 221

Related information

pmx-group-policy

3.4.5.7 Adding a Group Document

Sometimes you may want group administrators to have access to relevant custom documentation.

Although you can choose to permit group administrators to edit these documents, document templates are generally read-only. In this tutorial step you will create a document template using

PureMessage for UNIX | Administrator’s Reference | 251 the

pmx-group-file

command, and add content via the group administrator interface.

Permissions for the template will be set in step 9.

■

To add a group document template: a) At the command line, as the “pmx6” user, run the following: pmx-group-file --add --id policy-description --name "Policy

Description"\

--type document b) Run

pmx-profile sync-from-db --all

.

c) Run

pmx-httpd restart

.

A new template is added to the

/opt/pmx6/var/lib/multifile

directory. In addition, a new category, Documents, is displayed on the sidebar of the Configuration tab in the

Groups Web Interface.

■

To add content to the document: a) Log in to the Groups Web Interface: point a supported browser at https://

<Hostname>:28443/groups

, and log in as one of the users you created in step 3 (for example, Username:

GeorgeC

Password:

sophos

). Accept the certificate to continue to the GUI.

The GUI launches with the Search tab displayed.

b) Click the Configuration tab.

On the Configuration sidebar, the Policy Description link is displayed beneath the

Documents heading.

c) Click Policy Description.

The Documentation template is displayed in the content pane.

d) Copy and paste the content below into the text box provided, and click Save.

Mail from internal hosts

Reject mail containing viruses

Allow unscannable messages to pass through

Mail from external hosts

Clean mail containing viruses

Quarantine mail containing suspicious attachments

Deliver mail from whitelisted hosts and senders

Deliver mail to anti-spam opt-outs

Quarantine mail from blacklisted hosts and senders

Copy to quarantine and deliver if spam probability is 50% or

more

Add X-Header and deliver messages

252 | Administrator’s Reference | PureMessage for UNIX

A message is displayed at the bottom of the content pane, indicating that the Policy

Description has been saved. The access rights for this document are currently read/write, but you will change the status to read-only as part of step 9, "Granting Access Rights."

For additional information, see “Creating a Policy Setting” and the

pmx-group-file

man page.

Next, you will see how to add a group-specific banner.

Related tasks

Creating a Group List

on page 222

Related information

pmx-group-file

3.4.5.8 Adding a Group Banner

In this step you will create a group-specific add banner option that will be available to group administrators. First you will use the

pmx-group-file

command to create the group-specific banner option. Then you will edit the PureMessage policy to create an action that can be used to append a disclaimer to all outgoing mail.

■

To add a group banner: a) At the command line, as the “pmx6” user, run the following: pmx-group-file --add --id outgoing-disclaimer-per-group --name

"Outgoing Disclaimer"\

--type banner --charset latin1 b) Run

pmx-profile sync-from-db --all

.

c) Run

pmx-httpd restart

.

A new template is added to the

/opt/pmx6/var/lib/multifile

directory. In addition, a new category, Banners, is displayed on the sidebar of the Configuration tab. The group administrator can now click Outgoing Disclaimer to display a text box for adding banner text.

■

To create a group-specific "add banner" action: a) In the PureMessage Manager, click the Policy tab.

The default PureMessage policy is displayed in constructor mode.

b) At the bottom left of the page, click add main rule.

A set of controls for creating a new rule is displayed.

c) Use the text box and drop-down lists to create a rule identical to the one shown below.

PureMessage for UNIX | Administrator’s Reference | 253 d) Click the Arguments button.

The Add banner dialog box is displayed.

e) In the Add banner dialog box, select Group-specific banner. In the adjacent text box, type

outgoing-disclaimer-per-group

, which is the ID you assigned to this banner template using the

pmx-group-file

command.

f) Click OK.

g) Click Save.

h) Click Cut.

i) Click the existing rule, Reject mail containing viruses, in the Mail from internal hosts section of the policy.

j) Click Paste.

k) Click Save.

l) Click Commit.

For additional information, see

Creating a Policy Setting on page 222 and the

pmx-group-file

man page.

Next, you will see how to grant access rights to the various administrators.

Related tasks

Creating a Group List

on page 222

Related information

pmx-group-file

3.4.5.9 Granting Access Rights

Access rights are set on the basis of group/administrator pairs. By default, any group that has been associated with an administrator account has full access rights enabled. In this step you will change the permissions as necessary, so that some of the administrators will only be able to access certain tabs and options in the Groups Web Interface.

254 | Administrator’s Reference | PureMessage for UNIX

The access rights will be granted as follows:

Role

Assistant Administrator

Business Administrator

Science Administrator

Helpdesk

Username

GeorgeC

FrankB

SusanS

JerryS

Human Resources Administrator TanyaH

Access Rights

Full access to all domains.

Full access within the “business” domain.

Full access within the “science” domain.

Allow and block lists for all domains (no other Configuration options), online help access, quarantine (with no preview options) and no access to reports.

"Offensive Words" watch list for all domains, online help access, quarantine access (for reason

"offensive" only), and no access to reports.

In this tutorial, the Assistant Administrator (GeorgeC) has responsibility for all of the domains.

Since full access rights were granted by default when you associated this user with each of the three groups, there is no need to modify the permissions for GeorgeC. The same is true for FrankB

(Business Administrator) and SusanS (Science Administrator), who already have full access to their respective domains.

For rest of the administrators, however, you will have to restrict access to certain features. This is accomplished by specifying the --group, --user, --permission and --value (usually ''on" or

''off") for specific permissions or groups of permissions.

To set permissions for the Helpdesk and Human Resources administrators:

1. At the command line, as the “pmx6” user, run the following commands:

Helpdesk - JerryS

pmx-group --set-perm --group sophos --user JerryS --permission configuration.document.policy-description --value read pmx-group --set-perm --group sophos --user JerryS --permission configuration.policysettings --value off pmx-group --set-perm --group sophos --user JerryS --permission quarantine.preview --value off pmx-group --set-perm --group sophos --user JerryS --permission reports

--value off

PureMessage for UNIX | Administrator’s Reference | 255 pmx-group --set-perm --group business --user JerryS --permission configuration.document.policy-description --value read pmx-group --set-perm --group business --user JerryS --permission configuration.policysettings --value off pmx-group --set-perm --group business --user JerryS --permission quarantine.preview --value off pmx-group --set-perm --group business --user JerryS --permission reports --value off pmx-group --set-perm --group science --user JerryS --permission configuration.document.policy-description --value read pmx-group --set-perm --group science --user JerryS --permission configuration.policysettings --value off pmx-group --set-perm --group science --user JerryS --permission quarantine.preview --value off pmx-group --set-perm --group science --user JerryS --permission reports --value off

Human Resources Administrator - TanyaH

pmx-group --set-perm --group sophos --user TanyaH --permission configuration.document.policy-description --value read pmx-group --set-perm --group sophos --user TanyaH --permission configuration.lists.allowed-relays-per-group --value off pmx-group --set-perm --group sophos --user TanyaH --permission configuration.lists.allowed-senders-per-group --value off pmx-group --set-perm --group sophos --user TanyaH --permission configuration.lists.blocked-relays-per-group --value off pmx-group --set-perm --group sophos --user TanyaH --permission configuration.lists.blocked-senders-per-group --value off pmx-group --set-perm --group sophos --user TanyaH --permission configuration.policysettings --value off pmx-group --set-perm --group sophos --user TanyaH --permission help

--value off pmx-group --set-perm --group sophos --user TanyaH --permission quarantine.actions --value off pmx-group --set-perm --group sophos --user TanyaH --permission quarantine.actions.approve --value off pmx-group --set-perm --group sophos --user TanyaH --permission quarantine.actions.delete --value off pmx-group --set-perm --group sophos --user TanyaH --permission quarantine.actions.forward --value off pmx-group --set-perm --group sophos --user TanyaH --permission quarantine.actions.report --value off pmx-group --set-perm --group sophos --user TanyaH --permission quarantine.actions.save --value off pmx-group --set-perm --group sophos --user TanyaH --permission quarantine.preview.attachments --value off pmx-group --set-perm --group sophos --user TanyaH --permission quarantine.preview.attachments.download --value off pmx-group --set-perm --group sophos --user TanyaH --permission quarantine.preview.content --value off pmx-group --set-perm --group sophos --user TanyaH --permission quarantine.preview.info --value off pmx-group --set-perm --group sophos --user TanyaH --permission

256 | Administrator’s Reference | PureMessage for UNIX quarantine.preview.source --value off pmx-group --set-perm --group sophos --user TanyaH --permission quarantine.preview.status --value off pmx-group --set-perm --group sophos --user TanyaH --permission quarantine.reason.blacklisted --value off pmx-group --set-perm --group sophos --user TanyaH --permission quarantine.reason.spam --value off pmx-group --set-perm --group sophos --user TanyaH --permission quarantine.reason.virus --value off pmx-group --set-perm --group sophos --user TanyaH --permission reports

--value off pmx-group --set-perm --group business --user TanyaH --permission configuration.document.policy-description --value read pmx-group --set-perm --group business --user TanyaH --permission configuration.lists.allowed-relays-per-group --value off pmx-group --set-perm --group business --user TanyaH --permission configuration.lists.allowed-senders-per-group --value off pmx-group --set-perm --group business --user TanyaH --permission configuration.lists.blocked-relays-per-group --value off pmx-group --set-perm --group business --user TanyaH --permission configuration.lists.blocked-senders-per-group --value off pmx-group --set-perm --group business --user TanyaH --permission configuration.policysettings --value off pmx-group --set-perm --group business --user TanyaH --permission help

--value off pmx-group --set-perm --group business --user TanyaH --permission quarantine.actions --value off pmx-group --set-perm --group business --user TanyaH --permission quarantine.actions.approve --value off pmx-group --set-perm --group business --user TanyaH --permission quarantine.actions.delete --value off pmx-group --set-perm --group business --user TanyaH --permission quarantine.actions.forward --value off pmx-group --set-perm --group business --user TanyaH --permission quarantine.actions.report --value off pmx-group --set-perm --group business --user TanyaH --permission quarantine.actions.save --value off pmx-group --set-perm --group business --user TanyaH --permission quarantine.preview.attachments --value off pmx-group --set-perm --group business --user TanyaH --permission quarantine.preview.attachments.download --value off pmx-group --set-perm --group business --user TanyaH --permission quarantine.preview.content --value off pmx-group --set-perm --group business --user TanyaH --permission quarantine.preview.info --value off pmx-group --set-perm --group business --user TanyaH --permission quarantine.preview.source --value off pmx-group --set-perm --group business --user TanyaH --permission quarantine.preview.status --value off pmx-group --set-perm --group business --user TanyaH --permission quarantine.reason.blacklisted --value off pmx-group --set-perm --group business --user TanyaH --permission quarantine.reason.spam --value off pmx-group --set-perm --group business --user TanyaH --permission quarantine.reason.virus --value off

PureMessage for UNIX | Administrator’s Reference | 257 pmx-group --set-perm --group business --user TanyaH --permission reports --value off pmx-group --set-perm --group science --user TanyaH --permission configuration.document.policy-description --value read pmx-group --set-perm --group science --user TanyaH --permission configuration.lists.allowed-relays-per-group --value off pmx-group --set-perm --group science --user TanyaH --permission configuration.lists.allowed-senders-per-group --value off pmx-group --set-perm --group science --user TanyaH --permission configuration.lists.blocked-relays-per-group --value off pmx-group --set-perm --group science --user TanyaH --permission configuration.lists.blocked-senders-per-group --value off pmx-group --set-perm --group science --user TanyaH --permission configuration.policysettings --value off pmx-group --set-perm --group science --user TanyaH --permission help

--value off pmx-group --set-perm --group science --user TanyaH --permission quarantine.actions --value off pmx-group --set-perm --group science --user TanyaH --permission quarantine.actions.approve --value off pmx-group --set-perm --group science --user TanyaH --permission quarantine.actions.delete --value off pmx-group --set-perm --group science --user TanyaH --permission quarantine.actions.forward --value off pmx-group --set-perm --group science --user TanyaH --permission quarantine.actions.report --value off pmx-group --set-perm --group science --user TanyaH --permission quarantine.actions.save --value off pmx-group --set-perm --group science --user TanyaH --permission quarantine.preview.attachments --value off pmx-group --set-perm --group science --user TanyaH --permission quarantine.preview.attachments.download --value off pmx-group --set-perm --group science --user TanyaH --permission quarantine.preview.content --value off pmx-group --set-perm --group science --user TanyaH --permission quarantine.preview.info --value off pmx-group --set-perm --group science --user TanyaH --permission quarantine.preview.source --value off pmx-group --set-perm --group science --user TanyaH --permission quarantine.preview.status --value off pmx-group --set-perm --group science --user TanyaH --permission quarantine.reason.blacklisted --value off pmx-group --set-perm --group science --user TanyaH --permission quarantine.reason.spam --value off pmx-group --set-perm --group science --user TanyaH --permission quarantine.reason.virus --value off pmx-group --set-perm --group science --user TanyaH --permission reports --value off

The permissions are disabled for the specified users.