Escolar Documentos
Profissional Documentos
Cultura Documentos
Installation Guide
Version Information
PGP Universal Server Installation Guide. PGP Universal Server Version 3.0.0. Released March 2010.
Copyright Information
Copyright © 1991-2010 by PGP Corporation. All Rights Reserved. No part of this document can be reproduced or transmitted in any form or by any
means, electronic or mechanical, for any purpose, without the express written permission of PGP Corporation.
Trademark Information
PGP, Pretty Good Privacy, and the PGP logo are registered trademarks of PGP Corporation in the US and other countries. IDEA is a trademark of Ascom
Tech AG. Windows and ActiveX are registered trademarks of Microsoft Corporation. AOL is a registered trademark, and AOL Instant Messenger is a
trademark, of America Online, Inc. Red Hat and Red Hat Linux are trademarks or registered trademarks of Red Hat, Inc. Linux is a registered trademark
of Linus Torvalds. Solaris is a trademark or registered trademark of Sun Microsystems, Inc. AIX is a trademark or registered trademark of International
Business Machines Corporation. HP-UX is a trademark or registered trademark of Hewlett-Packard Company. SSH and Secure Shell are trademarks of
SSH Communications Security, Inc. Rendezvous and Mac OS X are trademarks or registered trademarks of Apple Computer, Inc. All other registered
and unregistered trademarks in this document are the sole property of their respective owners.
Acknowledgments
This product includes or may include:
-- The Zip and ZLib compression code, created by Mark Adler and Jean-Loup Gailly, is used with permission from the free Info-ZIP implementation,
developed by zlib (http://www.zlib.net). -- Libxml2, the XML C parser and toolkit developed for the Gnome project and distributed and copyrighted under
the MIT License found at http://www.opensource.org/licenses/mit-license.html. Copyright © 2007 by the Open Source Initiative. -- bzip2 1.0, a freely
available high-quality data compressor, is copyrighted by Julian Seward, © 1996-2005. -- Application server (http://jakarta.apache.org/), web server
(http://www.apache.org/), Jakarta Commons (http://jakarta.apache.org/commons/license.html) and log4j, a Java-based library used to parse HTML,
developed by the Apache Software Foundation. The license is at www.apache.org/licenses/LICENSE-2.0.txt. -- Castor, an open-source, data-binding
framework for moving data from XML to Java programming language objects and from Java to databases, is released by the ExoLab Group under an
Apache 2.0-style license, available at http://www.castor.org/license.html. -- Xalan, an open-source software library from the Apache Software
Foundation that implements the XSLT XML transformation language and the XPath XML query language, is released under the Apache Software
License, version 1.1, available at http://xml.apache.org/xalan-j/#license1.1. -- Apache Axis is an implementation of the SOAP ("Simple Object Access
Protocol") used for communications between various PGP products is provided under the Apache license found at
http://www.apache.org/licenses/LICENSE-2.0.txt. -- mx4j, an open-source implementation of the Java Management Extensions (JMX), is released under
an Apache-style license, available at http://mx4j.sourceforge.net/docs/ch01s06.html. -- jpeglib version 6a is based in part on the work of the
Independent JPEG Group. (http://www.ijg.org/) -- libxslt the XSLT C library developed for the GNOME project and used for XML transformations is
distributed under the MIT License http://www.opensource.org/licenses/mit-license.html. -- PCRE Perl regular expression compiler, copyrighted and
distributed by University of Cambridge. ©1997-2006. The license agreement is at http://www.pcre.org/license.txt. -- BIND Balanced Binary Tree Library
and Domain Name System (DNS) protocols developed and copyrighted by Internet Systems Consortium, Inc. (http://www.isc.org) -- Free BSD
implementation of daemon developed by The FreeBSD Project, © 1994-2006. -- Simple Network Management Protocol Library developed and
copyrighted by Carnegie Mellon University © 1989, 1991, 1992, Networks Associates Technology, Inc, © 2001- 2003, Cambridge Broadband Ltd. ©
2001- 2003, Sun Microsystems, Inc., © 2003, Sparta, Inc, © 2003-2006, Cisco, Inc and Information Network Center of Beijing University of Posts and
Telecommunications, © 2004. The license agreement for these is at http://net-snmp.sourceforge.net/about/license.html. -- NTP version 4.2 developed
by Network Time Protocol and copyrighted to various contributors. -- Lightweight Directory Access Protocol developed and copyrighted by OpenLDAP
Foundation. OpenLDAP is an open-source implementation of the Lightweight Directory Access Protocol (LDAP). Copyright © 1999-2003, The
OpenLDAP Foundation. The license agreement is at http://www.openldap.org/software/release/license.html. Secure shell OpenSSH developed by
OpenBSD project is released by the OpenBSD Project under a BSD-style license, available at http://www.openbsd.org/cgi
bin/cvsweb/src/usr.bin/ssh/LICENCE?rev=HEAD. -- PC/SC Lite is a free implementation of PC/SC, a specification for SmartCard integration is released
under the BSD license. -- Postfix, an open source mail transfer agent (MTA), is released under the IBM Public License 1.0, available at
http://www.opensource.org/licenses/ibmpl.php. -- PostgreSQL, a free software object-relational database management system, is released under a
BSD-style license, available at http://www.postgresql.org/about/licence. -- PostgreSQL JDBC driver, a free Java program used to connect to a
PostgreSQL database using standard, database independent Java code, (c) 1997-2005, PostgreSQL Global Development Group, is released under a
BSD-style license, available at http://jdbc.postgresql.org/license.html. -- PostgreSQL Regular Expression Library, a free software object-relational
database management system, is released under a BSD-style license, available at http://www.postgresql.org/about/licence. -- 21.vixie-cron is the Vixie
version of cron, a standard UNIX daemon that runs specified programs at scheduled times. Copyright © 1993, 1994 by Paul Vixie; used by permission.
- JacORB, a Java object used to facilitate communication between processes written in Java and the data layer, is open source licensed under the GNU
Library General Public License (LGPL) available at http://www.jacorb.org/lgpl.html. Copyright © 2006 The JacORB Project. -- TAO (The ACE ORB) is an
open-source implementation of a CORBA Object Request Broker (ORB), and is used for communication between processes written in C/C++ and the
data layer. Copyright (c) 1993-2006 by Douglas C. Schmidt and his research group at Washington University, University of California, Irvine, and
Vanderbilt University. The open source software license is available at http://www.cs.wustl.edu/~schmidt/ACE-copying.html. -- libcURL, a library for
downloading files via common network services, is open source software provided under a MIT/X derivate license available at
http://curl.haxx.se/docs/copyright.html. Copyright (c) 1996 - 2007, Daniel Stenberg. -- libuuid, a library used to generate unique identifiers, is released
under a BSD-style license, available at http://thunk.org/hg/e2fsprogs/?file/fe55db3e508c/lib/uuid/COPYING. Copyright (C) 1996, 1997 Theodore Ts'o. --
libpopt, a library that parses command line options, is released under the terms of the GNU Free Documentation License available at
http://directory.fsf.org/libs/COPYING.DOC. Copyright © 2000-2003 Free Software Foundation, Inc. -- gSOAP, a development tool for Windows clients to
communicate with the Intel Corporation AMT chipset on a motherboard, is distributed under the gSOAP Public License version 1.3b, available at
http://www.cs.fsu.edu/~engelen/license.html. -- Windows Template Library (WTL) is used for developing user interface components and is distributed
under the Common Public License v1.0 found at http://opensource.org/licenses/cpl1.0.php. -- The Perl Kit provides several independent utilities used to
automate a variety of maintenance functions and is provided under the Perl Artistic License, found at
http://www.perl.com/pub/a/language/misc/Artistic.html. -- rEFIt - libeg, provides a graphical interface library for EFI, including image rendering, text
rendering, and alpha blending, and is distributed under the license found at
http://refit.svn.sourceforge.net/viewvc/*checkout*/refit/trunk/refit/LICENSE.txt?revision=288. Copyright (c) 2006 Christoph Pfisterer. All rights reserved.
-- Java Radius Client, used to authenticate PGP Universal Web Messenger users via Radius, is distributed under the Lesser General Public License
(LGPL) found at http://www.gnu.org/licenses/lgpl.html. -- Yahoo! User Interface (YUI) library version 2.5.2, a Web UI interface library for AJAX.
Copyright (c) 2009, Yahoo! Inc. All rights reserved. Released under a BSD-style license, available at http://developer.yahoo.com/yui/license.html. --
JSON-lib version 2.2.1, a Java library used to convert Java objects to JSON (JavaScript Object Notation) objects for AJAX. Distributed under the Apache
2.0 license, available at http://json-lib.sourceforge.net/license.html. -- EZMorph, used by JSON-lib, is distributed under the Apache 2.0 license, available
at http://ezmorph.sourceforge.net/license.html. -- Apache Commons Lang, used by JSON-lib, is distributed under the Apache 2.0 license, available at
http://commons.apache.org/license.html. -- Apache Commons BeanUtils, used by JSON-lib, is distributed under the Apache 2.0 license, available at
http://commons.apache.org/license.html. -- SimpleIni is an .ini format file parser and provides the ability to read and write .ini files, a common
configuration file format used on Windows, on other platforms. Distributed under the MIT License found at http://www.opensource.org/licenses/mit
license.html. Copyright 2006-2008, Brodie Thiesfield. -- uSTL provides a small fast implementation of common Standard Template Library functions and
data structures and is distributed under the MIT License found at http://www.opensource.org/licenses/mit-license.html. Copyright (c) 2005-2009 by
Mike Sharov <msharov@users.sourceforge.net>. -- Protocol Buffers (protobuf), Google's data interchange format, are used to serialize structure data in
the PGP SDK. Distributed under the BSD license found at http://www.opensource.org/licenses/bsd-license.php. Copyright 2008 Google Inc. All rights
reserved.
Additional acknowledgements and legal notices are included as part of the PGP Universal Server.
Export Information
Export of this software and documentation may be subject to compliance with the rules and regulations promulgated from time to time by the Bureau
of Export Administration, United States Department of Commerce, which restricts the export and re-export of certain products and technical data.
Limitations
The software provided with this documentation is licensed to you for your individual use under the terms of the End User License Agreement provided
with the software. The information in this document is subject to change without notice. PGP Corporation does not warrant that the information meets
your requirements or that the information is free of errors. The information may include technical inaccuracies or typographical errors. Changes may be
made to the information and incorporated in new editions of this document, if and when made available by PGP Corporation.
4
Contents
Introduction 1
What is PGP Universal Server? 1
Symbols 3
Getting Assistance 3
Contact Information 4
Server Placement 7
Gateway Placement 7
Internal Placement 8
Installation Overview 10
Open Ports 17
TCP Ports 17
UDP Ports 19
About Installation 23
System Requirements 23
Installation Materials 25
Installation Options 25
i
PGP Universal Server Contents
Hardware 29
System Information 29
Configuration Examples 41
Cluster Configuration 44
Encircled Configuration 50
Unsupported Configurations 54
ii
1 Introduction
This book describes some important PGP Universal Server concepts and gives
you a high-level overview of the things you need to do to set up and use PGP
Universal Server.
This book provides information about how your PGP Universal Server processes
email, to help you decide how to integrate your PGP Universal Servers into your
existing network.
It lists system requirements, provides an overview of the installation process,
and provides step-by-step instructions on how to install the software. It also
includes information about using Microsoft Exchange Server and Lotus Domino
Server with PGP Universal Satellite.
1
PGP Universal Server Introduction
2
PGP Universal Server Introduction
Symbols
Notes, Cautions, and Warnings are used in the following ways.
Note: Notes are extra, but important, information. A Note calls your attention
to important aspects of the product. You can use the product better if you
read the Notes.
Getting Assistance
For additional resources, see these sections.
3
PGP Universal Server Introduction
Contact Information
4
PGP Universal Server Introduction
5
2 Adding the PGP Universal
Server to Your Network
This chapter provides information about how your PGP Universal Server
processes email, to help you decide how to integrate your PGP Universal
Servers into your existing network. It also includes information about using
Microsoft Exchange Server and Lotus Domino Server with PGP Universal
Satellite.
These topics are covered in the following sections.
Server Placement
A PGP Universal Server can be placed in your network in either of two locations
in the logical flow of data:
• Internal placement. The PGP Universal Server is located between your
email users and their local mail server in the logical flow of data.
• Gateway placement. The PGP Universal Server is located between your
external facing mail server and the Internet in the logical flow of data.
Caution: The PGP Universal Server must not be behind a proxy server, unless
it is a transparent proxy, to receive licensing and update information
automatically. This is true for both gateway and internal placement.
Gateway Placement
With a gateway placement, your PGP Universal Server sits between your mail
server and the Internet in the logical flow of data.
7
PGP Universal Server Adding the PGP Universal Server to Your Network
Note: The physical location of the PGP Universal Server and the mail server
are not important. What is important is that, from a mail relay point of view,
the PGP Universal Server is between the mail server and the Internet. Both
can be on the internal network or in the DMZ.
With a gateway placement, email messages are secured before they are sent to
the Internet (on the way to their destination) and decrypted/verified when
received from the Internet, over SMTP in both cases.
Note: Email users on your internal network should not be allowed direct
access to a PGP Universal Server in gateway placement. PGP Universal
Server attempts to enforce this automatically based on your configuration.
Configure the mail server to verify From addresses if you intend to use the
signing features of PGP Universal Server.
With a gateway placement, messages are stored unsecured on the mail server
(unless PGP Universal Satellite is being used).
For PGP Universal Server to create the SMSA, you must make sure to correctly
configure your mail server when you are using PGP Universal Servers in
gateway placements.
Internal Placement
With an internal placement, your PGP Universal Server sits between your email
users and their email server in the logical flow of data.
8
PGP Universal Server Adding the PGP Universal Server to Your Network
Note: The physical location of the PGP Universal Server and the mail server
are not important. What is important is that, from a mail relay point of view,
the PGP Universal Server is between the email users and the mail server.
Both can be on the internal network or in the DMZ. From a performance
perspective, it is generally advisable to put them next to each other on the
same network.
With an internal placement of your PGP Universal Server, messages are secured
based on the applicable policies when they are sent to the mail server using
SMTP; they are decrypted and verified when they are retrieved from the mail
server using POP or IMAP.
With an internal placement, messages are stored secured on the mail server.
Messages are only transmitted unencrypted between the internal user and the
PGP Universal Server, then only if PGP Universal Satellite has not been
deployed globally to your internal users. If your mail server is configured for
SSL/TLS communications with the email client, the messages can be passed
through that encrypted channel thus maintaining encryption along the entire
path.
For PGP Universal Server to create the SMSA, email clients must have SMTP
authentication turned on when they are communicating with a PGP Universal
Server in an internal placement.
9
PGP Universal Server Adding the PGP Universal Server to Your Network
Configure the relay on the Outbound or Unified SMTP proxy. For more
information, see "Creating New or Editing Existing Proxies" in the PGP Universal
Server Administrator's Guide.
Installation Overview
The following steps are a broad overview of what it takes to plan, set up, and
maintain your PGP Universal Server environment.
Steps 1 and 4 are described in detail in this book. The remaining tasks are
described in the PGP Universal Server Administrator's Guide.
Note that these steps apply to the installation of a new, stand-alone PGP
Universal Server. If you plan to install a cluster, you must install and configure
one PGP Universal Server following the steps outlined here. Subsequent cluster
members will receive most of their configuration settings from the initial PGP
Universal Server through data replication.
The steps to install and configure a PGP Universal Server are as follows:
1 Plan where in your network you want to locate your PGP Universal
Server(s).
Where you put PGP Universal Servers in your network, how many PGP
Universal Servers you have in your network, and other factors all have a
major impact on how you add them to your existing network.
10
PGP Universal Server Adding the PGP Universal Server to Your Network
Create a diagram of your network that includes all network components and
shows how email flows; this diagram details how adding a PGP Universal
Server impacts your network.
For more information on planning how to add PGP Universal Servers to your
existing network, see Adding the PGP Universal Server to Your Network (on
page 7).
2 Perform necessary DNS changes.
Add IP addresses for your PGP Universal Servers, an alias to your
keyserver, update the MX record if necessary, add keys.<domain>,
hostnames of potential Secondary servers for a cluster, and so on.
Properly configured DNS settings (including root servers and appropriate
reverse lookup records) are required to support PGP Universal Server. Make
sure both host and pointer records are correct. IP addresses must be
resolvable to hostnames, as well as hostnames resolvable to IP addresses.
3 Prepare a hardware token Ignition Key.
If you want to add a hardware token Ignition Key during setup, install the
drivers and configure the token before you begin the PGP Universal Server
setup process. See “Protecting PGP Universal Server with Ignition Keys” in
the PGP Universal Server Administrator's Guide for information on how to
prepare a hardware token Ignition Key.
Note: In a cluster, the Ignition Key configured on the first PGP Universal
Server in the cluster will also apply to the subsequent members of the
cluster.
11
PGP Universal Server Adding the PGP Universal Server to Your Network
If you want the PGP Universal Server to provide mail proxy services, you
must have a PGP Universal Server license with the mailstream feature
enabled. For more information, see “Licensing Your Software” in the PGP
Universal Server Administrator's Guide.
6 If you have a PGP key you want to use as your Organization Key with
PGP Universal Server, import it, then back it up.
Your Organization Key does two important things: it is used to sign all user
keys the PGP Universal Server creates and it is used to encrypt PGP
Universal Server backups. This key represents the identity of your
organization, and is the root of the Web-of-Trust for your users.
If your organization uses PGP Desktop and already has an Corporate Key or
Organization Key, and you want to use that key with PGP Universal Server,
you should import it as soon as you have configured your server, then
create a backup of the key.
If your organization does not have an existing key that you want to use as
your Organization Key, use the Organization Key the Setup Assistant
automatically creates with default values. For more information, see
“Managing Organization Keys” in the PGP Universal Server Administrator's
Guide.
No matter which key you use as your Organization Key, it is very important
to make a backup of the key. Since PGP Universal Server’s built-in back-up
feature always encrypts backups to this key, you need to provide a copy of
your Organization Key to restore your data.
For more information, see “Organization Certificate” in the PGP Universal
Server Administrator's Guide.
7 If you have a PGP Additional Decryption Key (ADK) that you want to
use with PGP Universal Server, add it.
An ADK is a way to recover an email message if the recipient is unable or
unwilling to do so; every message that is also encrypted to the ADK can be
opened by the holder(s) of the ADK. You cannot create an ADK with the
PGP Universal Server, but if you have an existing PGP ADK (generated by
PGP Desktop, an ideal scenario for a split key; refer to the PGP Desktop
User’s Guide for more information), you can add it to your PGP Universal
Server and use it. For more information, see “Additional Decryption Key
(ADK)” in the PGP Universal Server Administrator's Guide.
8 Create a SSL/TLS certificate or obtain a valid SSL/TLS certificate.
The Setup Assistant automatically creates a self-signed certificate for use
with SSL/TLS traffic. Because this certificate is self-signed, however, it
might not be trusted by email or Web browser clients. PGP Corporation
recommends that you obtain a valid SSL/TLS certificate for each of your
PGP Universal Servers from a reputable Certificate Authority.
This is especially important for PGP Universal Servers that are accessed
publicly. Older Web browsers might reject self-signed certificates or not
know how to handle them correctly when they encounter them via PGP
Universal Web Messenger or Smart Trailer.
12
PGP Universal Server Adding the PGP Universal Server to Your Network
For more information, see “Working with Certificates” in the PGP Universal
Server Administrator's Guide.
9 Configure the Directory Synchronization feature if you want to
synchronize an LDAP directory with your PGP Universal Server.
Using the Directory Synchronization feature gives you more control over
who is included in your SMSA, if you have an existing LDAP server.
By default, user enrollment is set to Email enrollment. If you elect to use
LDAP directory enrollment, it assumes that you have an LDAP directory
configured. You can change the client enrollment setting for Directory
Synchronization from the Directory Synchronization Settings page in the
PGP Universal Server administrative interface. You must have an LDAP
directory configured and Directory Synchronization enabled for LDAP user
enrollment to work.
For more information, see “Using Directory Synchronization to Manage
Users” in the PGP Universal Server Administrator's Guide.
10 Add trusted keys, configure consumer policy, and establish mail
policy.
All these settings are important for secure operation of PGP Universal
Server. For more information on adding trusted keys from outside the
SMSA, see “Managing Trusted Keys and Certificates” in the PGP Universal
Server Administrator's Guide. For more information about consumer policy
settings, see “Administering Consumer Policy.” For information on setting
up mail policy, see “Setting Mail Policy.”
Note: When setting policy for Consumers, PGP Universal Server provides
an option called Out of Mail Stream (OOMS) support. OOMS specifies
how the email gets transmitted from the client to the server when
Protector for Mail Encryption Client cannot find a key for the recipient and
therefore cannot encrypt the message.
You can elect to enable OOMS, which means that sensitive messages
that can't be encrypted locally are sent to PGP Universal Server "out of the
mail stream." Protector for Mail Encryption Client creates a separate,
encrypted network connection to the PGP Universal Server to transmit the
message. However, archiving solutions, outbound anti-virus filters, or
other systems which monitor or proxy mail traffic will not see these
messages.
13
PGP Universal Server Adding the PGP Universal Server to Your Network
14
PGP Universal Server Adding the PGP Universal Server to Your Network
Learn Mode lets you become familiar with how the PGP Universal Server
operates and it lets you see the effects of the policy settings you have
established before the PGP Universal Server actually goes live on your
network. Naturally, you can fine tune settings while in Learn Mode, so that
the PGP Universal Server is operating just how you want before you go live.
For more information, see “Operating in Learn Mode” in the PGP Universal
Server Administrator's Guide.
16 Adjust policies as necessary.
It might take a few tries to get everything working just the way you want.
For example, you might need to revise your mail policy.
17 Perform backups of all PGP Universal Servers before you take them
out of Learn Mode.
This gives you a baseline backup in case you need to return to a clean
installation. For more information, see “Backing Up and Restoring System
and User Data” in the PGP Universal Server Administrator's Guide.
18 Take your PGP Universal Servers out of Learn Mode.
Once this is done, email messages are encrypted, signed, and
decrypted/verified, according to the relevant policy rules. Make sure you
have licensed each of your PGP Universal Servers; you cannot take a PGP
Universal Server out of Learn Mode until it has been licensed.
19 Monitor the system logs to make sure your PGP Universal Server
environment is operating as expected.
15
3 Open Ports
This chapter lists and describes the ports a PGP Universal Server has open and
on which it is listening.
TCP Ports
17
PGP Universal Server Open Ports
465 SMTPS (Simple Mail Transfer Used for sending mail securely
Protocol, Secure) with internal placements only.
Closed for gateway placements.
This is a non-standard port used
only by legacy mail servers. We
recommend not using this port,
and instead always using
STARTTLS on port 25.
636 LDAPS (Lightweight Directory Used to securely allow remote
Access Protocol, Secure) hosts to look up public keys of
local users.
993 IMAPS (Internet Message Access Used for retrieving mail securely
Protocol, Secure) by users with IMAP accounts
with internal placements only.
Closed for gateway placements.
995 POPS (Post Office Protocol, Used for retrieving mail securely
Secure) by users with POP accounts with
internal placements only. Closed
for gateway placements.
9000 HTTPS (HyperText Transfer Used to allow access to the PGP
Protocol, Secure) Universal Server administrative
interface.
18
PGP Universal Server Open Ports
UDP Ports
19
4
Naming your PGP
Universal Server
This section describes how and why to name your PGP Universal Server using
the keys.<domain> convention.
Note: Keys that are found using the keys.<domain> convention are treated as
valid and trusted by default.
21
PGP Universal Server Naming your PGP Universal Server
22
5
Installing the PGP
Universal Server
This section describes how to set up your PGP Universal Server; it lists the
system requirements, and provides step-by-step instructions on how to install
the software.
For a higher-level view of this process, see Installation Overview (on page 10).
About Installation
Install and test the installation in a lab or staging environment before integrating
the PGP Universal Server into your network.
PGP Universal Server is a customized Linux installation; it cannot be installed on
a Windows server. Every PGP Universal Server requires a dedicated computer
that meets the system requirements below. Installation deletes all data on the
system and reconfigures it as a PGP Universal Server.
Warning: Make sure all data on the system is backed up before you begin
the installation.
The installation software is included on the Server Installation DVD, which also
includes documentation, software license, PGP Universal Satellite and PGP
Desktop software installers, and Release Notes.
System Requirements
For the latest system requirements, see the PGP Universal Server Release
Notes.
You must install the PGP Universal Server software on PGP Universal Server
Certified Hardware. You can find the latest PGP Universal Server Certified
Hardware List available on PGP Corporation's website (www.pgp.com
(http://www.pgp.com/support/\n)).
23
PGP Universal Server Installing the PGP Universal Server
Note: Using PGP Universal Server with vMotion is not supported at this time.
24
PGP Universal Server Installing the PGP Universal Server
2 Run one of the following scripts, depending on whether you are running
ESX 3.5 or ESX 4.0:
• If you are running ESX 3.5:
# /usr/bin/install-vmware-tools.sh --version 3.5
3 During a reboot, the console messages should indicated that the VMWare
modules have been loaded correctly ("[OK]").
4 Confirm that the modules have been installed:
• # lsmod | grep vm
This should list four vmware modules for ESX 3.5, and six for ESX 4.0.
5 Confirm that the appropriate processes are running:
• # chkconfig --list vmware-tools
This will show if the VMWare modules are correctly set to load during
system startup: they should be ON for runlevel 3.
# ps aux | grep guestd This should show that /usr/sbin/vmware
guestd is running.
Installation Materials
PGP Universal Server is distributed on a single DVD. Use this DVD to install the
server on PGP Universal Server Certified Hardware. The DVD also contains PGP
Universal Server documentation and PGP Universal Satellite and PGP Desktop
software installers.
Installation Options
Note: Your system must be set to boot from the DVD in order to perform this
installation.
When you insert the installation DVD and reboot the server, you can choose
among several installation boot options. The default option (customnet) installs
the PGP Universal Server using a standard partitioning scheme and configures
the network settings based on your inputs during the installation process. PGP
Corporation recommends you perform the default installation to ensure that
your PGP Universal Server will run properly when you have finished.
25
PGP Universal Server Installing the PGP Universal Server
You can have the installation program verify the contents of the DVD prior to
beginning the installation itself, if you suspect the media not be valid (this is not
usual). The mediacheck boot option provides for this. For more information, see
Performing a Media Verification on your DVD (on page 28).
If you choose to run the default installation, during installation you are asked to
provide the following information for the PGP Universal Server:
• IP address
• Subnet mask
• Default gateway
• DNS information
• Hostname
For instructions, see Default Installation Procedure (on page 26).
If you provide the network information during installation, it is pre-loaded into
the Setup Assistant. The default installation also simplifies the steps necessary
to connect to the PGP Universal Server to continue with the setup.
Other installation boot options provide various combinations of installation and
configuration steps, which are best suited for expert system administrators. If
you are considering one of these installation boot options, please consult with
your PGP Technical Support representative. These options may make it more
complicated to connect to and continue setting up your PGP Universal Server.
For more information about these options, see Alternate Installation Procedures
(on page 28).
To install the PGP Universal Server software using the default installation
1 Set up the system that will be hosting the server in a secure location.
2 Attach a keyboard and monitor to the server on which you are installing
PGP Universal Server.
3 Make sure the system is set to boot from the DVD.
4 Insert the PGP Universal Server Installation DVD into the drive.
5 Reboot the system.
When the system reboots, the install begins.
6 At the prompt, you can either
Press Enter to run the default installation without verifying the DVD or
• Type customnet mediacheck and Enter to perform a DVD verification
prior to the installation, if you suspect there may be problems with the
DVD (this is not usual).
26
PGP Universal Server Installing the PGP Universal Server
27
PGP Universal Server Installing the PGP Universal Server
28
PGP Universal Server Installing the PGP Universal Server
• expert. Clears disk partitions, but does not make default partitions. Allows
partitioning of removable media, and prompts for a driver disk. Prompts for
network configuration information.
• noautopart. Clears disk partitions, but does not make default partitions.
Assigns IP address 192.168.1.100.
• memtest86. Does not perform the installation, but runs memtest86+ to
test the RAM of the system. This test is recommended if you are installing
on new hardware that has not been used previously.
You can perform a media verification prior to running the installation by including
the mediacheck keyword after any of these installation commands. For more
information, see Performing a Media Verification on your DVD (on page 28).
Hardware
To configure your PGP Universal Server using the Setup Assistant You must
have the following:
• A Windows or Mac OS X computer to connect to the PGP Universal Server
using a Web browser so that you can run the Setup Assistant.
• A crossover Ethernet cable to connect a Windows or Mac OS X computer
to the PGP Universal Server.
System Information
You also need some information to configure your PGP Universal Server:
• Connect through the temporary IP address and subnet of the newly
installed PGP Universal Server, which will be used for the initial
configuration portion of the Setup Assistant:
29
PGP Universal Server Installing the PGP Universal Server
IP: 192.168.1.100:9000
Subnet: 255.255.255.0
Use this data to connect to the PGP Universal Server you are configuring in
the initial configuration portion of the Setup Assistant, before the PGP
Universal Server is available via a Web browser.
• An IP address, name, gateway, and DNS server information for the PGP
Universal Server.
• A license or license authorization from PGP Corporation Which one you
need depends on your Internet connection:
• If your PGP Universal Server can connect to the PGP Licensing Server
over the Internet, the license server authorizes your PGP Universal
Server license.
• If your PGP Universal Server cannot connect to the PGP Licensing
Server over the Internet, you need the License Authorization file to
correctly license your PGP Universal Server. The License Authorization
file is a text file you need during the configuration process.
• You can also need other data, such as your Organization Key or a saved
backup, depending on the type of setup you are performing.
30
6 Setting Up the PGP
Universal Server
This section describes how to access and use the Setup Assistant, which is a
set of screens you use to configure your PGP Universal Server.
31
PGP Universal Server Setting Up the PGP Universal Server
32
PGP Universal Server Setting Up the PGP Universal Server
33
PGP Universal Server Setting Up the PGP Universal Server
If your PGP Universal Server does not have a direct Internet connection,
you can still receive licensing authorization and automatic system software
updates from PGP Corporation through an HTTP proxy server.
Configure the proxy server to authenticate and authorize the PGP Universal
Server, and to proxy HTTP traffic for updates and license authorization
requests. Make sure the proxy access list and authentication parameters
are correct. The proxy server must also be able to contact and relay HTTP
traffic to and from PGP Corporation.
13 Type in the following proxy server information:
• Hostname/IP
• Port number
• Username (optional)
• Passphrase (optional)
14 Click the Forward arrow to continue.
The Confirmation screen appears.
15 Make sure the information is correct, then click Done.
Click the Back arrow if you need to go back and make any changes.
The Network Configuration Changed dialog box appears, while the server
restarts automatically.
If you chose the default installation (customnet) or the standard, ks, or
expert installation options, skip step 15 and go on to the next section.
If you chose the pgp or noautopart installation, go on to the next step. At
this point, your PGP Universal Server has accepted the new network
settings you typed, so you can disconnect the temporary setup.
16 Disconnect the cable between the client computer and the PGP Universal
Server, return the settings of the client computer back to what they were,
connect the two computers back to the original network, and continue with
the Setup Assistant.
34
PGP Universal Server Setting Up the PGP Universal Server
3 To license your PGP Universal Server at this step, type your PGP Universal
Server license information, then click the Forward arrow.
If your PGP Universal Server has an active connection to the Internet, the
4 If your PGP Universal Server does not have an active connection to the
Internet, and you did not previously provide proxy server configuration
during setup, you need to enter your license authorization information; click
Manual.
The Manual Licensing page appears, where you can paste your license
authorization block into the field provided. You can also click Skip from this
page to skip the licensing step.
5 Type the appropriate license information, paste your license authorization
information in the License Authorization box, then click the Forward arrow.
The Administrator Name & Passphrase page appears.
6 On the Administrator Name & Passphrase page, type the administrator’s
login name in the Login Name field.
7 In the Passphrase field, type the administrator’s passphrase.
8 In the Confirm field, type the same passphrase.
9 In the Email Address field, type the administrator’s email address. This is
optional and enables the administrator to receive a daily status email.
10 Click the Forward arrow to continue.
The Mail Processing page appears.
11 Specify the placement of this PGP Universal Server in your network:
• Select Gateway Placement if your PGP Universal Server is logically
located between your mail server and the Internet.
• Select Internal Placement if your PGP Universal Server is logically
located between your email users and your mail server, or if your PGP
Universal Server is out of the mailstream.
12 Click the Forward arrow to continue.
The Mail Server Selection page appears.
13 In the Mail Server field, type the hostname or IP address of the mail server
that this PGP Universal Server interacts with.
14 In the Proxy Server field, type an optional additional mail server to which all
outbound mail is sent. This only applies if you are installing your PGP
Universal Server in gateway placement.
15 In the Primary Domain field, type the email domain that the PGP Universal
Server manages.
16 Click the Forward arrow to continue.
The Ignition Keys page appears.
35
PGP Universal Server Setting Up the PGP Universal Server
Note: If this PGP Universal Server will be used as the initial member of a
cluster, this Ignition Key will be replicated to all additional cluster
members. New cluster members sponsored by this PGP Universal Server
will be initially locked with this Ignition Key.
36
PGP Universal Server Setting Up the PGP Universal Server
37
PGP Universal Server Setting Up the PGP Universal Server
The PGP Universal Server again reboots, and then the Waiting for Cluster
Host page appears. This message continues to be displayed until an
administrator logs into the sponsoring server's administrative interface, and
clicks the Contact button to initiate the join with this server you are
installing.
When contact is received from the sponsoring PGP Universal Server the
Waiting message is replaced by the Replicating Cluster Data page. This
displays a progress bar that indicates the progress of the data replication
process.
The configuration settings for the PGP Universal Server you are installing as
a cluster member (administrator login and password, primary domain,
ignition key (if any)) are replicated from the sponsoring server.
When the replication process is complete, the PGP Universal Server
administrative interface Login page is displayed.
Note: The replication process has copied many of the configuration settings
from the sponsor PGP Universal Server. This includes the administrator login
name(s) and password(s), and a number of other settings.
38
PGP Universal Server Setting Up the PGP Universal Server
Note: You can find more information online about moving to PGP Universal
Server at the PGP Corporation website.
39
7
Configuration Examples
This section shows and describes potential configurations for PGP Universal
Server:
• Internal Placement Configuration (on page 41)
• Gateway Placement Configuration (on page 42)
• Non-mailstream Placement Configuration (on page 43)
• Cluster Configuration (on page 44)
• Clustered Proxy and Keyserver Configuration (on page 45)
• Gateway Cluster with Load Balancer (on page 47)
• Gateway and Internal Placement Cluster (on page 48)
• Encircled Configuration (on page 50)
• Large Enterprise Configuration (on page 51)
• Spam Filters and PGP Universal Server (on page 52)
• Exchange with PGP Client Software (on page 53)
• Lotus Domino Server with PGP Client Software (on page 54)
• Unsupported Configurations (on page 54)
41
PGP Universal Server Configuration Examples
By placing the server in the DMZ, the company can use an internal placement
(which means its messages are encrypted even while on its mail server) and still
support external email users via Smart Trailers, PGP Universal Web Messenger
mail, or PGP Universal Satellite.
42
PGP Universal Server Configuration Examples
Gateway placement also supports external email users via Smart Trailers or PGP
Universal Web Messenger mail.
43
PGP Universal Server Configuration Examples
Cluster Configuration
In this example, Example Corporation has a cluster, with multiple PGP Universal
Servers proxying messages on its internal network, and another server in the
DMZ that performs keyserver and PGP Universal Web Messenger functions
only.
44
PGP Universal Server Configuration Examples
Notes:
One internally placed PGP Universal Server configured as
the first server in the cluster; the other and the keyserver
Universal Server.
45
PGP Universal Server Configuration Examples
Notes:
mail.example.com becomes mail-1.example.com. PGP Universal Server becomes
mail.example.com.
Cluster port (444) on firewall between the two servers must be opened.
To support external users via PGP Universal Web Messenger, designate the
46
PGP Universal Server Configuration Examples
47
PGP Universal Server Configuration Examples
Notes:
Add DNS MX record that points to cluster-gw.example.com.
Also in DNS, create an alias from cluster-gw.example.com to
keys.example.com.
The mail server must be reconfigured to relay through
cluster-gw-internal.example.com.
48
PGP Universal Server Configuration Examples
The most common usage for this configuration is when you have internal MAPI
clients running PGP Universal Satellite in addition to non-MAPI clients using
POP, IMAP, and SMTP. In such a scenario, those using standards-based
protocols connect to the internally placed PGP Universal Server while the PGP
Universal Server in gateway placement ensures proper handling of PGP
Universal Web Messenger and Smart Trailer messages for the MAPI clients.
Notes:
If the same user sends messages from different
locations (such as from the internal network using a
desktop computer, then from a remote location using a
laptop), they can create multiple user accounts and/or
keys.
The first server (cluster member) is internally placed,
with PGP Universal Web Messenger disabled. The
second server cluster member is in the DMZ, in
gateway placement, with PGP Universal Web
Messenger enabled.
49
PGP Universal Server Configuration Examples
Encircled Configuration
Using PGP Universal Server in an encircled configuration is an alternative to
placing two PGP Universal Servers in a clustered internal/gateway placement,
when you have internal MAPI clients running PGP Universal Satellite in addition
to non-MAPI clients using POP, IMAP, and SMTP.
mail.example.com.
50
PGP Universal Server Configuration Examples
8 MTA
The company uses its MTA to perform static email routing and to establish rules
that govern which email messages are processed by PGP Universal Server and
which are not. Naturally, the features of the MTA being used govern what it can
be used for.
51
PGP Universal Server Configuration Examples
Note: PGP Corporation does not recommend any specific MTA for use with
PGP Universal Server. Make sure the MTA you decide to use is correctly
configured for use with PGP Universal Server.
52
PGP Universal Server Configuration Examples
Notes:
Alternatively, put both spam filters between the PGP Universal Server and the
firewall in the logical flow of data. This configuration assumes PGP Universal
Server–encrypted messages do not contain spam because they are scanned
while encrypted. However, spam in unencrypted messages is still detected.
53
PGP Universal Server Configuration Examples
Unsupported Configurations
Not every PGP Universal Server deployment scenario is a supported
configuration.
54
PGP Universal Server Configuration Examples
Notes:
This configuration will not work as expected because the mail
server will only route outbound email through one of the PGP
Universal Servers.
You can use load balancing to achieve a similar result. For more information, see
Gateway Cluster with Load Balancer (on page 47).
55