Sophos Mobile Control Installation guide. Product version: 5.1

Transcription

1 Sophos Mobile Control Installation guide Product version: 5.1 Document date: July 2015

2 Contents 1 Introduction Sophos Mobile Control licenses Integration Ports and protocols Cluster: ports and protocols between nodes Set up Sophos Mobile Control Databases Request an SSL certificate for Sophos Mobile Control Install and set up the Sophos Mobile Control Server Initial configuration of the Sophos Mobile Control Server Configuration wizard External EAS Proxy server Download external EAS Proxy installer Install external EAS Proxy server Clustering Requirements Setup Load balancing and high availability Running the Sophos Mobile Control Service as a limited user Apple Push Notification service Requirements Create and upload an APNs certificate Updating Sophos Mobile Control Technical Reference Architecture Microsoft Exchange ActiveSync Proxy Technical support Legal notices

3 Installation guide 1 Introduction Sophos Mobile Control is a device management solution for mobile devices like smartphones and tablets. Sophos Mobile Control helps to keep corporate data safe by managing apps and security. The Sophos Mobile Control system consists of a server and a client component which communicate through data connections. The Sophos Mobile Control client is easily installed and managed with over-the air setup and configuration through the Sophos Mobile Control web console. With the Sophos Mobile Control Self Service Portal for your users, you can reduce IT efforts by allowing users to register their own devices and carry out other tasks without having to contact the helpdesk. This guide describes: How to request a trial license for evaluating Sophos Mobile Control, see Trial licenses (page 4). How to request an SSL certificate for Sophos Mobile Control with the SSL Certificate Wizard, see Request an SSL certificate for Sophos Mobile Control (page 11). How to install and set up the Sophos Mobile Control server, see Set up Sophos Mobile Control (page 11). How to install the external EAS Proxy server, see External EAS Proxy server (page 29). How to run the Sophos Mobile Control Service as a limited user, see Running the Sophos Mobile Control Service as a limited user (page 47). How to update Sophos Mobile Control, see Updating Sophos Mobile Control (page 51). How to create and upload an APNs certificate, see Apple Push Notification service (page 48). Note: All steps have to be executed as an administrator of Microsoft Windows Server or as a user of the relevant group. The database user needs sysadmin rights. 1.1 Sophos Mobile Control licenses Sophos Mobile Control offers two types of license: Standard license SMC Advanced license An SMC Advanced license adds functionality by enabling you to manage Sophos Mobile Security and Sophos Secure Workspace. Sophos Mobile Security is a security app for Android phones and tablets. The app protects your Android device and your privacy without impacting performance or battery life. Using up-to-the-minute intelligence from SophosLabs, your apps will be automatically scanned as you install them. This anti-virus functionality protects you from malicious software which 3

4 Sophos Mobile Control can lead to data loss and unexpected costs. Moreover, if your device is lost or stolen, a remote lock or wipe will shield your personal information from prying eyes. Sophos Secure Workspace is an app for ios and Android phones that provides a secure workspace for your important documents: Browse, manage, edit, share, encrypt and decrypt documents from various storage providers or distributed by your company. It is designed to prevent any data loss even when your device gets stolen or you send a document to an unintended source. Files can be decrypted and viewed in a seamless way. Encrypted files can be handed over by other apps and uploaded to one of the supported cloud storage providers. Alternatively the documents can be stored locally within the app. With Sophos Secure Workspace you can read files encrypted by SafeGuard Cloud Storage or SafeGuard Data Exchange. Both are modules of SafeGuard Enterprise or one of its different editions. They allow you to encrypt files using a local key. These local keys are derived from a passphrase that is entered by a user. You can only decrypt a file when you know the passphrase that was used to encrypt the file. For details of the SafeGuard Cloud Storage and SafeGuard Data Exchange modules please refer to the SafeGuard Enterprise 7.0 documentation on Note: You can activate your licenses in the Sophos Mobile Control configuration wizard. The wizard is launched automatically when you log in to the Sophos Mobile Control web console for the first time after installation Trial licenses Sophos offers a free trial for Sophos Mobile Control. You can register for the trial on the Sophos website: A trial license allows you to manage up to five users and is valid for 30 days. All you will need when you set up Sophos Mobile Control for evaluation is the address you used to register when downloading the installer Upgrading trial licenses to full licenses For upgrading trial licenses to full licenses you only have to enter your full license key in the Sophos Mobile Control web console. For further information, see the Sophos Mobile Control administrator help Updating licenses For updating you licenses you only have to enter the new license key in the Sophos Mobile Control web console. For further information, see the Sophos Mobile Control super administrator guide. 4

5 Installation guide 2 Integration The following graphic shows how the Sophos Mobile Control server (SMC server) can be integrated into a company s infrastructure. 5

6 Sophos Mobile Control Sophos Mobile Control in DMZ The Sophos Mobile Control server can be installed in the DMZ (Demilitarized Zone) network segment. 6

7 Installation guide Sophos Mobile Control in DMZ with incoming and outgoing traffic protection 7

8 Sophos Mobile Control Sophos Mobile Control in backend with incoming and outgoing traffic protection 8

9 Installation guide Sophos Mobile Control Cluster setup with Sophos UTM WAF 9

10 Sophos Mobile Control 2.1 Ports and protocols 2.2 Cluster: ports and protocols between nodes 10

11 Installation guide 3 Set up Sophos Mobile Control The key steps are: Request an SSL Certificate Execute the Sophos Mobile Control installer. If you want to configure the EAS Proxy server separately, execute the Sophos Mobile Control EAS Proxy installer, see External EAS Proxy server (page 29). Log in to the Sophos Mobile Control web console as a super administrator. For further information see Sophos Mobile Control super administrator guide. Before you can use the Sophos Mobile Control web console you need to configure certain server settings. Sophos Mobile Control provides a configuration wizard to guide you through this. The wizard is launched automatically when you log in to the Sophos Mobile Control web console for the first time after installation. You need to provide: HTTP proxy credentials (optional) A Standard license key and/or an Advanced license key SSL certificate(s) SMTP credentials 3.1 Databases Sophos Mobile Control allows you to install Microsoft SQL Server 2014 Express during installation. If you want to use existing database you will need the corresponding logon credentials during installation. 3.2 Request an SSL certificate for Sophos Mobile Control For setting up Sophos Mobile Control, you need an SSL webserver certificate. In the setup process, you can select between creating a self-signed certificate and using a PKCS12 with certificate, private key and certificate chain. For further information, see Install and set up the Sophos Mobile Control Server (page 13). Your Sophos product delivery includes an SSL Certificate Wizard in the %MDM_HOME%\tools\Wizard folder which you can use to request your certificate or you can download the wizard from MySophos. Note: If you plan to manage Windows Phone 8 devices, you need to use an official SSL certificate. Otherwise you need to install the self-signed certificate manually on the devices. To request your SSL certificate: 1. Start the SSL Certificate Wizard by double-clicking the file Sophos Mobile Control SSL Certificate Wizard.exe. The Certificate Wizard welcome dialog is displayed. 11

12 Sophos Mobile Control 2. Click Next. The License Agreement dialog is displayed. 3. Click I Agree. The Create Certificate Signing Request dialog is displayed. 4. Enter the Server Name (FQDN), the Company, City, State and Country code (for example US or UK). These fields are mandatory. 5. Click Next. The Upload CSR dialog is displayed. 6. In this step, you upload the Certificate Signing Request to the Certificate Authority (CA) for signing. Follow the instructions in the dialog: a) Go to the website of your Certificate Authority and log in. b) Upload the file ServerCertificateSigningRequest.csr from the folder indicated on the Upload CSR dialog of the SSL Certificate Wizard. Note: If your certificate vendor supports copy and paste, you can open the.csr file with the Open CSR button in the Upload CSR dialog. c) Save the certificate issued by the CA in Base 64 format (*.pem, *cer, *crt) in the folder indicated in the Upload CSR dialog. d) Download the certificate chain and CA certificate of your certificate authority. e) Click Next in the Upload CSR dialog. The Import Certificate Files dialog is displayed. 7. In the Import Certificate Files dialog, you import the intermediate certificates file (depending on your CA vendor) and the downloaded CA certificate. You also need to define a password for the server certificate (PKCS12) that is to be created: a) In the Select intermediate certificates file, field browse for the intermediate certificate. b) In the Select CA certificate file field, browse for the downloaded CA certificate. c) In the Password for private key field, enter a password for the server certificate to be created. Confirm the password. d) Click Next. The Certificate created dialog is displayed. 8. In the Certificate created dialog, the location of the certificate created is shown. You can use it when setting up Sophos Mobile Control, see Install and set up the Sophos Mobile Control Server (page 13). Note: Create a backup of the folder containing the certificate files. Click Next. The Sophos Mobile Control - SSL Certificate Wizard finished dialog is displayed. 9. Click Finish. 12

13 Installation guide 3.3 Install and set up the Sophos Mobile Control Server If the database is not held locally, you need access to the TCP Port 3306 for MySQL and 1433 for Microsoft SQL Server. In addition, you need an admin account that can log in from the Sophos Mobile Control Server. 1. Execute the Sophos Mobile Control installer as administrator, review and agree to the License Agreement. The System Property Checks dialog is displayed. To check that the system environment fulfills all necessary requirements for Sophos Mobile Control installation, click Check. If you want to generate a system check report after the check has been run, click Report. 13

14 Sophos Mobile Control 2. If all requirements are fulfilled, click Next. The Choose Install Location dialog is displayed. Choose the destination folder and click Install to start installation. 3. After the installation process the Sophos Mobile Control Configuration Wizard welcome dialog is displayed. Click Next. The Database selection dialog is displayed. 14

15 Installation guide 4. In the Database selection select the database you want to use: Install and use Microsoft SQL Server 2014 Express: Will immediately install SQL Server 2014 Express and configure it to be used with Sophos Mobile Control Use existing Microsoft SQL database Use existing MySQL 15

16 Sophos Mobile Control 5. Click Next to specify database server information and logon credentials in the Database Settings dialog. This dialog offers the required options according to the option you have selected. If you have selected Install and use Microsoft SQL Server 2014 Express in the Database selection dialog, the Database Settings dialog offers the following options. Select Use SQL Server Authentication with the following password, enter a password and confirm it. The installation of SQL Server 2014 Express starts. 16

17 Installation guide If you have selected Use existing Microsoft SQL database in the Database selection dialog, the Database Settings dialog offers the following options: To use the user credentials specified during SQL server installation, select Use SQL Server Authentication with the following credentials and enter the required user name and password. Click Next. If you have selected, Use existing MySQL database in the Database selection dialog, the Database Settings dialog offers the following options: Under Authentication, enter the required user name and password and click Next. 17

18 Sophos Mobile Control 6. In the next step, you create the database. In the Database Selection dialog, select Create a new database named, enter a name (for example SMCDB) and click Next. The Database Configuration dialog is displayed. It shows the relevant progress messages. After the database has been successfully created and populated, click Next. 18

19 Installation guide 7. In the next step, you create a super administrator account. The super administrator has specific rights and tasks and is primarily used for customer management. In Sophos Mobile Control, customers are the tenants that manage the devices of their users. The super administrator logs in to a super administrator customer and can, for example, predefine settings for new customers and push settings and configurations to existing customers. For further information, refer to the Sophos Mobile Control super administrator guide. Note: These credentials are required for the first log in to the Sophos Mobile Control web console. The super administrator should not be used in productive operation, but only for administrative purposes. The super administrator is primarily intended for customer management. In the Configure super admin account dialog, enter the Super admin customer (the customer the super administrator will log on to), the Super admin login (the super administrator login name) and a Super admin password. Confirm the password and click Next. Note: After installation additional super administrators can be added in the Sophos Mobile Control web console. 19

20 Sophos Mobile Control 8. In the next step enter a client resolvable Sophos Mobile Control server name (for example smc.mycompany.com) and click Next. 20

21 Installation guide 9. In the next step, a certificate for the secure (HTTPS) access to the web server needs to be created or imported. Note: Your Sophos product delivery includes an SSL Certificate Wizard that you can use to request your SSL certificate for Sophos Mobile Control. For further information, see Request an SSL certificate for Sophos Mobile Control (page 11). If you do not have a trusted certificate yet, select Create self-signed certificate, click Next and continue with step 10. If you have a trusted certificate, click Import a certificate from a trusted issuer, select PKCS12 with certificate, private key and certificate chain (intermediate and CA) from the drop-down list, click Next and continue with step 11. You can also select Separate files for certificate, private key, intermediate and CA certificate from the drop-down list, click Next and continue with step

22 Sophos Mobile Control 10. If you have selected Create self-signed Certificate, the following dialog is shown. Enter the appropriate certificate information. After you have entered all necessary information click Next. 11. If you have selected PKCS12 with certificate, private key and certificate chain (intermediate and CA) under Import a certificate from a trusted issuer, the following dialog is shown. Select the appropriate file and enter the password. Click Next. 22

23 Installation guide 12. If you have selected Separate files for certificate, private key, intermediate and CA certificate under Import a certificate from a trusted issuer, the following dialog is shown. Select the appropriate files and enter the password for the private key. Click Next. 13. In the next step, you verify the server information. Click Next to confirm the server and configuration process. 14. The configuration is now complete. 23

24 Sophos Mobile Control 15. After installation has finished, the Sophos Mobile Control - Installation finished dialog is displayed. Make sure that the check box Start Sophos Mobile Control server now is selected and click Finish to start the Sophos Mobile Control server for the first time. If you have selected SQL server authentication during installation, the SMCSVC service is started automatically and the Sophos Mobile Control server is executed. If you have selected Windows authentication, you first have to enter logon details in the service and start it afterwards. Note: After the service has been started it can take a few minutes before the web interface is available. Note: If a different language than English is used for the SQL login, an error occurs and an error message is displayed. To solve this problem, first stop the SMCSVC service. Then open SQL Management Studio on the server and select Security followed by Logins. Edit the properties of the user that is used to start the Sophos Mobile Control server and set the Default language for this account to English. Click OK and start the SMCSVC service again. 24

25 Installation guide Continue with the following configuration steps: Log in to the Sophos Mobile Control web console and complete the first steps wizard. The configuration wizard is launched automatically when you log in to the Sophos Mobile Control web console for the first time after installation. You need to provide: HTTP proxy credentials (optional) A Standard license key and/or an Advanced license key SSL certificate(s) SMTP credentials During Installation you have created a super administrator for customer management. This setup does not support the LDAP connection to a directory service such as Active Directory and the self-registration of end users with the Self Service Portal. To support these features, a customer must be created by the super administrator. For further information, refer to the Sophos Mobile Control super administrator guide. If you have selected to configure the EAS Proxy server separately, configure the EAS Proxy now, see External EAS Proxy server (page 29). 25

26 Sophos Mobile Control 4 Initial configuration of the Sophos Mobile Control Server Before you can use the Sophos Mobile Control web console you need to configure certain server settings. Sophos Mobile Control provides a fist steps configuration wizard to guide you through this. The wizard is launched automatically when you log in to the Sophos Mobile Control web console for the first time after installation. You need to provide: HTTP proxy credentials (optional) A Standard license key and/or an Advanced license key SSL certificate(s) SMTP credentials Note: You can request a trial license when the configuration wizard is run. 4.1 Configuration wizard Note: As a super administrator you can change these settings in the Sophos Mobile Control web console at any time after initial configuration under SYSTEM > Setup > System Setup. 1. After you have logged in to the Sophos Mobile Control web console the Welcome view is displayed. Click Next. 2. If you use a HTTP proxy, enter the relevant server details in the HTTP proxy view: a) Select Proxy enabled. b) Enter the Proxy host. c) Enter the Proxy port. d) Click Next. 26

27 Installation guide 3. In the License view, enter your Sophos Mobile Control Standard license key or request a trial license: Sophos Mobile Control Standard license key: When you enter the Sophos Mobile Control Standard license key and click Activate, you are given the option to enter a Sophos Mobile Control Advanced license key. If you have purchased Advanced licenses, enter the key in the Advanced license key field. Request a trial license: To request a trial license click Request trial and enter the address you used when registering to download the Sophos Mobile Control installer from and click Request trial again. Note: You can change the license settings at any time in the Sophos Mobile Control web console. If you do not enter an Advanced license key here, you can do it in the web console later on. Click Next. 4. In the SSL view, enter the certificates to be used for securing the SSL connection between server and clients. The certificates guarantee the authenticity of the server. The clients will only trust the certificates specified here (certificate pinning). a) Click the Auto-discover certificate(s) button. In most cases the auto-discover function is sufficient to discover the certificates currently in use. b) If the certificates cannot be discovered automatically, you can upload them by clicking Upload a file, selecting the desired file (.CER or.der) and clicking Open. The certificates are displayed in the SSL view. Sophos Mobile Control supports up to four certificates. If a certificate is no longer valid the client will use any other valid certificate from the list to establish the SSL connection to the server. Note: You have to update the list after changing or renewing SSL certificates. It is important to ensure that at least one valid certificate is always available. Otherwise the clients will not trust the server and will no longer connect to it, until the list has been updated. 27

28 Sophos Mobile Control 5. SMTP has to be configured to enable s to be sent to new users, providing them with logon credentials. It also needs to be configured to enable enrollment via . In the SMTP view, enter SMTP information and logon credentials: SMTP host Connection Type (SSL, TSL or plain) SMTP user SMTP password originator Send error s: Select this option if you want error mails to be sent, for example in case of an expired APNs certificate. recipient: Enter the recipients for error mails here. Note: To check sending of s, click the Send test button. 6. Click Finish 28

29 Installation guide 5 External EAS Proxy server With Sophos Mobile Control you can set up an external EAS Proxy server with several instances. Sophos Mobile Control offers a separate EAS Proxy. You can download the installer from the Sophos Mobile Control web console. For further information, see Download external EAS Proxy installer (page 32). Features Besides the features of the internal EAS Proxy, the external EAS Proxy offers the following features: Lotus Traveler client support (which is not ActiveSync) Support for multiple Microsoft Exchange and Lotus Traveler servers (one instance per mail server, one TCP port per instance) Usage scenarios Note: For Sophos Mobile Control as a Service, the following scenarios do not apply. In this scenario, the EAS Proxy server is suitable for installation in your own environment because the EAS Proxy communicates through HTTPS with the Sophos Mobile Control Server. For further information on Sophos Mobile Control as a Service, refer to the Sophos Mobile Control as a Service startup guide. An external EAS Proxy server should be used for the following scenarios: You use Lotus Traveler for non-ios devices. The internal EAS Proxy cannot handle this scenario as Active Sync is not used here. The internal EAS Proxy supports ios devices for Lotus Traveler as Traveler supports ActiveSync for ios only. So for ios devices you do not need to use the external EAS Proxy. For other platforms (for example, Android), Lotus Notes Traveler is supported by the external EAS Proxy. For these platforms, a dedicated Traveler client software is required. This software is available through <traveler-server>/servlet/traveler or the Traveler file system. Sophos Mobile Control can install and uninstall the client software. Configuration has to be done manually. 29

30 Sophos Mobile Control You want to support multiple backend servers. With the external EAS Proxy you can set up multiple instances of backend mail systems. Each instance needs an incoming TCP port. Each port can connect to a different backend.you need one URL per EAS instance. 30

31 Installation guide You want to set up load balancing for EAS For this scenario an existing load balancer for http is required. You set up the external EAS Proxy on different machines. Setup The following applies to installation and setup: The external EAS Proxy can be installed on the same server, but needs to listen on different ports. 31

32 Sophos Mobile Control Each instance is secured by an automatically generated certificate that needs to be uploaded to the Sophos Mobile Control server. The external EAS Proxy can run on different (virtual and physical) machines. Simple Windows setup 5.1 Download external EAS Proxy installer 1. Log on to the Sophos Mobile Control web console as a super administrator. 2. In the web console, under SYSTEM, click Setup and then click System setup. The System setup view is displayed. 3. Go to the EAS proxy tab and click the download link in the External section. 5.2 Install external EAS Proxy server Prerequisite: Sophos Mobile Control has been installed and set up, see Install and set up the Sophos Mobile Control Server (page 13). To configure the EAS Proxy server separately: 1. Execute the Sophos Mobile Control EAS Proxy Setup.exe. The Sophos Mobile Control EAS Proxy Setup welcome dialog is displayed. Click Next. 2. In the License Agreement dialog, review the license terms and click I Agree. 3. In the Choose Install Location dialog, choose the destination folder and click Install to start installation. 32

33 Installation guide 4. After Sophos Mobile Control EAS Proxy has been installed, the EAS Proxy Configuration Wizard welcome dialog is displayed. Click Next. 5. In the SMC Server configuration dialog, select the SMC Server to be used. Optionally, select Use SSL for incoming connections (Clients to EAS Proxy). If you do not select this option, continue with step 10. Click Next. 33

34 Sophos Mobile Control 6. In the next step, a certificate for the secure (HTTPS) access to the EAS Proxy needs to be created or imported. Note: Your Sophos product delivery includes an SSL Certificate Wizard that you can use to request your SSL certificate for Sophos Mobile Control EAS Proxy. For further information, see Request an SSL certificate for Sophos Mobile Control (page 11). If you do not have a trusted certificate yet, select Create self signed certificate, click Next and continue with step 7. If you have a trusted certificate, click Import a certificate from a trusted issuer, select PKCS12 with certificate, private key and certificate chain (intermediate and CA) from the dropdown list, click Next and continue with step 8. You can also select Separate files for certificate, private key, intermediate and CA certificate from the dropdown list, click Next and continue with step 9. 34

35 Installation guide 7. If you have selected Create self-signed Certificate, the following dialog is shown. Enter the appropriate certificate information. After you have entered all necessary information click Next. 8. If you have selected PKCS12 with certificate, private key and certificate chain (intermediate and CA) under Import a certificate from a trusted issuer, the following dialog is shown. Select the appropriate file and enter the password. Click Next. 35

36 Sophos Mobile Control 9. If you have selected Separate files for certificate, private key, intermediate and CA certificate under Import a certificate from a trusted issuer, the following dialog is shown. Select the appropriate files and enter the password for the private key. Click Next. 36

37 Installation guide 10. In the next step, you configure the EAS Proxy instances. In the EAS Proxy instance setup dialog, enter an Instance name, the relevant Server port (incoming traffic) and the ActiveSync server (target). Select Enable traveler client access to enable Lotus Traveler client access. After entering the instance information, click Add to add the instance to the Instances list. After you have added an instance a message like the following is displayed: Click OK. A window with the certificate that needs to be uploaded to Sophos Mobile Control opens. 11. In the next step, you need to upload the certificate in the Sophos Mobile Control web console as a super administrator. For further information on Sophos Mobile Control super administrators, see the Sophos Mobile Control super administrator guide. a) Log in to the Sophos Mobile Control web console as a super administrator. b) In the web console under SYSTEM, click Setup and then click System setup. c) Go to the EAS proxy tab. d) On the EAS Proxy tab, in the External section, click Upload a file, browse for the certificate and click Upload. e) Browse for the certificate, select it and click Open. 37

38 Sophos Mobile Control The certificate is uploaded and shown in the EAS Proxy tab. f) Click the Save button. Note: Upload the certificate before you start the EAS proxy server. If the certificate is not available at startup, Sophos Mobile Control rejects the server and the service will not be started. 12. In the EAS Proxy instance setup dialog of the EAS Proxy Configuration Wizard, click Next. The server port you entered is checked and an Inbound Rule for the Windows Firewall is configured. Then the Sophos Mobile Control EAS Proxy - Configuration Wizard finished dialog is displayed. 13. Configuration is now complete. Click Finish to close the Configuration Wizard. 14. After installation has finished, the Sophos Mobile Control EAS Proxy Installation finished dialog is displayed. Make sure that the check box Start Sophos Mobile Control EAS Proxy server now is selected and click Finish to start the Sophos Mobile Control EAS Proxy server for the first time. The Sophos Mobile Control EAS Proxy server has been installed and configured. Note: Every day a new EAS Proxy log file will be created. The old file is renamed (EASProxy.log.yyyy-mm--ttt). Old EAS Proxy log files are not deleted automatically. To prevent problems, delete or backup these files manually or by using a script. 38

39 Installation guide 6 Clustering Sophos Mobile Control (SMC) provides the possibility to set up a high-availability environment. This ensures that the SMC service remains externally accessible and tasks can be further processed even after failure of an Sophos Mobile Control node. To achieve this, load balancing, that distributes client and browser sessions by using DNS Round Robin to the available nodes, is required. The following describes setting up clustering for Sophos Mobile Control and configuring load balancing by means of Sophos UTM. 6.1 Requirements One Windows Server for each Sophos Mobile Control node All nodes must be on the same network One MSSQL/MySQL database server or cluster Sophos UTM or Apache Reverse Proxy (mod_proxy) for load balancing Note: For detailed information about the installation requirements see and The figure below shows the communication paths of a three-node Sophos Mobile Control cluster. 39

40 Sophos Mobile Control For communication between the individual Sophos Mobile Control nodes by means of multicasting, optionally a separate network can be used. The network interface to be used can be selected during cluster configuration, Install the first node (page 40). It may also be a VLAN. Note: If you want to operate a second Sophos Mobile Control cluster for test purposes, a separate network is needed. 6.2 Setup For setting up a clustered environment you install the first node as described in Install and set up the Sophos Mobile Control Server (page 13). Clustering itself is then activated using the Configuration Wizard. For all other nodes, the database created during installation of the first node has to be selected and clustering hast to be activated. Note: It is also possible to configure an already running Sophos Mobile Control server for clustering and extend the environment by adding additional nodes Install the first node 1. Install Sophos Mobile Control as described in chapter Install and set up the Sophos Mobile Control Server (page 13) and note down the name of the database you created.this database hast to be used for installing further nodes. 40

41 Installation guide 2. At the end of the installation deselect the Start Sophos Mobile Control server now option in the Sophos Mobile Control - Installation finished dialog. Note: If the SMC service has already been started you can stop it from the menu of the Sophos Mobile Control System Tray icon. 3. On the server, under Start, go to Sophos Mobile Control and click Configuration Wizard. 4. The Welcome dialog of the The Sophos Mobile Control - Configuration Wizard is displayed. Click Next. The Database Selection dialog is displayed. 5. Select Skip database configuration and click Next. The Choose configuration steps dialog is displayed. 41

42 Sophos Mobile Control 6. Select Configure cluster support and click Next. The Cluster Configuration dialog is displayed. It lists all available network interfaces. 7. Select the network interface to be used for communication between the Sophos Mobile Control nodes from the drop-down list and click Next. The Server information dialog is displayed. 8. Click Next and confirm the next dialog by clicking Yes in order to start the SMC service. The configuration of the first SMC node is now complete. Click Finish in the Sophos Mobile Control - Configuration Wizard finished dialog Install further nodes 1. Start the installation of Sophos Mobile Control as described in chapter Install and set up the Sophos Mobile Control Server (page 13). 2. When the Database selection dialog is displayed, select the database you created when you installed the first node and click Next. The Database configuration dialog is displayed. It shows the progress of the configuration process. 42

43 Installation guide 3. Click Next after the configuration has been finished. The Choose configuration steps dialog is displayed. 4. Select Configure cluster support and click Next. The Configure server certificate dialog is displayed. 5. Create a self signed certificate as described in chapter Install and set up the Sophos Mobile Control Server (page 13) and click Next. The Cluster Configuration dialog is displayed. It lists all available network interfaces. 43

44 Sophos Mobile Control 6. Select the network interface to be used for communication between the Sophos Mobile Control nodes from the drop-down list and click Next. The Server information dialog is displayed. 7. Click Next. 8. After installation has finished, the Sophos Mobile Control - Installation finished dialog is displayed. Make sure that the check box Start Sophos Mobile Control server now is selected and click Finish to start this Sophos Mobile Control node. 6.3 Load balancing and high availability To set up clustering for Sophos Mobile Control you need a DNS load balancer which supports permanent session cookies and official SSL web server certificates. Sophos Mobile Control supports: Sophos UTM Note: In order to use Sophos UTM for clustering you need a Sophos UTM license with Sophos Webserver Protection subscription. Apache Proxy with mod_proxy Note: Your Sophos product delivery includes an SSL Certificate Wizard that you can use to request your SSL certificate for Sophos Mobile Control. The certificate must be of type PKCS#12 and needs to be protected by a password, see Install and set up the Sophos Mobile Control Server (page 13). You must use the same certificate for configuring the webservers. The following describes configuring load balancing by means of Sophos UTM. For more information about configuring your UTM refer to your Sophos UTM documentation Sophos UTM 1. Log into WebAdmin of Sophos UTM. 2. In the WebAdmin menu bar, under Webserver Protection, click Web Application Firewall. 3. Got to the Real Webservers tab. 4. Click + New Real Webserver in order to create a SMC node. The Add Real Webserver dialog box opens. 5. Make the following settings: a) Name: Enter a descriptive name for the webserver (for example "SMC node"). b) Host: Select or add a host. Select a host by clicking the folder symbol right beside the host edit field. All available hosts are listed on the left-hand side of the WebAdmin. Drag & Drop a host form the list into the Host edit field. How to add a definition is explained on the Definitions & Users > Network Definitions > Network Definitions page in your UTM manual. c) Type: Select Encrypted (HTTPS). 6. Click Save. 7. Repeat this step for each SMC node. 44

45 Installation guide 8. In the WebAdmin menu bar, under Webserver Protection, click Certificate Management. 9. Got to the Certificates tab. 10. Click + New Certificate in order to upload an SSL webserver certificate. The Add Certificate dialog box opens. 11. Make the following settings: a) Name: Enter a descriptive name for this certificate. b) Method: Select Upload. c) File type: Select PKCS#12(Cert+CA) d) Password: Enter the password for your certificate file e) File: Click the Folder icon next to the File box and select the certificate you want to upload and click Start Upload. 12. Click Save. The certificate appears on the Certificates list. 13. In the WebAdmin menu bar, under Webserver Protection, click Web Application Firewall. 14. Got to the Vitual Webservers tab. 15. Click + New Virtual Webserver in order to add a virtual webserver for the cluster. The Add Virtual Webserver dialog box opens. 16. Make the following settings: a) Name: Enter a descriptive name for the virtual webserver (for example "SMC cluster"). b) Interface: Select the WAN interface from the drop- down list over which the cluster should be accessible from outside. c) Type: Select Encrypted (HTTPS) & redirect. d) Certificate: Select the webserver's certificate you uploaded beforehand from the dropdown list. e) Domains (only with Encrypted (HTTPS) with wildcard certificate): Enter the domains the webserver is responsible for as FQDN, e.g. shop.example.com, or use the Action icon to import a list of domain names. You can use an asterisk (*) as a wildcard for the prefix of the domain, e.g., *.mydomain.com. Domains with wildcards are considered as fallback settings: The virtual webserver with the wildcard domain entry is only used when no other virtual webserver with a more specific domain name is configured. Example: A client request to a.b.c will match a.b.c before *.b.c before *.c f) Real Webservers: Select the checkbox in front of the SMC nodes you created beforehand. Note: Do not select a firewall profile! 17. Click Save. The server is added to the Virtual Webservers list. 45

46 Sophos Mobile Control 18. Enable the virtual webserver. The new virtual webserver is disabled by default (toggle switch is gray). Click the toggle switch to enable the virtual webserver. The virtual webserver is now enabled (toggle switch is green). The Virtual Webservers list displays a status icon for each real webserver assigned to a virtual webserver. The status icon of a real webserver is red when the real webserver has not been enabled. It is amber when the real webserver is down or unavailable and green if everything is working. 19. Got to the Site Path Routing tab. 20. In the Virtual Webservers list, go to the virtual webserver you added and click Edit. The Edit Site Path Route dialog box opens. 21. Click Advanced and select Enable sticky session cookie. 22. Click Save. 46

47 Installation guide 7 Running the Sophos Mobile Control Service as a limited user For security reasons, you may want to run the SMC service as a limited user instead of an administrator. Note: If you use Windows Authentication for database access, you only have to carry out step 3 of the following description. 1. On the computer, on which Sophos Mobile Control is running, create a local, regular Windows user account with a password that does not expire. 2. Remove this user account from all groups. (By default, the user is in the users group.) 3. Grant this user account full access to the Sophos Mobile Control installation directory (C:\Programs\Sophos\Sophos Mobile Control) including all subdirectories. 4. In the SMCSVC service properties, change the user to this user account with the relevant password. 47

48 Sophos Mobile Control 8 Apple Push Notification service To use the built-in Mobile Device Management (MDM) protocol of devices running Apple ios 4 (or higher), Sophos Mobile Control must use Apples Push Notification service (APNs) to trigger the ios devices. The following sections describe the requirements that have to be fulfilled and the steps you must take to get access to the APNs servers with your own client certificate. Sophos Mobile Control offers an APNs Certificate Wizard for creating your APNs certificate. The wizard is included in your product delivery. It is also available for download in the web console. Note: Do NOT use the Internet Explorer for any Apple websites. Apple recommends their own Safari browser, but Mozilla Firefox, Opera or Google Chrome also work. 8.1 Requirements For silent operations all devices must have at least ios version 4 installed. To notify ios devices, the Sophos Mobile Control server needs to connect to the Apple Push Notification service. The notifications are sent SSL-encrypted to gateway.push.apple.com:2195 TCP ( /8) but not to the ios devices directly. ios devices itself need a connection to Apple via port 5233 since Apple forwards the notification. Note: ios devices with Wi-Fi only need access to APNs as usually in corporate networks only http and https are accepted. This has to be enabled in the company Wi-Fi network. Wi-Fi ios device -> *.push.apple.com:5223 TCP ( /8) 8.2 Create and upload an APNs certificate Prerequisites: You can use the APNs Certificate Wizard to create an APNs certificate. The wizard is included in your product delivery. It is also available for download in the web console. In the web console menu bar, under SYSTEM, click Setup and then System setup,and go to the ios APNS tab. To download the wizard, click the download link available under APNS. To start the APNs Certificate Wizard: 1. Double-click the file Sophos Mobile Control APNs Certificate Wizard.exe. The APNs Certificate Wizard welcome dialog is displayed. 2. Click Next. The License Agreement dialog is displayed. 3. Click I Agree. The Create Certificate Signing Request dialog is displayed. 48

49 Installation guide 4. Enter your Company Name and your Country code (for example US or UK). These fields are mandatory. Note: Below these fields, the dialog shows where all data of the process is stored. Make a note of this information. 5. Click Next. The Upload PLIST dialog is displayed. 6. In this step, you upload the Certificate Signing Request to Apple. Follow the instructions in the dialog: a) Open the Apple site indicated in the dialog in your browser. Note: Do not use Internet Explorer to open the Apple site as this may cause problems. Use Firefox, Chrome or Safari instead. We recommend that you use the latest browser versions. b) Log in with your Apple ID. If you do not have an Apple ID, create one. We recommend you create a Corporate Apple ID and not a personal one. c) In the first dialog of the Apple Push Certificates Portal, click Create a Certificate. d) Accept the terms and conditions. e) Browse for your Certificate Signing Request (*.plist) and click Upload. You find the file name and the path in the Upload PLIST dialog of the Sophos APNs Certificate Wizard. Your APNs certificate is created. f) Download and save the certificate file (*.pem) in the directory indicated in the Upload PLIST dialog. 7. Click Next. The Create P12 dialog is displayed. 8. In this step, you create your APNs certificate for Sophos Mobile Control. Enter a password for the APNs certificate. You need this password later, when you upload the.p12 certificate file to Sophos Mobile Control. Note: The Create P12 dialog shows the directory the certificate will be stored in. Make a note of this information. We recommend that you create a backup of the folder that contains the certificate files. 9. Click Next. The Sophos Mobile Control APNs Certificate Wizard finished dialog is displayed. 10. Click Finish. 11. In the web console return to the ios APNs tab. 12. Click on Upload a file. Browse for the.p12 certificate file you have created and enter your password. Optionally you can enter your Apple ID for future reference. After the file has been uploaded successfully, a confirmation message is displayed and the Topic, Type and Expiry date information of your APNs certificate is shown. 49

50 Sophos Mobile Control 13. Click Save. 50

51 Installation guide 9 Updating Sophos Mobile Control Sophos Mobile Control server installations can be updated directly from version 5 to 5.1. Older versions need to be updated to version 5 beforehand. Please see your Sophos Mobile Control 5 documentation for details. To update your Sophos Mobile Control server installation to version 5.1, execute the Sophos Mobile Control 5.1 installer and follow the instructions. The installer automatically detects that an existing installation is to be updated to version 5.1. A system property check will be performed before the update starts. If all checks are passed you can proceed with the update. Database and files will be updated automatically without any user interaction. Once the update is complete, the Sophos Mobile Control service will be started again. Note: If you used Windows Authentication during your initial Sophos Mobile Control server installation the Start Sophos Mobile Control server now option is greyed out.you have to start the service manually. 51

52 Sophos Mobile Control 10 Technical Reference 10.1 Architecture Sophos Mobile Control Server The core component of the system is the Sophos Mobile Control server. It is connected to the Internet. It provides the possibility to set up a high-availability environment. The administrator controls the server using the web interface. End users can register their devices by using the Self Service Portal or the users get a device from the administrator, that has already been prepared by means of auto enrollment. The mobile devices synchronize with the server through HTTPS. The server notifies ios clients trough APNs and Android clients through GCM. Windows Phone 8 devices receive their tasks by connecting to the server in fixed intervals. For Windows Phone 8.1 there is a push service available as well. Text messages and tile updates can be sent to Windows Phone 8 devices by MPNS. A database is used for storage.the database does not necessarily have to reside on the same machine. It supports multi-tenant setups to allow different customers on the same server. EAS integrated or standalone for access. For the standalone variant HTTPS access to the SMC server is required. The Sophos Mobile Control server has been developed for the Java enterprise environment (JEE). It installs and runs inside the well tested industry standard application server Wildfly 8.2. The default environment for the SMC server is Windows Server 2012 R2 The server may be installed in virtualized environments Business logic The Sophos Mobile Control server provides the business logic for the administration of data and the scheduler functionality. Every device management operation results in a task. These tasks are handled by the time driven scheduler. All tasks follow a well defined state process. The scheduler queries the database for tasks and handles the transition to the next state. This may for example result in a notification being sent or data being prepared for synchronization. 52

53 Installation guide Web interface Administration interface The web interface is secured by a login and a session mechanism. You can implement password policies. Access control allows different user roles. These roles have different sets of access rights. Each user can be assigned exactly one role. The predefined roles are: Role Description Administrator Has the rights to perform all available actions. Limited Administrator Is allowed to perform all actions required for enrolling and managing a device, but cannot specify essential settings (for example modify a client package or a template). Reporting A reporting administrator can view all objects in the system, but cannot change them. A typical user is an auditor or an employee who needs to document the settings in Sophos Mobile Control. Content admin This role is intended for employees responsible for uploading, updating or removing documents distributed via the Documents feature. Usually this role is assigned to a person outside the IT department. The permissions are set to limit visibility and access only the content in the Documents menu. Helpdesk This role is intended for support purposes. It has only limited rights (for example installation of software packages). This role does not have access to critical functions, for example defining settings and creating, deleting or editing devices/device groups, packages and profiles. These are the most important components and views of the web interface: Dashboard The customizable Dashboard is the regular start page of Sophos Mobile Control and provides access to the most important information at a quick glance. It consists of several widgets providing information about: Devices, all or per group Compliance status by platform or for all devices 53

54 Sophos Mobile Control Managed status by platform or for all devices The SSP registration status The platform versions in use Reports Used to create device, app and compliance reports. Audit Logging Used to log all actions of administrators of the different customers to the database. Tasks and Tasks archive Used to monitor current and completed management operations including detailed status info. MANAGE Used to administer registered devices, device groups and users. Profiles Used to create and apply configuration profiles for individual platforms. Task bundles Used to bundle several tasks for mobile devices in one transaction. All tasks necessary to have a device fully registered and running can be combined in a task bundle. Apps Used to manage software packages and to (un-)install them on the devices. Documents Used to distribute company documents to the devices. Compliance rules Used to define compliance rules for individual platforms. You can define different compliance rules for different device groups and private or employee devices. Setup Used to define the following type of settings: General Administrators Self Service Portal System setup Optional filters are available in many views of the web interface for restricting the number of items displayed. All kinds of operations follow the same wizard structure which makes it easy to work with the web interface. 54

55 Installation guide For further information, see the Sophos Mobile Control administrator guide Super administrator interface A super administrator has specific rights and tasks in Sophos Mobile Control administration. The first super administrator account is created during Sophos Mobile Control setup, see the Sophos Mobile Control installation guide. The super administrator is primarily used to set up and manage customers for device management. As a super administrator you log on to the super administrator customer which is also created during Sophos Mobile Control configuration. The Sophos Mobile Control web console shows a specific view for the super administrator customer. This view is customized for super administrator tasks. For further information, see the Sophos Mobile Control super administrator guide Self Service Portal The Self Service Portal is secured by a login, session mechanism and a password policy. The account has to be set up by the administrator of the server and can be associated with any tenant. The Self Service Portal is designed for the end users of devices and enables them to perform the provisioning process and MDM client bootstrap process of the device by themselves. The end users are also allowed to perform tasks for their devices, for example remote lock or remote wipe. The tasks they can perform vary according to device type and configuration. As an administrator you can configure the Self Service Portal functions available to end users in the Sophos Mobile Control web console. For further information on how to configure the Self Service Portal use for end users, see the Sophos Mobile Control administrator guide. 55

56 Sophos Mobile Control For further information on how to use the Self Service Portal as an end user, see the Sophos Mobile Control user guides for Android, Apple ios, Windows Phone 8 and Windows Mobile Database The database stores all data needed for the operation of Sophos Mobile Control. This includes device and application information. Sophos Mobile Control connects to the database through JDBC (Java database connectivity) drivers. The database does not have to be installed on the same machine as the Sophos Mobile Control server. For example, existing database clusters can be used File system The Sophos Mobile Control server s central synchronization directory includes a directory named after the serial number for each registered device. These IMEI directories are synchronized with the corresponding devices Microsoft Exchange ActiveSync Proxy With the module EAS Proxy, Sophos Mobile Control provides a means for filtering incoming ActiveSync traffic as used by Microsoft Exchange and Lotus Traveler for ios and Samsung SAFE/KNOX devices. For Android devices a Traveler client is available that uses its own protocol. This protocol is only supported by the external EAS Proxy. For further information, see the Sophos Mobile Control installation guide. The component is installed as the ActiveSync endpoint known by the mobile devices. It only forwards traffic to the Exchange server, if the device is known in Sophos Mobile Control and matches the required policies. This guarantees higher security as the Exchange server does not need to be accessible from the Internet and only authorized (correctly configured, for example passcode guidelines) devices can access it. Access to Exchange can also be blocked for specific devices through the web interface. The EAS Proxy component is part of the Sophos Mobile Control Server. For specific scenarios it is also available as a standalone component. The EAS Proxy is automatically installed with Sophos Mobile Control. Sophos Mobile Control also offers a separate installer for an external EAS Proxy (for example for load balancing or processing Lotus Notes traffic). The standalone variant communicates by web interface (HTTPS) with the Sophos Mobile Control Server. If you use Sophos Mobile Control as a service, the EAS Proxy server is therefore suitable for installation in your own environment. For further information, refer to the Sophos Mobile Control installation guide. 56