EMC SourceOne. Products Security Configuration Guide. Version REV 02

Transcription

1 EMC SourceOne Version 7.2 Products Security Configuration Guide REV 02

2 Copyright EMC Corporation. All rights reserved. Published in USA. Published October 8, 2015 EMC believes the information in this publication is accurate as of its publication date. The information is subject to change without notice. The information in this publication is provided as is. EMC Corporation makes no representations or warranties of any kind with respect to the information in this publication, and specifically disclaims implied warranties of merchantability or fitness for a particular purpose. Use, copying, and distribution of any EMC software described in this publication requires an applicable software license. EMC², EMC, and the EMC logo are registered trademarks or trademarks of EMC Corporation in the United States and other countries. All other trademarks used herein are the property of their respective owners. For the most up-to-date regulatory document for your product line, go to EMC Online Support ( EMC Corporation Hopkinton, Massachusetts In North America EMC SourceOne 7.2 Products Security Configuration Guide

3 CONTENTS Preface 5 Chapter 1 Overview 9 Chapter 2 Security Configuration Settings 11 Access control settings...12 User authentication...12 User authorization Component access control Log settings...26 Log description Log management and retrieval Communication security settings...28 Port usage...28 Network encryption Data security settings...30 Encryption of data at rest...30 Data integrity Data erasure Secure serviceability settings Security alert system settings...31 Other security considerations...31 Chapter 3 Secure Deployment and Usage Settings 33 Security controls map...34 Secure deployment settings Chapter 4 Secure Maintenance 37 Security patch management...38 Chapter 5 Physical security controls 39 Physical Security Controls EMC SourceOne 7.2 Products Security Configuration Guide 3

4 CONTENTS 4 EMC SourceOne 7.2 Products Security Configuration Guide

5 Preface As part of an effort to improve its product lines, EMC periodically releases revisions of its software and hardware. Therefore, some functions described in this document might not be supported by all versions of the software or hardware currently in use. The product release notes provide the most up-to-date information on product features. Contact your EMC technical support professional if a product does not function correctly or does not function as described in this document. Note This document was accurate at publication time. Go to EMC Online Support ( support.emc.com) to ensure that you are using the latest version of this document. Purpose This document describes the security features and settings of EMC SourceOne. Audience This document is part of the EMC SourceOne documentation set, and is intended for use by installers of the product, EMC SourceOne system administrators, and mail server administrators. Revision history The following table presents the revision history of this document. Table 1 Revision history Revision Date Description 01 April 30, 2015 Initial release of the EMC SourceOne Products Security Configuration Guide. 02 October 8, 2015 Includes updates for EMC SourceOne Supervisor 7.2. Related documentation The EMC SourceOne documentation set includes the following publications: EMC SourceOne Product Guides EMC SourceOne Products Compatibility Guide EMC SourceOne Products Security Configuration Guide EMC SourceOne Management EMC SourceOne Management Installation Guide EMC SourceOne Management Administration Guide EMC SourceOne Management Release Notes EMC SourceOne Management Localized Product Release Notes EMC SourceOne Auditing and Reporting Installation and Administration Guide EMC SourceOne Management Pack for Microsoft System Center Operations Manager Guide EMC SourceOne Search User Guide EMC SourceOne 7.2 Products Security Configuration Guide 5

6 Preface EMC SourceOne Disaster Recovery Solution Guide EMC SourceOne Discovery Manager EMC SourceOne Discovery Manager Installation and Administration Guide EMC SourceOne Discovery Manager Desktop User Guide EMC SourceOne Discovery Manager Web Application User Guide EMC SourceOne Discovery Manager Release Notes EMC SourceOne Discovery Manager Localized Product Release Notes EMC SourceOne Discovery Manager Desktop Quick Reference Cards EMC SourceOne for File Systems EMC SourceOne for File Systems Installation Guide EMC SourceOne for File Systems Administration Guide EMC SourceOne for File Systems Release Notes EMC SourceOne Offline Access EMC SourceOne Offline Access Installation and Administration Guide EMC SourceOne Offline Access User Guide EMC SourceOne Offline Access Release Notes EMC SourceOne Archiving for Microsoft SharePoint EMC SourceOne Archiving for Microsoft SharePoint Installation Guide EMC SourceOne Archiving for Microsoft SharePoint Administration Guide EMC SourceOne Archiving for Microsoft SharePoint Release Notes EMC SourceOne Archiving for Microsoft SharePoint Quick Reference Card EMC SourceOne for Microsoft SharePoint Storage Management EMC SourceOne for Microsoft SharePoint Storage Management Installation Guide EMC SourceOne for Microsoft SharePoint Storage Management Administration Guide EMC SourceOne for Microsoft SharePoint Storage Management Release Notes EMC SourceOne Supervisor EMC SourceOne Supervisor Installation Guide EMC SourceOne Supervisor Administration Guide EMC SourceOne Supervisor Web Application (Reviewer and Reports) Guide EMC SourceOne Supervisor Release Notes Special notice conventions that are used in this document EMC uses the following conventions for special notices: NOTICE Addresses practices that are not related to personal injury. Note Presents information that is important, but not hazard-related. Typographical conventions EMC uses the following type style conventions in this document: 6 EMC SourceOne 7.2 Products Security Configuration Guide

7 Preface Table 2 Style conventions Bold Italic Monospace Used for names of interface elements, such as names of buttons, fields, tab names, and menu paths (what the user specifically selects or clicks) Used for full titles of publications that are referenced in text Used for: System code System output, such as an error message or script Pathnames, file names, prompts, and syntax Commands and options Monospace italic Monospace bold Used for variables Used for user input [ ] Square brackets enclose optional values Vertical bar indicates alternate selections - the bar means or { } Braces enclose content that the user must specify, such as x or y or z... Ellipses indicate non-essential information that is omitted from the example Where to get help EMC support, product, and licensing information can be obtained as follows: Product information For documentation, release notes, software updates, or information about EMC products, go to EMC Online Support at Technical support Go to EMC Online Support and click Service Center. Several options for contacting EMC Technical Support appear on the site. Note that to open a service request, you must have a valid support agreement. Contact your EMC sales representative for details about obtaining a valid support agreement or with questions about your account. Online communities Go to EMC Community Network at for peer contacts, conversations, and content on product support and solutions. Interactively engage online with customers, partners, and certified professionals for all EMC products. Your comments Your suggestions help to improve the accuracy, organization, and overall quality of the user publications. Send your opinions of this document to DPAD.Doc.Feedback@emc.com. EMC SourceOne 7.2 Products Security Configuration Guide 7

8 Preface 8 EMC SourceOne 7.2 Products Security Configuration Guide

9 CHAPTER 1 Overview This guide provides an overview of security configuration for all SourceOne products. Topics in this guide include: Security Configuration Settings Describes settings available in the product to ensure a secure operation of the product. Secure Deployment and Usage Settings Describes instructions on how to deploy the product securely and how to use the product securely. Secure Maintenance Describes how to perform secure maintenance of the product. Physical Security Controls Describes controls needed to protect the product components against unauthorized physical access and physical tampering. Overview 9

10 Overview 10 EMC SourceOne 7.2 Products Security Configuration Guide

11 CHAPTER 2 Security Configuration Settings This section provides an overview of the settings available to ensure secure operations of the SourceOne product. Access control settings...12 Log settings...26 Communication security settings...28 Data security settings...30 Secure serviceability settings Security alert system settings...31 Other security considerations...31 Security Configuration Settings 11

12 Access control settings This section describes settings available to limit access by end-user or by external product components. User authentication Default accounts User authentication settings control the process of verifying an identity claimed by a user for accessing the product. The SourceOne product does not provide any pre-configured default accounts. The following accounts must be configured as prerequisite for product installation and administration. Product installation account Authentication configuration Primary service account Outlook Web Access (OWA) service account Master service account (optional) Product console administrator Product system administrator In addition to these accounts, an EMC Security group must be created to host the service accounts. Admins group can be created to host console administrator accounts. This section discusses how to configure accounts. Active Directory This section includes an accounts and permission checklist for the Active Directory. Table 3 Accounts and permissions checklist Active Directory Accounts and groups Primary Service account Details All environments The EMC SourceOne primary service account is required in all environments to process EMC SourceOne activities. Details: Password does not need to be changed at next login. Account does not expire. Password does not expire. Must be in the same domain as the SourceOne servers. Management environments only In Exchange environments, you can optionally create an Exchange mailbox for the primary service account. 12 EMC SourceOne 7.2 Products Security Configuration Guide

13 Table 3 Accounts and permissions checklist Active Directory (continued) Accounts and groups Master Services service account (optional) Details All environments The optional EMC SourceOne Master Services service account is specified during Master Services installation. You can alternatively use the primary service account. Details: Password does not need to be changed at next login. Account does not expire. Password does not expire. Must be in the same domain as the SourceOne servers. OWA service account (optional) Management environments only The EMC SourceOne OWA service account is specified during Extensions for OWA installation on Exchange. You can alternatively use the primary service account. Details: Password does not need to be changed at next login. Account does not expire. Password does not expire. Must be in the same domain as the SourceOne servers. Security group All environments Create the EMC SourceOne security group. This group houses the service accounts used with EMC SourceOne. Details: Created in a domain that is fully trusted by the domains EMC SourceOne applications are running. Group scope is Universal, or Global if Universal is not available in the environment. Group type is Security. Group name does not contain special characters. Add service accounts to security group All environments Add the following accounts: EMC SourceOne primary service account. EMC SourceOne Master Services service account (if used). EMC SourceOne OWA service account (if used). EMC SourceOne This section includes an account and permission assignments for EMC SourceOne. User authentication 13

14 Table 4 Accounts and permissions permissions assignment Environment /System Task Details Validation MIME drop directories NSF drop directories PST drop directories Configure drop directory permissions for MIME management Configure drop directory permissions for NSF management Configure drop directory permissions for PST management For drop directories into which you place MIME messages to be archived by EMC SourceOne: Sharing tab Configure the security group with Full Control permissions to the share. Security tab Configure the security group with Full Control permissions to the share. For drop directories into which you place NSF files to be archived by EMC SourceOne: Sharing tab Configure the security group with Full Control permissions to the share. Security tab Configure the security group with Full Control permissions to the share. For drop directories into which you place PST files to be archived by EMC SourceOne in a single Exchange forest configuration: Sharing tab Configure the security group with Full Control permissions to the share. Security tab Configure the security group with Full Control permissions to the share. See the EMC SourceOne Management Administration Guide for considerations in an Exchange resource forest configuration. 1. Log in to a system as the primary service account. 2. Access the share and create a text file. 3. Delete the text file. 1. Log in to a system as the primary service account. 2. Access the share and create a text file. 3. Delete the text file. 1. Log in to a system as the EMC SourceOne primary service account. 2. Access the share and create a text file. 3. Delete the text file. Network computers Configure PST discovery permissions To support PST discovery and management on network computers in a single Exchange forest configuration, add the EMC SourceOne security group as member of local Administrators group for these computers. See the EMC SourceOne Management Administration Guide for Network computers: 1. Log in to a system as the EMC SourceOne primary service account. 2. Access a computer from My Network Places. 3. Access C$ drive. 14 EMC SourceOne 7.2 Products Security Configuration Guide

15 Table 4 Accounts and permissions permissions assignment (continued) Environment /System Task Details Validation considerations in an Exchange resource forest configuration. Microsoft Exchange This section includes an account and permission assignments for Microsoft Exchange. Table 5 Accounts and permissions Microsoft Exchange Task Details Validation Create Exchange journaling mailboxes. Create one or more Exchange journaling mailboxes. A journaling user account is associated with an Exchange journaling mailbox that collects messages generated on a Mailbox Store. Most configurations will consist of several journaling users and mailboxes. Ensure mailboxes created. Configure general Exchange permissions. Configure permissions for journaling mailboxes. Envelope journaling is required for EMC SourceOne. A journaling user account is created in Active Directory and must have the following characteristics: Member of Domain Users group. Password does not need to be changed at next login. Password does not expire. Account does not expire. Journaling users/mailboxes Grant the EMC SourceOne primary service account and the EMC SourceOne Admins group the following permission: Exchange View-Only Administrator (at the Organization level) Note If using Exchange 2010 in a mixed environment, that includes both Exchange 2010 and a previous Exchange version, you must explicitly configure these permissions in Exchange 2010, as they do not automatically propagate over from previous Exchange versions. Grant the EMC SourceOne primary service account access rights to each journaling mailbox. Exchange 2013 Server 1. Start the EMC SourceOne Console. 2. Check that the administrator can view the mail server hierarchy from the EMC SourceOne Console. Test journaling mailbox access: User authentication 15

16 Table 5 Accounts and permissions Microsoft Exchange (continued) Task Details Validation Configure permissions for user mailboxes. Full mailbox access Exchange 2010 Server Full mailbox access Exchange 2007 Server Full mailbox access To support storage management, which requires a higher level of permissions to access and change mailbox contents, configure the following permissions depending on the Exchange version. Note In a mixed environment of Exchange 2010 and Exchange 2013, mail does not get pulled from the Exchange 2013 journaling mailboxes. When logging into the Worker, errors will occur. When pulling mail from the journals on the Exchange 2013 server, jobs will fail. To avoid these errors and jobs failing, in Account Settings, change the Outlook configuration on the workers by selecting the Connect to Microsoft Exchange using HTTP checkbox. Exchange 2013 Grant the EMC SourceOne primary service account the following extended permissions: Receive As 1. Open Outlook as the primary service account. 2. Open the journal mailbox Inbox folder. 3. Add and delete a message. Storage management: 1. Open Outlook as the primary service account. 2. Open a test user mailbox Inbox folder. 3. Add and delete a message. Note In a mixed environment, for example, Exchange 2013 and a previous version of Exchange, grant these permissions at the mailbox database level, targeting only the mailboxes on Exchange You can then use the permissions described in the following section for mailboxes hosted on previous Exchange versions. Exchange 2010 Grant the EMC SourceOne primary service account the following extended permissions: Receive As 16 EMC SourceOne 7.2 Products Security Configuration Guide

17 Table 5 Accounts and permissions Microsoft Exchange (continued) Task Details Validation Note In a mixed environment, for example, Exchange 2010 and a previous version of Exchange, grant these permissions at the mailbox database level, targeting only the mailboxes on Exchange You can then use the permissions described in the following section for mailboxes hosted on previous Exchange versions. Exchange 2007 Grant the EMC SourceOne primary service account the following extended permissions: Receive As Send As Note These permissions can be granted at the Organization level (highest) to the individual mailbox level (lowest). Review Exchange 2010 considerations. Review Exchange 2013 considerations. Review the following considerations if using EMC SourceOne in an environment that includes Microsoft Exchange 2010: Exchange 2010 replaced the permissions model used in Exchange 2007 with a Role Based Access Control (RBAC) permissions model. Refer to the Microsoft Exchange 2010 documentation set for more information. Exchange 2010 takes two hours to update the permissions cache. Restart the Microsoft Exchange Information Store after applying permissions to activate the changes. Review the following considerations if using EMC SourceOne in an environment that includes Microsoft Exchange 2010: Exchange 2013 takes two hours to update the permissions cache. Restart the Microsoft Exchange Information Store after applying permissions to activate the changes. None. None. IBM Lotus Domino This section includes an account and permission assignments for IBM Lotus Domino. User authentication 17

18 Table 6 Accounts and permissions IBM Lotus Domino Task Details Validation Create EMC SourceOne Lotus Notes account. This account will later be specified on EMC SourceOne host computers to support message processing in a Domino environment. To support all EMC SourceOne activities, configure the account with: Manager privileges for all users mail files. Delete access to all mailboxes. To support all EMC SourceOne activities except archiving messages based on read or unread status, restoring messages from EMC SourceOne Search, and user-directed archiving: Editor privileges for all users mail files. Delete access to all mailboxes. Account name: 1. Open a user NSF file for test purposes as the EMC SourceOne Notes user. 2. Add data. 3. Delete the data. Configure Internet address and password for Lotus Notes users. Ensure Lotus Notes users have an Internet address and password configured. This is required for Notes users to use EMC SourceOne Search. After EMC SourceOne is installed, confirm that a Notes user can log in to EMC SourceOne Search. User actions performed without authentication Users cannot perform any actions without authentication. Before starting the SourceOne Console, user authentication occurs when users login to their Windows system. A user must be configured as a console administrator through Windows security assignment, before the user can perform any action within the SourceOne Console. User authorization This section outlines the user authorization settings, control rights, and permissions that are granted to a user to access a resource that is managed by SourceOne. SourceOne Console The Console Management subsystem restricts the ability to query, modify, delete, or select the user and group map folder permissions to SourceOne Console Administrators. Through the Permissions page of the New Folder Wizard, SourceOne Console Administrators can specify the users and groups who can access a folder and the permissions each user and group has on the folder. These values are then passed to the Database Provider Subsystem to be entered into the Activity database. Table 7 SourceOne Console Task Resource Role Assign/unassign Windows Users, Windows Groups, and LDAP Query Groups Console Administrator or SourceOne Administrator 18 EMC SourceOne 7.2 Products Security Configuration Guide

19 Table 7 SourceOne Console (continued) Task Resource Role (defined through primary service account) Create, modify, and delete Policies, activities, and rules Console Administrator Create and delete Native Archive folders Console Administrator View, create, modify, copy, and delete Assign, modify, delete SourceOne mapped folders User and group permissions on mapped folders Console Administrator Console Administrator Modify Native Archive folder properties Console Administrator View, edit Worker properties Console Administrator Specify Users to be audited ("audited users") Console Administrator Select Events to be audited Console Administrator SourceOne Reporting You can use the SourceOne reporting tools to view role and to audit reports. The EMC SourceOne Auditing and Reporting Installation and Administration Guide provides detailed information. Table 8 SourceOne Reporting Task Resource Role Assign users to Roles for access to audit reports SourceOne Administrator View and customize Audit reports Content Manager View Audit reports Browser role Component access control Component access control settings define control over access to the product by external and internal systems or components. Components are sub-systems of the product that typically interact over the network and often have their own security settings. For example, Agents, Database, Console, and Host Servers. The key components are listed as follows: SQL Database server Master computers Worker computers Archive servers Web server File shares and storage Mail servers Component access control 19

20 Component authentication Elasticsearch Worker server This section describes how to configure authentication of remote components. SourceOne accounts and permissions This table includes the component authentication accounts and permissions for SourceOne. Table 9 Accounts and permissions permissions assignment Environment /System Task Details Validation SQL Server Configure SQL database install permissions and Security Logins. Ensure that the installation account is a local administrator and has the SQL sysadmin role. Configure the following groups and accounts as Security Logins in SQL Server: After EMC SourceOne is installed, use the ODBC Test Connection function to confirm the connection. EMC SourceOne security group EMC SourceOne Admins group EMC SourceOne installation accounts After EMC SourceOne databases are installed, you assign individual database privileges to these logins. Master computers Add service account to local administrators group. Add one of the following service accounts as a member of the local administrators group for this computer: Ensure accounts were added. Primary service account, or Master Services service account (if used) This account is required to be a member of this group to run the EMC SourceOne Job Scheduler service. Master computers Add installation account to local administrators group. Add the EMC SourceOne installation account as a member of the local administrators group for this computer. Ensure you can log in using this account. You can remove this user from the group after the installation completes. Alternatively you can use an existing account that is a member of the local administrators group to install the software. 20 EMC SourceOne 7.2 Products Security Configuration Guide

21 Table 9 Accounts and permissions permissions assignment (continued) Environment /System Task Details Validation Worker computers Add installation account to local administrators group. Add the EMC SourceOne installation account as a member of the local administrators group for this computer. Ensure you can log in using this account. You can remove this user from the group after the installation completes. Alternatively you can use an existing account that is a member of the local administrators group to install the software. Native Archive computers Add installation account to local administrators group. Add the EMC SourceOne installation account as a member of the local administrators group for this computer. Ensure you can log in using this account. You can remove this user from the group after the installation completes. Alternatively you can use an existing account that is a member of the local administrators group to install the software. Console client computers Add installation account to local administrators group. Add the EMC SourceOne installation account as a member of the local administrators group for this computer. Ensure you can log in using this account. You can remove this user from the group after the installation completes. Alternatively you can use an existing account that is a member of the local administrators group to install the software. Storage Configure storage location permissions. Configure EMC SourceOne Security Group with permissions for the following storage locations: Message Center location 1. Log in to a system as the primary service account. Archive location Index location Job detail log file location Configure the following permissions for each location: 2. Access the share and create a text file. 3. Delete the text file. Sharing tab Configure the security group with Full Control permissions to the share. Component access control 21

22 Table 9 Accounts and permissions permissions assignment (continued) Environment /System Task Details Validation Security tab Configure the security group with Full Control permissions to the share. DiskXtender Add security group to DX administrators group. If using DiskXtender, add the EMC SourceOne Security Group to the DxAdministrators group on the DiskXtender server. Ensure the group is added. Xtender Provide access to Xtender database. To use an EMC SourceOne archive connection to an Xtender 4.x read-only archive, the EMC SourceOne service account must have db_datareader access to the Xtender database. This access is created using Microsoft SQL Server Management Studio. Ensure the service account can access the database. MIME drop directories Configure drop directory permissions for MIME management. For drop directories into which you place MIME messages to be archived by EMC SourceOne: Sharing tab Configure the security group with Full Control permissions to the share. Security tab Configure the security group with Full Control permissions to the share. 1. Log in to a system as the primary service account. 2. Access the share and create a text file. 3. Delete the text file. NSF drop directories Configure drop directory permissions for NSF management. For drop directories into which you place NSF files to be archived by EMC SourceOne: Sharing tab Configure the security group with Full Control permissions to the share. Security tab Configure the security group with Full Control permissions to the share. 1. Log in to a system as the primary service account. 2. Access the share and create a text file. 3. Delete the text file. PST drop directories Configure drop directory permissions for PST management. For drop directories into which you place PST files to be archived by EMC SourceOne in a single Exchange forest configuration: Sharing tab Configure the security group with Full Control permissions to the share. Security tab Configure the security group with Full Control permissions to the share. 1. Log in to a system as the EMC SourceOne primary service account. 2. Access the share and create a text file. 3. Delete the text file. 22 EMC SourceOne 7.2 Products Security Configuration Guide

23 Table 9 Accounts and permissions permissions assignment (continued) Environment /System Task Details Validation See the EMC SourceOne Management Administration Guide for considerations in an Exchange resource forest configuration. Network computers Configure PST discovery permissions. To support PST discovery and management on network computers in a single Exchange forest configuration, add the EMC SourceOne security group as member of local Administrators group for these computers. See the EMC SourceOne Management Administration Guide for considerations in an Exchange resource forest configuration. Network computers: 1. Log in to a system as the EMC SourceOne primary service account. 2. Access a computer from My Network Places. 3. Access C$ drive. Microsoft Exchange accounts and permissions This table includes the component authentication accounts and permissions for Microsoft Exchange. Table 10 Accounts and permissions Microsoft Exchange Task Details Validation Create Exchange journaling mailboxes. Create one or more Exchange journaling mailboxes. A journaling user account is associated with an Exchange journaling mailbox that collects messages that are generated on a Mailbox Store. Most configurations consist of several journaling users and mailboxes. Ensure mailboxes created. Configure general Exchange permissions. Envelope journaling is required for EMC SourceOne. A journaling user account is created in Active Directory and must have the following characteristics: Member of Domain Users group. Password does not need to be changed at next login. Password does not expire. Account does not expire. Journaling users/mailboxes Grant the EMC SourceOne primary service account and the EMC SourceOne Admins group the following permissions: 1. Start the EMC SourceOne Console. Component access control 23

24 Table 10 Accounts and permissions Microsoft Exchange (continued) Task Details Validation Configure permissions for journaling mailboxes. Configure permissions for user mailboxes. Exchange View-Only Administrator (at the Organization level) Note If using Exchange 2010 in a mixed environment, which includes both Exchange 2010 and a previous Exchange version, then you must explicitly configure these permissions in Exchange Permissions do not automatically propagate over from previous Exchange versions. Grant the EMC SourceOne primary service account access rights to each journaling mailbox. Exchange 2013 Server Full mailbox access Exchange 2010 Server Full mailbox access Exchange 2007 Server Full mailbox access To support storage management which requires a higher level of permissions to access and change mailbox contents, configure the following permissions depending on the Exchange version. Note In a mixed environment of Exchange 2010 and Exchange 2013, mail does not get pulled from the Exchange 2013 journaling mailboxes. When logging in to the Worker, errors occur. When pulling mail from the journals on the Exchange 2013 server, jobs fail. To work around these limitations, from the Account Settings, change the Outlook configuration on the workers by selecting the Connect to Microsoft Exchange using HTTP checkbox. Exchange 2013 Grant the EMC SourceOne primary service account the following extended permissions: Receive As 2. Check that the administrator can view the mail server hierarchy from the EMC SourceOne Console. Test journaling mailbox access: 1. Open Outlook as the primary service account. 2. Open the journal mailbox Inbox folder. 3. Add and delete a message. Storage management: 1. Open Outlook as the primary service account. 2. Open a test user mailbox Inbox folder. 3. Add and delete a message. 24 EMC SourceOne 7.2 Products Security Configuration Guide

25 Table 10 Accounts and permissions Microsoft Exchange (continued) Task Details Validation Note In a mixed environment, for example, Exchange 2013 and a previous version of Exchange, grant these permissions at the mailbox database level, targeting only the mailboxes on Exchange You can then use the permissions that are described in the following section for mailboxes that are hosted on previous Exchange versions. Exchange 2010 Grant the EMC SourceOne primary service account the following extended permissions: Receive As Note In a mixed environment, for example, Exchange 2010 and a previous version of Exchange, grant these permissions at the mailbox database level, targeting only the mailboxes on Exchange You can then use the permissions that are described in the following section for mailboxes that are hosted on previous Exchange versions. Exchange 2007 Grant the EMC SourceOne primary service account the following extended permissions: Receive As Send As Note These permissions can be granted at the Organization level (highest) to the individual mailbox level (lowest). Review Exchange 2010 considerations. Review the following considerations if using EMC SourceOne in an environment that includes Microsoft Exchange 2010: Exchange 2010 replaced the permissions model that is used in Exchange 2007 with a Role Based Access Control (RBAC) permissions model. Refer to the Microsoft Exchange 2010 documentation set for more information. Exchange 2010 takes 2 hours to update the permissions cache. Restart the Microsoft Exchange Information Store after applying permissions to activate the changes. None. Component access control 25

26 Table 10 Accounts and permissions Microsoft Exchange (continued) Task Details Validation Review Exchange 2013 considerations. Review the following considerations if using EMC SourceOne in an environment that includes Microsoft Exchange 2010: Exchange 2013 takes 2 hours to update the permissions cache. Restart the Microsoft Exchange Information Store after applying permissions to activate the changes. None. IBM Domino accounts and permissions This table includes the component authentication accounts and permissions for IBM Lotus Domino. Table 11 Accounts and permissions IBM Domino Task Details Validation Create EMC SourceOne Lotus Notes account. This account is specified later on EMC SourceOne host computers to support message processing in an IBM Domino environment. To support all EMC SourceOne activities, configure the account with: Manager privileges for all users mail files. Delete access to all mailboxes. To support all EMC SourceOne activities except archiving messages based on read or unread status, restoring messages from EMC SourceOne Search, and user-directed archiving: Editor privileges for all users mail files. Delete access to all mailboxes. Account name: 1. Open a user NSF file for test purposes as the EMC SourceOne Notes user. 2. Add data. 3. Delete the data. Configure Internet address and password for IBM Notes users Ensure IBM Notes users have an Internet address and password configured. This is required for IBM Notes users to use EMC SourceOne Search. After EMC SourceOne is installed, confirm that a Notes user can log in to EMC SourceOne Search. Component authorization This section includes instructions or references to instructions on how to configure the product to restrict access to remote components or systems (for example, LUN masking or IP filtering). Log settings This section describes settings related to the logging of events. A log is a chronological record of system activities that is sufficient to enable the reconstruction and examination 26 EMC SourceOne 7.2 Products Security Configuration Guide

27 of the sequence of environments and activities surrounding or leading to an operation, procedure, or event in a security-relevant transaction from inception to final results. Log description This table lists all relevant logs including their location, for example, file path or database, on a system and a description of their content. This table only includes event logs and does not include trace and debug logs. Table 12 Log files Log file SQL Database server Master server Worker server Archive server IIS Web server Location Windows event log/application Windows event log/application/emc Windows event log/application/emc Windows event log/application/emc On IIS server: Event Viewer\Custom Views\Server Roles\Web Server(IIS) Event Viewer\Applications and Services Logs \Microsoft\Windows\IIS-Configuration Event Viewer\Applications and Services Logs \Microsoft\Windows\IIS-Logging On IIS server disk: C:\inetpub\logs\LogFiles C:\Windows\System32\LogFiles C:\Windows\System32\inetsrv Log management and retrieval This section includes instructions on how to configure log management and retention policies. Standard Windows event log management procedures can be applied. Refer to Microsoft documentation on Windows event log and alert management. Log roll-over This section includes information about log roll-over. Configuration of an external Syslog server This section includes information about the configuration of an external Syslog server. Configuration of logging levels This section includes information about the configuration of logging levels. Log description 27

28 Configuration of alert mechanisms This section includes information about the configuration of alert mechanisms. Configuration for external log management tools like envision This section includes information about the configuration for external log management tools like envision. Configuration of time synchronization with external source This section includes information about the configuration of time synchronization with external source. For example, using NTP, and Windows Time Service. Accessing log files This section includes instructions or references to instructions on how a customer can access log files. Communication security settings This section describes settings that are related to security for the product network communications. Communication security settings enable the establishment of secure communication channels between the product components as well as between product components and external systems or components. Port usage This table lists all the network ports, services, and protocols that are used by the product components. Information in the table includes what external interfaces, ports, and services must be open or enabled for proper operation of the product as well as the configurable default ports. Use this information when using the EMC SourceOne product along with a firewall. Table 13 Port usage Component Service Protocol Port Note Offline Access Document Management Service TCP/HTTP 8001/8002 Search TCP/HTTP 80/443 Port 80 when TLS/SSL is disabled. Port 443 when TLS/SSL is enabled. Universal Shortcut/ Mobile Discovery Manager Web Application Supervisor Web Application TCP/HTTP 80/443 Port 80 when TLS/SSL is disabled. Port 443 when TLS/SSL is enabled. TCP/HTTP 80/443 Port 80 when TLS/SSL is disabled. Port 443 when TLS/SSL is enabled. TCP/HTTP 80/443 Port 80 when TLS/SSL is disabled. Port 443 when TLS/SSL is enabled. 28 EMC SourceOne 7.2 Products Security Configuration Guide

29 Table 13 Port usage (continued) Network encryption This section includes instructions about how to use the SourceOne product with SSL to configure an encryption key or a certificate for use in secure communications. Follow this procedure to ensure that SSL is enabled. Procedure 1. In the New Archive folder, specify the following: Ensure that the Enable SSL checkbox is selected. If SSL is enabled, HTTPS is used for data transport, otherwise, HTTP is used. In the Port field, specify the port number for the server. The default value for http is 80. The default value for https is 443. Figure 1 Enabling SSL 2. If the LDAP or ADS server requires a secure sockets layer connection (SSL), select the Server requires a secure connection (SSL)? checkbox. When this checkbox is selected, the LDAP port changes to the default secure LDAP port value of 636 for Active Directory. Note that the value for Domino is different. 3. If the LDAP or ADS server requires a secure sockets layer connection (SSL): Network encryption 29

30 a. Open the Select Data Sources page of the New Activity wizard. b. Select the Server requires a secure connection (SSL)? checkbox. When this checkbox is selected, the LDAP port changes to the default secure LDAP port value of 636 for Active Directory. Note that the secure LDAP port value for IBM Domino is different. Figure 2 LDAP server configuration Data security settings Encryption of data at rest This section describes settings available to ensure protection of the data that is handled by the product. Data security settings enable definition of controls to prevent data that is permanently stored by the product to be disclosed in an unauthorized manner. This section includes instructions or references to instructions about how to configure encryption for the data that is stored by the SourceOne product. Also this section includes instructions on how to configure or change the encryption key. SourceOne does not provide the capability to encrypt archived data. Encryption of data must be managed through underlying storage assuming that the storage platform provides that capability. Data integrity This section describes how the SourceOne product secures data integrity. SourceOne archive stores checksum with the archived object which is verified when the object is read and retrieved from the archive storage. Also, SourceOne calculates unique object IDs that are based on using the properties on the object through proprietary, patented SHA-1 hash algorithm. 30 EMC SourceOne 7.2 Products Security Configuration Guide

31 Data erasure This section includes instructions about how to configure the secure erasure of the data that is stored by the SourceOne product. Configure data retention and disposal as follows. Procedure 1. Specify the data retention on the archive folder in the Native Archive. You can specify how long data in the archive folder is to be retained by entering a value in the Months to retain field. 2. Determine whether you want to automatically or manually dispose of data that is past the retention period. To manually dispose of the data, perform the following: a. Select the archive folder that contains the data that you want to process. b. Select Action > Perform Disposition. To automatically dispose of the data, select the Enable automatic disposition field on the archive folder. The EMC SourceOne Management Administration Guide contains more information about configuring data retention and disposal. Secure serviceability settings Security alert system settings Other security considerations SourceOne does not enable any in-built specific role or accounts for EMC personnel for remote support. Configuration changes require specific account and authentication setup by the customer for administration or usage of the SourceOne product. There are a number of settings that are not available in the product Administration Console and require Customer Support involvement. SourceOne does not provide built-in notification services. However, in environments that integrate the SourceOne product with the Microsoft System Center Operations Manager (SCOM), the logging of specific SourceOne product events occurs in the Windows Event Management Console. These events might generate notifications. The EMC SourceOne Management Pack for Microsoft System Center Operations Manager Guide includes more information. For changes to permissions to data folders, SourceOne provides Mapped Folder permissions. The EMC SourceOne Management Administration Guide includes more information. SourceOne also provides audit reports. The EMC SourceOne Auditing and Reporting Installation and Administration Guide includes more information. This section describes security settings that may not fall in one of the previous sections. Consider the following EMC recommended security measures: Data erasure 31

32 Place all SourceOne components behind a fire wall. Use SSL for client web applications. Use SSL for accessing EMC Atmos devices. Install the latest Windows Security Patch on the SourceOne product build server. Remove unnecessary local Admin rights for SourceOne account. Configure security software (anti-virus software) with SourceOne. Configure and change the caching period. Set up Network Address Translation (NAT). Do not host SQL server and IIS on the same server. Use SQL server security hardening. Use Windows Server security hardening. When configuring and administering SourceOne, remove the following from the SQL server: Guest rights Extended stored procedure rights Registry access Sample databases 32 EMC SourceOne 7.2 Products Security Configuration Guide

33 CHAPTER 3 Secure Deployment and Usage Settings This section describes instructions on how to deploy and how to use the SourceOne product securely. Security controls map...34 Secure deployment settings Secure Deployment and Usage Settings 33

34 Secure Deployment and Usage Settings Security controls map This section provides a high level application map to explain the components, data flows, and communications the SourceOne application uses. The map labels security controls used to protect data. Figure 3 Security controls map Secure deployment settings This section includes instructions or references on how to securely deploy and use the EMC SourceOne product. The following table includes information about deploying the SourceOne product securely. 34 EMC SourceOne 7.2 Products Security Configuration Guide

35 Secure Deployment and Usage Settings Table 14 Secure Deployment Settings Default Setting Secure Deployment Settings Pros of Secure Deployment Settings Cons of Secure Deployment Settings Instructions on how to configure secure deployment settings In Management, SSL is disabled by default between the client and server. For the best possible security between the client and server, enable SSL. Provides a high level of protection for the communication between client and server by avoiding tampering, spoofing, and man in the middle type of attacks. Impacts performance. The EMC SourceOne Management Installation Guide includes SSL configuration instructions. In Discovery Manager, SSL is enabled by default between the client and server. For the best possible security between the client and server, enable SSL. Provides a high level of protection for the communication between client and server by avoiding tampering, spoofing, and man in the middle type of attacks. Impacts performance. The EMC SourceOne Discovery Manager Installation and Administration Guide includes SSL configuration instructions. In Supervisor, SSL is enabled by default between the client and server. For the best possible security between the client and server, enable SSL. Provides a high level of protection for the communication between client and server by avoiding tampering, spoofing, and man in the middle type of attacks. Impacts performance. The EMC SourceOne Supervisor Installation Guide includes SSL configuration instructions. SNMPv1 by default for backward compatibility reasons SNMPv3 by default for best possible security and ability to switch back to SNMPv1 for backward compatibility Best possible security By default, backward compatibility is not available. Refer to instructions about how to deploy with SNMPv3 by default and how to switch back to SNMPv1 for backward compatibility. The following table includes information about recommended default secure protocols and settings. Secure deployment settings 35

36 Secure Deployment and Usage Settings Table 15 Secure Deployment Settings Recommended Default Secure Settings SSL is turned on by default. Risks Posed by Turning Off Default Secure Settings By turning off SSL, SourceOne is exposed to tampering, spoofing, and man in the middle type of attacks. 36 EMC SourceOne 7.2 Products Security Configuration Guide

37 CHAPTER 4 Secure Maintenance This section describes how to perform secure maintenance of the product. Security patch management Secure Maintenance 37

38 Secure Maintenance Security patch management This section includes instructions or references to instructions on Security patch management. This table lists all the third-party components for which a patch is needed. Table 16 Security patch management Third-party component for which patch is needed Frequency of patch EMC responsibility (Y/N) Customer responsibility (Y/N) Reference to instructions for applying patch Open SSL 0.9.8za in SourceOne Management Not applicable Y N EMC SourceOne Management Installation Guide 38 EMC SourceOne 7.2 Products Security Configuration Guide