Security configuration of the mail server IBM

Transcription

1 Security configuration of the mail server IBM

2 ii Security configuration of the mail server

3 Contents Security configuration of the mail server 1 Configuration of the SSL client to trust the SMTP server certificate Importing the certificate for the SMTP server in the WebSphere Application Server truststore... 1 Configuring Security Identity Manager to use SSL when it communicates with the SMTP server.. 2 Running runconfig with SSL to the SMTP server 2 Configuring SMTP authentication with the SMTP server iii

4 iv Security configuration of the mail server

5 Security configuration of the mail server IBM Security Identity Manager uses Secure Socket Layer (SSL) to communicate with the SMTP server to send notifications. You must configure the SMTP server to use SSL for secure communications. Do this task only after you install IBM Security Identity Manager. If you want to configure SMTP server only through an SSL connection, skip mail configuration during the installation and run runconfig again to configure the mail server after the installation completes. Configuration of the SSL client to trust the SMTP server certificate The IBM Security Identity Manager runconfig utility does not operate as an embedded part of WebSphere Application Server. It operates as a Java application and uses Java Secure Socket Extension (JSSE) to implement SSL support. SSL certificates and CA certificates are retrieved from a standard format Java truststore or keystore. The truststore and keystore use the same file formats that the Java virtual machine and WebSphere Application Server use for other certificate configuration. You can use standard Java tools to maintain the trust and keystores, including the IBM Key Management tool and the Java Keytool command-line utility. To configure the SSL connection between the IBM Security Identity Manager Server and SMTP Server, you must import the certificate created for the SMTP Server into the truststore. This truststore is used by the IBM JSSE, which is part of WebSphere Application Server. Additionally, you must first configure IBM Security Identity Manager to use SSL when communicating with the SMTP Server. Importing the certificate for the SMTP server in the WebSphere Application Server truststore Use this procedure to import the self-signed certificate to the WebSphere Application Server truststore. Ensure that the WebSphere Application Server is running and that you start the WebSphere Application Server administrative console. You must have a WebSphere Application Server administrative user ID and password. Procedure 1. Copy the SSL server CA certificate file, smtpserver.der, to a temporary directory on the workstation on which Security Identity Manager is installed. For example, you might use temp/smtpserver.der. 2. Connect to the WebSphere Application Server administrative console. 3. Click Security > SSL certificate and key management. 4. Under Related Items, click Key stores and certificates. 1

6 5. For a single-server environment, click NodeDefaultTrustStore or for a cluster environment, click CellDefaultTrustStore. 6. Under Additional Properties, click Signer certificates. 7. Click Add. a. Set the alias. Type smtpserver in the Alias field. b. Specify the file name of the SMTP server certificate. For example, temp/smtpserver.der. c. From the Data type menu, select Binary DER data. 8. Click OK to continue and save. What to do next Configure Security Identity Manager to use SSL when it communicates with the SMTP server. Configuring Security Identity Manager to use SSL when it communicates with the SMTP server After you import the certificate, you must configure Security Identity Manager server to complete the SSL connection. You must finish importing the SSL certificate for the SMTP server in the WebSphere Application Server truststore. Procedure 1. Edit the enrol .properties file. This file is in the ISIM_HOME\data directory. 2. Set the port value on the mail.smtp.port property to the SSL port number configured on the SMTP server. For example: mail.smtp.port= Set the value of the mail.smtp.starttls.enable property to true. This setting directs the Security Identity Manager Server to use SSL to communicate to SMTP. For example: mail.smtp.starttls.enable=true 4. Save the changes. Running runconfig with SSL to the SMTP server If SMTP is configured to use SSL only, the runconfig utility does not work during a new Security Identity Manager installation. Obtain the SMTP server SSL certificate from your administrator and place in a temporary directory on IBM Security Identity Manager Server. Ensure that the Security Identity Manager installation process is completed. About this task Skip the runconfig Mail tab during the installation process. The runconfig utility Java runtime is typically in <ITIM_HOME>/jre/jre, separate from the WebSphere Application Server Java runtime. 2 Security configuration of the mail server

7 Procedure 1. Locate the Java runtime for the runconfig utility in the runconfig.lax file. For example: LAX.NL.CURRENT.VM # # the VM to use for the next launch lax.nl.current.vm=<itim_home>/jre/jre/bin/java 2. Run the Java key management tool, ikeyman in <ITIM_HOME>/jre/jre/bin. 3. Click Open, for Key database type, select JKS. 4. Click Browse, and navigate to <ITIM_HOME>/jre/jre/lib/security. 5. In Files of Type, select All Files. 6. Select cacerts. 7. Enter the password of the keystore. The default password is changeit. 8. Select Signer Certificates. 9. Click Add, and browse to the temporary directory to select the SMTP server SSL certificate that you obtained. 10. Click OK, and supply a label for the certificate. For example: SMTPcert The certificate is added to the runconfig Java runtime. What to do next Configure Security Identity Manager to use SSL when it communicates with the SMTP server. Configuring SMTP authentication with the SMTP server Run the runconfig utility to supply SMTP authentication user id and password. If you use SSL communication on SMTP server, ensure that the runconfig lax file is updated with the WebSphere Application Server truststore. In enrol .properties, ensure mail.smtp.auth is set to true. Procedure Run runconfig after you complete this procedure and supply SMTP user id and password. The password is encrypted in enrol .properties. Security configuration of the mail server 3