Contents. Introducing TARMAC Customizing your user experience... 19

Transcription

1 TARMAC Version 1.2

2 Contents Overview... 3 Introducing TARMAC... 4 Installation and Licensing... 5 Installing TARMAC on Mac OS X Client 5 Installing TARMAC on Mac OS X Server 5 Accessing TARMAC for the first time 6 Licensing TARMAC 6 Connecting to your directory service... 8 Configuring TARMAC with an Open Directory 8 Configuring TARMAC with an Active Directory 9 Creating ios configuration templates Getting started with iphone Configuration Utility 10 Configuration templates schema overview 10 Common Open Directory placeholders 11 Common Active Directory placeholders 11 Exporting ios device configuration templates 11 Setting up the initial SCEP profile 16 Using an existing external certificate authority 16 Using TARMAC s built-in CA server 17 Getting an overview of provisioned users 18 Customizing your user experience Adding a custom logo 19 Displaying header and footer text 19 Informing users with the About Screen 20 Adding Links 20 Troubleshooting Accessing TARMAC Server when directory service is offline 21 Locating TARMAC s server logs 21 Getting to know your directory service 21 Uninstalling TARMAC 21 Assigning profiles to user groups Importing ios device configuration templates 12 Signing profiles with a certificate 12 Setting Compliance Rules 13 Securing access to TARMAC Enabling HTTPS 14 Distributing a root CA 14 Enrolling Microsoft Exchange certificates 15 Enrolling certificates using SCEP... 16

3 Overview The aim of an automatic iphone and ipad provisioning system is to automate the setup and minimize administrative effort. TARMAC fulfills this aim. Specialized for iphone and ipad TARMAC fully supports your device, whether it is an iphone, ipod touch or ipad. Compliance rule management allows TARMAC to query devices and restrict profile access based on OS version or device generation. Everything at a Glance Get an instant overview of your users to see which have already provisioned their devices. Use the in-built log to recognize problems and proactively fix them. Front-Seat Security No data leaves your internal infrastructure. Centralized provisioning means important changes can be deployed immediately. Fast OTA Provisioning Over-the-air (OTA) provisioning means administrators do not need physical access to the end-user s device. Efficient Administration All devices are efficiently configured to meet corporate IT policies. All but eradicate the time spent configuring individual user devices. Future Proof TARMAC uses Apple Standards. No special proprietary formats are involved, guaranteeing future support for your device and securing your investment. Scales with your Company Whether you are profiling a thousand devices or just one, TARMAC handles them just the same. New users added to the directory service can benefit from TARMAC straight away. Easy Deployment As TARMAC requires no additional software to be installed on the end-user s device, set up is a breeze. In no time at all, their device is fully configured.

4 Introducing TARMAC Profiles Import mobile config templates and assign profiles to directory groups. You can also set Compliance Rules here. Licenses Manage your TARMAC licenses and get an overview of licensed users. Services Define and setup your directory service and user groups here. Customize Customize the look and feel of TARMAC for the end-user. Add company branding, helper text and more. Logs Get an overview of TARMAC log in attempts both admin and client side. Asset Management Keep track of all provisioned devices. Including device and ios version information. Secure Access Encrypt all communication with the TARMAC server, including enabling HTTPS and setting a root CA. 4

5 Installation and Licensing TARMAC is installed using a standard Mac OS X installer package. This section steps you through this process and helps you license your software making it ready to use. Installing TARMAC on Mac OS X Server Double-click the Install TARMAC icon in the.dmg image file. This will initiate the automatic TARMAC installer. As TARMAC is configured directly within a web browser, the installer should only take a few minutes to complete. Installing TARMAC on Mac OS X Client Double-click the Install TARMAC icon in the.dmg image file. This will initiate the automatic TARMAC installer. Tip TARMAC is installed into one self-contained directory. Find it here: /Library/WebServer/tarmac/ In order to not interfere with any existing services, TARMAC does not automatically start any web services when installed on Mac OS X Server. Please be sure to create a web host to the TARMAC Server using the Server Admin tool. Note The Apache configuration file can be found here: /etc/apache2/sites/tarmac.conf As TARMAC is configured directly within a web browser, the installer should only take a few minutes to complete. Tip TARMAC is installed into one self-contained directory. Find it here: /Library/WebServer/tarmac/ 5

6 Accessing TARMAC for the first time If you are installing TARMAC on Mac OS X Client, your default web browser will automatically open and navigate to the TARMAC admin interface towards the end of the installation process. Licensing TARMAC On Mac OS X Server, you can manually navigate to this interface at any time, either directly from the local server or remotely from a different computer. Navigating to the TARMAC Server interface locally: Open your preferred browser Navigate to Navigating to the TARMAC Server interface remotely: Open your preferred browser Navigate to Launching the TARMAC Server web interface the first time will ask for licensing information. You should have received this information when you purchased TARMAC. Alternatively, all license information is stored in your equinux License Manager. To look up your TARMAC license information online: Visit Log in using your equinux ID and password Click TARMAC in your software products list Click the license and click More Once you have the license code, this can be copied and pasted in the Licenses page of TARMAC. There are two categories of licenses associated with TARMAC: base licenses and user licenses. 6

7 Base licenses define server modules, such as which directory service or features should be enabled. Multiple base licenses (such as additional modules) can be added at any time. To add a base license: Click Add Base License Paste base license code Click Add User licenses define how many users can provision their device. Multiple user licenses can be added at a future date to scale with your company. To add a user license: Click Add User License Paste user license code Click Add Once licenses have been added to TARMAC, the appropriate modules should now be active. 7

8 Connecting to your directory service TARMAC requires access to your directory service to personalize individual ios configuration profiles. Use this guide to get TARMAC connected with your directory service. TARMAC needs to connect to your company s directory service to personalize mobile configuration templates and deliver them to end-user devices. This is done from the Services page of the TARMAC Server. Field Host Description IP or hostname of your OD. Multiple hosts can be used as contingency. Port Port used for OD connections. Default 389. Base DN Anonymous Bind Fetch this automatically by clicking Fetch Base DN. This is the base structure of your directory tree. Check this if OD allows anonymous access (i.e. does not require a service account to gain access to user information) TARMAC can connect to a variety of different directory services. Which service is active depends on your base license. Configuring TARMAC with an Open Directory The following table details everything that is required to set up TARMAC with an Open Directory (OD). Once all required information has been filled, press Update. You will receive an error, should any information be incorrect. Service Account DN Service Account Password User DN Attribute Display Name Distinguished Name (DN) Distinguished Name of the Service Account which is used to connect to the Open Directory. This should be fully qualified, e.g. uid- =johnsmith, cn=users (not required if Anonymous Bind is enabled). Password for the Service Account (not required if Anonymous Bind is enabled). This is the attribute which defines a user name in your OD. Commonly uid. If you have multiple domains (e.g. one for the US office, another for the EU office) you need to define them both here. The Display Name need not be pre-defined and can be created at this point (e.g. US office ). The DN is used to authenticate all users. This specifies the domain where all users are listed. If you have multiple domains, these can be entered here too. E.g. cn=users. Enabling Append appends the Base DN (defined above). Enabling Default makes this domain the default when users log in to the TARMAC client. 8

9 Field Description Field Description Group DN This is where you must define which users can use TARMAC to provision their devices. E.g. cn=finance,cn=groups or cn=vpnusers,cn=groups. These values are defined by your existing OD. Append appends the Base DN (defined above). Enabling Admin gives this user group TARMAC Server administration rights. They can then access the Admin interface with their standard user login. Configuring TARMAC with an Active Directory The following table details everything that is required to set up TARMAC with an Active Directory (AD). Once all required information has been filled, press Update. You will receive an error, should any information be incorrect. Field Host Description IP or hostname of your AD. Multiple hosts can be used as contingency. Port Port used for AD connections. Default 389. Base DN Fetch this automatically by clicking Fetch Base DN. This is the base structure of your directory tree. User DN Attribute Display Name Distinguished Name (DN) Group DN This is the attribute which defines a user name in your AD. Commonly cn. If you have multiple domains (e.g. one for the US office, another for the EU office) you need to define them both here. The Display Name need not be pre-defined and can be created at this point (e.g. US office ). The DN is used to authenticate all users. This specifies the domain where all users are listed. If you have multiple domains, these can be entered here too. E.g. cn=users. Enabling Append appends the Base DN (defined above). Enabling Default makes this domain the default when users log in to the TARMAC client. This is where you must define which users can use TARMAC to provision their devices. E.g. cn=finance,cn=users or cn=vpnusers,- cn=users. These values are defined by your existing AD. Append appends the Base DN (defined above). Enabling Admin gives this user group TARMAC Server administration rights. They can then access the Admin interface with their standard user login. Anonymous Bind Service Account DN Service Account Password Check this if AD allows anonymous access (i.e. does not require a service account to gain access to user information). Note: This is not commonly the case with an AD. Distinguished Name of the Service Account which is used to connect to the Active Directory. This should be fully qualified, e.g. cn=johnsmith, cn=users. Password for the Service Account. 9

10 Creating ios configuration templates Use Apple s iphone Configuration Utility to create ios configuration templates which can be imported into TARMAC. These templates are then personalized before being delivered to end-user devices. Getting started with iphone Configuration Utility The iphone Configuration Utility is used to create all ios device configuration templates ready for TARMAC provisioning. This tool is available free from Apple s Support website at Creating a new configuration template: Choose Configuration Profiles from the Library column on the left Click New in the toolbar Start configuring your template, following the tooltips from Apple Use a placeholder in place of specific user information when you need TARMAC to provision this information automatically Repeat these steps creating templates for the required number of user groups. For example, one template for the finance department, another for the marketing department. These will be assigned to your user groups in the next section. Note You can configure as little or as much as you want. Only activate features you intend to provision. Leaving required fields blank may prevent the profile being installed successfully on the end-user device. Configuration templates schema overview In order for TARMAC to personalize ios configuration templates, it needs to know where this information can be found in your directory service. Special placeholders can be used in the fields which would normally be filled with specific user data. Defining a TARMAC placeholder: Enter $$ + directory service attribute + $$ E.g. $$uid$$ would commonly be used in place of a username when using an Open Directory server After downloading and installing the iphone Configuration Utility, you can start creating your ios device configuration templates. Tip If you need a little help remembering the structure of your directory service, try using an LDAP browser. If you do not currently have a LDAP browser on your computer, try Apache Directory Studio available for Mac OS X, Linux and Windows from 10

11 Common Open Directory placeholders Most Open Directories use a standard set of attribute names. Here is a list of common features used in the iphone Configuration Utility and what placeholder would need to be used in order for TARMAC to provision the profile per user. Item Account / Username Password* Address $$uid$$ Common OD Attribute $$TARMAC:password$$ $$mail$$ Item Address User Display Name First Name Surname Company Department Office Phone Common AD Attribute $$mail$$ $$cn$$ $$givenname$$ $$sn$$ $$company$$ $$department$$ $$telephonenumber$$ User Display Name $$cn$$ Exchange ActiveSync Certificate** $$CERT:NameOfTemplate$$ First Name Surname Office Phone Exchange ActiveSync Certificate** $$givenname$$ $$sn$$ $$telephonenumber$$ $$CERT:NameOfTemplate$$ * Passwords are often encrypted and cannot be provisioned. Note This is not a definite list. Please check your directory service with an LDAP browser to check all attributes are correct. If an attribute is listed in a template and is not available on the directory service, provisioning will fail. Common Active Directory placeholders Item Account / Username Common AD Attribute $$samaccountname$$ * Password can only be provisioned if SCEP or HTTPS is enabled. * * See section Securing Access to TARMAC for more information. Exporting ios device configuration templates Once you have created a configuration template, you can export it ready to be imported into TARMAC. Exporting configuration templates from iphone Configuration Utility: Select the configuration profile to export Click Export in the toolbar Choose None from the security pop-up menu Save to your preferred location Your ios device configuration templates are now ready to be imported into TARMAC. Password* $$TARMAC:password$$ 11

12 Assigning profiles to user groups After your ios device configuration templates have been created in Apple s iphone Configuration Utility, they can be imported into TARMAC and assigned user groups. This section shows you how. Importing configuration templates from iphone Configuration Utility: Navigate to the Profiles page on the TARMAC Server interface Click Import in the Access section Choose a.mobileconfig configuration template Click import The Profiles page of TARMAC Server allows you to upload and assign user groups to your configuration templates. Additionally you can use this section to set compliance rules, restricting profile download access only to those who have permission. The template will now show in the table below, ready for you to assign user groups. These user groups correspond to the group DNs in the Access section of the Services page (see section: Connecting to your directory service). Assign user groups to configuration templates: Click an uploaded configuration template in the table Select the check box next to the group you wish to assign this template These changes are made dynamically and you do not need to save each time. More than one group can be assigned to each template. For example, you may have one template called VPN Access among several other departmental templates. VPN Access may need to be assigned to several different groups giving permitted end-users access to this profile regardless of which department they are in. Signing profiles with a certificate TARMAC profiles can be signed during the provisioning process by a custom certificate and private key that matches your root CA. This way, end-users can rest assure that the profile they are installing is indeed from their company. Certificates are added globally and not to individual profiles. Importing ios device configuration templates Once ios device configuration templates have been created in the Apple iphone Configuration Utility they need to be imported into TARMAC. To add a certificate and private key: Click Set Signature Choose a certificate Choose a private key 12

13 Click Import TARMAC supports certificate files in PEM or DER format, encoded in Base64. They must not be encrypted. Profiles can also be signed individually using an automated SCEP service (see section Enrolling certificates using SCEP) Setting Compliance Rules TARMAC allows you to restrict access to profiles based on device or ios version. It may be that you do not want to allow certain devices access to provisioning profiles due to security concerns or any other reasons. At present, Compliance Rules are set globally and cannot be assigned to individual profiles. To set compliance rules: Check the box next to each allowed device Click Save If an unauthorized device attempts to download a profile, the user will receive an error message saying no profile is available. Tip Enabling SCEP allows TARMAC to differentiate between iphone models with greater accuracy and therefore allows additional compliance rules to be set. 13

14 Securing access to TARMAC TARMAC keeps security on the front-seat. This sections helps you encrypt communication with the TARMAC Server on both server and client side. Enabling HTTPS Enabling HTTPS will encrypt all information between your end-users and the TARMAC Server. Access to the TARMAC Server Admin will also go over SSL. If you have installed TARMAC on Mac OS X Server and have not yet set up HTTPS credentials, you may lock yourself out. Please consult Apple s Server Management manual for help on encrypting http connections to your server. If TARMAC has been installed on Mac OS X Client, it is possible for TARMAC to manage the HTTPS connection itself. Activating HTTPS on Mac OS X Client: Check the box Activate HTTPS Click HTTS Choose a certificate and private key Click Import Note All URLs will use the prefix if HTTPS is enabled. Be sure to update your users. The root CA needs to be embedded in a.mobileconfig file created with Apple s iphone Configuration Utility. To create a.mobileconfig file with signed root CA: Open the iphone Configuration Utility Create a new configuration profile Add a certificate under Credentials Export the profile The.mobileconfig file can now be imported into TARMAC. To import a certificate profile: Click Set Profile Choose the.mobileconfig file created in the steps above Click Import End-users will receive an additional step during provisioning on their ios device. Downloads the mobileconfig with root CA Continues to the user log in Distributing a root CA If certain services, such as CalDAV or your Mail server, have a certificate which cannot be verified against a root CA, the end-user will be asked to trust each certificate manually. A root CA can be quickly deployed to endusers so all certificates signed by the root CA are trusted automatically. 14

15 Enrolling Microsoft Exchange certificates TARMAC can use your existing certificate authority to enroll user certificates, allowing users to be authenticated with their Microsoft Exchange server. In order to use this feature, TARMAC needs to know when it must provision the user certificate. This is done by entering a special placeholder in the Password field of the Exchange ActiveSync settings in the iphone Configuration Utility ($$CERT:NameOfTemplate$$ where NameOfTemplate is the name of a valid certificate template). Activating exchange certificate enrollment in TARMAC: Enter the URL of your certificate authority under CA Server Import a configuration profile that contains the certificate placeholder Tip If enrollment fails, check whether the user has enrollment rights and the correct template name has been defined in the placeholder. 15

16 Enrolling certificates using SCEP TARMAC allows automated certificate enrollment during the device provisioning process. Certificates can be enrolled using an existing certificate authority or via TARMAC s own built-in CA. The simple certificate enrollment protocol (SCEP) allows certificate enroll- ment based on a user s unique identity and device. The certificate is then used to authenticate the provisioning profile and encrypt the.mobileconfig file. Setting up the initial SCEP profile Before provisioning an end-user s device, TARMAC sends an SCEP profile to query the device and return information to the certificate authority. As this step will require the user to accept and install this pre-enrollment profile, it is important to provide TARMAC with clear information to show the user. There are four required fields, organization, base ID, title and description. Attribute Organization Base ID Title Description Your company name What s needed A base ID which will be used to generate the IDs of the SCEP configuration profiles (e.g. com.yourcompanyname ) Title of the profile Any descriptive text which will be displayed in the configuration Using an existing external certificate authority TARMAC can connect to your existing certificate authority, such as a Micro- soft Windows 2008 Server running Certificate Services, to enroll user certificates. In order to set this up you will need to provide TARMAC with access to your SCEP-compatible certificate authority server. Giving TARMAC access to your external certificate authority: Select Use external certificate authority Set a root certificate from your CA Fill in the access details of your CA Press Save 16

17 Attribute What s needed SCEP URL SCEP Admin URL SCEP Service Account SCEP Service Account Password Enter the URL of the SCEP service here. For example, (Windows Server 2003 CA with MSCEP add-on or a Windows Server 2008 CA with the NDES role). This is the location of the SCEP service and will be used to enroll the certificate. Enter the URL of the SCEP service admin interface here. For example: ' for a Windows Server 2003 CA with the MSCEP Add-On or ' for a Windows Server 2008 CA with the NDES role. This will be used before enrollment to obtain an enrollment challenge password for each new SCEP request which is passed to the SCEP service above. This is the user name of the service account which has permission to obtain an enrollment challenge password from the SCEP admin interface. The service account requires Enroll permissions on the Certificate Template used for SCEP. The user principle name (UPN) needs to be entered in this box, for example: account1@example.com. Service account password which be used to gain access to the SCEP admin interface. Using TARMAC s built-in CA server If your infrastructure does not already have an existing certificate authority, TARMAC can enroll certificates by using its built-in CA. Enabling the built-in CA requires a root CA certificate and private key. The root CA can either be self-signed or signed by a third-party verification agency. Enabling TARMAC s built-in certificate authority: Select Use TARMAC as SCEP certificate authority Set a certificate and private key and click import Click Save Once initiated, all users will be enrolled using the simple certificate enroll- ment protocol. 17

18 Keeping track of users with Asset Management TARMAC keeps track of all activities, giving you an overview of provisioned devices in the field. TARMAC Asset Management allows quick access to user device information such as device type, ios version, which profile provisioned and the date of provisioning by utilizing information captured using the Simple Certificate Enrollment Protocol (SCEP). This tool is useful to see who has and who has not yet provisioned their device. Getting more information about user devices: Click on the user name in the Provisioned Users table All extra information will collapse under their username Tip To find out more information, such as a IMEI number or MAC address, take a look at TARMAC s Logs page. Here you will find the user s log in name and extra information such as UDID, device type and profile installed. Getting an overview of provisioned users The Asset Management page in TARMAC displays a list of TARMAC provisioned devices. There are two fields immediately available: user and last provisioning date. More information about the user, such as device type and ios version, can also be seen. 18

19 Customizing your user experience TARMAC allows admins to customize the end-user experience, so that users feel right at home. This section explains how. Adding a custom logo Custom logos, such as your company logo, give users the look and feel they expect from your company. Supported image file formats include: PNG, GIF and JPEG. For a seemless fit on the iphone, we recommend dimensions of 320x79px and a transparent background. Displaying header and footer text Header and footer text is displayed throughout the end-user interface and can be used to aid the user or provide additional information. Header Footer To add a custom logo to the end-user interface: Navigate to the Customize page on the TARMAC Server interface Click Upload Image Choose an image file Click Upload To add a header and footer to the end-user interface: Navigate to the Customize page of the TARMAC Server interface Type a header and a footer Click Save This text will now be shown on the end-user s device when they access the TARMAC service. Note At present, the same header and footer is shown on each page. 19

20 Informing users with the About Screen The TARMAC end-user interface is designed to be as straightforward as possible for the end-user. If the more inquisitive user wishes to learn more about TARMAC, they can tap the? on their device. Adding Links Links can help direct end-users to external pages if required. TARMAC includes a short introduction by default, which can be customized by the TARMAC admin at any time. Links To customize About Screen text: Navigate to the Customize page of the TARMAC Server interface Edit the text Click Save This text will now show when the user taps? on any of the end-user inferface pages. To add custom links to the end-user interface: Navigate to the Customize page on the TARMAC Server interface Give the Link a user-friendly name Enter the URL Click Save Tip TARMAC also allows you to link phone numbers here. In the Link field type tel: plus the number. This number will then be dialed if the end-user taps the link. Note The About Screen edit field accepts basic HTML tags such as <p> and <br />. 20

21 Troubleshooting Some hints and tips in case something goes wrong Accessing TARMAC Server when directory service is offline TARMAC admins are defined by selecting Admin next to the Group DN on the Services page of TARMAC server (see section: Connecting to your directory service). If your directory service is offline or has changed, these users will be unable to log in to the TARMAC Server admin interface. TARMAC includes a local login feature which allows a local user to log in at all times. This username is admin, the password should have been changed during initial TARMAC set up. To log in locally: Navigate to the TARMAC Server admin interface Choose Local Login from the domain pop-up menu Enter the username (admin) and password (default: admin) You can then manage the TARMAC Server and change directory service details if necessary. Locating TARMAC s server logs TARMAC s logs are easily accessible via the Logs page on the TARMAC Server web interface. You can export these logs giving you access to the following files: Production.log (an extensive general log) Access.log (Apache access log) Error.log (Apache error log) Alternatively you can access the production log directly within the TARMAC directory. This directory can be found at /Library/WebServer/Tarmac/log/ and can be opened using any plain text reader such as TextEdit or vi. Getting to know your directory service Knowing your way round your directory service is key to troubleshooting TARMAC. Correct directory service attributes need to be used not only for valid ios device configuration but also to connect TARMAC successfully to your directory service. You can troubleshoot issues related to your directory service by reviewing the TARMAC production.log and your LDAP server logs. These both contain data on successful and unsuccessful connection attempts along with a multitude of other useful information. Uninstalling TARMAC To uninstall TARMAC, simply delete the following files. Delete the following folder: /Library/WebServer/Tarmac/ Delete the following files: /etc/apache2/other/tarmac.conf (10.5, 10.6 Client) /etc/apache2/sites/tarmac.conf (10.5, 10.6 Server) Unload and delete the following LaunchDaemons: /Library/LaunchDaemons/com.equinux.tarmac.webconfig.plist /Library/LaunchDaemons/com.equinux.tarmac.purgetmp.plist /Library/LaunchDaemons/com.equinux.tarmac.rake.purgesessions.plist /Library/LaunchDaemons/com.equinux.tarmac.rake.purgescep.plist /Library/LaunchDaemons/com.equinux.tarmac.mongrel plist (>30083) 21

22 equinux AG and equinux USA, Inc equinux USA, Inc. All rights reserved. Under the copyright laws, this manual may not be copied, in whole or in part, without the written consent of equinux AG or equinux USA, Inc. Your rights to the software are governed by the accompanying software license agreement. The equinux logo is a trademark of equinux AG and equinux USA, Inc., registered in the U.S. and other countries. Other product and company names mentioned herein may be trademarks and/or registered trademarks of their respective companies. equinux shall have absolutely no liability for any direct or indirect, special or other consequential damages in connection with the use of the quick setup guide or any change to the router generally, including without limitation, any lost profits, business, or data, even if equinux has been advised of the possibility of such damages. Every effort has been made to ensure that the information in this manual is accurate. equinux is not responsible for printing or clerical errors. Manual revision 1.2 Created using Apple Pages. 22