Install and Configure Guide Version 4.3

Transcription

1 Install and Cnfigure Guide Versin 4.3

2 Cpyright Ntice This dcument cntains the cnfidential infrmatin and/r prprietary prperty f Ivanti, Inc. and its affiliates (referred t cllectively as Ivanti ), and may nt be disclsed r cpied withut prir written cnsent f Ivanti. Ivanti retains the right t make changes t this dcument r related prduct specificatins and descriptins, at any time, withut ntice. Ivanti makes n warranty fr the use f this dcument and assumes n respnsibility fr any errrs that can appear in the dcument nr des it make a cmmitment t update the infrmatin cntained herein. Fr the mst current prduct infrmatin, please visit Cpyright 2017, Ivanti. All rights reserved. Ivanti and its lgs are registered trademarks r trademarks f Ivanti, Inc. and its affiliates in the United States and/r ther cuntries. Other brands and names may be claimed as the prperty f thers. Page 2 f 120

3 Table f Cntents Install and Cnfigure Guide 1 Cpyright Ntice 2 Table f Cntents 3 The File Directr appliance 6 Appliance prerequisites 7 The appliance in an enterprise netwrk 7 Supprted perating systems and technlgies 8 LDAP Directry Service 8 DNS Settings 8 Checklist f Required Infrmatin 9 Install and start the File Directr appliance 10 Start the appliance and change yur passwrd 11 Appliance Netwrk Identity 13 Cnfigure the Appliance Netwrk Identity 13 Cnfigure the File Directr Appliance 14 Cnnect t the Admin Cnsle 14 Licensing 15 Enable HTTP access 17 Cnfigure DNS fr file server lcatin 18 Cnfigure the Active Directry Cnnectin 19 Create File Directr Admin users 21 Check the Appliance Status 22 Rebt the Appliance 23 Cnfigure Certificates fr the File Directr Appliance 24 Uplad an Existing PKCS #12 / PFX Certificate 24 Request and apply a certificate using the File Directr appliance 25 Back Up a PKCS #12 / PFX certificate 33 File Directr Versin 34 Backup and Restre 35 Backup an Appliance Cnfiguratin 35 Restre an Appliance Cnfiguratin 36 Apply a File Directr Patch 37 Map Pint Cnfiguratin 38 Clustering 40 Set up the Initial Cluster Nde 40 Cnfigure Additinal Cluster Ndes 43 Manage a Cluster in the Admin Cnsle 43 Kerbers Authenticatin 48 Prerequisites fr Kerbers Authenticatin 48 Cnfigure Kerbers in the File Directr Admin Cnsle 50 Kerbers Cnstrained Delegatin 53 Advanced Cnfiguratin 58 DSCP QS Cnfiguratin 58 Page 3 f 120

4 HTTP Access 58 TLS NTP 59 Lad Balancer Status 60 SMB Strage Authenticatin 60 SMTP Cnfiguratin 61 Syslg Server 62 Plicy 63 Glbal Plicy 63 Mbile Plicy 66 Map Pint Plicy 67 Users and Devices Plicy 70 Auditing 72 Cnfigure a Remte Syslg Server in File Directr 72 Set up a Remte Syslg Server 72 Reprt Lgs 74 Link Based Sharing 75 Preparatin 75 Admin Cnsle 75 Set Up the SMTP Server 76 Create Staging Map Pints 77 Enable Link Based Sharing n Map Pints 77 Set the Autmatic Expiratin fr Link Based Sharing 79 File Directr SMB3 Encryptin 80 Abut File Directr SMB3 Encryptin 80 Rll Out File Directr 81 Install Trusted Certificates n Client Devices 81 Install Rt Certificates n Windws 82 Install Rt Certificates n Mac 83 Install Rt Certificates n ios 83 File Directr SAN Certificates 85 DNS and SAN Certificates 85 General Certificate 86 SAN Certificates in the File Directr Appliance 92 File Directr Cmmand Line Interface 93 Access the CLI using the Virtual Terminal 93 Access the CLI using Secure Shell 94 Cmmands 95 OneDrive cnnectr fr Hme map pints 96 Prerequisites 97 Step 1 - Cnfigure Azure AD 98 Step 2 - Update the Azure AD manifest 104 Step 3 - Update the Hme map pint surce 106 Step 1 - Cnfigure Azure AD Classic 107 Step 2 - Generate a manifest fr Azure AD 116 Page 4 f 120

5 Step 3 - Edit the manifest and uplad t Azure AD Classic 117 Step 4 - Update the Hme map pint surce 120 Page 5 f 120

6 The File Directr appliance The File Directr virtual appliance is a data brker that frms a cnnectin frm yur existing file stre, thrugh the enterprise firewall, t File Directr clients n end-user wrkstatins and mbile devices. After cnfiguratin, the brker allws the File Directr client applicatin t make encrypted cnnectins ver public netwrks r the Internet t files inside the rganizatin. The appliance cnnects t an Active Directry using Lightweight Directry Access Prtcl (LDAP) and reads the lcatin f hme flders fr all users. When a user cnnects a File Directr client t the appliance, it prvides a channel t securely synchrnize the user s netwrk hme flder t their device. The appliance is simple t cnfigure and can easily be backed up, s it can be recreated quickly. Cnfigure map pints and define related plicies, using the appliance t manage behavir fr specific rganizatinal units, users, and grups f users. Page 6 f 120

7 Appliance prerequisites The appliance in an enterprise netwrk We recmmend that yu install the File Directr appliance n a hypervisr r virtual machine server in the enterprise demilitarized zne (DMZ). Frm there the appliance des the fllwing: Prvides secure cmmunicatins using Secure Scket Layer (SSL) encryptin. Uses yur existing Lightweight Directry Access Prtcl (LDAP) t cmmunicate with the Active Directry and cnfigure users, grups, and hme flders. Lks up the lcatin f the file servers using a Dmain Name System (DNS) server. Cnnects t existing file strage using Server Message Blck (SMB) prtcl (als knwn as Cmmn Internet File System, CIFS). External firewall requirements Fr the external firewall, cnfigure the fllwing IP prts: TCP Clients cnnect t the File Directr appliance n SSL n prt 443 s that they can synchrnize files. It is recmmended that yu make this the nly external prt mapped t the appliance. Internal firewall requirements Fr the internal firewall, cnfigure the fllwing IP prts: TCP 25 - Fr SMTP t the internal system TCP Active Directry service LDAP n TCP 389 TCP File stre SMB/CIFS n TCP 445 TCP Fr internal client cnnectins TCP The web administratin interface is available ver SSL n http prt 8443 TCP 80 - May be required if cnnecting t internal nn-ssl WebDAV resurces UDP 53 - Dmain Name System (DNS) n UDP 53 Additinal Prts The fllwing prts can be enabled if required: TCP Open this prt if yu require the Ivanti Supprt service. TCP Open this prt if yu are require the Netwrk Lad Balancing health check. TCP/UDP 88 - If the File Directr server is secured in a DMZ, yu must pen prt 88 n the firewall fr Kerbers Authenticatin t wrk. Page 7 f 120

8 Supprted perating systems and technlgies Fr details f supprted perating systems see the Maintained Platfrms Matrix n ivanti.cm. LDAP Directry Service The appliance needs read-nly access t a Micrsft Active Directry (AD) service thrugh a read-nly user accunt. Yu can change the hme flder field that the appliance uses in the AD recrds. By default, it uses hmedirectry. If yu want t use the RDP r Terminal Services hme flder, yu can specify CtxWfHmeDir instead. The hme flder feature can be disabled if required. DNS Settings File Directr requires internal DNS settings and a public DNS recrd. T synchrnize user hme flders, the appliance needs t crrectly reslve the address f the file servers where the flders are stred. The appliance uses DNS reslutin t lcate the crrect file server. The appliance DNS settings must specify the DNS servers within the Active Directry and, in rder t reslve the shrt-frm file-server addresses used in user AD recrds, the dmain names it shuld search. T access the File Directr service n the Internet, yu must set up a public DNS recrd using the File Directr server name. Yu can then use this public DNS name t generate the Certificate Signing Request (CSR) and apply fr a publicly trusted SSL certificate. A Reverse DNS (PTR) recrd is required in DNS fr each file server that will be accessed by File Directr. This can be validated frm a Windws endpint by typing ping a (where is the file server IP v4 address). If reverse DNS is prperly cnfigured, it shuld return the FQDN, fr example. server.mycmpany.cm. If it returns just the IP address, r the single-label hst name, fr example, server, then it is likely that reverse DNS is nt cnfigured crrectly. Any changes t DNS cnfiguratin may require a rebt f the File Directr appliance t expedite the changes t it's DNS cache. Page 8 f 120

9 Checklist f Required Infrmatin T cmplete the installatin and cnfiguratin f the File Directr appliance yu need the fllwing infrmatin. Hypervisr Hypervisr Details Hyper-V r VMware ESX File Directr Netwrk File Directr Appliance Name Appliance IP address Subnet mask Gateway Details <appliance name> <IP address> <IP mask> <gateway IP> DNS DNS servers DNS search dmains Details <IP addresses> <dmain names> Active Directry Dmain cntrllers Details <IP addresses> LDAP prt <prt number> (default 389) LDAP bind accunt LDAP bind passwrd <userid@dmain.cm> <passwrd> Page 9 f 120

10 Install and start the File Directr appliance 1. Lg int Ivanti Supprt and dwnlad the required File Directr appliance sftware. Appliance sftware is available fr ESXi VMWARE 5.5 nward and Hyper-V 2012 R2. 2. Extract the appliance image files and template. 3. In the hypervisr r virtual machine manager, imprt the template. 4. The template creates the required appliance envirnment. 5. Start the appliance. Examples: Install the appliance n Micrsft Hyper-V 1. Lg in t a Windws Server desktp. 2. Dwnlad and extract the File Directr Hyper-V zip file t a suitable strage lcatin. Hyper-V uses the virtual hard disks frm the lcatin yu chse. 3. Start Micrsft Hyper-V Manager. 4. Select the Imprt Virtual Machine actin. If yu are using System Center, select New Virtual Machine t imprt the template. 5. Brwse t the flder that yu extracted. The Imprt Virtual Machine wizard requires the flder that cntains the cnfig.xml file. 6. Select the ptin t cpy the virtual machine and create a new unique ID. 7. Click Imprt. Install the appliance n ESX using vsphere client When deplying t ESX, the OVT template defaults netwrking t "Hst Only" and must be manually assigned the crrect netwrk befre using the appliance. 1. Dwnlad and extract the File Directr ESX zip n yur lcal machine. 2. Start the VMware vsphere Client and lg in t the hst f vcenter Server. 3. Frm the menu, select File > Deply OVF Template and fllw the wizard. Page 10 f 120

11 Start the appliance and change yur passwrd During deplyment, cnnectivity can be lst when the appliance is migrated t anther nde, fr example fllwing a rebt. Netwrk cnfiguratins will nt be applied because dynamic MAC addresses assigned in Hyper-V are lst when the nde is mved. T slve this issue, cnfigure a static MAC address in Hyper-V prir t bting the appliance fr the first time. Fr further infrmatin, see Micrsft KB Start r pwer n the virtual machine and wait fr the appliance t bt. 2. If required, change the input lcale. Press F9 t cycle thrugh the available ptins. This sets the character mapping fr yur keybard. The default lcale fr keybard mapping is US English. If yu set a passwrd which cntains characters with different mapping in yur lcale, it culd affect yur lgin. Fr example, if yur passwrd is set t P@sswrd thrugh the cnsle using a UK English keybard, it will be recrded as P"sswrd Therefre, if yu lg in frm the web client r an SSH client which supprts character translatin, the wrng passwrd will be supplied and lgin will fail. 3. Press F2. The passwrd prmpt displays. 4. Enter the default passwrd: AppSense The Main Menu displays. The passwrd must be changed befre netwrking can be cnfigured. D nt frget the appliance passwrd. It cannt be recvered r reset. Page 11 f 120

12 5. Select Change Passwrd and press Enter. The passwrd prmpt displays. 6. Type the default passwrd, AppSense, and press Enter. 7. Type the new passwrd and press Enter. 8. Type the new passwrd again t verify it and press Enter. The Main Menu displays with the Cnfigure netwrking ptin nw available. Page 12 f 120

13 Appliance Netwrk Identity Cnfigure the Appliance Netwrk Identity 1. After the appliance has bted, click in the cnsle and press F2. The Passwrd prmpt displays. 2. Type the passwrd and press Enter. The main menu displays. 3. Use the arrw keys t select Cnfigure Netwrking and press Enter. The Cnfigure netwrking bx displays. 4. Enter a hst name. When yu set a hst name, the appliance uses it t generate a temprary self-signed SSL certificate. 5. Enter an IP address, subnet mask and a default gateway. The default gateway is the IP address f the internal gateway t services that include, fr example, the DNS server, the Active Directry service, the server and the file stre. 6. Press F10 t save the netwrk settings. 7. Frm the main menu, select Rebt and press Enter. The server rebts then displays the hst name and IP address. Page 13 f 120

14 Cnfigure the File Directr Appliance The fllwing prcesses shuld be cmpleted in rder: 1. Cnnect t the Admin Cnsle 2. Uplad a License File 3. Enable HTTP access 4. Cnfigure DNS fr file server lcatin 5. Cnfigure the Active Directry Cnnectin 6. Create File Directr Admin users 7. Check the Appliance Status 8. Rebt the Appliance 9. Cnfigure Certificates fr the File Directr Appliance Cnnect t the Admin Cnsle By default, the File Directr Admin Cnsle listens fr secure scket layer (SSL) cnnectins n TCP prt Initially yu can use the unqualified server name r IP address. If yu want t use the server name, yu can add the server t yur enterprise DNS r add the IP address and server name t the hsts file n yur lcal cmputer. 1. In a web brwser. cnnect t the File Directr Admin Cnsle by typing in the address bar, where <server> represents the fully qualified dmain name (FQDN) f the File Directr appliance, fr example filedirectr.ivanti.cm. Press Enter. When yu cnfigure the appliance netwrk settings, a temprary, self-signed, SSL certificate is generated that uses the unqualified server name specified. Yur web brwser will indicate that there is a prblem with the website s security certificate because it is self-signed and nt issued by a trusted certificatin authrity (CA). Yu can trust this temprary certificate initially and cntinue t the website. Replace this certificate with a trusted certificate cntaining the server s fully qualified name. The brwser cnnects t the File Directr Admin Cnsle and displays the lgin screen. Page 14 f 120

15 2. Lg in t the cnsle: Username: appliance Passwrd: The passwrd yu cnfigured when yu started the appliance. By default MS Internet Explrer 9 cnnects in cmpatibility mde fr intranet sites, that is, sites that d nt use the FQDN. Yu must view the Admin Cnsle with IE9 cmpatibility view disabled. Press F12 t change the Brwser Mde. Licensing Befre yu can set up and cnfigure yur appliance, yu must uplad a valid license file. License files are prvided by Ivanti - if yu have nt received yurs, cntact ur supprt team. Until the license has been upladed, the Cnfiguratin and Plicy tabs are nt accessible. When yu view yur license details, the license status is License Expired. Page 15 f 120

16 Uplad a License File 1. Select Hme > License. If this is the first time yu have accessed the appliance r yur current license is nt valid, the License Status shws License Expired. 2. Click Chse file, navigate t yur license file and click Uplad License File. If yur license is valid, the license status is updated and details abut yur license are displayed. Once installed, yu can access all areas f the appliance enabling yu t cnfigure File Directr. Page 16 f 120

17 Enable HTTP access Select Cnfiguratin > Advanced. In the HTTP Access area f the Advanced ptins, cnfigure the required setting and click Update t apply. This ptin shuld nly be used t enable cnnectin by HTTP in a lad balanced envirnment r with an SSL fflad appliance. Page 17 f 120

18 Cnfigure DNS fr file server lcatin T synchrnize user hme flders the appliance needs t crrectly address the file servers where the flders are stred. The appliance uses DNS t reslve the file server IP address. The appliance DNS settings must specify the DNS servers within the Active Directry (AD) and the dmain names it shuld search in rder t reslve the shrt-frm file-server addresses used in user AD recrds. 1. Select Cnfiguratin > DNS and click Edit. 2. Cmplete the fllwing DNS Settings: DNS Server IP address. DNS Search Dmain. 3. T add further DNS server details, use the + buttns. 4. Click Save t cmmit yur DNS settings. Page 18 f 120

19 Cnfigure the Active Directry Cnnectin The appliance needs read-nly access t a Micrsft Active Directry (AD) service thrugh a read-nly user accunt. The appliance cmmunicates with the Active Directry using Lightweight Directry Access Prtcl (LDAP), The LDAP prt is cnfigurable - the default is prt 389. T use a name fr the directry server yu must set the DNS IP address and search dmains first. 1. Select Cnfiguratin > Directry Services and click Add New AD. 2. Cmplete the fllwing Active Directry settings: Name - A descriptive name fr the server. This is a free text field used t easily identify servers. Server - The name r IP address f the LDAP server. Prt - The prt fr yur AD. The default fr LDAP cmmunicatin is 389. Hme Directry Field - Select which field t use fr active directry. The default setting is hmedirectry but this can be changed t use a different AD attribute r disabled if required. This field crrespnds t the active directry Attribute Editr prperties. Yu can use any f the attributes defined in the dmain cntrller and add a value. Changing the attribute in the admin cnsle changes the value read n the DC. Bind User - A username with read permissins t the required recrds. This user accunt is used by the appliance t synchrnize with the directry. Frmat - username@dmain r dmain\user. Bind Passwrd - The passwrd fr the bind user. Enable SSL - Adds further encryptin between the File Directr and LDAP servers. When this ptin is applied, the prt setting is autmatically updated t use prt Click Save t cmmit yur Active Directry settings. 4. Rebt the appliance. Page 19 f 120

20 5. Fllwing the appliance restart, select Hme > Status t verify that the WebServer, Appliance Services, File Directr Server and Active Directry have been cnfigured. Set Hme map pint surce Select where the Hme map pint is derived frm: Nne Active Directry OneDrive Fr further infrmatin abut using OneDrive as the hme map pint, see OneDrive cnnectr fr Hme map pints. Page 20 f 120

21 Create File Directr Admin users After cnnecting the Active Directry, t cntinue cnfiguring the appliance, it is recmmended that yu create a File Directr admin user in the cnsle. File Directr admin users lg in t the cnsle using their dmain credentials and can synchrnize File Directr users with the Active Directry withut rebting the appliance. This is an ptinal prcess fr delegated admins because all appliance actins can be perfrmed using the appliance lgin. 1. Select Cnfiguratin > Admin Users and click Add User. The Admin Users search field is displayed. 2. Enter a username r part f the username yu want t add. 3. If required, click Brwse t target a specific dmain. 4. Click Search. Any users matching the search criteria are displayed. 5. Select a user and click OK. If yu are cnfiguring the appliance fr the first time, yu must lg ut as the appliance user and lg in again as an admin user befre cntinuing. 6. Click Lg ut. Page 21 f 120

22 7. Lg in as the admin user. The username frmat is dmain\username. The UPN style lgin is als supprted, fr example, If yu are cnfiguring the appliance fr the first time, yu must lg ut as the appliance user and lg in again as an admin user befre cntinuing. Check the Appliance Status Fllwing a rebt, the Status page is autmatically displayed. This shws yu the areas f the appliance which are cnfigured and thse areas requiring attentin. Select Hme > Status t view the Appliance status. Page 22 f 120

23 Rebt the Appliance When yu are cnfiguring the appliance r updating its settings, a rebt is required fr the settings t take effect. T rebt, select Hme > Status and click Rebt. Page 23 f 120

24 Cnfigure Certificates fr the File Directr Appliance If yu have an existing certificate - Uplad an Existing PKCS #12 / PFX Certificate If yu need t request a new certificate frm a Certificatin Authrity - Request and Apply a Certificate Using the Admin Cnsle Uplad an Existing PKCS #12 / PFX Certificate T use an existing certificate fr File Directr, it must fulfill the fllwing criteria: The certificate s CN must match the URL fr File Directr (unless a wildcard is used) The certificate must be valid fr the server authrity The private key must be available t exprt in PFX/P12 The certificate must cntain the full chain The certificate must have a valid date If yur certificate cnfrms t all f the abve, it can be upladed t the appliance. 1. Select Cnfiguratin > SSL Certificate. 2. In the If yu have an existing certificate yu'd like t use area, click Chse File. 3. Brwse t the lcatin f yur certificate. 4. If the certificate was created with an encryptin passwrd, type it int the field prvided. 5. Click Uplad Certificate. Page 24 f 120

25 Request and apply a certificate using the File Directr appliance The File Directr Admin Cnsle allws creates a Certificate Signing Request (CSR) fr yur appliance. Once the CSR is generated, a trusted persn within yur rganizatin can apply fr a public certificate frm ne f the public Certificatin Authrities (CA). A trusted persn is nrmally a directr r smene publicly acknwledged t represent the rganizatin. The prcess is split int fur sectins: Create a CSR frm the File Directr appliance Request a certificate fr yur appliance Prepare yur certificates Apply a certificate t the appliance Create a CSR frm the File Directr appliance 1. Select Cnfiguratin > SSL Certificate. 2. Expand the T btain a certificate frm a Certificate Authrity sectin and cmplete the fllwing fields: Hst Name - The fully-qualified dmain name f the server where the certificate will be installed. Wildcard dmains can be specified with a * prefix. The hst name des nt have t match the appliance hst name set in the appliance cnsle. Hwever, the hst name yu prvide must match the FQDN n yur DNS A recrds. Fr further infrmatin abut wildcards and SAN attributed certificates, see File Directr SAN Certificates. Cmpany/Organizatin Name - The name f the rganizatin requesting the certificate. Organizatinal Unit - The divisin within the rganizatin. Fr example, Engineering r Human Resurces, r if applicable, the database administratr name fr the rganizatin. City - The full name f the city where the rganizatin is lcated. D nt use cdes r abbreviatins. State/Prvince - The full name f the state r prvince where the rganizatin is lcated. D nt use abbreviatins r cdes. Cuntry - The tw digit ISO cuntry cde where the rganizatin is lcated. Fr example, US, FR. - The address that will be a pint f cntact fr the certificate request. Page 25 f 120

26 3. Click Create CSR. A text bx displays the certificate request data. Every time yu use the Generate New CSR ptin, the unique server key is changed, making any previus certificates generated fr this appliance invalid. 4. Cpy the entire text including the lines cntaining BEGIN CERTIFICATE REQUEST and END CERTIFICATE REQUEST and save it as a TXT file. Using a Private r Enterprise Certificatin Authrity We recmmend that yu use a public Certificatin Authrity (CA). Hwever, yur rganizatin may use an Enterprise CA and a private CA fr prf f cncept (PC) tests. The fllwing prcedure describes generating certificates using Micrsft Enterprise Certificate Authrity n Windws Server. Other Enterprise CA slutins are available. If yu are nt using a public CA yu need t install the rt certificate fr yur private CA n the appliance befre installing any chain certificates and the appliance certificate. Yu als need t prvisin the rt certificate n every client device that uses the File Directr client. Request a Certificate Using a Micrsft Private CA 1. In a web brwser, navigate t: CA>/certsrv 2. Click Request a Certificate. 3. Click Advanced certificate request. 4. Click Submit a certificate request by using a base-64-encded CMC r PKCS #10 file, r Submit a renewal request by using a base-64-encded PKCS #7 file. 5. Paste the CSR yu generated int the Saved Request field. Page 26 f 120

27 6. Frm the Certificate Template list, select Web Server and click Submit. 7. Select Base 64 encded, click Dwnlad certificate chain and save. 8. Once the dwnlad is cmplete, install the certificates and fllw the prcesses detailed in: 1. Prepare yur certificates 2. Apply a certificate t the File Directr appliance If the private CA is installed with default settings, it may sign the resulting issued certificates with SHA1. This generates brwser warnings when accessed by certain brwsers. It's recmmended t use SHA256 r higher t mitigate this. Prepare yur certificates Yur certificate will be a web certificate and shuld include intermediate and rt certificates. Once it is installed, yu can access yur File Directr certificate frm Certificate Manager. Befre yu can apply yur certificates t the File Directr appliance, they must be exprted. Page 27 f 120

28 Exprt certificates 1. Open Certificate Manager. 2. Right click n the rt File Directr certificate and select Open frm the shrt-cut menu. 3. Select the Details tab and click Cpy t File. 4. The Certificate Exprt Wizard pens, click Next. Page 28 f 120

29 5. Select Base-64 encded X.509 (.CER) and click Next. 6. Brwse t where yu want t save the certificate, give the rt certificate a name and click Next. 7. Review yur settings and click Finish t start the exprt. Yu are ntified when the certificate has been successfully exprted. 8. Repeat this prcess fr yur Standard certificate and any Intermediate certificates. Page 29 f 120

30 Apply a certificate t the appliance This sectin describes hw t apply a certificate fr bth Private and Public Certificatin Authrity (CA). Mst majr public CA rt certificates are included in the File Directr appliance and in client perating systems fr the cmputers and devices that supprt the File Directr client. Yu must have the rt certificate frm yur Private CA. If yur CA is a subrdinate CA yu will require its certificate (intermediate/chain) and any ther subrdinate CA certificates and the rt certificate. File Directr uses 2048-bit RSA certificates in Base64 PEM frmat, which must be installed in the fllwing in rder: 1. Rt Certificate 2. Chain 1 Certificate 3. Chain 2 Certificate 4. Server Certificate Befre cntinuing with this prcess, we recmmend that yu take a hypervisr snapsht t back up the pending CSR state prir t any further cnfiguratin. Page 30 f 120

31 Apply certificates t File Directr T restart the certificate uplad prcess, click Reset Certificates. Any entered data is deleted withut remving the pending Certificate Signing Request (CSR). 1. Lcate the CER file fr the rt certificate. 2. Open the certificate in a text editr, such as Ntepad. 3. Cpy the text including the BEGIN CERTIFICATE and END CERTIFICATE statements. 4. In the File Directr Admin Cnsle, select Cnfiguratin > SSL Certificate. 5. In the Set New Certificate area f the File Directr appliance, paste the certificate details int the text bx. 6. Select Rt Certificate and click Uplad Certificate. A message will cnfirm that the certificate has been installed. Page 31 f 120

32 7. Add yur Chain Certificate - select Chain Certificate/Bundle and click Uplad Certificate. If yur chain is a bundle, yu must add each chain certificate (e.g. number 3 then number 3) t the text bx in reverse rder. In the example belw, Chain 2 has been added fllwed by Chain 1. A message cnfirms that the certificate has been installed. 8. Add yur Server Certificate - select Server Certificate and click Uplad Certificate. When all certificates have successfully installed, an infrmatin message infrms yu that the certificate has been enrlled. 9. Rebt the appliance t apply the certificates t the web service. T test the certificate, clse and repen the brwser and cnnect t the Admin Cnsle using the fully qualified server name specified in the certificate. If the certificates are installed crrectly, the brwser cnnects securely withut any security warnings. We recmmend that yu back up the File Directr appliance cnfiguratin snapsht. Page 32 f 120

33 Back Up a PKCS #12 / PFX certificate A PKCS #12 / PFX certificate cntaining yur encrypted SSL certificate and yur private keys can be dwnladed frm yur File Directr appliance. Yu can use this when cnfiguring new installatins f the appliance withut having t repeat the prcess f cnfiguring an SSL certificate. 1. Click the Cnfiguratin tab and click SSL Certificate. 2. Lcate the T back up the existing SSL certificate chain area. 3. If required, enter an encryptin passwrd. Encryptin passwrds are ptinal and add an extra level f security. If yu set a passwrd during dwnlad, it must be entered t successfully uplad yur certificate. Passwrds are nn-recverable, s it is imprtant that yu remember the passwrd r stre it in a safe lcatin. 4. Click Dwnlad P12 and save the certificate. Page 33 f 120

34 File Directr Versin Check which versin f File Directr yu are running and uplad new patches f the sftware. Select Hme > Versin. The left-hand side f the versin view shws the versin numbers f the cmpnents that make up the appliance. Page 34 f 120

35 Backup and Restre Yu can back up yur appliance cnfiguratin infrmatin frm within the File Directr appliance. The whle persnality f the appliance and the SSL certificates are backed up t create a snapsht that can be used t cnfigure ne r mre appliances with the same settings. The backup and restre des nt include the database lcatin because that is a clustered setting. Fr example, if yu are cnnected t an external database and yu perfrm a backup, it backs up the settings frm there. If yu restre a snapsht t an appliance pinting t its internal database, the cnfiguratin is restred t that. This is a useful mechanism t mve frm a single appliance a clustered appliance, r t restre a cnfiguratin t a spare database, fr example. Backup an Appliance Cnfiguratin 1. Select Hme > Backup & Restre. 2. In the Backup Appliance Cnfiguratin sectin f the page, enter an Encryptin Passwrd in the field prvided. This is an ptinal level f security that requires the same passwrd t be entered when restring the cnfiguratin. 3. If set, it is imprtant that yu d nt lse r frget an encryptin passwrd because they are nn-recverable and the backup will becme unusable. 4. In the Backup Appliance Cnfiguratin sectin f the page, click Dwnlad Snapsht. The cnfiguratin snapsht is saved t yur default dwnlad lcatin. Page 35 f 120

36 Restre an Appliance Cnfiguratin 1. Select Hme > Backup & Restre. 2. Click Brwse and lcate the required cnfiguratin snapsht. 3. If required, enter the encryptin passwrd, defined when the snapsht was created. If yu did nt set a passwrd, leave the field blank. 4. Click Restre Settings. 5. Rebt the appliance. The settings frm the snapsht are applied t the appliance. Page 36 f 120

37 Apply a File Directr Patch File Directr sftware can be updated by applying a patch, supplied by Ivanti, which can be upladed thrugh yur appliance. If clustering is enabled and a patch server has been set, patches are applied in the Cluster tab. 1. Lg int Ivanti Supprt and navigate t the File Directr sftware page. 2. Click the link fr the required sftware. 3. Lg in t the File Directr Appliance. 4. Select Hme > Versin. In the Status sectin, details f the current patch versin are displayed. 5. Click Chse File and navigate t a File Directr patch file. The screen updates t list the cmpnents that the patch is updating and their versin numbers. Click a patch t view further details. 6. Select the required patch and click Deply Update file. T cmplete the patch install, the server autmatically rebts. Cnnected devices are unable t cmmunicate with the server fr few minutes whilst the rebt cmpletes. Page 37 f 120

38 Map Pint Cnfiguratin Map pints allw usage plicy sets t be targeted t different users based n the server they cnnect t and their OU membership. Yu can create Map Pints fr whle OUs, user grups, and individual users t create a usage plicy that meets their requirements while adhering t yur security plicy. There are tw parts t setting a Map Pint: Cnnectin String - Define the File Directr server fr the Map Pint and set the dwnlad plicy. Plicy - Define usage plicies and platfrm access fr the Map Pint. 1. Select Cnfiguratin > Map Pints and click Add New. Or click Edit t update an existing Map Pint. 2. Enter a name fr yur map pint. This can be any value t easily identify the map pint. The name "Hme" is reserved fr use by Active Directry hme drive settings and shuld nt be set as the name f a webdav r SMB map pint. D nt name a Map Pint Share. 3. Enter a cnnectin string. It is recmmended that file servers are entered as fully qualified dmain names (FQDN), particularly if yu are using Kerbers authenticatin. SMB cnnectin strings must begin with \\ r smb:// WebDav cnnectin strings must begin with r T designate a user directry, insert %UserName% int the share path, fr example, %UserName% is case sensitive. Page 38 f 120

39 4. Select the required sync mde: Manual: Only dwnlad files as requested by the user - Files are dwnladed t a user device as they are pened. Autmatic: Dwnlad/sync all files fr this map pint - All File Directr files are dwnladed lcally when the user lgs in t File Directr and changed, and new lcal files are autmatically synchrnized with the server. These settings apply t Windws and Mac clients. Mbile devices uplad and dwnlad n demand rather than sync. Fr Windws clients, electives can be applied that prevent certain files being autmatically dwnladed. Fr example, certain file types r files abve a certain size can be prevented frm being autmatically dwnladed. See File Sync Cntrls. 5. Click Save. 6. T set a plicy fr the map pint, click the Set plicy fr this map pint. Page 39 f 120

40 Clustering File Directr supprts clustered infrastructures and failver prcessing and is fully scalable t meet the varying demands f rganizatins. If an appliance is taken ffline, the File Directr service is maintained by having users lg n in the backgrund t an alternate appliance in the cluster, accrding t the current netwrk lad balancing methd. Althugh users are mmentarily discnnected, they are autmatically returned t the service withut lsing their sessin state. Any transactins that have nt been cmmitted t the database are rlled back. Nte When setting up the lad balancer, ensure that sessin persistence is setup fr the File Directr cluster. It is recmmended that the ckie insert methd is used. Set up the Initial Cluster Nde Prerequisites Befre cnfiguring clustering: Ensure all appliances that will be in yur cluster are f the same versin. Create a new blank database in the default SQL instance (SQL Server 2005, 2008, 2008R2 and 2012 are supprted). Create a new SQL accunt. It is recmmended that the SQL Service accunt has DBO privileges. Cnfigure the switching envirnment t allw Bradcast traffic. Ensure all cluster ndes that are t share cmmn settings are available n the same netwrk t allw lw frequency bradcast discvery between the cluster peers. Take a backup f the current appliance cnfiguratin. Enable Clustering n the First File Directr Appliance 1. Bt up the appliance fr the first cluster nde. 2. Press F2 and lgn. 3. Select Cluster Cnfiguratin and press Enter. 4. Enter a cluster name. 5. Enter a prt number. The default prt is but yu can use any prt frm t Press F10 t save the cluster cnfiguratin. T disable clustering, use the prcess abve, leaving the Cluster Name field blank. Page 40 f 120

41 Cnfigure an External Micrsft SQL Database 1. Lg n t the Admin Cnsle fr the first cluster nde. 2. Select Cluster > Database. 3. Select Micrsft SQL Server. 4. Cmplete the fllwing fields t cnfigure yur database: Database Hst: DNS name r IP Address f the SQL server Database Prt: 1433 Database User: SQL accunt created during initial SQL setup. Database Passwrd: Passwrd set fr the SQL accunt created during initial SQL setup. Database Name: Name f the blank database created during initial SQL setup 5. Click Save t cnfigure the database. A message cnfirms the setup has been successful. 6. Restre the backup f the appliance cnfiguratin yu tk prir t cnfiguring clustering. 7. Select Hme > Status t ensure that appliance is fully set up. Cnfigure the Appliance n the Initial Cluster Nde The fllwing appliance settings frm the initial cluster nde are shared between appliances in the cluster: DNS server settings Certificate settings Database cnfiguratin settings NTP server settings Web client enabled state Page 41 f 120

42 DSCP setting Tggle Web Client setting HTTP Access setting Syslg settings Kerbers settings License details It is recmmend that nce yu have enabled clustering and set up the database n the first nde, yu cnfigure the appliance settings r restre a backup with the required settings cnfigured. When further ndes are added t the cluster, the appliance settings are autmatically applied. Applicatin settings, such as Map Pints, are nt autmatically mved t the SQL server when database settings are updated. A backup f the required settings must be restred t seed these settings in the database when switching frm a cnfigured lcal setup t a clustered ne. Check the Lad Balancer Status 1. Select Cnfiguratin > Advanced. 2. Lcate the Lad Balancer Status sectin. 3. Click the Status URL link t check the health status f a server in a lad balanced envirnment. A status page is displayed shwing ne f the fllwing: Success - The server is functining crrectly within the lad balancer pl. Failure - The server is either ffline r is nt functining crrectly within the lad balancer pl. Page 42 f 120

43 Cnfigure Additinal Cluster Ndes Once yu have successfully cnfigured the initial cluster nde, cnfigure all the ndes yu want t be part f the cluster. 1. Bt up the appliance fr the nde yu are adding t the cluster. 2. Lg in t the Admin Cnsle fr that nde and Uplad a License File. 3. On the appliance text cnsle, press F2 and lgn. 4. Select Cluster Cnfiguratin and press Enter. 5. Enter the name f the cluster. This must be the name yu entered when setting up the initial cluster nde. 6. If yu are nt using the standard prt number (49152), enter the prt number yu are using fr yur cluster. 7. Press F10 t save the cluster cnfiguratin. 8. If yu have already perfrmed cnfiguratin via ther ndes f the cluster, the settings are autmatically updated t any new ndes in the cluster and thereafter shuld autmatically remain synchrnized thrugh updates when any setting changes. T cnfirm clustering is perating crrectly, lgn t the web admin fr the nde and make a simple change, such as changing the DNS settings. When yu lg int anther nde in the cluster, the same change shuld be apparent. 9. Repeat this prcess fr every new nde that yu add t the cluster. Manage a Cluster in the Admin Cnsle If clustering is enabled n the appliance, yu can check the status f the ndes in yur cluster, apply a patch t yur cluster, update, and shutdwn ndes. Patch Server By nminating ne f the ndes in a cluster as the Patch Server, yu can apply patches t all ndes in the cluster. Any active nde in a cluster can be used as the patch server. T make a nde the patch server, lg int the web admin cnsle fr a nde that is nt currently the patch server, select Cluster > Status and click Prmte t Patch Server. The current nde is nw identified as the patch server. Page 43 f 120

44 Status The status shws the name f the cluster, the File Directr server versin, and which nde in the cluster is currently the patch server. If a patch server has nt been set, these details are nt displayed. Page 44 f 120

45 Cluster Status The state f each nde in the cluster is dented by the icn displayed in the Cluster Status clumn. Icn Meaning Active The nde is nline and using the crrect File Directr server versin, determined fr the cluster by the versin applied t the patch server. Warning This can signify ne f the fllwing states: A patch server has nt been set. Set ne f the ndes as the patch server. The nde's File Directr server versin is different t that f the patch server. Reapply the current patch t the cluster. This updates nly thse ndes that are nt at the File Directr server versin applied t the patch server. Ndes already at the crrect versin are unaffected by the update. The nde requires a rebt. Click the Rebt buttn fr the nde. Cmpnent infrmatin cannt be retrieved. Inactive The nde is ffline. Hst Displays the name f each nde in the cluster, identifies which nde is the patch server, and which nde yu are currently accessing thrugh the web admin cnsle. Click n a name t see details f the current cmpnent versins f that nde and its patching histry. The name f the current nde and the patch server are anntated apprpriately. IP Address The IP address f each nde in the cluster. Actin In the web admin cnsle fr any nde in the cluster, use the buttns in the Actins clumn t rebt r shutdwn any ther nde in the cluster. If a nde is inactive, it can be remved frm the list using the crrespnding buttn. If a remved nde restarts, it will autmatically re-display in the list. Page 45 f 120

46 Update The Update screen displays cluster name, File Directr Server Versin and which nde is the current patch server. All patches that have previusly been upladed are listed in the Updates area. Apply a Patch t a Cluster This prcess explains hw t apply a patch t all ndes in a cluster. T apply a patch when clustering has nt been enabled, see Apply a File Directr Patch. In mst cases, a database schema upgrade is required. This is perfrmed by the first nde t be upgraded. Frm this pint n, all lder ndes are blcked frm cmmunicating with the database, which causes their health mnitrs t fail and be marked as ffline by the Netwrk Lad Balancing (NLB). Client device sessin tkens (lgn states) are held in appliance memry. When the cluster is patched, these are lst, which means that the clients need t reauthenticate n their next cnnectin with the appliance (generally within 30 secnds unless ntificatin checks are disabled). Because all this traffic will be directed at the first single updated appliance that shws as nline t the NLB, the resultant traffic culd saturate this appliance and result in an unbalanced cnfiguratin. Fr this reasn, we recmmend that appliances are frced ffline via the maintenance mde flag (r manually at the NLB) and bught back nline tgether fllwing the patching prcess. Page 46 f 120

47 Yu can apply a patch t a cluster using any ndes as lng as ne f the ndes in the cluster is the patch server. T make the current nde the patch server, select Cluster > Status and click Prmte t Patch Server. Lg in t the web admin cnsle n any nde in the cluster. 1. Select Cluster > Update. 2. In the Status sectin, details f the current patch versin are displayed. 3. Click Chse File and navigate t a File Directr patch file. 4. Click Uplad. The patch is displayed in the Updates sectin f the screen alng with all patches that have been previusly upladed. Select a patch and click Delete t remve it frm the list and frm the patch server. 5. Select the rw in the table f the required patch and click Deply Update. T see the cmpnents and release ntes fr a patch, click the patch name. Updates are applied in parallel t all cmpnents acrss the cluster that are nt the same versin as the patch. Ndes may require a rebt fllwing an update - click Rebt in the Actin clumn fr the apprpriate ndes. Ndes that are ffline are nt updated and display with a warning icn in the Status screen. Reapply the patch when the nde is nline t update its cmpnents. This des nt affect any ndes that have already been updated. The prgress f the update is displayed and yu are infrmed when the update is cmplete. Page 47 f 120

48 Kerbers Authenticatin Prerequisites fr Kerbers Authenticatin These prerequisites are nly required fr cnfiguring Windws Client Kerbers SSO. In rder t use Kerbers authenticatin against the File Directr appliance, Active Directry needs t be cnfigured with a user that allws: A. The Kerbers keytab t be acquired frm a user accunt s the server can trust the authrized user t access it. B. Preauthenticatin checks. C. Kerbers Ticket Granting services, which are part f Active Directry, t determine the service principal used t access the File Directr appliance and btain a ticket t establish an authrized cnnectin t the File Directr appliance. D. The re-use f service tickets sent t the platfrm s that the service can access data upn the user s behalf (Kerbers Uncnstrained Delegatin). This is required if setting up Kerbers n the client. T perfrm the setup, cmplete the fllwing steps: 1. Create a user accunt in Active Directry fr this purpse and set a passwrd t be used by the appliance t perfrm actins A and B. It is recmmended that this accunt is nt an admin accunt. T ensure the crrect default dmain is used, the username fr this accunt must include the relevant realm name. The required frmat is username@realm, fr example, bsmith@filedirector.local. The realm must be entered in uppercase. 2. Set the accunt s that the passwrd cannt be changed and never expires. This is recmmended because it remves the need t recnfigure the platfrm t use new credentials. 3. Ensure DNS references the File Directr server and always use the full DNS name t access the File Directr server in the future. DNS shuld be an A recrd that pints t either the File Directr appliance r, in the case f a clustered envirnment, the NLB VIP. A CNAME recrd can be used by clients as the server address, but the SPN must be registered against the A recrd. Page 48 f 120

49 4. Take the DNS name and use the setspn tl frm a dmain cntrller t add HTTP Kerbers service principals that match the DNS name t the user accunt. Fr example, if the user accunt is called fdpreauth and the DNS name that will be used t access the user accunt is fd.mycmpany.cm, issue the fllwing setspn cmmands n a dmain cntrller and ensure they run errr free: setspn -S http/fd.mycmpany.cm fdpreauth If the client endpints pint t a DNS CNAME address that references an A recrd, the SPN needs t be registered against the A recrd rather than the CNAME. Fllwing step 4, a new Delegatin tab appears in Active Directry Users and Cmputers assciated with the user accunt. This tab is used t allw the Kerbers Ticket Granting server in AD t lcate the key infrmatin assciated with the user accunt and allw a tken t be returned t the client system t access the File Directr appliance. 5. Select the Delegatin tab fr the preauthenticated user and select Trust this user fr delegatin t any service (Kerbers nly). The File Directr appliance has authrizatin t use the Kerbers ticket frwarded t it by the File Directr client r web brwser s that it can reuse the user identity t access file service resurces. The prcess describes hw t cnfigure File Directr fr Kerbers Uncnstrained Delegatin. If yu are using Credential Guard n a Windws 10 client, yu need t cnfigure Kerbers Cnstrained Delegatin. Page 49 f 120

50 Cnfigure Kerbers in the File Directr Admin Cnsle This prcess describes hw t cnfigure the File Directr Admin cnsle fr Kerbers authenticatin. Kerbers Realm 1. In the File Directr Web Admin cnsle, select Cnfiguratin > Kerbers. 2. Click Add Realm. The Add/Edit Kerbers Realm dialg displays. 3. In the Dmain field, enter the default dmain name. 4. Enter the fully qualified dmain name f the dmain Key Distributin Center (KDC). This is usually the same DNS as the Active Directry cntrller. If yu are unsure f the KDC name, use nslkup _kerbers._tcp.<dmainfqdn> frm a dmain-jined client t get the IP f the KDC. The use ping -a <ip address> t get the name f the KDC. Page 50 f 120

51 5. Click OK. Details f the realm are added t the Kerbers sectin f the screen. The name f the realm is autmatically added. Realm names are case sensitive and are usually the same as the dmain name in upper-case letters. 6. Repeat steps 2 t 6 fr all relevant realms. This ensures successful authenticatin t all shares added as map pints. 7. Click Save. Kerbers Tken Size Set the maximum tken size fr users in yur envirnment. The default value is 12k and this can be increased up t 64k t accmmdate users with large tkens. Setting the tken size t large can have a effect n perfrmance. Fr mre infrmatin abut checking the size f tkens, see blgs.technet.micrsft.cm/askds/2007/11/02/whatsin-a-tken/. Page 51 f 120

52 Kerbers Preauthenticatin This setting is required when cnfiguring encryptin fr Kerbers frm the client. A preauthenticatin user is nt required fr username and passwrd authenticatin. Select Cnfiguratin > Kerbers. In the Kerbers Preauthenticatin sectin, enter the username and passwrd fr the preauthenticatin user. The username can be entered as username r username@realm. Where the realm is used, it must be in upper case - fr example, bsmith@filedirector.local. This is the preferred frmat where multiple dmains are cnfigured. Only ne preauthenticatin user can be added. See the prerequisites fr details abut setting up this user. Page 52 f 120

53 Kerbers Cnstrained Delegatin Credential Guard was intrduced in Windws 10 Enterprise and uses virtualizatin-based security t islate NTLM passwrd hashes, Kerbers Ticket Granting Tickets, and credentials stred by applicatins as dmain credentials - all s that nly privileged system sftware can access them. File Directr supprts crss-realm Kerbers cnstrained delegatin, where users/endpints are in different dmains t the strage and preauthenticatin accunt. If Credential Guard is enabled n a Windws 10 client, users' ticket granting ticket is nt frwarded t the File Directr server and the File Directr server fails t authenticate the user. Enabling Kerbers Cnstrained Delegatin allws the File Directr server t create a ticket n behalf f the user. Preauthenticatin accunts must use cnstrained delegatin with any prtcl, t enable Windws server supprt fr MS-S4U. Envirnments Kerbers Cnstrained Delegatin has been tested in the fllwing envirnments: Users, endpints and preauthenticatin accunt and strage in the same dmain Page 53 f 120

54 Users and endpints in example.cm, file servers and preauthenticatin in trusted child dmain child.example.cm File servers and preauthenticatin example.cm with users and endpints in trusted child dmain child.example.cm Users and endpints in frest users.net with file servers and preauthenticatin accunt in frest resurces.net Fr the cnfiguratin belw, Active Directry must be setup in a 2-way transitive frest trust t allw Kerbers tickets t be utilized acrss realms. Page 54 f 120

55 Installing Credential Guard t supprt Kerbers Cnstrained Delegatin Pre-requisites Micrsft require that the dmain/frest functinal level be at least 2003 in rder t supprt Prtcl Transitin. If the users and resurces are in different frests, there must be a 2-way transitive frest trust cnfigured. The Frests shuld be cnfigured t supprt Kerbers cnstrained delegatin/prtcl transitin. This may require the deplyment f a Frest search rder plicy if nt already present - see Cnfigure Kerbers Frest Search Order (KFSO). If the users and resurces are in different dmains, there must be a 2-way transitive trust relatinship established. The maximum Kerbers tken size must be ascertained and cnfigured in the admin cnsle. Fr mre infrmatin, see blgs.technet.micrsft.cm/askds/2007/11/02/whats-in-a-tken/ base64 encding adds arund a third extra verhead t the actual size f the tken - be sure t allw fr this when cnfiguring the maximum size. Clck accuracy must be ensured n endpints, appliances (see admin guide fr cnfiguring NTP), File servers and dmain cntrllers the SPN (Service Principal Name) used by File Directr clients must pint t a DNS A recrd, nt a CNAME Kerbers AES128 encryptin must be allwed in KDC plicy (as per default) Endpints must have cnnectivity t a dmain cntrller as well as the File Directr appliance t acquire a service ticket File Directr server versin must be 4.2+ Page 55 f 120

56 Cnfiguring Kerbers Cnstrained Delegatin fr File Directr Preauthenticatin Accunt 1. Lcate yur preauthenticatin accunt in Active Directry Users and Cmputers. 2. Frm the preauthenticatin accunt prperties, select the Delegatin tab. 3. Select Trust this user fr delegatin t the specified services nly t enable the assciated ptins. 4. Select Use any authenticatin prtcl. 5. Click Add t select the resurces yu wish t access using Kerbers cnstrained delegatin 6. Click Users r Cmputers buttn t allw yu t search AD. 7. Select the cmputer accunt fr the file server yu want t access. If yu have multiple file servers, select all f them. 8. In the Service Type field fr the server, select cifs. Page 56 f 120

57 9. Click OK. 10. Click Apply, Yur File Directr preauthenticatin accunt is setup fr Kerbers Cnstrained Delegatin t access the selected servers. Page 57 f 120

58 Advanced Cnfiguratin The advanced ptins are used t set DSCP QS ptins and t create and restre cnfiguratin backups. Select Cnfiguratin > Advanced t access the Advance ptins. In this sectin: DSCP QS Cnfiguratin This setting is nly required if yur rganizatin uses Differentiated Services Cde Pint (DSCP) settings t help manage its netwrk traffic. The setting must be applied t in accrdance with yur rganizatin s netwrking requirements. Yur netwrk team will be able t advise which setting t apply. In the DSCP QS Cnfiguratin area f the Advanced ptins, select the required cnfiguratin and click Update. HTTP Access In the HTTP Access area f the Advanced ptins, cnfigure the required setting and click Update t apply. Page 58 f 120

59 This ptin shuld nly be used t enable cnnectin by HTTP in a lad balanced envirnment r with an SSL fflad appliance. TLS 1.0 PCI cmpliance requires SSL v3/tls 1.0 t be disabled in File Directr. Cnfiguring endpints t default t a secure prtcl (TLS 1.1 r TLS 1.2) requires the implementatin f registry settings and ptentially an update. Custmers that are unable t implement this change can nw tggle TLS 1.0 n in File Directr 4.2. Fr mre infrmatin, see this Micrsft supprt article Select Cnfiguratin > Advanced and apply the Enable TLS 1.0 ptin as required. When enabled, this is dne acrss the whle cluster. Ivanti recmmends turning ff TLS 1.0 supprt as sn as all legacy endpints in the envirnment are updated r replaced. NTP Add the server addresses r FQDNs f the NTP servers yu want t use. File Directr is cnfigured with the addresses f three default NTP servers. If yu use yur wn NTP servers, replace the default addresses with the addresses f yur wn. Yu can use a maximum f three NTP servers and a minimum f ne. Page 59 f 120

60 Lad Balancer Status Click the Status URL link t check the health status f a server in a lad balanced envirnment. A status page is displayed shwing ne f the fllwing: Success - The server is functining crrectly within the lad balancer pl. Failure - The server is either ffline r is nt functining crrectly within the lad balancer pl. Enable Maintenance Mde Select Enable Maintenance Mde t temprarily take the server ffline. The server is n lnger available in the lad balancer pl and cannt be cmmunicated with. This allws any necessary maintenance and cnfiguratin tasks t be cmpleted. Whilst the server is in Maintenance Mde, the status f the server shws as 'failure'. De-select Enable Maintenance Mde t make the server available in the lad balancer pl nce again. SMB Strage Authenticatin Set the authenticatin methd used by the File Directr appliance t cnnect t the SMB Strage - NTLM r Kerbers. If yu select Kerbers, yu must cnfigure the Realm and Key Distributin Center (KDC) settings in the Kerbers page. Page 60 f 120

61 SMTP Cnfiguratin Set up SMTP t use the required accunt fr initiating Link Based Sharing s. The server URL, prvided in the client's request, is used t create the link included in s t users. The File Directr server URL cnfigured fr yur cmpany's appliances must be accessible externally. 1. Select Cnfiguratin > Advanced. 2. In the SMTP Cnfiguratin sectin, enter the details f the SMTP server and 3. address: 4. Click Update. Hstname r IP address f the SMTP server SMTP server prt number Encryptin type t use when sending s The address t send s frm address t receive test Indicate if authenticatin is required and, if s, prvide the username and passwrd Page 61 f 120

62 Syslg Server File Directr uses Transmissin Cntrl Prtcl (TCP) t utput syslg rather than User Datagram Prtcl (UDP). 1. Select Cnfiguratin > Advanced and scrll dwn t the Syslg Server sectin f the screen. 2. Enter the IP address f the remte syslg server and click Update. Page 62 f 120

63 Plicy Cnfigure a range f settings t determine hw File Directr is used in yur rganizatin and by whm. There are fur categries f plicy rules in File Directr. Select Plicy and the required categry: Glbal Plicy - Set restrictins n platfrm, IP address, timeut and lgin attempts that apply t all yur users. Mbile Plicy - Cnfigure a range f settings t dictate hw File Directr behaves n mbile devices. Map Pint Access Plicy - Define plicy settings unique t each map pint allwing different sets f rules t match the requirements f different users and grups f users. Users and Devices Plicy - Verify new users and devices and manage their access. Users and devices can be remte wiped and unlcked if required. Glbal Plicy Set restrictins n platfrm, IP address, timeut and lgin attempts that apply t all yur users. In the admin cnsle, select Plicy > Glbal and click Edit. When all required changes have been made, click Save. Client Access Specify which platfrms can lg n t File Directr n yur server. Set the plicy fr each platfrm t On r Off as required. Platfrm restrictins can als be set fr individually fr each Map Pint. Glbal restrictins take precedence ver thse set at Map Pint level - if yu disable a platfrm at the glbal level, it is disabled fr all users regardless f the setting n their Map Pint. The table belw illustrates this behavir. Page 63 f 120

64 Platfrm Glbal Map Pint Effect Windws On On Users fr that Map Pint can access the File Directr server thrugh Windws. Mac On Off Users fr that Map Pint cannt access yur server n a Mac as the Glbal setting is verridden. ios Off Off Users cannt access yur server n an ios device regardless f their Map Pint. Andrid Off On Users cannt access yur server n an Andrid device regardless f their Map Pint as the Map Pint setting is verridden. IP Address Lgin Restrictins Specify which IP addresses can access yur File Directr server using the fllwing frmats: Enter each IP address n a separate line in IPv4 frmat. Specify a range f values using a dash. Fr example, Use an asterisk t specify dente a wildcard - any value between 0 and 255. Fr example, * Page 64 f 120

65 Failed Lgin Attempts Set the number f cnsecutive failed lgin attempts befre a user is lcked ut fr the specified time perid. Yu can als specify the number f cnsecutive failed lgin attempts befre lcally stred data is wiped frm the desktp r device. If an accunt is wiped in this way, the user is put n the Remte Wipe list fr the web platfrm which prevents the user frm all web lgin attempts. It is therefre recmmended that yu d nt set the failed lgin attempts befre wiping data at a very lw figure (less than five). This plicy wrks differently fr mbile devices where the PIN check ccurs n the lcal device, nt the server. There is n lckut fr PIN attempts but if the Remte Wipe setting des apply - if the number f PIN attempts exceeds the Remte Wipe Failed Lgin Attempts number, the lcal device is wiped f all data and stred lgin credentials, including the PIN. Sharing Set the length f time, in days, that files are available t recipients when shared by a link. If yu d nt require a time limit fr a share, set t Off. When updating this setting, changes nly apply t newly created shares - existing shares adhere t the setting which was applied when the share was created. The figure set here is als the number f days a share is extended by when an expiry date is extended. Page 65 f 120

66 Mbile Plicy Cnfigure a range f settings t dictate hw File Directr behaves n mbile devices. In the admin cnsle, select Plicy > Mbile and click Edit. When all required changes have been made, click Save. Client Security The fllwing security plicies are available: Set whether user's encrypted passwrds is stred in the mbile device keychain. On - Users can use a PIN fr authenticatin instead f a passwrd. Off - Users must enter their passwrd each time they launch the File Directr app. If this plicy is enabled, a further ptin is available - Require PIN authenticatin check every time File Directr app launches t the fregrund. If this plicy is applied, users must enter their PIN each time the File Directr app launches r returns t the fregrund. Set whether users must enter their passwrd after a defined perid f inactivity. This can be in minutes, days. Data Security Set the File Directr behavir fr dwnladed files using the buttns t cnfigure the fllwing: Wipe dwnladed files - Only stres files whilst they are in the fregrund n a device. When the file is n lnger in the fregrund, the lcal cpy is deleted frm the device r endpint. Page 66 f 120

67 Allw dwnladed files t be pened by ther apps - Files dwnladed frm the File Directr app can be pened in ther apps. This can ptentially cmprmise security as files pened in ther apps may be able t be printed r saved in a nn-encrypted frmat. Allw cpy/pasting frm the File Directr app t ther apps - Prtect yur rganizatin s sensitive infrmatin by disabling cpy and paste frm File Directr apps. Allw file uplads - Select whether users can uplad files frm their mbile devices t yur File Directr server. When this ptin is set t On, it enables and disables the 'Open in' feature frm ther apps t File Directr. If this ptin is turned ff, all dwnladed files are read-nly and users cannt uplad files t yur File Directr server. Map Pint Plicy Create and maintain plicies, platfrm and file sharing ptins fr map pints. A plicy can be created t define permissins fr users cnnected t the map pint. Further plicies can be defined t set different permissins fr individual users, Organizatinal Units (OU) and User Grups. In the example belw, ne plicy has been created fr Admin Users and ne fr all ther users. Admin Users can nly cnnect t the server n verified devices whilst fr all ther users cnnected t the map pint, all data is read-nly. These plicies apply cncurrently n the map pint. Page 67 f 120

68 Edit Map Pint Access 1. Select Plicy > Map Pint Access. 2. Click Edit. Map Pint Access plicy settings can als be accessed directly frm the link in the crrespnding map pint cnnectin string cnfiguratin - Cnfiguratin > Map Pints. 3. Click Add t create the plicy yu want t define: Organizatinal Units - Find the OU yu want t add and click Select. User Grups - Find a user grup and click Select. Individual Users - Find a user and click Add by the users yu want t set a plicy fr. 4. Select an OU, User Grup, Individual user r select All Users t apply settings t everyne wh uses that map pint. Page 68 f 120

69 5. Cnfigure the required settings: Frce read-nly - Users cannt mdify r uplad File Directr files. Only allw VERIFIED devices t cnnect - Only thse devices which have been apprved by the administratr can cnnect t the File Directr server. Platfrm Access - Set which devices users can use t fr this Map Pint. Platfrm Access can als be set glbally which can cnflict the Map Pint plicy settings as shw by the examples in the table belw. Platfrm Glbal Map Pint Effect Windws On On Users fr that Map Pint can access the File Directr server thrugh Windws. Mac On Off Users fr that Map Pint cannt access yur server n a Mac as the Glbal setting is verridden. ios Off Off Users cannt access yur server n an ios device regardless f their Map Pint. Andrid Off On Users cannt access yur server n an Andrid device regardless f their Map Pint as the Map Pint setting is verridden. 6. Click Save. Link Based Sharing - Select whether the type f access internal and external users can have - either read-nly r cllabrative. Link based sharing can als be disabled. These settings are applied t the users cnnected t the File Directr server wh and match the defined criteria. Page 69 f 120

70 Users and Devices Plicy The Users & Devices page enables yu t keep track f yur users and their devices. The page shws yu the users that have lgged n t File Directr and displays details f each device n which they have installed File Directr. Yu can see the ID, type and status f all devices and have the ptin t verify any unverified devices. Yu can als remte wipe and unlck users and devices if necessary. Search fr Users and Devices 1. Select the Plicy tab and click Users & Devices. 2. Select the required filters and enter yur search criteria using the fllwing filters: User/Device Status - Display thse users r devices at a particular status. Fr example, yu might want t find all users wh have been lcked ut r all unverified devices. Available ptins are: All Users and Devices Remte Wipe List Devices Nn-Remte Wipe Devices Lcked Out Users Only Nn-Lcked Out Users Verified Devices Only Unverified Devices Only Platfrm Type - Refine yur list f devices by selecting a particular platfrm. Fr example, yu might nly want t view Andrid devices r Web Client sessins. User Name Matches - Perfrm a search n full r part user names. 3. Click Shw Users/Devices t update yur user/device list using the filter and search settings. Page 70 f 120

71 Manage Users and Devices 1. Select a user(s) and/r device(s) - each user and device has their wn checkbx. 2. Click the required actin: Remte Wipe User/Device - All File Directr files are remved frm the selected device r, if a user is selected, frm all f their devices. This is useful fr ensuring sensitive data is nt left n a lst r stlen device r n the devices f smene wh has left yur rganizatin. If a user is lgged in at the time f the wipe, their next actin n the device autmatically returns t the lgin screen. The current sessin is invalidated and any lgin attempts are rejected. Unlck User/Device - If a user has had t many unsuccessful lgin attempts, their accunt is temprarily lcked as defined in the Failed Attempts plicy. Once unlcked, the failed lgin cunter is reset. Verify Device - Any device that lgs in fr the first time is cnsidered unverified until an admin manually apprves/verifies the device in the File Directr appliance. Once verified, a device is added t the verified categry and can nly be remved fllwing a remte wipe. The actin is perfrmed fr the selected devices and/r users. Page 71 f 120

72 Auditing The File Directr appliance supprts sending audit and usage data t a single remte syslg server ver a TCP cnnectin. The File Directr server requires the IP address and prt f a remte syslg server. Only IP addresses are supprted as DNS can be unreliable. The syslg message cntains JSON encded data which can be indexed by sftware, such as Splunk, t prvide reprting and analysis. The facility levels in syslg distinguish between usage and audit lg data as fllws: Level lcal2 lcal3 Data audit data usage data All messages are sent at the infrmatinal severity level. Cnfigure a Remte Syslg Server in File Directr 1. Select Cnfiguratin > Advanced and scrll dwn t the Syslg Server sectin f the screen. 2. Enter the IP address f the remte syslg server and click Update. Set up a Remte Syslg Server The syslg server must be cnfigured t listen n a TCP prt fr it t wrk with File Directr. The fllwing steps instruct yu hw t d this using either Rsyslg r Splunk. Rsyslg The standard syslg service included in Ubuntu Server is Rsyslg. 1. Create a File Directr cnfiguratin file in the /etc/rsylg.d flder called 10-dnsyslg.cnf. 2. Add the fllwing lines t 10-dnsyslg.cnf t listen fr TCP traffic n prt 10514: # prvides TCP syslg receptin $MdLad imtcp $InputTCPServerRun T filter ut the File Directr messages t separate lg files yu must create a directry /var/lgdatanw and ensure that the syslg daemn has permissin t write t that directry. Page 72 f 120

73 4. Add the fllwing lines t 10-dnsyslg.cnf t redirect the File Directr messages and stp them appearing in the nrmal syslg files: lcal2.* /var/lg/datanw/audit.lg &~ lcal3.* /var/lg/datanw/usage.lg &~ 5. Restart the syslg server t pick up changes using the fllwing cmmand: service rsyslg restart Splunk Fr instructins n hw t set up Splunk t mnitr File Directr syslg files, see Trubleshting Check fr data arriving n the Syslg server Check fr data arriving n the syslg server either in /var/lg/syslg r var/lg/datanw/usage.lg using the fllwing tail cmmand: tail -f /var/lg/datanw/usage.lg Check the server is listening On the syslg server, use the fllwing cmmand t ensure the server is listening n the prt cnfigured: netstat -nlt grep The respnse shuld be: tcp : :* LISTEN Check the File Directr appliance has cnnected On the syslg server, use the fllwing cmmand t ensure the File Directr appliance has cnnected: netstat -nt grep The respnse shuld be: cp 0 0 [syslgserver]:10514 [datanw appliance]:42901 ESTABLISHED If supprt mde is enabled n the File Directr server and yu have SSH access, then running netstat n the File Directr server shuld shw a similar cnnectin as abve. Page 73 f 120

74 Reprt Lgs Yu can dwnlad cnfiguratin reprts and appliance lgs which can be used by Ivanti supprt t check yur installatin, perfrmance and t trublesht yur appliance. Select Hme > Status and click the dwnlad link. Yu may be asked fr these reprts when cntacting Ivanti abut File Directr. Page 74 f 120

75 Link Based Sharing Link Based Sharing prvides File Directr users with a fast and efficient way t share cntent. Once sharing has been cnfigured in the admin cnsle, it can be enabled fr the required map pints and the type f receivers that are able t access the files can be defined. File Directr classifies receivers int tw grups: Internal - Any emplyee f the rganizatin as defined by membership f the cmpany s Active Directry. External - Anyne nt in the abve grup. File Directr saves a versin f the shared files and autmatically creates links which are ed t listed recipients. Fr external receivers, File Directr autmatically enrlls them and sends access details t the shared cntent. Preparatin Sharing files using File Directr requires the Server Administratr t create dedicated staging areas fr the tw types f receivers. These dedicated areas can be n any AD jined file server, NAS, r SAN. Steps required fr Internal Link Based Sharing 1. Create an Server Message Blck (SMB) share. This can be any name yu chse. 2. Prvide all dmain users with mdify access. Users require Mdify access t delete expired shares. Steps required fr External Link Based Sharing 1. Create an SMB share. This can be any name yu chse. 2. Prvide all dmain users with mdify access. 3. Create a new dmain user with mdify access t the external share. Users require Mdify access t cntribute t a share. T prevent users viewing cntent ut f band, yu can lcate the staging file server in a segregated netwrk t which nly the File Directr appliance has SMB access. Admin Cnsle Yu must cnfigure SMTP t send the s cntaining the links, create new Staging Map Pints t hld the shared files, enable sharing n yur map pints and set the expiratin time fr the shares befre using the Link Based Sharing feature. Page 75 f 120

76 Set Up the SMTP Server Set up SMTP t use the required accunt fr initiating Link Based Sharing s. The server URL, prvided in the client's request, is used t create the link included in s t users. The File Directr server URL cnfigured fr yur cmpany's appliances must be accessible externally. 1. Select Cnfiguratin > Advanced. 2. In the SMTP Cnfiguratin sectin, enter the details f the SMTP server and 3. address: 4. Click Update. Hstname r IP address f the SMTP server SMTP server prt number Encryptin type t use when sending s The address t send s frm address t receive test Indicate if authenticatin is required and, if s, prvide the username and passwrd Page 76 f 120

77 Create Staging Map Pints Set up Staging Map Pints t enable files t be shared internally and externally. Yu can nly have tw staging map pints; ne internal and ne external. 1. Select Cnfiguratin > Staging Areas. 2. Click Add New. 3. Enter details f the Internal Staging Map Pint: Name fr the staging area Cnnectin string fr the staging area Select Internal User Access frm the drp-dwn 4. Click Save. 5. Repeat this prcess fr an External Staging Map Pint if yu want t enable Link Based Sharing fr nn-ad users, adding the credentials f the External AD User accunt yu are using t enable the external staging area. 6. Click Save. Enable Link Based Sharing n Map Pints Enable Link Based Sharing n yur map pints by editing yur Map Pint Access Plicy. 1. Select Plicy > Map Pint Access. 2. Click Edit fr the required map pint. Page 77 f 120

78 3. Select the users fr whm yu want t enable Sharing. Sharing can be enabled fr All Users assciated with the map pint r create individual plicies fr selected OUs, user grups and/r individual users. Click Add fr an OU, User Grup r Individual User t define a specific plicies. 4. Open the apprpriate Map Pint and set the plicy fr internal and external users. Yu can apply the fllwing settings fr each type: Disabled - Link based sharing is nt available fr users cnnecting t this map pint. If link based sharing is disabled fr internal users, it cannt be enabled fr external users n the same map pint. Read-nly - All shares are read-nly fr this map pint. Users can dwnlad files but nt uplad files t shares. Cllabratin - Users can dwnlad and uplad files t shares. Internal users can als delete files they uplad whilst external users cannt. In the example belw, Link Based Sharing has been disabled fr external users and fr the map pint. Internal users have cllabrative access t shares. 5. Click Save t apply the setting. 6. Repeat these steps fr any ther Map Pints where Link Based Sharing is required. Page 78 f 120

79 Set the Autmatic Expiratin fr Link Based Sharing Set the glbal expiratin fr the Link Based Sharing by editing yur Glbal Plicy. If a user tries t access a share after it expires, the shared files are remved under the security cntext f the user's accunt. If yu d nt want the Link Based Sharing t have an expiry date, d nt enable the Sharing plicy. 1. Select Plicy > Glbal. 2. Click Edit. 3. Set the Sharing plicy t On. 4. Enter the number f days the shared links will be active fr. 5. Click Save. The figure set here is als the number f days by which a share is extended when an expiry date is extended. Page 79 f 120

80 File Directr SMB3 Encryptin Abut File Directr SMB3 Encryptin File Directr supprts SMB3.02 encryptin fr all traffic frm File Directr servers t back end strage. Supprt is fr SMB3.02 encrypted shares using Windws Server 2012 R2 as the reference platfrm. Using encrypted SMB3.02 shares requires valid Kerbers cnfiguratin items in the File Directr server t supprt authenticatin. It als requires that map pints are specified using a hstname rather than an IP address. It is preferable t use the Fully Qualified Dmain Name althugh using the Shrtname will wrk if valid DNS search dmains have been cnfigured. If the File Directr server is secured in a DMZ, prt 88 must be pen between File Directr and Active Directry n the firewall fr this t wrk. This applies t bth TCP and UDP prtcls. Tw mdes f authenticatin are available: Username and passwrd authenticatin n the endpint with the File Directr server switching t Kerbers authenticatin t cmmunicate securely with the back end SMB3.02 share. Using Kerbers frm the endpint right thrugh t the SMB3.02 share utilizing ticket frwarding. Fr bth authenticatin mdes, reverse IP lkups fr file servers and dmain cntrllers must be setup and the clck skew between File Directr and must be less than five minutes. In rder fr File Directr t functin crrectly, AES-128 encryptin must be enabled n the Key Distributin Center (KDC). Once all cnfiguratin is cmplete, enable SMB3.02 prtcl n Server 2012 R2 share, therwise data will nt be encrypted in transit. Fr further details, see Page 80 f 120

81 Rll Out File Directr After cnfiguring File Directr, all end users specified in the MS Active Directry belw the Base DN have access t the website and can synchrnize their hme flders using the File Directr client. Users nw need t knw hw File Directr helps them, where t dwnlad the client, the address f the File Directr appliance and hw t use File Directr n their devices. 1. Stre the client dwnlads in an accessible lcatin ready fr dwnlad by users. Cnsider selecting a lcatin that is accessible frm inside and utside the enterprise firewall. 2. If yu use Ivanti Applicatin Cntrl sftware cnsider elevating user rights fr the File Directr installer. 3. Cmmunicate the fllwing suggested details t end-users: Hw and where t dwnlad the Windws and Mac clients. Hw t install the Andrid clients frm the Ggle Play app stre (search fr Ivanti). Hw t install the ios client fr iphne and ipad frm the itunes app stre (search fr Ivanti). The server address, username and passwrd t use in the client (their usual username and passwrd frm MS Active Directry). Hw t visit the appliance website using a secure https cnnectin. The server address fr the client and the website address are the same. Links t the File Directr Help Center: Yur supprt arrangements in case they encunter difficulties. Links t the enterprise acceptable usage plicy. If yu are nt using a Public CA, the details f the enterprise SSL certificate and instructins. Install Trusted Certificates n Client Devices T use an enterprise certificatin authrity (CA), yu need t install the enterprise rt SSL certificate n each f the client devices. The instructins in this chapter prvide infrmatin designed t help yu install rt certificates n Windws, Mac, ios and Andrid clients. Netwrk prvisining tls are als available fr installing trusted SSL certificates n clients. Hwever, these instructins fcus n individual clients. Yu nly need t add a rt certificate t client devices if the enterprise is using a private CA. If yu experience difficulties with a certificate issued by a public CA, then review the appliance certificate cnfiguratin. Page 81 f 120

82 Fr testing purpses during the evaluatin phase f yur File Directr deplyment, t avid installing the default self-signed certificate n each client device, it is recmmended that yu request a free time-limited certificate frm ne f the public CAs. Install Rt Certificates n Windws Web brwsers and the File Directr Client use the perating system certificate stre. S, if yu install the certificate in the perating system then bth the File Directr Client and Internet Explrer autmatically trust the server certificate. This prcedure describes ne methd f installing the rt certificate using Internet Explrer and Micrsft Management Cnsle n Windws In Internet Explrer, brwse t the File Directr Website r File Directr Admin Cnsle as fllws: Website: Admin Cnsle: The brwser displays a security warning. 2. Click Cntinue t the website. 3. In the address bar, right-click the certificate and select View Certificates. 4. On the certificate dialg, click the Details tab. 5. Click Cpy t file. 6. In the wizard, select Base-64 encded binary X.509 (.CER). The saved file cntains the certificate. Yu can view the file in a text editr t see the certificate. The certificate must be installed as a trusted certificate fr the cmputer. T d this, run the Micrsft Management Cnsle (MMC) as administratr and add the Certificates snap-in. If MMC is run as a standard user, trusted certificates can nly be added at the user accunt level. 7. Click the Windws Start buttn. 8. In the search bx, begin typing mmc.exe, right-click the mmc.exe entry in the search results and select Run as Administratr. 9. Select File > Add/Remve Snap-in. 10. Select Certificates and click Add. 11. In the Certificates snap-in dialg, select Cmputer accunt and cmplete the wizard. 12. Click OK. 13. In the MMC cnsle, expand Certificates. Page 82 f 120

83 14. Right-click Trusted Rt Certificates and select All Tasks > Imprt. 15. Fllw the Certificate Imprt Wizard t imprt the certificate. After installing the certificate, clse and repen Internet Explrer and lad the File Directr Website r File Directr Admin Cnsle. If the certificate installed crrectly and is valid, the security warning n lnger displays. Install Rt Certificates n Mac Bth the web brwser and the File Directr Client use the perating system certificate stre. S, if yu install the certificate in the perating system using Safari then the File Directr client autmatically trusts the certificate. This prcedure describes installing the rt certificate n a Mac OS X using Safari Launch Safari and brwse t the File Directr Website r File Directr Admin Cnsle as fllws: Website: Admin Cnsle: Safari displays a message, Safari can t verify the identity f the website. 2. Click Shw Certificates. 3. Select, when using this certificate, Always Trust. The Secure Sckets Layer (SSL) and X.509 Basic Plicy trusts update t Always Trust. 4. Click Cntinue. 5. Prvide yur passwrd and click Update Settings. Safari adds the rt certificate t the certificate stre and the brwser starts trusting the server. Install Rt Certificates n ios This prcedure is based n using the prvisining tl, iphne Cnfiguratin Utility 3.5, n Windws 7 t create r edit a cnfiguratin prfile cntaining the certificate and t prvisin it t an ipad r iphne. Alternatively, yu can the certificate file t the device and install it. Cnfiguratin prfiles are XML files that cntain device security settings including certificates. T install the certificate n an ios device, first install the certificate in the cmputer perating system - either Windws r Mac. 1. In iphne Cnfiguratin Utility, select Cnfiguratin Prfiles. 2. Select an existing prfile r click New in the tlbar t create ne. 3. At the tp f the list, click General and cmplete the frm. 4. Further dwn the list, click Credentials. Page 83 f 120

84 5. If Credentials are nt cnfigured, click Cnfigure, therwise, click the plus symbl t add a certificate. A dialg displays the certificates installed n the cmputer perating system. 6. Select the required certificate. 7. Plug yur ios device int the cmputer. 8. In the Devices list, click the device name. 9. Click the Cnfiguratin Prfiles tab. 10. Select the prfile yu edited, and click Install. The iphne Cnfiguratin Utility installs the cnfiguratin and certificates n the device. Page 84 f 120

85 File Directr SAN Certificates This sectin prvides infrmatin abut cnfiguring a File Directr certificate that cntains SAName entries. Subject Alternative Name (SAN) extensins allw a certificate subject t be assciated with the service name and dmain name cmpnents f a DNS Service Resurce Recrd. This enables us t publish multiple DNS names using ne SSL web listener. This allws administratrs t use CNAME alias DNS recrds with an SSL certificate that has a different Cmmn Name set within the subject f the certificate. This sectin assumes that yu have a functining File Directr appliance with a base DNS, AD, admin user and license cnfiguratin applied already. The cnfiguratin is in three parts, DNS, General Certificate and File Directr Appliance. DNS and SAN Certificates 1. Create DNS entries fr yur appliance. 2. Check that bth recrds reslve crrectly. Page 85 f 120

86 General Certificate 1. Open Micrsft Management Cnsle. 2. Select Add Certificates > Cmputer accunt > lcal cmputer. 3. Click Finish and OK. 4. Expand Persnal and select Certificates. 5. Right-click in the center pane and select Request New Certificate. The Certificate Enrllment wizard displays. 6. Click Next and Next again. 7. Select Web Server and click Prperties. The Certificate Prperties ptins are displayed. Page 86 f 120

87 8. Cmplete the fllwing fields in the Subject name ptins: Cmmn Name Organizatinal Unit Organizatin Lcality State Cuntry This wuld be the same infrmatin yu enter int the File Directr appliance when generating a CSR request. 9. In the Alternative name sectin, select DNS frm the Type drp dwn. 10. In the Value field, add the Alternative DNS names t be included in the certificate request. Page 87 f 120

88 11. Select the General tab and enter a Friendly Name and ptinal Descriptin. 12. Select the Private Key tab and expand the Key Optins. 13. Select Make private key exprtable. 14. Click Apply and OK. 15. In the Certificate Enrllment dialg, click Enrll. 16. When the certificate has successfully enrlled, click Finish. Yu shuld see the certificate in the Persnal stre. 17. Right-click n the new certificate and select Open. Page 88 f 120

89 18. Click n the Details tab and select Subject. Yu will see the subject details fr yur certificate. Page 89 f 120

90 19. Scrll t the Subject Alternative Name sectin. The alternative DNS names yu cnfigured shuld be visible. 20. Click Cpy t File and then OK. 21. Click Next. 22. Enable the Yes, exprt the private key ptin and click Next. 23. In the exprt file frmat sectin, select Include all certificates in the certificatin path pssible and click Next. 24. Type and cnfirm a passwrd and click Next. 25. Save the certificate t a suitable lcatin. Page 90 f 120

91 26. Cmplete the wizard by clicking finish. Page 91 f 120

92 SAN Certificates in the File Directr Appliance 1. Open a web brwser and cnnect t yur Appliance Admin cnsle. 2. Select Cnfiguratin > SSL Certificate. 3. Click Brwse and select the required certificate. 4. If the certificate was created with an encryptin passwrd, type it int the field. 5. Click Uplad Certificate and yur certificate shuld be installed and enrlled fr the hst name yu specified in the Certificate Subject. Yu shuld nw be able t use the A and CNAME recrd t cnnect t the appliance using SSL. A' Recrd Cnnectin example CNAME' Recrd Cnnectin example Page 92 f 120

93 File Directr Cmmand Line Interface The cmmand line interface (CLI) prvides a set f cmmands fr administratrs t perfrm actins using a Virtual Terminal (VT) r Secure Shell (SSH). T use the File Directr CLI, yu must install the 4.3 patch. Fr mre infrmatin, see Apply a File Directr patch. Vide: File Directr - Cmmand Line Interface Access the CLI using the Virtual Terminal 1. Start yur appliance. 2. In the text cnsle, press Alt+F2. The CLI displays. 3. Enter yur appliance passwrd. 4. Enter the required cmmand. T exit the CLI and return t the appliance text cnsle, press Alt+F1. Page 93 f 120

94 Access the CLI using Secure Shell 1. Start yur appliance and g t the main menu. 2. Select Tggle SSH access t CLI (supprt user). The screen displays 'SSH Enabled' t cnfirm that the CLI can be accessed. 3. Open the CLI n the required perating system: Windws - Windws des nt have a built in SSH client but there are many free applicatins that can be used t access the File Directr CLI, fr example, PuTTY. macos - T access the File Directr CLI n macos using Terminal, press cmmand+spacebar and type terminal. When Terminal pens, enter: ssh supprt@<appliance> Where <appliance> is the hstname r IP address f the File Directr appliance. 4. In the CLI, at the lgin as: prmpt, enter supprt. 5. Enter yur passwrd - this is the same as yur appliance passwrd. Fr further details, see Start the appliance and change yur passwrd. Page 94 f 120

95 Cmmands The fllwing cmmands are available in the File Directr CLI: Cmmand Parameters filedirectr kdc If yu have Kerbers cnfigured, use this cmmand t test the cnnectin t yur Active Directry server. restart Restart the File Directr applicatin n the current nde. lkup <hstname> Frward lkup f hstname. This is cmpared t the utput f the hst cmmand frm the full shell t validate utput. The cmmand returns all IPV4 addresses that the appliance can reslve. ping <hstname> The hstname is reslved and the ping result displayed. restart - Restart yur File Directr appliance. shutdwn - Shutdwn yur File Directr appliance. lgut - Lg ut frm the cmmand line. help r? - Displays the available cmmands and their descriptins. Prefix a cmmand with? r help t display the descriptin fr that particular cmmand. Fr example,? filedirectr r help filedirectr returns infrmatin abut what the datanw kdc and datanw restart cmmands d. Page 95 f 120

96 OneDrive cnnectr fr Hme map pints Cnfigure Azure Active Directry (Azure AD) and the File Directr admin cnsle, t use OneDrive accunts as the strage lcatin fr user's hme map pints. File Directr can then utilize the 1TB f strage, included free f charge, with each Office 365 fr Business license. Vide: Cnfigure the OneDrive Cnnectr fr Hme Map Pints - New Azure prtal Updates made t files n map pints using any File Directr client are synchrnized with OneDrive and the changes are evident when accessed using OneDrive fr Business clients. Hwever, changes made t files n File Directr Map Pints using OneDrive fr Business clients are nt synchrnized with File Directr desktp and mbile clients. Page 96 f 120

97 Prerequisites Yur perimeter firewall must allw cmmunicatin t <instancename>-my.sharepint.cm n prt 443 and Micrsft supplied URLs detailed in this article. Yu are an Office 365 administratr. Yur public dmain is assciated with yur Azure AD instance. Passwrd replicatin is set up n yur lcal AD. Federated AD access is nt supprted - the lcal username UPN must match the ne used t sign int Azure Users have an Office 365 license assigned t them frm the Office 365 Admin Center. Users have OneDrive strage prvisined. Fr further infrmatin abut hw t pre-prvisin OneDrive fr Business fr yur users, see: Fr further reading abut integrating applicatins with Azure AD, see the Micrsft dcumentatin. The prcess belw describes the setup using the new Azure AD prtal. T see hw t set it up using the classic Azure AD prtal, click here. Page 97 f 120

98 Step 1 - Cnfigure Azure AD Lg in t Azure AD and cpy yur Tenant ID 1. Lg int Office 365 as an Administratr. 2. Click Admin. 3. In the Admin center, select Admin Centers > Azure AD. The Azure Prtal displays. 4. Select the tile fr yur Azure Active Directry. Page 98 f 120

99 5. Click Dmain names frm the Manage menu and cpy yur dmain name t a text editr - yu need this t generate data fr the manifest. Page 99 f 120

100 Add a File Directr applicatin t Azure AD 1. Select Enterprise Applicatinsand click New applicatin. 2. Select All then click Applicatin yu're develping. 3. Click Ok, take me t App Registratins t register my new applicatin then click New applicatin registratin. Page 100 f 120

101 4. Enter a Name fr yur applicatin, select Web app / API and enter the Sign-n URL. This is the URL yur users will use t sign in t File Directr. 5. Click Create. Yur applicatin is added t the list f App registratins. Page 101 f 120

102 Cnfigure permissins fr the appliance This determines what the applicatin is allwed t d and what it can access. 1. Select the applicatin yu added then select Required permissins and click Add. 2. Select Select an API and click Office 365 SharePint Online (Micrsft SharePint). 3. Click Select. 4. Select Select permissins and then select all Applicatin Permissins. 5. Click Select then click Dne. Page 102 f 120

103 6. Click Grant Permissins then click Yes. Page 103 f 120

104 Step 2 - Update the Azure AD manifest This uses public key infrastructure t generate a self-signed certificate in the server and uplad the public key t Azure as part f a manifest. 1. Click Manifest fr yur Azure AD applicatin. The manifest displays. 2. Cpy the appid frm the manifest and save it t Ntepad - yu need this t generate data fr the manifest. 3. In the File Directr web admin cnsle, select Cnfigure > Directry Services. 4. Enter the Client ID fr the app - this is the appid yu cpied frm Azure AD. 5. Enter the Tenant Name - this is the dmain name yu cpied frm Azure AD. 6. Select an expiry ptin - 1 r 2 years. Page 104 f 120

105 7. Click Generate. The data yu need t add t the manifest is generated. 8. Click Cpy t cpy the data t the clipbard. Yu can save this t a text editr if yu are nt ging t edit the manifest immediately - if yu are, just leave it n the clipbard. 9. In Azure AD, Lcate the keycredentials class in yur manifest and paste the data yu cpied frm the File Directr web admin cnsle between the square brackets. 10. Click Save Page 105 f 120

106 Step 3 - Update the Hme map pint surce Select OneDrive as the Hme Map Pint Surce. The OneDrive tenant name is autmatically ppulated frm the infrmatin yu entered fr the manifest. Althugh OneDrive is selected as the Hme Map Pint Surce, yu still need t cnfigure the active directry setting. The lcal Active Directry is used fr authenticatin but must be in sync with Azure AD. Fr further infrmatin, see Cnfigure the Active Directry cnnectin. When users access their Hme flder, they are nw using their OneDrive strage - there is n impact n their File Directr user experience. OneDrive nw displays files that have been saved t the user's File Directr hme map pint. A flder named _filedirectr_ is als created in the rt f user's OneDrive strage. This flder stres cntains creatin times, mdified times, and ther metadata. Cnfigure the OneDrive Cnnectr fr Hme map pints in the classic Azure AD prtal The prcess belw describes the setup using the classic Azure AD prtal. Vide:Cnfigure the OneDrive Cnnectr fr Hme Map Pints - Classic Azure prtal Page 106 f 120

107 Step 1 - Cnfigure Azure AD Classic Lg in t Azure AD 1. Lg int Office 365 as an Administratr. 2. Select Admin. Page 107 f 120

108 3. In the Admin center, click Admin Centers > Azure AD. The Azure Prtal displays - ensure yu are using the Azure Classic Prtal. Page 108 f 120

109 Add a File Directr applicatin t Azure AD Classic 1. Select yur Azure directry. 2. In yur directry, select Applicatins and the click Add. Page 109 f 120

110 3. Select Add an applicatin my rganizatin is develping. 4. Enter a name fr yur applicatin and select WEB APPLICATION AND/OR WEB API. Page 110 f 120

111 5. Enter valid Sign-n and APP ID URLs: The Sign-n URL is that f yur appliance The APP ID URL must be unique - typically the appliance URL and an ID. Yur appliance is added as an applicatin in Azure AD. Page 111 f 120

112 Cnfigure permissins fr the appliance 1. Fr the added applicatin, select Cnfigure. 2. Cpy the Client ID t a text file editr and reserve if fr later use. Page 112 f 120

113 3. Click Add Applicatin. Page 113 f 120

114 4. Select Office 365 SharePint Online. This gives yur appliance applicatin in Azure, permissin t access the user's files n OneDrive. Page 114 f 120

115 5. Select all permissins fr the Office 365 SharePint Online applicatin (OneDrive fr Business). 6. Click Save. Page 115 f 120

116 Step 2 - Generate a manifest fr Azure AD This uses public key infrastructure t generate a self-signed certificate in the server and uplad the public key t Azure as part f a manifest. 1. In the File Directr web admin cnsle, select Cnfigure > Directry Services. 2. Enter the Client ID fr the app - yu cpied this frm Azure AD earlier. 3. Enter the Tenant Name - this can als be cpied frm Azure AD. 4. Select an expiry ptin - 1 r 2 years. 5. Click Generate. The data required fr the manifest is generated. 6. Click Cpy and paste the data in a text editr fr The cpied data is used in the Azure AD manifest. Page 116 f 120

117 Step 3 - Edit the manifest and uplad t Azure AD Classic 1. In Azure AD, fr yur File Directr appliance app, click Manage Manifest > Dwnlad Manifest. 2. Open the dwnladed manifest in a text editr. Page 117 f 120

118 3. Lcate the keycredentials class and paste the data, cpied frm the File Directr appliance, in the square brackets. 4. Save the manifest. Page 118 f 120

119 5. Uplad the saved manifest. Page 119 f 120

120 6. Azure will indicate a successful uplad. Step 4 - Update the Hme map pint surce Select OneDrive as the Hme Map Pint Surce. The OneDrive tenant name is autmatically ppulated frm the infrmatin yu entered fr the manifest. Althugh OneDrive is selected as the Hme Map Pint Surce, yu still need t cnfigure the active directry setting. The lcal Active Directry is used fr authenticatin but must be in sync with Azure AD. Fr further infrmatin, see Cnfigure the Active Directry cnnectin. When users access their Hme flder, they are nw using their OneDrive strage - there is n impact n their File Directr user experience. OneDrive nw displays files that have been saved t the user's File Directr hme map pint. A flder named _filedirectr_ is als created in the rt f user's OneDrive strage. This flder stres cntains creatin times, mdified times, and ther metadata. Page 120 f 120