Microsoft Exchange ActiveSync (EAS) Security Information and Guidance

Transcription

1 Microsoft Exchange ActiveSync (EAS) Security Information and Guidance Good Work Product Version: 2.0 Doc Rev Last Updated: 05-Jan-16 Good Work TM

2 Legal Notice This document, as well as all accompanying documents for this product, is published by Good Technology Corporation ( Good ). Good may have patents or pending patent applications, trademarks, copyrights, and other intellectual property rights covering the subject matter in these documents. The furnishing of this, or any other document, does not in any way imply any license to these or other intellectual properties, except as expressly provided in written license agreements with Good. This document is for the use of licensed or authorized users only. No part of this document may be used, sold, reproduced, stored in a database or retrieval system or transmitted in any form or by any means, electronic or physical, for any purpose, other than the purchaser s authorized use without the express written permission of Good. Any unauthorized copying, distribution or disclosure of information is a violation of copyright laws. While every effort has been made to ensure technical accuracy, information in this document is subject to change without notice and does not represent a commitment on the part of Good. The software described in this document is furnished under a license agreement or nondisclosure agreement. The software may be used or copied only in accordance with the terms of those written agreements. The documentation provided is subject to change at Good s sole discretion without notice. It is your responsibility to utilize the most current documentation available. Good assumes no duty to update you, and therefore Good recommends that you check frequently for new versions. This documentation is provided as is and Good assumes no liability for the accuracy or completeness of the content. The content of this document may contain information regarding Good s future plans, including roadmaps and feature sets not yet available. It is stressed that this information is non-binding and Good creates no contractual obligation to deliver the features and functionality described herein, and expressly disclaims all theories of contract, detrimental reliance and/or promissory estoppel or similar theories. Legal Information Copyright All rights reserved. All use is subject to license terms posted at GOOD, GOOD TECHNOLOGY, the GOOD logo, GOOD FOR ENTERPRISE, GOOD FOR GOVERNMENT, GOOD FOR YOU, GOOD APPCENTRAL, GOOD DYNAMICS, SECURED BY GOOD, GOOD MOBILE MANAGER, GOOD CONNECT, GOOD SHARE, GOOD TRUST, GOOD VAULT, and GOOD DYNAMICS APPKINETICS are trademarks of Good Technology Corporation and its related entities. All third-party technology products are protected by issued and pending U.S. and foreign patents. Patent Information: Good Work EAS Guide ii

3 Revision History Log begins 31-Aug-15 Date 31-Aug-15 Description Initial v1.5 MR Edition published 05-Jan-16 Updated for Good Work v2.0 Good Work EAS Guide iii

4 Table of Contents Introduction 1 Good Work EAS Workflow 1 Enabling EAS 2 Verifying Your EAS Configuration 4 Exchange Mobile Security 6 Mobile Device Access Policy 6 Mobile Device Mailbox Policy 7 Firewall 9 Restricting EAS Access 9 Enabling EAS Approval Delegation 9 Good Work EAS Enrollment 10 Short-Form Enrollment 10 Long-Form Enrollment 11 Troubleshooting 12 Additional Technical References 12 Glossary 14 Good Work EAS Guide iv

5 Introduction Introduction Good Work is a mobile collaboration application developed by Good Technology. Currently available for ios and Android devices, Good Work employs EAS to provide , calendar, and contact information. For more information on Good Work features and product specifications visit Good Work's respective Apple itunes and Google Play product page. Exchange ActiveSync (EAS) is a Microsoft Exchange synchronization protocol optimized to work with high-latency and low-bandwidth networks. The protocol, based on HTTP and XML, allows authorized mobile devices to access an organization's information on a server running Microsoft Exchange. Enabled by default when you install Microsoft Exchange, EAS gives mobile phone and tablet users convenient access to their , calendar, contacts, and tasks, and lets them continue to access this information while working offline. A relevant history of Microsoft EAS can be found in Wikipedia. Based on a number of Microsoft TechNet articles, Product Guides, Product Online Help, and Microsoft Press references, this document provides needed clarification regarding Microsoft Exchange ActiveSync (EAS) implementation when used with Good Work. The goal is to help you optimize the Exchange Risk Management and Operational posture in your Good Work deployment. See the Additional Technical References below for a complete listing of supporting reference materials and literature. Note: Although this document's focus is limited to EAS, not all Good Work features are provided by EAS. Please see the Good Work Datasheet for a feature summary and deployment options. Consult your Microsoft technical representative(s) for instructions and guidance on all aspects of your Exchange deployments. Good Work EAS Workflow From the perspective of the Exchange ActiveSync server, all EAS requests are sourced from the Good Proxy server. This makes proper setup of your Good Dynamics infrastructure Good Control and Good Proxy crucial to EAS connectivity with Good Work. At a high level, this workflow is captured in the following diagram and enumerated below. Good Work EAS Guide 1

6 Enabling EAS 1. The Good Work client initiates an EAS request. 2. Request traverses a Wi-Fi or celluar network. 3. Request is relayed from the Good NOC to the on-premise Good Proxy server; or, alternatively, the request is sent to a Good Direct Connect environment. 4. The request is validated against the configuration in the Good Control server. 5. If permitted, the request is sent from the Good Proxy server to the EAS server. Note: Step 3 is dictated by the Good Dynamics environment, not the Good Work client. See Good Dynamics Direct Connect for additional information concerning routing options. Enabling EAS By default, Exchange ActiveSync is enabled when you install the Client Access Server (CAS) role on the computer running Microsoft Exchange Server. Notwithstanding this, in order to use the Good Work app, each user must be enabled for EAS on their respective Exchange server. If EAS is not enabled for a user, it can be enabled via the Exchange Admin GUI or via the Exchange Shell. To enable EAS from the Exchange Admin GUI: 1. In the console tree, navigate to Recipient Configuration > Mailbox. 2. Select Properties from the action pane or right-click the user's mailbox and select Properties. 3. Click Mailbox Features. Good Work EAS Guide 2

7 Enabling EAS 4. Select Exchange ActiveSync, then click Enable Exchange ActiveSync. 5. Click OK. Although the example shows the Exchange 2013 Admin interface, the process readily applies to other versions of Exchange, as well. The Exchange Shell provides a lot of flexibility on how to enable EAS in an Exchange environment. The following examples highlight some of the most common ways to enable EAS with the Exchange Shell. To enable/disable EAS for a single user via the Exchange Shell: Set-CASMailbox Identity <SMTP Address of user> -ActiveSyncEnabled $true Set-CASMailbox Identity <SMTP Address of user> -ActiveSyncEnabled $false Example: Set-CASMailbox -Identity john.smith@good.com -ActiveSyncEnabled $true To enable/disable EAS for all users: get-mailbox set-casmailbox -ActiveSyncEnabled:$True get-mailbox set-casmailbox -ActiveSyncEnabled:$False Good Work EAS Guide 3

8 Verifying Your EAS Configuration To disable/enable ActiveSync connectivity for a group of users: Use the Get-User cmdlet to change the scope of the command. For example, to disable/enable ActiveSync for all the users in the Sales department, run the following command: Get-User -RecipientTypeDetailsUserMailbox where {$_.Department -eq "Sales"} Set-CASMailbox -ActiveSyncEnabled $true Get-User -RecipientTypeDetailsUserMailbox where {$_.Department -eq "Sales"} Set-CASMailbox -ActiveSyncEnabled $False This following command will find all EAS enabled users and save the results to C:\ActiveSyncEnabled.txt. Get-CASMailbox -ResultSize Unlimited where { $_.ActiveSyncEnabled -eq 'True'} ft name, activesyncenabled autosize > c:\activesyncenabled.txt You can also check on which devices are registered to a user's mailbox with this command: Get-ActiveSyncDeviceStatistics -Mailbox jsmith ft DeviceFriendlyName, DeviceType, DeviceUserAgent, LastSuccessSync In later versions of Exchange, replace Get-ActiveSyncDeviceStatistics with Get-MobileDeviceStatistics. Verifying Your EAS Configuration In default installations of Exchange the EAS virtual directory needs to be set in order for EAS to work correctly for mobile devices a requirement plainly necessary for Good Work as well. Additional background information can be found in the Exchange 2013 Client Access server configuration article available from TechNet. For Good Work, the External EAS virtual directory needs to set in Exchange 2013 as pictured here, in the Exchange admin center console. Good Work EAS Guide 4

9 Verifying Your EAS Configuration Alternatively, in environments with a large CAS array, you can use Exchange cmdlets to set the EAS virtual directory, since you can do it one time with a single cmdlet and have it apply to all your CAS machines via the following: Get-activesyncvirtualdirectory set-activesyncvirtualdirectory externalurl array>/microsoft-server-activesync Then, to verify that the External EAS virtual directory is set correctly, use the following: Get-activesyncvirtualdirectory fl *url*, identity This will produce verification output similar to the following albeit reflecting your particular CAS machine taxonomy: Good Work EAS Guide 5

10 Exchange Mobile Security Exchange Mobile Security Before a mobile device can connect to an Exchange mailbox via EAS, the user s mailbox must be enabled for EAS as described above. The Exchange mobile policy associated with the user s mailbox must also permit the device to connect. Once permitted, the device is then subjected to the user s mobile device mailbox policy, which controls which EAS policies are enforced on the device. The following topics describe these policies and the corresponding affect the Good Work client. Mobile Device Access Policy The mobile device access policy in Exchange allows the administrator to control which type of devices can connect via EAS. It also allows for the quarantine of devices. In Exchange 2013, the mobile device access policy is opened by selecting Exchange admin center > mobile. Good Work EAS Guide 6

11 Exchange Mobile Security The default policy allows for all devices to connect. If you are not using the default policy, please be sure to include the following Good device types in your policy. Device Type GoodiPhone GoodiPad GoodAndroid Applies To Apple iphones Apple ipads All Android Devices Mobile Device Mailbox Policy A mobile device mailbox policy allows an administrator to enforce device policies on a connecting device. All mailboxes must belong to a mobile device mailbox policy and by default, it is the default mobile device mailbox policy. Mobile device mailbox policy settings can be viewed from Exchange admin center > mobile > mobile device mailbox policies. Good Work EAS Guide 7

12 Exchange Mobile Security The default policy is pictured here. As a best practice, a separate policy should be created for Good mobile device mailboxes. The Good Work app will be managed by Good Control. Therefore, EAS security policies should not be enforced for Good Work EAS clients. All security policy enforcement for Good Work clients (i.e., wipe data, lock app, jail break detection, etc.) are administered from Good Control. As mentioned, the default policy is automatically assigned to new mailbox users, and also to those mailboxes that have not been manually reassigned to a non-default policy. Somewhat confusingly, the policy that Exchange Server 2010 and 2013 created automatically during setup is called the Default. However the name Default is not the true indication of which policy is the default. Rather, it is the IsDefaultPolicy property (for Exchange 2010) or IsDefault (for Exchange 2013) which actually determines the default policy. You can see which policy is the default by using the Get-ActiveSyncMailboxPolicy or Get-MobileDevic boxPolicy cmdlet. Good Work EAS Guide 8

13 Exchange Mobile Security Firewall If a firewall exists between the Exchange ActiveSync server and the Good Proxy server, TCP port 443 must be open from the Good Proxy server to the EAS server. For optimal EAS direct push performance, the timeout should be set to 30 minutes. The Good Work client utilizes direct push for EAS notifications when the GEMS Push notification service is unavailable. As such, it is important that the firewall setting noted above is configured properly. For more information about EAS direct push, refer to Restricting EAS Access To block rogue EAS clients from accessing your Exchange server, take the following steps: 1. Keep EAS access restricted to the Good Proxy server. 2. Restrict EAS access to Good devices only via a mobile device access policy. Enabling EAS Approval Delegation You can create a new mail-enabled security group responsible for receiving ActiveSync devices requests using Exchange Management Console (EMC) or using the Exchange Management Shell (EMS) shown here. Good Work EAS Guide 9

14 Good Work EAS Enrollment 1. Create the new group with: New-DistributionGroup -Name "ActiveSync Approvers" -Type "Security" -OrganizationalUnit "itguydiaries.net/security_groups/" -SamAccountName "Exchange ActiveSync Approvers" -Alias "ExASapprovers" 2. Enable Exchange ActiveSync quarantine and configure the notification with: Set-ActiveSyncOrganizationSettings DefaultAccessLevel Quarantine AdminMailRecipients 3. Copy the management role containing Set-CASMailbox ActiveSyncAllowedDeviceIDs cmdlet/parameter with: New-ManagementRole -Parent "Organization Client Access" -Name "ExActiveSync Approval" 4. Remove all other management role entries from the created management role ExActiveSync Approval using: Get-ManagementRoleEntry "ExActiveSync Approval\*" Where {$_.Name -NotLike "Set-CASMailbox*"} Remove- ManagementRoleEntry 5. Create a role group and add the previously created security group [ActiveSync Approvers] with: New-RoleGroup -Name "ActiveSync Device Management" Roles "ExActiveSync Approval", "User Options" -Members "Exchange ActiveSync Approvers" -Description "Members of this management role group have the rights to approve and deny ActiveSync devices" Good Work EAS Enrollment The last step is activating the Good Work client in Exchange ActiveSync. Short-Form Enrollment In the first enrollment screen, the user is prompted for their address and password. Good Work EAS Guide 10

15 Good Work EAS Enrollment The address should be populated automatically. What happens next depends on the Good Work application/policy configuration in Good Control. The Good Work application configuration in Good Control dictates how the Good Work app finds the user s Exchange ActiveSync server. The Good Control administrator has three options: 1. Hard code the Exchange ActiveSync server a useful option in simple environments for which there is only one universal URL to the Exchange ActiveSync server. 2. Hard code the Autodiscover endpoint URL suitable for environments with multiple EAS servers. This option allows the Good Work app to query the autodiscover endpoint to lookup the user s EAS server URL dynamically. 3. Enable Automated Autodiscovery suitable for environments in which the autodiscover endpoint URL is not known. With this option enabled, the Good Work app will use autodiscover to look up the autodiscover endpoint URL, which it will then use to lookup the EAS server URL for the user. Note: As a best practice, only the first or second option is recommended. Long-Form Enrollment Once the user s EAS server is found, the Good Work app will try to authenticate the user based on the address and password that was entered in the first screen. If the user s address is not the same as the user s UPN (user principal name) or the password/ combination is incorrect, the user is presented with the second enrollment screen (long form). This enrollment screen gives the user an opportunity to enter their correct credentials. Good Work EAS Guide 11

16 Troubleshooting If the user is ever presented with the second enrollment screen, they should always enter in their network credentials, consisting of their domain, username, and password. These are the same network credentials that users use to login to their computers. Depending on what the administrator has configured in Good Control, the EAS server field maybe optional. To avoid having users enter in the EAS server field, it is highly recommended that option 1 or 2 from above is preconfigured on the system. For more detailed information on how to configure the Good Work Application/Policy in Good Control, please refer to the Good Work Product Guide and GEMS Administration Guide. Troubleshooting The most common issue with Good Work and EAS is connectivity. Pertinent KB articles explaining how to troubleshoot EAS issues, include: How to test EAS Connectivity How to check EAS policy block Additional Technical References The following technical references and training aids are available online at the URLs provided. Understanding Mobile Device Management Exchange High availability and Site Resilience Exchange Risk Management and Security Guidance Exchange ActiveSync Guidance Understanding Security for Exchange ActiveSync Good Work EAS Guide 12

17 Additional Technical References Understanding Exchange ActiveSync Mailbox Policies Exchange ActiveSync: Frequently asked questions Comparison of Exchange ActiveSync Clients Best Practices for Mobile Messaging Deployment with Exchange Server Controlling Exchange ActiveSync Device Access Reference to Available PowerShell Cmdlets in Exchange Online Microsoft Exchange Conference TechEd Good Work EAS Guide 13

18 Glossary Glossary A Access Key Part of the activation key that is different for every GD application activation. Access keys consist of 15 letters and numbers. Access keys are generated by the enterprise GC server. Activation Key All the credentials necessary for activation of a GD application for an end user. The necessary credentials are a provisioning ID and an access key. AD Active Directory ADSI Active Directory Services Interface ADT Plugin Android Development Tools Plugin Affinities The feature that enables enterprises to allocate their GP servers between their GC servers and their application servers. Allocation can be an absolute division, or based on a priority order, or both. Application Policies The feature that enables GD application developers to add policies that are specific to their application to a GC server. Application policies are defined by developers, using an XML file format. Application-Based Service A GD shared service that is provided by GD applications. An application-based service uses Good Dynamics AppKinetics for communication. Authentication Delegation The feature for transferring authentication of the end user from one application to another. An application for which authentication is delegated does not display its unlock screen, and does not have its own security password. Authentication delegation can be used between two GD applications, and between GD applications and the GFE mobile client. Authentication delegation is controlled by the enterprise administrator through the management console of the respective software product, either GC or GFE Good Mobile Control. Good Work EAS Guide 14

19 Glossary C CIFS Common Internet File System - the standard way that computer users share files across corporate intranets and the Internet. An enhanced version of the Microsoft open, cross-platform Server Message Block (SMB) protocol, CIFS is a native file-sharing protocol in Windows. CLI Command Line Interface COTS Commercial Off the Shelf HTTP Proxy D DC Direct Connect DMZ Demilitarized Zone DMZ proxy for Direct Connect HTTP proxy in the enterprise perimeter network that relays DC connections. DN F For a single domain Active Directory Domain Service, this is the text box for the Distinguished Name (DN) of the starting point for directory server searches. For example: DC=mmycompany,DC=com. The Connector starts from this DN to create master lists from which you can later filter out individual users and groups. For a multidomain Active Directory Domain Service (AD DS) forest, the appropriate action is to leave this text box blank. FQDN fully qualified domain name Good Work EAS Guide 15

20 Glossary G GC GD Good Control server. The GD server component which hosts the web-enabled Good Control management console, or GC console, for managing permissions and settings for Good Dynamics applications. GC resides on a machine belonging to your organization. Good Dynamics. Good product that gives companies a set of development tools to create their own secure apps built on the technology used to create GFE. GD Application ID The unique identifier used throughout GD to identify the application for the purposes of entitlement, publishing and service provider registration. GD Authentication Token mechanism A token-based single sign-on feature that enables an end user to be authenticated by an application server without the need for entry of any further credentials. GD Direct Connect The feature for relaying GD communication through a proxy in the enterprise perimeter network (also known as DMZ or demilitarised zone) instead of through the GD NOC. This feature also enables GP servers to be deployed in the enterprise perimeter network, instead of behind the firewall. GD Enterprise Servers Two GD components installed behind the enterprise firewall: Good Control (GC) and Good Proxy (GP). GD NOC Good Dynamics Network Operations Centre - provides a secure communications infrastructure between the GD Runtime on the mobile device and the GD enterprise servers behind the firewall. GD Runtime The component that is embedded in a mobile application to enable its connection to the GD platform and container. Every GD application includes an instance of the Good Dynamics Runtime. Alternative form: Good Dynamics Runtime GD SDK Good Dynamics Software Development Kit. The products that enable developers to build GD applications from source code in the native programming languages of the mobile platform. Native Good Work EAS Guide 16

21 Glossary source code includes, for example, Objective-C on ios, and Java on Android. Other forms: Good Dynamics SDK Good Dynamics Software Development Kit GD Shared Services Framework for collaboration that includes Application-Based Services and Server- Based Services. Both types of service use a consumer-provider model. The consumer is always a GD application. The provider of an application-based service will also be a GD application. The provider of a server-based service will be an application server. Alternative forms: GD Shared Services Good Dynamics Shared Services Framework GD Shared Services Framework Shared Services Framework GD Wrapped Application An application in which the GD Runtime has been embedded by using the GD Wrapping process. Other form: Good Dynamics Wrapped Application GD Wrapping The product for embedding the GD Runtime in a mobile application executable without requiring access to application source code. Other form: Good Dynamics Wrapping GDN Good Developer Networking. A web portal to support app development. Download the Good Dynamics SDK Download the Good Dynamics Servers Access technical support, the Good Community, and other resources Get notifications for technical updates Get access to Good Dynamics enabled applications Connect with developers and Good ISV partners GEMS Good Enterprise Mobility Server GFE Good for Enterprise GNP Good Notification Push. Protocol that allows notification messages to be pushed from an application server to GD app. Good Dynamics AppKinetics Mechanism for secure exchange of application data between two mobile applications on the same mobile device. AppKinetics data exchange uses a consumer-provider model. One application in the exchange provides a service that is consumed by the other. Good Work EAS Guide 17

22 Glossary GP Good Proxy. The GD server component which provides a secure bridge between the GC server and your enterprise application servers, if any exist, and delivers messages to and from GD applications. GP resides on a machine belonging to your organization. GRP Good Relay Protocol. Protocol for end-to-end secure communications between the GD app and the GP server. GUID Globally Unique Identifier - is a unique reference number used as an identifier and typically refers to various implementation of the universally unique identifier (UUID) standard. See UUID. GW Good Wrapping. The GD server component which can be used to wrap non-gd ios applications with GD technology, allowing you to secure your applications without the need for additional programming or access to source code. GW resides on a machine belonging to your organization. H HTML/CSS/JS Hypertext Markup Language, Cascading Style Sheet, and JavaScript, which are the languages used to code applications in the Adobe PhoneGap MEAP. I IDE Integrated Development Environment IOPS Input/Output Operations Per Second (pronounced eye-ops) is a common performance measurement used to benchmark computer storage devices like hard disk drives (HDD), solid state drives (SSD), and storage area networks (SAN). As with any benchmark, IOPS numbers published by storage device manufacturers do not guarantee real-world application performance. ISV Indepdent Software Vendor - a third-party software developer or reseller who has executed a partnership agreement with Good. Good Work EAS Guide 18

23 Glossary J JKS Java keystore JSON JavaScript Object Notation, the format used for AppKinetics service definitions files. JSON is a standard. K KCD Kerberos Constrained Delegation. A single sign-on feature that enables an end user to be authenticated by an application server that uses Kerberos, without the need for entry of further credentials. KDC Key Distribution Center. A logical component of the Kerberos infrastructure L LDAP Lightweight Directory Access Protocol - a directory service protocol that runs on a layer above the TCP/IP stack LUN In computer storage, a logical unit number, or LUN, is a number used to identify a logical unit, which is a device addressed by the SCSI protocol or Storage Area Network protocols which encapsulate SCSI, such as Fibre Channel or iscsi. LUSE Logical Unit Size Expansion M MAM Mobile Application Management MMC Microsoft Management Console Good Work EAS Guide 19

24 Glossary MyTerm O OWA Outlook Web Access P Provisioning ID Part of the activation key that is the same for all GD applications activated by the same end user at the same enterprise. The provisioning ID is typically the end user s enterprise address. R Relay Server Server in the NOC that provides communications between the GD app and GP servers. Repository In GEMS-Docs, a repository is shared data source designated by a Display Name, a Storage Type (File Share or SharePoint), and a Path. Each repository is defined with user access permissions. Repositories can be further organized into Lists. When a repository is member of a list, it can inherent the user access permissions defined for the whole list. RTT Round trip time S SDK Software Development Kit. Typically a set of software development tools that allows for the creation of applications for a certain software package, software framework, hardware platform, computer system, video game console, operating system, or similar platform. Server Clustering A feature within GD that enables enterprises to deploy groups of servers as single nodes in their GD infrastructure. The following servers can be deployed in clusters using this feature: GP, GC, application servers. Good Work EAS Guide 20

25 Glossary Server-Based Service A GD shared service that is provided by application servers. A server-based service could use any communication technology, including HTTP or TCP sockets. Service Discovery Feature that enables a prospective consumer of a shared service to query for available providers of the service. The result of a service discovery query will be a list of GD applications, for an application-based service, or a list of servers, for a server- based service. Alternative forms: AppKinetics Service Discovery Service provider registration Activity of adding a GD application or application server to the list of providers of a particular service. The list of service providers is hosted in the GD NOC. Share In GEMS-Docs, a share is synonomous with a repository and can be one of two storage types: File Share or SharePoint. See Repository. SPN Service Principal Name SSL secure socket layer T TLS transport layer security U UI User Interface UPN - User Principal Name In Active Directory, this is the name of the system user in address format UUID Universally Unique Identifier - an identifier standard used in software construction. A UUID is simply a 128-bit value. The meaning of each bit is defined by any of several variants. For humanreadable display, many systems use a canonical format using hexadecimal text with inserted Good Work EAS Guide 21

26 Glossary hyphen characters. For example: de305d54-75b4-431b-adb2-eb6b9e The intent of UUIDs is to enable distributed systems to uniquely identify information without significant central coordination. UX User Experience Good Work EAS Guide 22