WinMagic Encryption on HC3 Using SecureDoc 7.27

Transcription

1 WinMagic Encryption on HC3 Using SecureDoc 7.27 Reference Guide Any information listed here is not a substitute for the product s user guide or support and is not covered under the support and warranty for the HC3 system. This is meant only as a reference guide as it may relate to the Scale Computing HC3 system.

2 WinMagic Encryption on HC3 Using SecureDoc 7.27 You can find the most up-to-date technical documentation on the Scale Computing Portal at: The Scale Computing site also provides the latest product updates and information: Provide feedback on this document at: Contact support at: US: SCALE-59 ( ) Europe: Document Version 1.0: Corporate Headquarters West Coast Office EMEA Office The Union Ritch Street Saunders House 525 South Meridian Street Suite The Mall Indianapolis, IN San Francisco, CA London P W5 3TA United Kingdom SCALE-59 ( ) 2

3 Contents Introduction 4 Requirements 5 Operating System 5 RAM 5 Hard Drive 5 CPU 5 Database 5 Installation 6 Install Required Windows Features 6 Install the SecureDoc Encryption Server Software 8 SecureDoc Encryption Server Configuration 11 Create the Key File and Database 11 Enable the SDConnex Service 14 Prepare For Client Installation 16 Create A Profile 16 Create the Installation Package 17 Client Installation on HC3 Virtual Machines 20 How To Monitor Encryption Status 22 Feedback, Support, and Disclaimer 23 Document Feedback 23 Technical Support and Resources 23 Disclaimer 23 3

4 Introduction This guide provides the basic installation and configuration process for installing the SecureDoc Encryption Server (SES), installing SDConnex, creating a profile and package, and finally encrypting a client consisting of a virtual Windows 2012 R2 server. The installation of the SES and client were completed on a fully patched fresh installation of Windows 2012 R2 Standard for this document and use SQLExpress for the database store. This document is intended for system administrators and assumes a working knowledge of Windows Server, databases, and local area networking. This document is not representative of the full features provided by SES. While SecureDoc offers protection to a wide assortment of potential company related work devices, this document is focused on protecting virtual machines running on a Scale Computing HC3 system. SecureDoc offers full disk encryption options that can be installed in a stand-alone or centrally controlled configuration. Both configurations can protect internal or external drives, USB/firewire drives, SD cards, RAID arrays, CD/ DVD drives, and more. SecureDoc offers the ability to do full disk encryption, file or folder encryption, and container or virtual drive encryption. The encryption of the devices is done with a very strong 256-bit AES encryption algorithm. The diagram below depicts an example SecureDoc deployment on a Scale Computing HC3 system. The three components of the SecureDoc solution (SES, SDConnex, and the key database) can be deployed on a single server or on three separate servers. However, all three servers must reside on the same LAN. 4

5 Requirements The following are requirements for the central SecureDoc Encryption Server (SES) installation and database creation. Ensure your server meets the minimum requirements for the SES installation. Operating System Any 32-bit or 64-bit server operating system from 2008 and onward.net Framework 4.0+.NET 3.5* Windows Identity Foundation 3.5* RAM Minimum of 512 MB 1 GB or more is recommended Hard Drive Minimum of 4 GB 40 GB or more is recommended CPU Intel Pentium (minimum) See the full detailed requirements on the WinMagic website here: Database A separate SQL instance will be required as a database is created as part of the SES configuration. The SQL instance can be a separate server or on the SES. An instance of SQLExpress is used for the purposes of this guide. The installation and configuration of the SQL instance is outside the scope of this document. Have the following information available in regards to the SQL instance: The domain of the server housing the SQL instance The full name of the server housing the SQL instance The System Administrator credentials for the SQL instance (this should have been configured during the SQL installation) 5

6 Installation Ensure all of the necessary Windows features are installed and everything is in place before installing the SecureDoc Encryption Server (SES) software. Install Required Windows Features The.NET 3.5 framework and Windows Identity Foundation 3.5 are requirements for SecureDoc. These features are not automatically installed during the Windows server OS installation and require the manual installation steps found below. NOTE: These features may require a server reboot after installation. 1. Go to SERVER MANAGER and then ADD ROLES AND FEATURES. 2. Click NEXT on the BEFORE YOU BEGIN screen. 3. Select ROLE BASED OR FEATURE BASED INSTALLATION and then click NEXT. 6

7 4. Click the check-box next to.net FRAMEWORK 3.5 FEATURE. 5. Scroll down through the list and click the check-box next to WINDOWS IDENTITY FOUNDATION Click INSTALL. 7. Once the installation is complete click CLOSE. 8. Reboot the server if required. 7

8 Install the SecureDoc Encryption Server Software The SES provides a central location to easily manage company-wide devices and data. All encryption related information (keys, key files, user, and device information) is centrally stored and managed. It also allows administrators to remotely control clients and assist users who have encryption-related issues. The SES console allows SecureDoc to be deployed to any client regardless of network access type or client OS. SecureDoc can be deployed to remotely connected or LAN clients running Windows, Mac, or Linux operating systems. NOTE: This version of SecureDoc does not work on Windows 10. The SecureDoc console requires administrative rights to function properly. NOTE: The SES software may require a server reboot after installation. 1. Download the SES_7.27.1_Setup.exe installation file from WinMagic. 2. Run the installation file to begin. You may be required to verify the installation by Windows security; click RUN. 3. The installation files will be extracted and the installation wizard will appear. 8

9 5. Click NEXT to begin the installation. 6. Accept license terms and click NEXT. 7. Enter your user name and organization and click NEXT. 9

10 8. Select the location to install the application and click NEXT. 9. Click INSTALL. 10. You may be prompted to restart your server after the installation is complete. Click YES to restart immediately. 10

11 SecureDoc Encryption Server Configuration Once the SecureDoc Encryption Server (SES) is installed you will need to configure the SES key(s) and database as well as the SDConnex service. Create the Key File and Database 1. Click START > SECUREDOC > ENTERPRISE SERVER. You will see the LOGIN TO THE DATABASE prompt. 2. Click CREATE KEY FILE to generate a new key. 3. The CREATE KEY FILE prompt will be shown. Click BROWSE to navigate to the location where you want to store the key file. NOTE: If possible, create the key file in the same folder where the database files are stored. 4. Enter a strong password in the PASSWORD field. This password will be required to log into the key file and access the SES database. 5. Confirm your password in the CONFIRM PASSWORD field. 6. Enter an ID in the USER ID field. This will be for the administrator that will log into the SES. This does not have to be a domain ID. 7. Enter a reference name for the key in the KEY NAME field. 8. Click OK once all the information is entered and verified. 9. The LOGIN TO THE DATABASE screen re-appears. 10. Use BROWSE to find the location of the key file that was created (if it does not automatically populate). 11

12 11. Enter the password that was created. 12. Click LOGIN KEY FILE to submit the key. 13. Click CREATE NEW DATABASE. A new screen will appear. 12

13 14. If the database server is in a different domain, enter the name of the domain. In most cases, the SQL server and SES server will be in the same domain and this field can be left blank. 15. Type the <MACHINE_NAME>\<INSTANCE_NAME> in the SERVER NAME box. SQLExpress installed on the same server as the SES software is used for the purpose of this document. 16. Type in a name for the database in the DATABASE NAME box. 17. Check the box next to USE SYSTEM ADMINISTRATOR ACCOUNT TO CONNECT TO SQL DATABASE. 18. Type in the SYS ADMIN USER NAME and the SYS ADMIN PASSWORD. These were created during the SQLExpress install for this document. 19. Click FINISH. 20. You will be presented with the ADMINISTRATOR ACCESS RIGHTS screen. This will set the access permissions for the SES administrator. 13

14 21. Not all options will be available as this screen is for the main administrator. Choose which key to use in USER S DEFAULT KEYS. Consult the SecureDoc User s Manual to see how to add additional administrators. 22. Click SAVE. 23. The SES software will generate the keys. This may take a few moments. 24. The SECUREDOC ENTERPRISE SERVER SQL PLUS window will open once the key generation is complete. Enable the SDConnex Service SDConnex is the communication engine for SecureDoc and runs as a service on the SES. SDConnex must be running in order for information to be sent or received between the client devices and the SES console. 1.Go to START > SECUREDOC ENTERPRISE SERVER > SECUREDOC SERVICES > CONFIGURATION. 2. Select AUTOMATIC STARTUP on the SECUREDOC SERVICE S CONFIGURATION screen. 3. Select LOCALSYSTEM on the SECUREDOC SERVICE S CONFIGURATION screen. 4. Click REGISTER to confirm the choices and move to the SDConnex configuration screen. 14

15 5. The KEYFILE PATH should automatically propagate. If it does not, enter the path where the key was saved in the previous section. 6. Enter the password that you gave the key file in the KEYFILE PASSWORD box. 7. Enter the SERVER\INSTANCE for the database that was created in the previous section. 8. Enter the DATABASE name for the SES keys that was created in the previous section. 9. Enter the proper credentials in the SQL SERVER LOGIN or use WINDOWS LOGIN depending on your unique environment. 10. Click APPLY. 15

16 Prepare For Client Installation Profiles and Packages set the parameters for the SecureDoc installation that will be performed on client devices. The profile is what defines the installation configuration. The package will contain a reference to the profile for the client configuration. The profile contains most of the configuration information and can be modified to make changes to the client after the initial installation. However, any changes made to a package must be manually applied to the client in order for the changes to be implemented. Create A Profile 1. Go to SECUREDOC ENTERPRISE SERVER SQL PLUS. 2. Click PROFILES. 3. Click ADD in the upper left corner. 5. Select WINDOWS DEVICE from the drop down menu in PLEASE SELECT PROFILE TYPE. 6. Click OK. 7. Enter a PROFILE NAME and COMMENTS (optional). 8. Click on BOOT CONFIGURATION. You will be brought to the GENERAL options screen. 16

17 9. Change VIRTUAL MBR to NO. 10. Change SPECIAL Y MODE (HEX) to Check the box next to ENABLE SUSAM. 12. Click OK. The SECUREDOC PROFILE screen will reappear. 13. Click SAVE. Create the Installation Package The installation package is a set of files that will be copied to the client device in order to install and configure the client for encryption. SecureDoc will place these files in a subfolder within the initial install path of the software. For large deployments, packages can be created to be distributed via SCCM. However, for our purposes, we will manually copy the files to the server to be encrypted. 1. Go to SECUREDOC ENTERPRISE SERVER SQL PLUS. 2. Select INSTALLATION PACKAGES. 3. Click ADD in the upper left corner. 4. From the drop down menu in PLEASE SELECT PACKAGE TYPE, select WINDOWS DEVICE. 5. Click OK. 6. The INSTALLATION PACKAGE SETTINGS window will open on the GENERAL screen. 17

18 7. Enter a PACKAGE NAME and COMMENTS (optional). 8. Click on the BROWSE button to the right of APPLY THIS SECUREDOC PROFILE DURING THE REMOTE INSTALLATION. 9. Select the profile created previously from the dropdown menu. 10. Change CLOUDBOOTPATH at the bottom of the options screen to ROOT_FOLDER. 11. Click OK. 12. Move to the KEY FILE options view on the left menu bar. 18

19 13. Enter an INITIAL PASSWORD. 14. Click OK. 15. Right click on the Installation Package you created and select CREATE PACKAGE FILES. 16. Once the files are completed, you will get a window with the location of the files. Notate the location for reference. 17. Click OK. 19

20 Client Installation on HC3 Virtual Machines This document assumes the guest OS is a version of Microsoft Windows Server for client installation. NOTE: One or more reboots of the guest OS will be required to finalize login access for any SecureDoc encrypted machines. 1. Login to the HC3 virtual machine (VM) on which you wish to enable WinMagic SecureDoc encryption. 2. Use the install path notated in the previous section to connect and/or open the share or folder hosting the installation package. 3. Copy the SECUREDOC_64 application for 64-bit servers or the SECUREDOC_32 for 32-bit servers. Also copy the PACKAGESETTINGS, SDCONNEX and SPPROFILE.SPF to the virtual machine to be configured. 4. Double click either SECUREDOC_64 or SECUREDOC_32 (whichever is applicable to your instance) to begin the SecureDoc installation. 5. You may receive a Windows security prompt to proceed; click RUN. 6. SecureDoc will automatically be installed and begin encrypting the virtual machine s disks. NOTE: See How to Monitor Encryption Status for details on checking encryption progress. 7. A green padlock icon in the System Tray will appear once the encryption is complete. 20

21 8. Reboot the virtual machine. 9. A login screen similar to the below will appear after the reboot. 10. Enter your Windows password in the PASSWORD box. If the KEY FILE box is left blank it will assume the specified USER DEFAULT KEY FILE configured in previous steps. 11. Open the SECUREDOC ENTERPRISE SERVER console. 12. Right-click on the machine in the right-hand pane and select ACTIVATE AUTO-BOOT. The machine will now boot to the Windows login screen going forward. 21

22 How To Monitor Encryption Status When you log onto a virtual machine that has been encrypted by SecureDoc you will see a SecureDoc status icon in the system tray. While the machine is being encrypted by SecureDoc you can view the status from either the SecureDoc Console machine or from the local server being encrypted. On the local server being encrypted you can find the progress during the encryption process in the system tray by hovering over the SecureDoc icon. The progress and the estimated encryption time remaining will be displayed. When the icon changes to a single yellow circle and blue padlock the encryption is complete. If you hover over the icon you can see the details of the protection. You can also go to the SecureDoc Console and open SecureDoc Enterprise Server SQL Plus. In the FOLDERS window will be a list of protected devices. The ENC column shows a status of the encryption process. When the bar is green, encryption is complete. For additional features or more detailed setup options, consult the SecureDoc Enterprise Server User Manual or your WinMagic representative. 22

23 Feedback, Support, and Disclaimer Document Feedback Scale Computing welcomes your suggestions for improving our documentation. If you have any comments or suggestions please send your feedback to Technical Support and Resources There are many technical support resources available for use. Access this document, and many others, at Online Support You can submit support cases and view account information online through the Portal at You can also Live Chat with support through during standard hours Monday-Friday 8-8. Telephone Support Support is available for critical issues 24/7 by phone at SCALE-59 ( ) in the US and at in Europe. Telephone support is recommended for the fastest response on priority issues, and the only response after standard Support hours. Professional Resources Scale Computing offers many professional service options for both remote and on-site assistance in getting your system off the ground quickly and knowledgeably. Contact your Scale Computing sales representative today to discuss our offerings that include options like the HC3 ScaleCare Network Configuration, the HC3 ScaleCare Migration, or even the HC3 ScaleCare Full Implementation. Find additional information at Disclaimer Any information listed here is not a substitute for the product s user guide or support and is not covered under the support and warranty for the HC3 system. Scale Computing is not responsible for any issues or damages arising out of the use of this reference guide. 23