Link Platform Manual. Version 5.0 Release Jan 2017

Transcription

1 Version 5.0 Release Jan 2017 Link Platform Manual

2 Copyright 2017 NetLinkz. All Rights Reserved. No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form or by any means without the written permission of NetLinkz. Basic Rights of Use Thank you for choosing NetLinkz. Licencing a single product entitles you to begin using the product for the specific purposes of the product. Additional licencing might be required to use additional features. For more information about NetLinkz, visit us at Trademarks Microsoft, Windows, Windows NT, and Vista are registered trademarks of Microsoft Corporation. Other brand and product names are registered trademarks or trademarks of their respective holders. Statement of Conditions To ensure proper operational function and/or reliability of the product is maintained, NetLinkz reserves the right to make changes to the product described within this document, via electronic means or otherwise, without notice. NetLinkz does not assume any liability that may occur due to the use, or application of, the product described herein.

3 Table of Contents Introduction 5 Port Forwarding Requirements 5 Logging In 6 Main Menu 7 Administration Features 8 User Manager 9 Adding and Editing Users 10 Creating Groups 11 Assigning Users to Groups 11 Directory Services Users and Groups 12 Certificate Manager 12 Uploading SSL Certificates 12 Removing SSL Certificates 13 Network Settings 14 Licencing 16 Activating a Licence 16 Viewing a Licence 17 Directory Services 18 Directory Service Management 18 Adding or Editing Directory Service 19 Directory Service Authentication 21 Authentication 22 Google Authenticator 22 SSH Management 25 Adding or Editing a SSH Key 26 Log Archive 27 Log Archive Settings 27 Backup 28 Secure Copy Key 28 Backup Settings 29 Backup Schedule 30 Restore 31 Upload Backup 32 Importing Users 33 Link Networking 34 Adding and Editing a Link Network 34

4 Configuring a Link Network 35 Enrolled Devices 37 Approving Devices 38 Device Connectivity 38 Link Connect / Link Server 39 Link Gateway 40 Link Platform 42 Link Desktop 42 Configuring Remote Connections 43 RDP Connection Options 44 VNC Connection Options 47 SSH Connection Options 49 Link Web 50 Creating Reverse Proxies 50 Backends 50 Frontends 52 Authentication 56 Link 57 Establishing Proxies 57 Release Notes 58 What s New for Error! Bookmark not defined.

5 Introduction The Link Platform is the configuration and administration interface for the NetLinkz product suite, including Link Connect, Link Server, link Gateway, Link Desktop, Link Web and Link . This manual will cover navigating the Link Platform and all the features available. Port Forwarding Requirements Each feature of the Link Platform requires certain ports forwarded to it in order to function. Ports do not need to be opened for any feature not in use. The Link Platform Web Service ports are required for normal functioning of the product. If you intend to run the Link platform in an isolated environment, please contact your installation technician. Service TCP Ingress TCP Egress UDP Ingress UDP Egress Administration & Maintenance , 80, Link Desktop 443, 7717 Link IMAP 143, 993 Link POP3 110, 995 Link SMTP 25, 587 Link Network , , 7719 Link Web 80, 443 or other port configured for HTTP/HTTPS 80, 443 or other port configured for HTTP/HTTPS Link Platform Alerts 25 Link platform Web Services , You may need to open more egress ports if your Link Platform is accessing external resources for services such as Link or Link Web. 5

6 Logging In An Administrator account is required to make any configuration changes in the Link Platform. It is highly recommended to change your password the first time you log in. After a default installation, the default username is admin, and the default password is password. After performing a custom installation, the username is admin, and the password is the unique passcode configured during custom installation Login: Enter your credentials here to log into the Link Platform. 2. Forgot Password: You can reset a password if the username and account address are known. 2 6

7 Main Menu The landing page of the Link Platform shows quick start links for each service along with access to the logged in user s details Sidebar: Links to all the Link Platform s Administrative content. 2. Quick Launch: Fast access links to the most commonly used sections. 3. User Details: A shortcut to view the logged in user s profile. 7

8 Administration Features The Administration menu provides access to a variety of features for modifying the Link Platform. The options available will vary depending on your Link platform s licence. For example, Network Settings may not be available in some Cloud deployed instances. 8

9 User Manager User accounts provide access to the Link Platform and its features, such as Link desktop and Link Network. There are two classes of users: Administrators: assigned rights to be able to setup and/or configure the Link Platform while administering a user s access. General Users: users who can only access features (Link Network, Link Desktop) assigned to them by an Administrator. There is no limit to the number of groups that can be created Add User: Creates a new User account. 2. Add Group Button: Creates a new group for categorizing users. 3. Group Drop Down List: Shows the entire list of users, denoted as All Users, or filters by selected group. 4. Enable Button: Enables all users listed in the currently selected group. 5. Add Button: Adds a new user into the currently selected group. 9

10 Adding and Editing Users Add users to the Link Platform by clicking the add user link or select a user in the list to edit it Username: Type a unique name for the User that isn t already in the Link Platform Provide the user s address. This is required for a user to be able to reset a password and receive alerts from the Link Platform. 3. Password: Type a password for the User account. This will allows access to the Link Platform. 4. Other Options: Full Name Cell Phone Enable Account Optional and only used for reference Optional but may be required by some integrated features Controls whether the user can log in and access features provided by the Link Platform 10

11 Global Administrator Controls whether the user is an Administrator with complete control over the Link Platform Creating Groups User groups can be used to organize users and help when assigning permissions. To create a new user grouping, click the Add in the Group header. Name the group and provide a brief description for future reference. Assigning Users to Groups User memberships in groups can be managed on a per-user basis or on a per-group basis. In either case, use the dropdown list to select users. Typing in the dropdown will search or filter to a specific user. 11

12 Directory Services Users and Groups If the Link Platform has been configured to synchronize users and groups from an Active Directory server, then these users and groups will be visible in the User Manager. There are however, a few notes on what an Administrator can do with these users and groups: A Directory Service is configured through the Directory Services Administration Feature. When configured an admin can synchronize now or wait for the scheduled time to trigger. By default, user accounts imported from a Directory Service are initially disabled to safe guard against accidental account exposure. An Administrator is not permitted to delete or edit a user or group, which is managed by a Directory Service, as all management should be performed through tools to manage the Directory Service, such as Active Directory. Certificate Manager Secure Socket Layer (SSL) certificates are used to create a secure encrypted link between a server and a user s application such as a browser or client. The use of SSL certificates is critical when protecting the transfer of sensitive data such as login credentials and personal information. The default SSL certificate installed on the Link Platform is self-signed. Uploading SSL Certificates Click Upload Signed Certificate in Certificate Manager. 12

13 1 Makes a Certificate active on the Link Platform Certificate Details: Type a Certificate Name to identify the new certificate. 2. Choose File: Opens a file dialog box to select the PFX file for uploading. The PFX file should contain your public certificate, private certificate and intermediate certificates. 3. Password: if your private key is password protected, provide it here. Removing SSL Certificates As certificates expire or become obsolete, it is recommended to remove them from the Link Platform. Currently assigned certificates or any in use by a Link Web cannot be removed. To delete a certificate, select it in Certificate Manager before clicking Delete. 13

14 Network Settings The Network Settings page allows the control of various aspects of your specific Link Platform s physical network adapters. Incorrect settings may inhibit normal functioning of the Link Platform General Settings: Sets which adapter to use as the Gateway Device. 2. Override Settings: Uses these settings to override any static or DHCP defined values. Host Name should match your assigned SSL certificate. 3. Active Settings: Displays the current values reported by the system. 4. Adapter List: Shows physical adapters. Click one to edit the adapter settings. 14

15 Select any field to edit the address. DHCP and On Boot may also be turned on. Inputting of incorrect numbers will inhibit the Link Platform from working correctly. 15

16 Licencing The Link Platform keeps track of licence data for Link Web servers, Link Network devices and Link Desktop Hosts. This includes information on the total number of licences acquired, the number already in use, validity dates and key number. Activating a Licence To enter or change the licence key, click Activate New Licence. Enter the licence key, and click Activate. 16

17 Viewing a Licence Once the licence is activated, details will be displayed on the main Licencing screen Update: The Link Platform automatically checks for updates to your licence, but you can click Update to check immediately. 2. Period of Validity: Indicates dates of your licence period. 3. Entitled to Use: Displays your Total licences available and the Number in use. 17

18 Directory Services The Link Platform can be integrated into one or more Directory Service servers for authenticating users and management of authorized access to features of the Link Platform. Microsoft Active Directory (AD) is currently supported as a Directory Service. Directory Service Management An Administrator can configure the Link Platform to synchronize user and group information from one or more AD servers. It is possible to configure synchronization of the entire directory or to a subtree of the directory tree by assigning a base name. The screen below provides a general overview of Directory Services Sync Now: Forces an immediate synchronization of user and group information from the server providing the Directory Service. 2. Add: Creates additional Directory Service synchronization settings. 18

19 Adding or Editing Directory Service Add Directory Service synchronization settings to the Link Platform by clicking Add or select an existing Directory Service setting in the list to edit it Directory Service Name: A descriptive name for the particular settings. 2. Server: The Directory Server s version 4 IP address. 3. Port: The port number on the server that provides access to the Directory Service. 4. Encryption Type: The type of encryption to be used between the Link Platform and the Directory Service. TLS SSL TLS is the default option to access Active Directory. The default ports for this encryption are 389 or Active Directory Services can be accessed using Secure Socket Layer (SSL) for encrypted communications to the server. The default ports for this encryption are 636 or

20 Insecure An Administrator may choose to connect using no encryption. This is not recommend for production systems. However, it is available for those Active Directory servers onto which no SSL certificate is deployed. 5. Base DN: The distinguished name of the path within the directory tree from where user and group information is to be synchronized. An example base is: CN=users, OU=sales, DC=domain, DC=local. 6. Service Authentication: The login credentials of the user account, which will be authenticating to the Directory Service for synchronizing user and group information to the Link Platform. It is recommended to create a specific user in the Directory Service for this purpose. For Active Directory, the account should be: An account with read-only access to the directory tree Configured with a password that does not expire May reside outside of the directory tree represented by the Base DN from which user accounts are synchronized 7. Sync Frequency: Controls the frequency of the synchronization of the Directory Service by the Link Platform. After configuring, all users and groups contained under the specified Base Distinguished Name (BaseDN) will be imported into the Link Platform and available for management through User Manager. By default, all users imported from a Directory Service are initially disabled access to the Link Platform. An administrator will need to enable each user before they will be able to access features on the Link Platform. Directory Service: Encryption It is recommended for a Directory Service to have suitable encryption between the Link Platform and server. The Link Platform provides support for SSL and TLS encrypted communications. If encryption cannot be enabled due to a Directory Service configuration, it is strongly recommended to connect the Directory Service to the Link Platform through a Link Network. Directory Service: Read Only Access The Link Platform does not have any ability to make changes to the Directory Service. It has the ability to only read user and group information and authenticate a user via an LDAP bind to the Directory Service. 20

21 Directory Service Authentication When a Directory Service is configured, synchronized to the Link Platform and users are enabled by an administrator, those users will be able to log in with their Directory Service credentials. The username they provide to the Link Platform to authenticate is their User Principal Name assigned to their account in Active Directory. The format of a UPN is <user_name>@<domain_name>. The password for the account is managed entirely through management tools provided with your Directory Service. Directory Service: Passwords User passwords are not cached or synchronized to the Link Platform. When the password for an account is changed through the Directory Service, then that password change will take effect immediately User accounts in Active Directory, requiring access to the features of the Link Platform, will need to be configured with a User Principal Name. The built-in Microsoft accounts or User accounts created on the Windows Server before the Microsoft Active Domain Services role is applied will not have a User Principal Name assigned and will not appear as users on the Link Platform. It is recommended not to provide UPN details to the built-in accounts, unless you understand the risks involved. Any User account disabled through Active Directory will have their corresponding account on the Link Platform disabled during the next synchronization window 21

22 performed by the Link Platform. Any User account re-enabled through Active Directory will not have their corresponding Link Platform account automatically re-enabled on the Link Platform. Administrators must grant access again through the Link Platform. For scenarios where a firewall exists between the Link Platform and an Active Directory Domain Controller, it is recommended that a Link Network be constructed with the Link Platform and Domain Controllers being participants. This will ensure an appropriate level of isolation of access to Directory Services from users or devices assigned to other Link Networks managed on your Link Platform. It is recommended that the Link Platform be configured to synchronize from the global catalog of the Active Directory Domain Controller. If accessing the global catalog is not possible, ensure that the DNS settings for the Link Platform point to the DNS service on your Active Directory Domain Controllers. Authentication The Link Platform can use multi-factor authentication (MFA) to enhance security. MFA will apply to Link Platform logins automatically and can optionally be turned on for Reverse Proxies. Google Authenticator Google Authenticator uses a Time-Based One Time Password (TOTP) algorithm. Users will need to install the Google Authenticator App on their mobile device and synchronize it with the Link Platform. Toggle the switch to turn on Google Authenticator 22

23 After enabling, all users will be asked to enroll with a device when they log into the Link Platform. They will be presented with a code to enter into the Google Authenticator App. Once enrolled, users will not be able to log in without using Google Authenticator, and will be prompted to enter a TOTP code after they have logged in with their username and password. 23

24 Administrators can reset a user s enrolment from a button on the User Manager, available when Google Authenticator is enabled. 24

25 SSH Management SSH access to the root user account on the Link Platform can be configured to allow password-based logins (the default) or SSH key-based authentication Allow SSH logons: Toggles to allow password authentication for SSH connections to the Link Platform. 2. Add: Registers a new SSH key into the root account. 3. Authorised Key for Root Account: Lists details of each SSH key authorized to log into the Link Platform through SSH, whether the key is currently enabled or disabled. Click on a listed key to edit that SSH key. 25

26 Adding or Editing a SSH Key Public SSH Key: Pasted public SSH key must be in OpenSSH protocol 2 format and may be either a RSA public key or a DSA public key. 2. Enabled: Toggles to enable or disable the key. If disabled, then authentication involving this key will be rejected. 26

27 Log Archive Log archive allows log data to be transferred to a remote file server for offsite storage. When configured, log files are automatically archived and transferred at midnight. A manual archive can be performed at any time. Log Archive Settings The remote server configuration settings can be entered after the Secure Copy key has been saved to the remote server Hostname: The host name or IP address of the remote server, running SSH. 2. Port: The port for the SSH service (default 22). 3. Username: The username of the shell account into which the Secure Copy Key has been deployed. 4. Path: The location onto the destination server where the log files are to be stored. The location must end with a trailing / and may be either an absolute path (e.g.: /path/to/backups/) or a path relative to the home directory of the specified username (e.g.: path/to/backups/). 27

28 Backup The configuration of the Link Platform can be backed up offsite to a remote location. The backup can be scheduled to occur at chosen times of the day or manually initiated. Secure Copy Key The first step in configuring remote backups or Log Archive is to copy the Secure Copy public key into a shell account on the destination server. Typically, the public key is pasted as a line into the file located at /home/<username>/.ssh/authorized_keys, on the destination server Copy: Copies the public key to your clipboard. 2. Re-Generate: Creates a new public key. 28

29 Backup Settings This configures an offsite location in which backup files are transferred to a remote server by the Link Platform. The Link Platform identifies itself to the remote server using the corresponding private key of the Secure Copy key which has been deployed to the remote server Hostname: The host name or IP address of the remote server, running SSH. 2. Port: The port for the SSH service (default 22). 3. Username: The username of the shell account into which the Secure Copy Key has been deployed. 4. Path: The location onto the destination server where the backup files are to be stored. The location must end with a trailing / and may be either an absolute path (e.g.: /path/to/backups/) or a path relative to the home directory of the specified username (e.g.: path/to/backups/). 4 29

30 Backup Schedule Specific times can be selected for daily Link Platform backup. When a scheduled backup occurs, a backup file will be transferred from the Link Platform to the location on the backup server, as specified in the Path field. The name of the backup file will take the form of <hostname>-<timestamp>.tar.bz2. This backup file can restore the Link Platform to the state at the time the backup was performed. Only when an offsite location is configured can a backup be instigated manually or automatically at a scheduled time. 30

31 Restore To restore a backup a user must first have a copy of a backup file on their local computer. The name of the backup file will take the form of <hostname>- <timestamp>.tar.bz2. A valid address must be provided in the user account used to perform the restore. When started, the restore process will temporarily stop all services on the Link Platform. An notification will be sent when the backup is complete, and all services have been restarted. For services to be fully operational, the restored Link Platform instance must be licensed either before the restore or immediately afterwards. 31

32 Upload Backup Backup files made from an older Link Platform release can be uploaded to a more recent version Backup File: Displays the backup file to restore. 2. Reset Google Authentication Enrolments: Forces all users, who have been restored from the backup, to re-enroll their account with Google Authenticator. 3. Restore: Begins the restore process. 32

33 Importing Users Rather than adding users manually through User Manager, many users can be imported using a CSV (comma-separated values) file. From the Import Users screen, click Choose File to select a CSV file. Import Summary displays the outcome of each import along with any possible issues for each user. 33

34 Link Networking Link Networking creates Virtual Networks using NetLinkz s patented broker and peer technology. Use Link Networking to easily create individual virtual networks to securely connect devices or networks to each other. Because each Link Network can operate independently from each other, multi-layered networks can be created without any additional hardware. The Link Platform broker facilitates connectivity between your devices, but does not join the network or decrypt any of the traffic. Adding and Editing a Link Network Click ADD on the Link Networking screen to create a new network, or select a network name from the list to edit an existing network. 34

35 Configuring a Link Network View Devices: View list of all devices enrolled in this network. 2. Name: Enter a unique Name for the network. 3. CIDR: Enter the IP range for all devices on the network using CIDR format. Currently valid CIDR network ranges are limited to 24 bit subnet masks, ie X.Y.Z.0/24 4. Encryption Cipher: The Cipher Type to use for the encryption on this network. This can be AES or Blowfish. 5. Invitation URL: The URL used to establish a connection to the network. Administrators provide this URL to users that have devices which are to be connected to the network. 35

36 6. Allow devices to enroll: This switch toggles the ability to add new devices to the network 7. Generate a new Invitation URL: Enabling this switch generates a new invitation URL and prevents devices from being enrolled using the previous URL. 8. Automatically approve devices: Disabling this switch prevents devices from being able to access the network until an administrator has approved the device. 9. Enrol the Link Platform: Enabling this switch adds the Link Platform to the network. 36

37 Enrolled Devices To view a list of all devices enrolled in a network click the Devices Approved / Enrolled link. The Devices page shows a list of all devices currently approved on the network Edit Network: Link to the Edit Network page. 2. Unapproved Devices: Link to devices that are awaiting approval. 3. FQDN: Fully Qualified Domain Name for the device on the network. Clicking this link takes the user to the edit page for the device. 4. IP Address: The IP address of the device on the network. 5. Product: The type of Link software running on the device (i.e Link Connect, Link Gateway ) 37

38 6. OS: The operating system of the device. 7. Last Seen: Indicates the last time a device was connected to the network. Clicking on this link displays additional device connectivity information. Approving Devices The Devices Awaiting Approval page lists all devices that have been enrolled but not approved for use on the network. To approve a device click the Approved toggle switch and click Save. Once a device has been approved it will be able to transmit data across the network. Device Connectivity The Device Connectivity page displays the bytes sent/received and latency between the current device and every other device registered on the network. 38

39 Link Connect / Link Server The Edit page for a Link Connect device allows the administrator to statically assign the IP address of the device, or to publish the routes of any networks connected to this device to all devices on the Link Network. If routes are published to the network, the device becomes a Link Server View Connectivity: Link to the Device Connectivity page. 2. FQDN: The fully qualified domain name of this device. 3. IP Address: The IP address of this device on the network. 4. CIDR: If the device has other networks attached, entering the network range in CIDR format and enabling the network will publish the routes to all devices on the Link Network. 5. Enable: Enabling an attached network publishes its routes to all devices on the Link Network. Publishing network routes changes the device to a Link Server. 6. Add: add a new network CIDR. 39

40 Link Gateway Link Gateway configuration is broken into 3 sections View Connectivity: Link to the Device Connectivity page. 2. FQDN: The fully qualified domain name of this device. 3. IP Address: The IP address of this device on the network Network Interfaces: Toggle between 1 or 2 Network interface Controllers enabled on the gateway. 2. RIP: Enable Routing Information Protocol. 3. DHCP: Enable DHCP configuration. 40

41 CIDR: The IP address and netmask of the internal interface in CIDR format 2. Gateway: The Gateway IP address (required for a 1-NIC configuration) 3. DNS-1: The IP address of the primary DNS server. 4. DNS-2: The IP address of the secondary DNS server (optional). 5. Authoritative: Toggle whether or not to send DHCPNAK messages to misconfigured clients. 6. Domain Name: The Domain Name the DHCP service appends to a client s hostname. 7. Default Lease Time: The default time in seconds that an IP address is leased. 8. Max Lease Time: The maximum time in seconds that an IP address is leased. 9. DNS-1: The IP address of the primary DNS server. 10. DNS-2: The IP address of the secondary DNS server (optional). 11. DHCP Range Start: The first valid IP address available for the DHCP server to offer. 12. DHCP Range End: The last valid IP address available for the DHCP server to offer. 41

42 Link Platform If the Link Platform has been added to the Link network, the platforms IP address can be statically configured from the Link platform device page View Connectivity: Link to the Device Connectivity page. 2. FQDN: The fully qualified domain name of this device. 3. IP Address: The IP address of this device on the network. Link Desktop Link Desktop provides secure access to remote computers by tunneling VNC, SSH or RDP services. Access is IP restricted at the time a user tries to connect, and incoming connections must be established within 20 seconds. Standard RDP and VNC configuration options can be configured and sent to users connecting through the Link Platform. Before using Link Desktop, the remote computer needs to be accessible to the Link Platform either by being on the same network or as a device enrolled onto a Link Network. 42

43 Configuring Remote Connections To add remote connections to Link Desktop, click Add Host Computer. Provide a reference name for the new connection, and choose a connection type from the drop-down list. 43

44 RDP Connection Options Creating an RDP connection will send an RDP6 configuration file when users connect, which can be used with a compatible RDP client. In the General tab, provide the Remote Computer name or IP address and the internal RDP Port used. Username and Domain Name are optional fields and will pre-fill for the user when they connect. The Display tab allows you to change the appearance settings of the RDP file. 44

45 In the Resources tab, set the peripheral device options. In the Program tab, configure any applications that are to start on the remote computer after the connection is established. The Experience tab provides adjustments to connection performance options. In the Advanced tab, set the authentication level for the RDP connection. 45

46 Use the Access tab to specify which users or groups can access and see a remote connection. Only users marked in the access list will be able to use this connection. Check a group to add all users in that group, or expand the All Users group with the to select individual users. icon 46

47 VNC Connection Options Creating a VNC connection will send a VNC configuration file when users connect, which can be used with a compatible VNC client. In the General tab, provide the Remote Computer name or IP address and the internal VNC Port used. Username is an optional field and will pre-fill for the user when they connect. The Display tab allows you to change the appearance settings of the VNC file. 47

48 In the Resources tab, change any control options or device mappings. The Experience tab adjusts connection performance options. 48

49 Use the Access tab to specify which users or groups can access and see a remote connection. Only users marked in the access list will be able to use this connection. Check a group to add all users in that group, or expand the All Users group with the to select individual users. icon SSH Connection Options Creating an SSH connection will allow users to connect with a compatible SSH client. Users will need to manage their own SSH client, as no configuration file is sent. In the General tab, provide the Remote Computer name or IP address and the internal SSH Port used. Use the Access tab to specify which users or groups can access and see a remote connection. Only users marked in the access list will be able to use this connection. Check a group to add all users in that group, or expand the All Users group with the to select individual users. icon 49

50 Link Web Link Web protects web servers by enhancing their SSL security and preventing direct access to web services. Link Web includes a number of proxy management tools, including web proxy integration with Multi-factor Authentication (MFA). Creating Reverse Proxies A reverse proxy provides an additional level of control and security to ensure the smooth flow of network traffic between client and server. Configure your DNS (Domain Name System) to direct domains to proxy to the IP address of the Link Platform. Backends A proxy Backend is a group that will contain information about your internal server or servers, onto which requests will be forwarded by the Link Platform. You should only group together servers that are hosting identical content. In Link Web s main menu, click Add next to Backends. 50

51 Type a reference name for the Backend and whether your internal servers are using SSL. The Load Balancing options will take effect if there are more than one server in this backend group. The options for loading balancing are: Round-Robin Least Connected IP-Hash Forwards each request onto the next server in this pool and treats all servers as equals. Directs connections to the server with the fewest connections used. This is effective in smoothing distributution when a server becomes bogged down. Ensures that user sessions from the same IP address are sticky to a single backend server. In the Server section of Backends, click Add to input information on a new internal web server. 51

52 Type the server s IP address and port; select any additional options such as making the backend act as a backup server before clicking OK. When finished adding servers, click Save to return to the Reverse Proxy main screen. Frontends A proxy Frontend configures host level or folder level proxy services. This is where the domain names or URLs are set for the Link Platform to respond to and connect to a backend server group. Configure a Host proxy when all traffic will be directed to your backend servers, for example Host proxies require a Fully Qualified Domain Name (FQDN) and appropriate DNS entries to operate. Configure a Folder proxy when only specific paths will be directed to your backend server, for example Folder proxies use the Link Platform hostname, and do not require additional FQDN or DNS entries to operate. At least one backend should be configured before proceeding. 52

53 In Link Web s main menu, click Add next to Frontends. 53

54 If adding a host proxy, click the Host Proxy option Name: Enter a reference Name for the new proxy. 2. Hostname: Provide the Hostname the proxy will respond to. 3. Port: Set the external Port which the Link Platform will listen for requests to this service. 4. Backend: Select a Backend server group. 5. Certificate: If using a SSL, choose a Certificate. 6. Multi factor authentication: Turn on MFA if needed. 7. Strict transport security: Only available when using a SSL certificate, turn on to protect the website against protocol downgrade attacks and cookie hijacking. To add a new folder map, click the Folder Proxy option in the Add Proxy module. 54

55 Name: Enter a reference Name for the new proxy. 2. Hostname: The Hostname is automatically set to your Link Platform hostname for folder proxies. 3. Port: Set the external Port to forward to the Link Platform for this service. 4. Backend: Select a Backend server group. 5. Certificate: If using SSL, choose your Link Platform Certificate. Leave this as No certificate if using the standard port 443 for SSL. 6. MFA: This will turn MFA for all folders in this proxy on or off. Use the individual folder settings to determine final MFA setup. 7. Strict transport security: Only available when using a SSL certificate, turn on to protect the website against protocol downgrade attacks and cookie hijacking. 55

56 Choose a pre-configured set of folders from the Folder Maps list and click Add; or type the web folder in the space provided and click Add. Authentication Reverse Proxies can use MFAs configured in the Authentication section of the Link Platform administration. To configure proxy authentication, click Configure MFA in the main Reverse Proxy module. Select the desired 1 st Factor Type. This is the authentication users must first enter to get through to the backend proxy servers. 56

57 Link Link protects mail servers by enhancing their SSL security and preventing direct access to SMTP, IMAP, and POP3 services. Establishing Proxies proxy services allow secure access to servers through the Link Platform along with virus scanning and spam filtering. proxy supports all protocols including: SMTP, POP3 and IMAP4 without individual configurations. If adjusting existing DNS or MX records to point to your Link Platform then no client changes are required. Otherwise, you may need to update client settings to include your Link Platform hostname. Click Add Mail server in Proxy. Enter the Mail Server hostname or IP address. 57

58 Add any domains that your Link Platform will receive SMTP for to the Delivery section. Add domains for user s in the Collection section. Choosing to authenticate unqualified usernames will allow users to attempt authentication against this mail server without using a login domain specified in the list. 58

59 Version 5.0 release Jan 2017