AppSuite:OX Guard
IN PRODUCTION - OX Guard
OX Guard is a security solution that provides protection for email communications and files. Fully integrated with both OX as a Service and standard OX App Suite installations, it allows users to send and read encrypted messages and store and share encrypted files – and requires no additional setup or knowledge. OX Guard offers a simple way to increase security by limiting the opportunity for unauthorized access while data is en-route or in-storage, creating extra peace of mind.
This article will guide you through the installation of Guard and describes the basic configuration and software requirements. As it is intended as a quick walk-through it assumes an existing installation of the operating system including a single server App Suite setup as well as average system administration skills. This guide will also show you how to setup a basic installation with none of the typically used distributed environment settings. The objective of this guide is:
- To setup a single server installation
- To setup a single Guard instance on an existing Open-Xchange installation, no cluster
- To use the database service on the existing Open-Xchange installation for Guard, no replication
- To provide a basic configuration setup, no mailserver configuration
Key features
- Simple security at the touch of a button
- Provides user based security - Separate from provider
- Supplementary security to Provider based security - Layered
- Powerful features yet simple to use and understand
- Security - Inside and outside of the OX environment
- Email and Drive integration
- Uses proven PGP security
Availability
A variety of options:
- Fully hosted with OX as a Service
- All on site (large scale customers solution)
IMPORTANT: If an OX App Suite customer would like to evaluate OX Guard integration, the first step is to contact OX Sales. OX Sales will then work on the request and send prices and license/API (for the hosted infrastructure) key details to the customer.
OX Guard can also be provided via OX as a Service. OXaaS provides a best in class Email & Collaboration services to customers without them needing to become a cloud service provider themselves and deal with hardware and software set-up for those services. Please contact Open-Xchange Sales for further information and pricing details.
Requirements
Please review following URL for remaining requirements
Please review OX Guard Requirements for a full list of requirements.
Since OX Guard is a Microservice it can either be added to an existing Open-Xchange installation or it can be deployed on a dedicated environment without having any of the other Open-Xchange App Suite core services installed. OX App Suite v7.6.0 or later is required to operate this extension both in a single or multi server environments.
Prerequisites:
- Open-Xchange REST API
- Grizzly HTTP connector (open-xchange-grizzly)
- A supported Java Virtual Machine (Java 7)
- An Open-Xchange App Suite installation v7.6.0 or later
- Please Note: To get access to the latest minor features and bug fixes, you need to have a valid license. The article Updating OX-Packages explains how that can be done.
Download and Installation
Redhat Enterprise Linux 6 or CentOS 6
If not already done, add the following repositories to your Open-Xchange yum configuration:
[open-xchange-appsuite-7.6.0-guard] name=Open-Xchange-appsuite-7.6.0-guard baseurl=https://LDBUSER:LDBPASSWORD@software.open-xchange.com/products/appsuite/7.6.0/guard/RHEL6/ gpgkey=https://software.open-xchange.com/oxbuildkey.pub enabled=1 gpgcheck=1 metadata_expire=0m
and run
$ yum update $ yum install open-xchange-rest open-xchange-guard open-xchange-guard-ui open-xchange-guard-ui-static
Debian GNU/Linux 6.0
If not already done, add the following repositories to your Open-Xchange apt configuration:
deb https://LDBUSER:LDBPASSWORD@software.open-xchange.com/products/appsuite/7.6.0/guard/DebianSqueeze /
and run
$ apt-get update $ apt-get install open-xchange-rest open-xchange-guard open-xchange-guard-ui open-xchange-guard-ui-static
Debian GNU/Linux 7.0
If not already done, add the following repositories to your Open-Xchange apt configuration:
deb https://LDBUSER:LDBPASSWORD@software.open-xchange.com/products/appsuite/7.6.0/guard/DebianWheezy /
and run
$ apt-get update $ apt-get install open-xchange-rest open-xchange-guard open-xchange-guard-ui open-xchange-guard-ui-static
SUSE Linux Enterprise Server 11
Add the package repository using zypper if not already present:
$ zypper ar https://LDBUSER:LDBPASSWORD@software.open-xchange.com/products/appsuite/7.6.0/guard/SLES11 appsuite-7.6.0-guard
and run
$ zypper ref $ zypper in open-xchange-rest open-xchange-guard open-xchange-guard-ui open-xchange-guard-ui-static
Guard requires Java 1.7, which will be installed through the Guard packages, still SUSE Linux Enterprise Server 11 will not use Java 1.7 by default. Therefor we have to set Java 1.7 as the default instead of Java 1.6:
$ update-alternatives --config java
Now select the Java 1.7 JRE, example:
There are 2 alternatives which provide `java'.
Selection Alternative ----------------------------------------------- * 1 /usr/lib64/jvm/jre-1.6.0-ibm/bin/java + 2 /usr/lib64/jvm/jre-1.7.0-ibm/bin/java Press enter to keep the default[*], or type selection number: 2 Using '/usr/lib64/jvm/jre-1.7.0-ibm/bin/java' to provide 'java'.
Configuration
The following gives an overview of the most important settings to enable Guard for users on the Open-Xchange installation. Some of those settings have to be modified in order to establish the database and REST API access from the Guard service. All settings relating to the Guard backend component are located in the configuration file guard.properties located in /opt/open-xchange/guard/etc. The default configuration should be sufficient for a basic "up-and-running" setup (with the exception of defining the database username and password). Please refer to the inline documentation of the configuration file for more advanced options.
$ vim /opt/open-xchange/guard/etc/guard.properties
Open-Xchange config_db host - Guard will establish a connection to the config_db
com.openexchange.guard.configdbHostname=localhost
Guard database for storing user keys
com.openexchange.guard.oxguardDatabaseHostname=localhost
Username and Password for the two databases above
com.openexchange.guard.databaseUsername=openexchange com.openexchange.guard.databasePassword=db_password
Open-Xchange REST API host
com.openexchange.guard.restApiHostname=localhost
External URL for this Open-Xchange installation. This setting will be used to generate the link to the secure content for external recipients
com.openexchange.guard.externalEmailURL=somewhere.com
Configure services
Apache
Configure the mod_proxy_http module by adding the Guard API.
Redhat Enterprise Linux 6 or CentOS 6
$ vim /etc/httpd/conf.d/proxy_http.conf
Debian GNU/Linux 7.0 and SUSE Linux Enterprise Server 11
$ vim /etc/apache2/conf.d/proxy_http.conf
<Proxy balancer://oxguard> Order deny,allow Allow from all, add
BalancerMember http://localhost:8080/oxguard timeout=1800 smax=0 ttl=60 retry=60 loadfactor=100 route=OX1 ProxySet stickysession=JSESSIONID|jsessionid scolonpathdelim=ON SetEnv proxy-initial-not-pooled SetEnv proxy-sendchunked </Proxy>
<Proxy /appsuite/api/oxguard> ProxyPass balancer://oxguard </Proxy>
Please Note: The Guard API settings should be inserted before the existing “<Proxy /appsuite/api>” parameter.
After the configuration is done, restart the Apache webserver
$ apachectl restart
Open-Xchange
Please add the following settings to the permission settings configuration file of the Open-Xchange backend servers:
$ vim /opt/open-xchange/etc/permissions.properties
OX GUard general permission com.openexchange.capability.guard=true
Initiating the Guard database and key store
Once the Guard configuration (database and backend configuration) and the service configuration has been applied, the Guard administration script needs to be executed in order to create the Guard databases. The administration script also takes care of the creation of the master keys and the master password file in /opt/open-xchange/guard. The initiation only needs to be done once for a multi server setup, for details please see “Optional / Clustering”.
/opt/open-xchange/guard/sbin/guard init
Please Note: It is important to understand that the master password file located at /opt/open-xchange/guard/oxguardpass is required to reset user passwords, without them the administrator will not be able to reset user passwords anymore in the future. The file contains the passwords used to encrypt the master database key, as well as passwords used to encrypt protected data in the users table.
Start Guard
The services have been configured and the database has been initiated, it's time to start Guard
$ /etc/init.d/open-xchange-guard start
Enabling Guard for Users
Guard provides two capabilities for users in the environment:
- Guard Mail: com.openexchange.capability.guard:mail
- Guard Drive: com.openexchange.capability.guard:drive
Each of those two Guard components is enabled for all users that have the according capability configured. Please note that users need to have the Drive permission set to use Guard Drive. So the users that have Guard Drive enabled must be a subset of those users with OX Drive permission. Since v7.6.0 we enforce this via the default configuration. Those capabilities can be activated for specific user by using the Open-Xchange provisioning scripts:
Guard Mail:
$ /opt/open-xchange/sbin/changeuser -c 1 -A oxadmin -P admin_password -u testuser --config/com.openexchange.capability.guard:mail=true
Guard Drive:
$ /opt/open-xchange/sbin/changeuser -c 1 -A oxadmin -P admin_password -u testuser --config/com.openexchange.capability.guard:drive=true
Please Note: Guard Drive requires Guard Mail to be configured for the user as well.