Server Administration Guide

AQL Application FormTo apply for an AQL W eb gateway account please go to the following URLhttp://w w w .A Q L.co m/S EFollow details onscreenVodafone SIM Considerations Vodafone do not adhere to the SMS standard when using the PDU mode. If using a Vodafone SIM, y ou are no longer able to use the PDU mode (dy namically ov erwriting of SMS texts); this is due to Vodafone hav ing their own proprietary method of completing this. Therefore enable the check box “Send Simple Text”. Otherwise the sending of a SMS passcode will fail. Page 101

Supported ASCII Data CodesOverviewSecurEnv oy supports ASCII 127 for use with \"Radius Pre Shared Key s\". ASCII stands for AmericanStandard Code for Information Interchange. Below is the ASCII character table for ASCII 0 throughASCII 127.Standard A SCII Code TableDecimal Octal Hex Binary Value------- ----- --- ------ -----000 000 000 00000000 NUL (Null char.)001 001 001 00000001 SOH (Start of Header)002 002 002 00000010 STX (Start of Text)003 003 003 00000011 ETX (End of Text)004 004 004 00000100 EOT (End of Transmission)005 005 005 00000101 ENQ (Enquiry )006 006 006 00000110 A CK (Ack nowledgment)007 007 007 00000111 BEL (Bell)008 010 008 00001000 BS (Back space)009 011 009 00001001 HT (Horizontal Tab)010 012 00A 00001010 LF (Line Feed)011 013 00B 00001011 VT (Vertical Tab)012 014 00C 00001100 FF (Form Feed)013 015 00D 00001101 CR (Carriage Return)014 016 00E 00001110 SO (Shift Out)015 017 00F 00001111 SI (Shift In)016 020 010 00010000 DLE (Data Link Escape)017 021 011 00010001 DC1 (XON) (Dev ice Control 1)018 022 012 00010010 DC 2 (Dev ice Control 2)019 023 013 00010011 DC3 (XOFF) (Dev ice Control 3)020 024 014 00010100 DC4 (Dev ice Control 4)021 025 015 00010101 NAK (Negativ e Ack nowledgement)022 026 016 00010110 SYN (Sy nchronous Idle)023 027 017 00010111 ETB (End of Trans. Block )024 030 018 00011000 CAN (Cancel)025 031 019 00011001 EM (End of Medium)026 032 01A 00011010 SUB (Substitute)027 033 01B 00011011 ESC (Escape)028 034 01C 00011100 FS (File Separator)029 035 01D 00011101 GS (Group Separator)030 036 01E 00011110 RS (Request to Send) (Record Separator)031 037 01F 00011111 US (Unit Separator)032 040 020 00100000 SP (Space)033 041 021 00100001 ! (exclamation mark )034 042 022 00100010 \" (double quote)035 043 023 00100011 # (number sign)036 044 024 00100100 $ (dollar sign)037 045 025 00100101 % (percent)038 046 026 00100110 & (ampersand) Page 102

039 047 027 00100111 ' (single quote)040 050 028 00101000 ( (left/opening parenthesis)041 051 029 00101001 ) (right/closing parenthesis)042 052 02A 00101010 * (asterisk )043 053 02B 00101011 + (plus)044 054 02C 00101100 , (comma)045 055 02D 00101101 - (minus or dash)046 056 02E 00101110 . (dot)047 057 02F 00101111 / (forward slash)048 060 030 00110000 0049 061 031 00110001 1050 062 032 00110010 2051 063 033 00110011 3052 064 034 00110100 4053 065 035 00110101 5054 066 036 00110110 6055 067 037 00110111 7056 070 038 00111000 8057 071 039 00111001 9058 072 03A 00111010 : (colon)059 073 03B 00111011 ; (semi-colon)060 074 03C 00111100 < (less than)061 075 03D 00111101 = (equal sign)062 076 03E 00111110 > (greater than)063 077 03F 00111111 ? (question mark )064 100 040 01000000 @ (AT sy mbol)065 101 041 01000001 A066 102 042 01000010 B067 103 043 01000011 C068 104 044 01000100 D069 105 045 01000101 E070 106 046 01000110 F071 107 047 01000111 G072 110 048 01001000 H073 111 049 01001001 I074 112 04A 01001010 J075 113 04B 01001011 K076 114 04C 01001100 L077 115 04D 01001101 M078 116 04E 01001110 N079 117 04F 01001111 O080 120 050 01010000 P081 121 051 01010001 Q082 122 052 01010010 R083 123 053 01010011 S084 124 054 01010100 T085 125 055 01010101 U086 126 056 01010110 V087 127 057 01010111 W088 130 058 01011000 X089 131 059 01011001 Y Page 103

090 132 05A 01011010 Z091 133 05B 01011011 [ (left/opening brack et)092 134 05C 01011100 \ (back slash)093 135 05D 01011101 ] (right/closing brack et)094 136 05E 01011110 ^ (caret/circumflex)095 137 05F 01011111 _ (underscore)096 140 060 01100000 `097 141 061 01100001 a098 142 062 01100010 b099 143 063 01100011 c100 144 064 01100100 d101 145 065 01100101 e102 146 066 01100110 f103 147 067 01100111 g104 150 068 01101000 h105 151 069 01101001 i106 152 06A 01101010 j107 153 06B 01101011 k108 154 06C 01101100 l109 155 06D 01101101 m110 156 06E 01101110 n111 157 06F 01101111 o112 160 070 01110000 p113 161 071 01110001 q114 162 072 01110010 r115 163 073 01110011 s116 164 074 01110100 t117 165 075 01110101 u118 166 076 01110110 v119 167 077 01110111 w120 170 078 01111000 x121 171 079 01111001 y122 172 07A 01111010 z123 173 07B 01111011 { (left/opening brace)124 174 07C 01111100 | (v ertical bar)125 175 07D 01111101 } (right/closing brace)126 176 07E 01111110 ~ (tilde)127 177 07F 01111111 DEL (delete) Page 104

SecurEnvoy Additional ToolsChapter 18 Page 105

18 SecurEnvoy Additional Tools18.1 Reporting Wizard (GUI)SecurEnv oy now has an additional tool called ”Reporting Wizard” which allows further detailedinv estigation of user set up and ov erall sy stem usage.The Report tool is included in v ersion 5.4 and abov e; all customers who are currently using anyv ersion 5 can download this additional Report tool from www.securenv oy .com/ftp/report.zip.Customer’s who are on v ersion 4 or below are required to upgrade to allow this additionalfunctionality .This tool can be used in one of two way s, v ia a graphical user interface for manually creating reportsor in command line mode for scripts or batch jobs to use.The SecurEnv oy Report tool can be launched from the “Start” “Programs” “SecurEnv oy ” Report W izardlink , alternativ ely run: for:32 bit installations \Program Files\SecurEnv oy \Security Serv er\Report\report.exeAnd 64 bit installations \Program Files(x86)\SecurEnv oy \Security Serv er\Report\report.exeOnce launched the Report GUI is shown, see below: To run the selected report click “Run Report” The status field will show activ ity and a progress bar may be shown upon heav ily used sy stems, this will be display ed to the right of the status field. Page 106

W hen a report is running the Stop button may be click ed to halt the current report. The Clear button will clear any prev ious report that has been outputted to the GUI screen. The Help button will prov ide detailed information of how to use the report wizard in HTML formatSecurEnv oy administrators, hav e a number of pre configured reports to run against selectedconfigured domains. Once complete report information can be managed from the GUI or can beexported to C SV file.Domain SelectionAll domain information is obtained from the serv er.ini file. All that is required is to select the domainthat a report is required for.LDA P Base DNThe LDAP base DN can be set, to only interrogate a certain part of y our directory serv er.Example OU=HQ,DC=W 23,DC=com so only users in HQ are reported upon.Once the Domain has been selected, it is a case of choosing one of the reports.A ll Managed UsersThis will output to the screen all users who are currently managed (This will include users who are inICE mode or a user who is disabled but still hav ing a lic ense assigned to them) upon the SecurEnv oyserv er; the SecurEnv oy administrator will then be able to directly manage any selected users v ia theReport GUI.In addition a CSV report can be generated by click ing the “Export results to a file” button. When the report has run, information will be outputted to the report GUI console. Click ing upon any of the Login ID user link s will allow direct management v ia the SecurEnv oy local Admin GUI. Page 107

Disabled UsersThis will output to the screen all users who are in a disabled state upon the SecurEnv oy serv er; theSecurEnv oy administrator will then be able to directly manage any selected users v ia the Report GUI.In addition a CSV report can be generated by click ing the “Export results to a file” button.Enabled UsersThis will output to the screen all users who are in an Enabled state upon the SecurEnv oy serv er; theSecurEnv oy administrator will then be able to directly manage any selected users v ia the Report GUI.In addition a CSV report can be generated by click ing the “Export results to a file” button.ICE UsersThis will output to the screen all users who are in a ICE Mode state upon the SecurEnv oy serv er; theSecurEnv oy administrator will then be able to directly manage any selected users v ia the Report GUI.In addition a CSV report can be generated by click ing the “Export results to a file” button.Full A dministratorsThis will output to the screen all users who hav e Administrativ e role based permissions upon theSecurEnv oy serv er; the SecurEnv oy administrator will then be able to directly manage any selectedusers v ia the Report GUI.In addition a CSV report can be generated by click ing the “Export results to a file” button.HelpDesk A dministratorsThis will output to the screen all users who hav e HelpDesk role based permissions upon theSecurEnv oy serv er; the SecurEnv oy administrator will then be able to directly manage any selectedusers v ia the Report GUI.In addition a CSV report can be generated by click ing the “Export results to a file” button.Config A dministratorsThis will output to the screen all users who hav e Config role based permissions upon the SecurEnv oyserv er; the SecurEnv oy administrator will then be able to directly manage any selected users v ia theReport GUI.In addition a CSV report can be generated by click ing the “Export results to a file” button.Real Time OTP UsersThis will output to the screen all users who are setup for “Real Time OTP” mode upon the SecurEnv oyserv er; the SecurEnv oy administrator will then be able to directly manage any selected users v ia theReport GUI.In addition a CSV report can be generated by click ing the “Export results to a file” button.Pre Loaded OTP UsersThis will output to the screen all users who are setup for “Pre Loaded OTP” mod e upon theSecurEnv oy serv er; the SecurEnv oy administrator will then be able to directly manage any selectedusers v ia the Report GUI.In addition a CSV report can be generated by click ing the “Export results to a file” button.Soft Token UsersThis will output to the screen all users who are setup for “Soft Tok en” mode upon the SecurEnv oyserv er; the SecurEnv oy administrator will then be able to directly manage any selected users v ia theReport GUI.In addition a CSV report can be generated by click ing the “Export results to a file” button. Page 108

Daycode UsersThis will output to the screen all users who are setup for “Day code” mode upon the SecurEnv oyserv er; the SecurEnv oy administrator will then be able to directly manage any selected users v ia theReport GUI.In addition a CSV report can be generated by click ing the “Export results to a file” button.Tmp UsersThis will output to the screen all users who are setup for “Tmp code” mode upon the SecurEnv oyserv er; the SecurEnv oy administrator will then be able to directly manage any selected users v ia theReport GUI.In addition a CSV report can be generated by click ing the “Export results to a file” button.Static UsersThis will output to the screen all users who are setup for “Static code” mode upon th e SecurEnv oyserv er; the SecurEnv oy administrator will then be able to directly manage any selected users v ia theReport GUI.In addition a CSV report can be generated by click ing the “Export results to a file” button.Users who have NOT authenticated in (x) daysThis will output to the screen all users who hav e not authenticated in (selectable) day s upon theSecurEnv oy serv er; the SecurEnv oy administrator will then be able to directly manage any selectedusers v ia the Report GUI.In addition a CSV report can be generated by click ing the “Export results to a file” button.Users who have authenticated in the last (x) daysThis will output to the screen all users who hav e authenticated in the last (selectable) day s upon theSecurEnv oy serv er; the SecurEnv oy administrator will then be able to directly manage any selectedusers v ia the Report GUI.In addition a CSV report can be generated by click ing the “Export results to a file” button.Users Sending Passcodes Via eMailThis will output to the screen all users who are setup to receiv e “Passcodes v ia eMail” mode upon theSecurEnv oy serv er; the SecurEnv oy administrator will then be able to directly manage any selectedusers v ia the Report GUI.In addition a CSV report can be generated by click ing the “Export results to a file” buttonUsers sending Passcodes Via Public Mobile NumberThis will output to the screen all users who are setup that hav e a “Public Mobile Number” i.e. Mobile ispopulated in LDAP within the “Mobile” attribute. The Mobile number will be display ed in the output.The SecurEnv oy administrator will then be able to directly manage any selected users v ia the ReportGUI.In addition a CSV report can be generated by click ing the “Export results to a file” buttonUsers sending Passcodes Via Private Mobile NumberThis will output to the screen all users who are setup that hav e a “Priv ate Mobile Number” i.e. Mobileis encry pted by the SecurEnv oy serv er. The Mobile number will be display ed in the output. TheSecurEnv oy administrator will then be able to directly manage any selected users v ia the Report GUI.In addition a CSV report can be generated by click ing the “Export results to a file” button Page 109

Users Waiting To EnrolThis will output to the screen all users who still hav en’t completed the enrolment process upon theSecurEnv oy serv er; the SecurEnv oy administrator will then be able to directly manage any selectedusers v ia the Report GUI.In addition a CSV report can be generated by click ing the “Export results to a file” button Page 110

18.2 Reporting Wizard (Cmd Line)The following command line options are av ailableUsage: report.exe /auto /report=(number) /file=(file name and path) /day s=(number of day s)/domain=(domain name) /hidegui /debugThe report number is a logical number assigned to each report, therefore please see table below fornumber to report mappingsReport Number1 All Managed Users2 Disabled Users3 Enabled Users4 ICE Users5 Full Administrators6 HelpDesk Administrators7 Config Administrators8 Real Time OTP Users9 Pre Loaded OTP Users10 Soft Tok en Users11 Day code Users12 Tmp Users13 Static Users14 Users who hav e NOT authenticated in (x) day s15 Users who hav e authenticated in the last (x) day s16 Users Sending Passcodes Via eMail17 Users Sending Passcodes Via Public Mobile Number18 Users Sending Passcodes Via Priv ate Mobile Number19 Users W aiting to Enrol/auto Must be set to use command line options/report=(number) Must be set to the number of the radio button to select. 1=All Manager Users, 2=Disabled users etc/file=(file name) Must be set to the file name and path the report is created in. Example c:\report.csv/day s=(number of day s) Only required for reports the need the number of day s entering/domain=(domain name) Optional, defaults to primary domain/ldapbase=(LDAP Base DN) Optional, defaults to primary domain/hidegui Optional, if set will hide the graphical interface/email=(recipient) Optional, sends report to the email address (recipient), multiple recipients must be separated with a semicolon/debug Optional, if set will enable debugExample1:Report /auto /report=1 /file=”c:\reportout.csv \"Example2:Report /auto /report=13 /file=”c:\tmp\not_authenticated.csv ” day s=30 /domain=”securev oy .com”/hidegui\" Page 111

18.3 Reporting Wizard (Admin GUI)Reports can now be generated directly 1 All Managed Userswithin the SecurEnv oy Admin GUI. 2 Disabled UsersThere are 19 pre-configured reports that can 3 Enabled Usersbe run against each LDAP Domain. In 4 ICE Usersaddition to selecting the LDAP Domain, the 5 Full AdministratorsLDAP base can also be configured. This 6 HelpDesk Administratorsallows large Enterprises to designate reports 7 Config Administratorsagainst certain Business units with their own 8 Real Time OTP UsersLDAP Domain (OU's) 9 Pre Loaded OTP UsersThe list of reports are display ed right of this 10 Soft Tok en Usersscreenshot. 11 Day code Users 12 Tmp UsersOnce the designated report has run the 13 Static Usersoutput is display ed in the right hand window 14 Users who hav e NOT authenticated in (x) day sof the Admin GUI, this allows the Admin or 15 Users who hav e authenticated in the last (x) day sHelpdesk operator directly manage the listed 16 Users Sending Passcodes Via eMailuser from within the Admin GUI. 17 Users Sending Passcodes Via Public Mobile Number 18 Users Sending Passcodes Via Priv ate Mobile Number 19 Users Waiting to Enrol Page 112