AppSuite:OX Guard Configuration - Revision history

WolfgangRosenauer: /* General Properties */

2018-04-13T11:50:05Z

General Properties

← Older revision		Revision as of 11:50, 13 April 2018
Line 98:		Line 98:
	until he uploads the encrypted mail (received as attachment to the notification) within the guest UI for		until he uploads the encrypted mail (received as attachment to the notification) within the guest UI for
	decrypted reading.		decrypted reading.
			This property can only be applied system wide.

	==== Storage Specific Properties ====		==== Storage Specific Properties ====

WolfgangRosenauer: /* Miscellaneous */

2018-04-09T11:40:06Z

Miscellaneous

← Older revision		Revision as of 11:40, 9 April 2018
Line 205:		Line 205:

	<source lang="bash">com.openexchange.guard.secureReply = true</source>		<source lang="bash">com.openexchange.guard.secureReply = true</source>
	(since Guard 2.2) ~~Normally, when~~ a person replies from an encrypted email, the reply is automatically encrypted. Set to false to disable this automatic encryption		(since Guard 2.2) When a person replies from an encrypted email, the reply is automatically forcefully encrypted. Set to false to disable this automatic forced encryption.

	== SSL ==		== SSL ==

WolfgangRosenauer at 09:07, 12 July 2017

2017-07-12T09:07:28Z

← Older revision		Revision as of 09:07, 12 July 2017
Line 88:		Line 88:
	=== File Storage ===		=== File Storage ===

	Local/remote storage is required for temporary caching of non-OX ~~encrypted emails~~. This can be an attached local file store, or Amazon S3 compatible object store depending on which <code>open-xchange-guard-*-storage</code> package is installed (<code>file</code> or <code>S3</code>).		Local/remote storage is required for temporary caching of encrypted emails to guest/non-OX users. This can be an attached local file store, or Amazon S3 compatible object store depending on which <code>open-xchange-guard-*-storage</code> package is installed (<code>file</code> or <code>S3</code>).

	==== General Properties ====		==== General Properties ====
Line 94:		Line 94:
	<source lang="bash">com.openexchange.guard.cacheDays = 30</source>		<source lang="bash">com.openexchange.guard.cacheDays = 30</source>
	How many days emails to guests are kept in file store before being deleted. Measured from time of sending, reset when someone reads the email.		How many days emails to guests are kept in file store before being deleted. Measured from time of sending, reset when someone reads the email.
			For this period a guest can access the mail directly via the provided link. If the cache is swiped though
			the mail will be removed from the server so the guest cannot directly read it anymore via the guest interface
			until he uploads the encrypted mail (received as attachment to the notification) within the guest UI for
			decrypted reading.

	==== Storage Specific Properties ====		==== Storage Specific Properties ====
Line 100:		Line 104:

	<source lang="bash">com.openexchange.guard.storage.file.uploadDirectory = /var/spool/open-xchange/guard/uploads</source>		<source lang="bash">com.openexchange.guard.storage.file.uploadDirectory = /var/spool/open-xchange/guard/uploads</source>
	Defines the temporary upload directory for OX Guard Drive files for <code>open-xchange-guard-file-storage</code> package.		Defines the temporary upload and cache directory for OX Guard Drive files for <code>open-xchange-guard-file-storage</code> package.
			This directory needs to be shared between application servers serving the Guest Reader interface.

	===== S3-Storage =====		===== S3-Storage =====
Line 195:		Line 200:

	<source lang="bash">com.openexchange.guard.noRecovery = true</source>		<source lang="bash">com.openexchange.guard.noRecovery = true</source>
	Keep in mind, that a lost password will result in total loss of encrypted data		Keep in mind, that a lost password will result in total loss of encrypted data.

	=== Miscellaneous ===		=== Miscellaneous ===
Line 204:		Line 209:
	== SSL ==		== SSL ==

	~~As of~~ 2.4.0, OX Guard is running inside the OSGi container, meaning that all its servlets are being registered and served by Grizzly.		Starting with 2.4.0, OX Guard is running inside the OSGi container, meaning that all its servlets are being registered and served by Grizzly.

	=== API SSL ===		=== API SSL ===

	~~The communication~~ between Guard and the ~~OX Backend~~ is by ~~default set~~ to HTTP~~. All items to be encrypted are already encrypted at this point, but other information (sender name, filename, etc) could appear in plain text here~~.		<source lang="bash">com.openexchange.guard.backendSSL = false</source>
			Per default the connection between the Guard backend and the configured Open-Xchange
			REST API host is unencrypted. Even though that Guard will never transmit unencrypted
			emails to or from the REST API you can optionally encrypt the whole communication between
			those two components by using SSL. Please note: Enabling SSL might decrease performance
			and/or create more system load due to additional encoding of the HTTP streams.

	~~TODO~~

	=== Incoming SSL ===		=== Incoming SSL ===

	The communication between the frontend load balancer (Apache or otherwise) to Guard is by default HTTP (if protected network). More information on how to enable SSL you can find [http://oxpedia.org/wiki/index.php?title=AppSuite:Grizzly#X-FORWARDED-PROTO_Header here].		The communication between the frontend load balancer (Apache or otherwise) to Guard is by default HTTP (if protected network). More information on how to enable SSL you can find [http://oxpedia.org/wiki/index.php?title=AppSuite:Grizzly#X-FORWARDED-PROTO_Header here].

WolfgangRosenauer at 08:54, 12 July 2017

2017-07-12T08:54:31Z

Greg.hill: /* Optional Properties */

2016-03-29T14:06:34Z

Optional Properties

← Older revision		Revision as of 14:06, 29 March 2016
Line 22:		Line 22:

	<source lang="bash">com.openexchange.guard.endpoint =</source>		<source lang="bash">com.openexchange.guard.endpoint =</source>
	Specifies the URI to the OX Guard end-point; e.g. http://guard.host.invalid:~~8081~~/~~some/path~~. By default is empty.		Specifies the URI to the OX Guard end-point; e.g. http://guard.host.invalid:8009/guardadmin. By default is empty.

	==== Capabilities ====		==== Capabilities ====

Greg.hill: Created page with "= OX Guard 2.4.0 Configuration = There are two main files for configuring OX Guard: `guard-api.properties` and `guard-core.properties`. The first config..."

2016-03-29T13:37:13Z

Created page with "= OX Guard 2.4.0 Configuration = There are two main files for configuring OX Guard: <code>guard-api.properties</code> and <code>guard-core.properties</code>. The first config..."

New page

= OX Guard 2.4.0 Configuration =

There are two main files for configuring OX Guard: <code>guard-api.properties</code> and <code>guard-core.properties</code>. The first configuration file is part of the OX backend and contains properties, among others, that enable the OX Guard functionality for various modules such as Mail and Drive as well as some capabilities. The second configuration file is part of the OX Guard and contains properties that configures the behaviour of the product.

== Configuration File (<code>guard-api.properties</code>) ==

=== Main Properties ===

<source lang="bash">com.openexchange.capability.guard = true</source>
Enables Guard. If not set, no guard functions will be loaded in the UI. Needed if users should be able to do ANY Guard functions including reading encrypted emails. This level will allow users without "guard-mail" enabled to read emails sent to them, reply to those emails, but not create new emails. Recommended minimum level for all users.

<source lang="bash">com.openexchange.capability.guard-mail = true</source>
Enables the user(s) ability to send encrypted emails. If False but guard enabled, they can read encrypted emails and reply to the original sender, but they cannot compose new emails

<source lang="bash">com.openexchange.capability.guard-drive = true</source>
Enables the drive functionality. If false, user(s) will not be able to decode nor upload new encrypted files

=== Optional Properties ===

<source lang="bash">com.openexchange.guard.templateID = 0</source>
Define template customization ID for the Guest reader emails, the Guest reader, and system emails. See [https://oxpedia.org/wiki/index.php?title%20=%20AppSuite:GuardCustomization Customization] for details.

<source lang="bash">com.openexchange.guard.endpoint =</source>
Specifies the URI to the OX Guard end-point; e.g. http://guard.host.invalid:8081/some/path. By default is empty.

==== Capabilities ====

<source lang="bash">com.openexchange.capability.guard-pin = true</source>
Enables optional PIN function when sending emails to non-ox users. Will provide an additional 4 digit pin that should be sent to the recipient. Extra protection during the time that the temporary password was assigned and sent.

<source lang="bash">com.openexchange.capability.guard-nodeleterecovery = true</source>
(Guard 2.0) Disable the ability of the user to delete the recovery keys. Makes it impossible to reset password, but also adds level of protection/security

<source lang="bash">com.openexchange.capability.guard-nodeleteprivate = true</source>
(Guard 2.0) Disable the ability of the user to delete their private key. They can revoke it, but not delete the key.

<source lang="bash">com.openexchange.capability.guard-nodeleteonrevoke = true</source>
(Depreciated as of Guard 2.0) Default when revoking an item is to delete the content key, making the item impossible to decode. If this option is true, then the item is merely expired and can later be retrieved for decoding in case of legal requirements, corporate requirements, etc

<source lang="bash">com.openexchange.capability.guard-noextra = true</source>
(Depreciated as of Guard 2.0) Disables the ability to add an extra password to encrypted items. May be required by some industry

== Configuration File (<code>guard-core.properties</code>) ==

=== Database ===

<source lang="bash">com.openexchange.guard.oxguardDatabaseHostname = localhost</source>
The address of the MySQL database for OX Guard data. May be the same as the OX MySQL database.

<source lang="bash">com.openexchange.guard.oxguardDatabaseRead</source>
Optional read-only IP/name for the OX Guard database that might be used in Master-Slave setups.

<source lang="bash">com.openexchange.guard.oxguardShardDatabase</source>
IP/Name for the location of the Guest database shards. Additional shards will be created on this database

<source lang="bash">com.openexchange.guard.oxguardShardRead</source>
Optional read-only IP/name for Guest database shards that might be used in Master-Slave setups.

<source lang="bash">com.openexchange.guard.databaseUsername = username</source>
The username to access the OX Backend and Guard database. This user needs to have select, create, lock, insert, update privileges. Guard database user also should have alter (for updates), drop, index.

<source lang="bash">com.openexchange.guard.databasePassword = password</source>
The password for the databases

=== OX API ===

<source lang="bash">com.openexchange.guard.restApiHostname = localhost</source>
The address for the OX REST API. It would be the location of the OX Backend

<source lang="bash">com.openexchange.guard.OXBackendPort = 8009</source>
The port for the OX Backend. Default is 8009 (which is direct communication with the backend). Could be 80, etc, if going through load balancers

<source lang="bash">com.openexchange.guard.restApiUsername = open-xchange com.openexchange.guard.restApiPassword = secret</source>
Username and password for the REST API

<source lang="bash">com.openexchange.guard.externalEmailURL = example.com/appsuite/api/oxguard/reader/reader.html</source>
When Guard sends an e-Mail to external recipients those recipients will be able to access the encrypted content by opening a link in that e-Mail. The description and the link of that e-Mail are not encrypted and always readable by the recipient. The link points to the Guard reader for external recipients, a servlet to decrypt and display the encrypted e-Mail content. Specify which domain and path should be used. The <code>https</code> link will be created dynamically by Guard. This value will be used as the default unless over-written by cascade value <code>com.openexchange.guard.externalReaderURL</code>.

=== Support API ===

<source lang="bash">com.openexchange.guard.supportapiusername = xxxxx
com.openexchange.guard.supportapipassword = yyyyy</source>
If the support API is to be used, a username and password should be configured.

<source lang="bash">com.openexchange.guard.exposedKeyDurationInHours = 168</source>
When a user is deleted, the Private keys are saved in a temporary deleted Keys table (in case of accidental deletion). If support "exposes" the key, the user can then retrieve it using link generated. For security reasons, this link is only valid for a short period of time. This property defines that duration.

=== File Storage ===

Local/remote storage is required for temporary caching of non-ox encrypted emails. This can be an attached local file store, or Amazon S3 compatible object store depending on which <code>open-xchange-guard-*-storage</code> package is installed (<code>file</code> or <code>S3</code>).

==== General Properties ====

<source lang="bash">com.openexchange.guard.cacheDays = 30</source>
How many days emails are kept in file store before being deleted. Measured from time of sending, reset when someone reads the email

==== Storage Specific Properties ====

===== File-Storage =====

<source lang="bash">com.openexchange.guard.storage.file.uploadDirectory = /var/spool/open-xchange/guard/uploads</source>
Defines the temporary upload directory for OX Guard Drive files for <code>open-xchange-guard-file-storage</code> package.

===== S3-Storage =====

<source lang="bash">com.openexchange.guard.storage.s3.endpoint =
com.openexchange.guard.storage.s3.bucketName =
com.openexchange.guard.storage.s3.region =
com.openexchange.guard.storage.s3.accessKey =
com.openexchange.guard.storage.s3.secretKey =</source>
S3 configuration options if the package <code>open-xchange-guard-s3-storage</code> is selected.

=== Crypto ===

<source lang="bash">com.openexchange.guard.aesKeyLength=256 (Depreciated)</source>
AES Key length. 256 is preferred, but not supported on all systems. May need to have the [http://www.oracle.com/technetwork/java/javase/downloads/index.html Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files] installed.

<source lang="bash">com.openexchange.guard.rsaKeyLength=2048</source>
RSA key length. Used when creating PGP keys

=== PGP ===

<source lang="bash">com.openexchange.guard.publicPGPDirectory = hkp://keys.gnupg.net:11371, hkp://pgp.mit.edu:11371</source>
List of PGP Public key servers to query for public keys

<source lang="bash">com.openexchange.guard.publicKeyWhitelist</source>
A list of IP addresses of TRUSTED Guard servers. When the public PGP key server is queried, it will normally only find Guard keys that have already been created. If on the whitelist, the Guard server will also query the OX backend to see if the email address exists on the OX system, and if so, will create new keys for the user.

<source lang="bash">com.openexchange.guard.keyValidDays = 3650</source>
PGP keys created will only be valid for this number of days. Default is 10 years. Set to 0 if no expiration date.

<source lang="bash">com.openexchange.guard.pgpCacheDays=7</source>
When looking up remote PGP keys, if found, the keys will be stored in a temporary cache. Set number of days until the cache item is expired and remote lookup is repeated.

<pre>com.openexchange.guard.usestarttls = true</pre>
Use TLS when delivering to the SMTP server when available

=== Email ===

<source lang="bash">com.openexchange.guard.guestSMTPServer=smtp.example.com
com.openexchange.guard.guestSMTPPort=25
com.openexchange.guard.guestSMTPUsername=
com.openexchange.guard.guestSMTPPassword=</source>
SMTP settings for outgoing emails from the guest reader. Emails sent from within the system use the OX Backend. The guest reader, however, sends replies through this SMTP. In addition, password emails (reset, initial) are sent through the SMTP server.

=== Bad Attempts ===

<source lang="bash">com.openexchange.guard.badMinuteLock = 10</source>
Defines how long someone will be locked out after bad attempts. Defaults to 10 minutes.

<source lang="bash">com.openexchange.guard.badPasswordCount = 5</source>
Defines how many times a person can attempt to unlock an encrypted item before being locked out. Defaults to 5 times.

=== RSA Key Generation ===

<source lang="bash">com.openexchange.guard.rsacache = true</source>
RSA keys are pre-generated in the background, encrypted, and stored for future user keys. RSA key generation is the most time consuming function and the RSA cache significantly improves new user creation time.

<source lang="bash">com.openexchange.guard.rsacachecount = 100</source>
Number of RSA keys to pre-generate

<source lang="bash">com.openexchange.guard.keycachecheckinterval = 30</source>
Interval in seconds to check the RSA cache and re-populate if less than rsacachecount.

<source lang="bash">com.openexchange.guard.rsacertainty = 256</source>
Bit certainty for RSA key generation. Higher numbers assure the number is in fact prime but time consuming. Lower is much faster. May need to be lower if not using cache.

=== Passwords ===

<source lang="bash">com.openexchange.guard.newpasslength=8</source>
Length of the randomly generated passwords when a user resets password.

<source lang="bash">com.openexchange.guard.minpasswordlength=6</source>
Minimum password length.

=== Backend ===

<source lang="bash">com.openexchange.guard.oxbackendpath = /ajax/</source>
URL used to communicated directly with the OX backend.

<source lang="bash">com.openexchange.guard.oxbackendidletime = 60</source>
HTTP connections to the backend are kept open for faster response. This is the timeout setting that will close idle connections.

=== Guest Accounts ===

<source lang="bash">com.openexchange.guard.shardsize=1000</source>
Guest users data are placed in databases oxguard_x. After set number of users, another database shard is created

<source lang="bash">com.openexchange.guard.externalreaderpath=/appsuite/api/oxguard/reader/reader.html</source>
Full path after domain name for the external reader (if changed from default)

=== Recovery ===

If you do not want password recovery available, you can disable by adding

<source lang="bash">com.openexchange.guard.noRecovery = true</source>
Keep in mind, that a lost password will result in total loss of encrypted data

=== Miscellaneous ===

<source lang="bash">com.openexchange.guard.secureReply = true</source>
(Guard 2.2) Normally, when a person replies from an encrypted email, the reply is automatically encrypted. Set to false to disable this automatic encryption

== SSL ==

As of 2.4.0, OX Guard is running inside the OSGi container, meaning that all its servlets are being registered and served by Grizzly.

=== API SSL ===

The communication between Guard and the OX Backend is by default set to HTTP. All items to be encrypted are already encrypted at this point, but other information (sender name, filename, etc) could appear in plain text here.

TODO

=== Incoming SSL ===

The communication between the frontend load balancer (Apache or otherwise) to Guard is by default HTTP (if protected network). More information on how to enable SSL you can find [http://oxpedia.org/wiki/index.php?title=AppSuite:Grizzly#X-FORWARDED-PROTO_Header here].

← Older revision		Revision as of 08:54, 12 July 2017
Line 1:		Line 1:
	= OX Guard 2.4.0 Configuration =		= OX Guard 2.4+ Configuration =

	There are two main files for configuring OX Guard: <code>guard-api.properties</code> and <code>guard-core.properties</code>. The first configuration file is part of the OX backend and contains properties, among others, that enable the OX Guard functionality for various modules such as Mail and Drive as well as some capabilities. The second configuration file is part of the OX Guard and contains properties that configures the behaviour of the product.		There are two main files for configuring OX Guard: <code>guard-api.properties</code> and <code>guard-core.properties</code>. The first configuration file is part of the OX backend and contains properties, among others, that enable the OX Guard functionality for various modules such as Mail and Drive as well as some capabilities. The second configuration file is part of the OX Guard and contains properties that configures the behaviour of the product.
Line 27:		Line 27:

	<source lang="bash">com.openexchange.capability.guard-pin = true</source>		<source lang="bash">com.openexchange.capability.guard-pin = true</source>
	Enables optional PIN function when sending emails to non-ox users. Will provide an additional 4 digit pin that should be sent to the recipient. Extra protection during the time that the temporary password was assigned and sent.		Enables optional PIN function when sending emails to non-OX users. Will provide an additional 4 digit pin that should be sent to the recipient. Extra protection during the time that the temporary password was assigned and sent.

	<source lang="bash">com.openexchange.capability.guard-nodeleterecovery = true</source>		<source lang="bash">com.openexchange.capability.guard-nodeleterecovery = true</source>
Line 36:		Line 36:

	<source lang="bash">com.openexchange.capability.guard-nodeleteonrevoke = true</source>		<source lang="bash">com.openexchange.capability.guard-nodeleteonrevoke = true</source>
	(~~Depreciated~~ as of Guard 2.0) Default when revoking an item is to delete the content key, making the item impossible to decode. If this option is true, then the item is merely expired and can later be retrieved for decoding in case of legal requirements, corporate requirements, etc		(Deprecated as of Guard 2.0) Default when revoking an item is to delete the content key, making the item impossible to decode. If this option is true, then the item is merely expired and can later be retrieved for decoding in case of legal requirements, corporate requirements, etc

	<source lang="bash">com.openexchange.capability.guard-noextra = true</source>		<source lang="bash">com.openexchange.capability.guard-noextra = true</source>
	(~~Depreciated~~ as of Guard 2.0) Disables the ability to add an extra password to encrypted items. May be required by some industry		(Deprecated as of Guard 2.0) Disables the ability to add an extra password to encrypted items. May be required by some industry

	== Configuration File (<code>guard-core.properties</code>) ==		== Configuration File (<code>guard-core.properties</code>) ==
Line 88:		Line 88:
	=== File Storage ===		=== File Storage ===

	Local/remote storage is required for temporary caching of non-ox encrypted emails. This can be an attached local file store, or Amazon S3 compatible object store depending on which <code>open-xchange-guard-*-storage</code> package is installed (<code>file</code> or <code>S3</code>).		Local/remote storage is required for temporary caching of non-OX encrypted emails. This can be an attached local file store, or Amazon S3 compatible object store depending on which <code>open-xchange-guard-*-storage</code> package is installed (<code>file</code> or <code>S3</code>).

	==== General Properties ====		==== General Properties ====

	<source lang="bash">com.openexchange.guard.cacheDays = 30</source>		<source lang="bash">com.openexchange.guard.cacheDays = 30</source>
	How many days emails are kept in file store before being deleted. Measured from time of sending, reset when someone reads the email		How many days emails to guests are kept in file store before being deleted. Measured from time of sending, reset when someone reads the email.

	==== Storage Specific Properties ====		==== Storage Specific Properties ====
Line 200:		Line 200:

	<source lang="bash">com.openexchange.guard.secureReply = true</source>		<source lang="bash">com.openexchange.guard.secureReply = true</source>
	(Guard 2.2) Normally, when a person replies from an encrypted email, the reply is automatically encrypted. Set to false to disable this automatic encryption		(since Guard 2.2) Normally, when a person replies from an encrypted email, the reply is automatically encrypted. Set to false to disable this automatic encryption

	== SSL ==		== SSL ==