TightGate-Pro

Dediziertes Remote-Controlled Browser System
zum Schutz vor Gefahren aus dem Internet

Automatisch generierter Auszug aus dem Administrationshandbuch

Datum: 11.04.2019

Herausgeber:

m-privacy GmbH

Technische Redaktion

Werner-Voß-Damm 62

12101 Berlin

Fon: +49 30 243423-34

support@m-privacy.de

www.help.m-privacy.de

Allgemeine Hinweise zu diesem Handbuch

Alle Materialien und Ausführungen wurden mit Sorgfalt erarbeitet und zusammengestellt. Den­noch sind Fehler nicht auszuschließen. Die m-privacy GmbH übernimmt keine Haftung für Schäden, die aus Unrichtigkeit einzelner Angaben entstehen.

Im Sinne einer raschen Orientierung und zur Vermeidung von Sicherheitsrisiken werden besonders wichtige Aspekte durch wiederkehrende Stichworte gekennzeichnet. Diese sind:

Hinweis
Unter diesem Stichwort werden nützliche Details zur rationellen Verwendung von TightGate-Pro er­läutert.

Achtung
Unter diesem Stichwort erfolgen Hinweise zur Problemvermeidung bzw. zur Vorbeugung von Betriebs­störungen bei TightGate-Pro.

Warnung
Unter diesem Stichwort erfolgen Hinweise auf mögliche Fehler bei der Konfiguration und Verwendung von TightGate-Pro, die weitreichende Sicherheitsrisiken bergen oder zu schwerwiegenden Betriebs­störungen führen können.

Inhaltsverzeichnis

Description of the user defaults

The users of TightGate-Pro can be extended or restricted in their functionality. Various options are available for this purpose, which can be assigned to the individual user accounts depending on the user administration. The following table only lists the options and describes their functionality:

Menu item	Description
Name	Change the user name for the selected identifier. The identifier itself cannot be changed at this point. If identifiers are to be renamed, this is done as described in the instructions Renaming user IDs to TightGate-Pro .
Profile	Select between the standard profile and a customised user profile. Note: The menu item only appears if a customised user profile is available.
Menu Desktop Options	Setting options for the available menu bar options for existing users. Note: The menu options for newly created users via user certificate or Active Directory are configured according to the user specifications by the administrator config according to the user specifications. Please note that the display in the menu bar for optionally installable packages such as Google Chrome for user management via Active Directory must be defined via the respective membership in the AD security group.
User Desktop Language	Selection of the user language. Only languages that already exist in the system can be selected. New languages are added by the administrator update provided by the administrator. Please note that languages other than the system languages English and German must always be must always be installed in advance on all TightGate-Pro nodes.
Groups	Provides an overview of the group membership of the account. The account can also be added to or removed from individual groups via this menu item.
Account expiration	Time the expiry date for the identifier and offers the option of setting the expiry date for the user ID.
Password change	Provides the option to assign a new initial password for an identifier. The initial password is not subject to the password restrictions of TightGate-Pro, but must be changed the first time it is used by a user.
Data transfer:	Authorisation to use the file lock. The transfer can be restricted to certain file types after activation for uploading and downloading. If this menu item is set to Yes the following two menu items appear. Note: If third-party systems such as OPSWAT, VAITHEX or ICAP systems are used, the local MIME types of TightGate-Pro may not work. If third-party systems are used, the respective documentation or the technical support of m-privacy GmbH must be contacted.
Transfer MIME types upload:	Setting to control the file types that may be transferred from the internal network to TightGate-Pro via the file transfer. The MIME types are used to recognise the file types in the filter function of the gateway. Here you can find a list of available MIME types. As soon as at least one file type has been selected, the filter is active. All unselected file types are blocked and can no longer be transferred to TightGate-Pro. Multiple selection is possible. Note: This menu item is only available if the file lock is enabled in the system settings. File transfer allowed is set in the system settings.
Transfer MIME types download:	Setting to control the file types that may be transferred to the internal network via the TightGate-Pro file transfer. The MIME types are used to recognise the file types in the filter function of the gateway. Here you can find a list of available MIME types. As soon as at least one file type has been selected, the filter is active. All unselected file types are blocked and can no longer be transferred to the internal network. Multiple selection is possible. Note: This menu item is only available if the file lock is enabled in the system settings. File transfer allowed is set in the system settings.
Auto-download	Authorisation to use the automated file transfer. Note: If the additional product OPSWAT is used for the file transfer, the automatic file transfer function is deactivated.
Filtered Web Access	When selecting Yes Internet traffic is always routed through the proxy filter from TightGate-Pro . If you select No the content filter at TightGate-Pro is bypassed.
Web Filter Group	Assignment of users to proxy filter groups Proxy filter groups. This menu item only appears if the selection Filtered web is set to Yes and there is more than one defined filter group.
Clipboard Autostart	Authorisation to use the clipboard. The clipboard can be used to transfer text in Unicode format. Images and formatting cannot be transferred via the clipboard. Note: If the use of the clipboard is disabled by config is switched off system-wide, this option has no effect.
Privileged Access	Selection of whether the user ID should receive privileged access to TightGate-Pro. Note: TightGate-Pro Distinguishes between two limits up to which user logins are permitted. These are defined in the licence. The first limit refers to the number of regular users, the second limit refers to the number of additional (privileged) users. As soon as the number of regular users is reached, only privileged users are authorised. Once the second limit has been reached, any further connection attempt is rejected with an error message. Privileged identifiers also receive a larger share of work and mass memory as well as CPU time on TightGate-Pro.
No Idle Timeout	A choice as to whether the identifier is excluded from the forced disconnection on inactivity. The disconnection when reaching the Maximum session duration is not cancelled.
Save Bandwidth	This value is set to No by default. This means that the image data is compressed using the JPEG standard. With the default setting, the user receives very good image quality, but sufficient bandwidth is required for this. By setting the setting to Yes a different compression method is used, which requires slightly more CPU resources at TightGate-Pro and slightly reduces the image quality, but saves approx. 2/3 of the bandwidth. This setting should be used if the connection from TightGate-Viewer is interrupted due to insufficient bandwidth (e.g. branch offices, home office, etc.).
Audio	Authorisation for audio transmission from TightGate-Pro to the client. With the setting Yes the sound is transmitted via the VNC protocol, with the setting Separate setting, the sound is transmitted to the workstation as a separate audio track. Caution: If the special case Separate is selected as the connection method, a network connection from TightGate-Pro to the workstation via port 4713 (TCP protocol) must be enabled!
Printing	Defines whether a user is authorised to use the print method to the local workstation printer.
Limit file size to 4GB	Specifies whether the maximum file size should be limited to 4 GB. The m-privacy GmbH recommends not limiting the file size.
Always reset user	If this option is selected, the profile is completely recreated for this identifier each time you log in.