TightGate-Pro

Dediziertes Remote-Controlled Browser System
zum Schutz vor Gefahren aus dem Internet

Automatisch generierter Auszug aus dem Administrationshandbuch

Datum: 11.04.2019

Herausgeber:

m-privacy GmbH

Technische Redaktion

Werner-Voß-Damm 62

12101 Berlin

Fon: +49 30 243423-34

support@m-privacy.de

www.help.m-privacy.de

Allgemeine Hinweise zu diesem Handbuch

Alle Materialien und Ausführungen wurden mit Sorgfalt erarbeitet und zusammengestellt. Den­noch sind Fehler nicht auszuschließen. Die m-privacy GmbH übernimmt keine Haftung für Schäden, die aus Unrichtigkeit einzelner Angaben entstehen.

Im Sinne einer raschen Orientierung und zur Vermeidung von Sicherheitsrisiken werden besonders wichtige Aspekte durch wiederkehrende Stichworte gekennzeichnet. Diese sind:

Hinweis
Unter diesem Stichwort werden nützliche Details zur rationellen Verwendung von TightGate-Pro er­läutert.

Achtung
Unter diesem Stichwort erfolgen Hinweise zur Problemvermeidung bzw. zur Vorbeugung von Betriebs­störungen bei TightGate-Pro.

Warnung
Unter diesem Stichwort erfolgen Hinweise auf mögliche Fehler bei der Konfiguration und Verwendung von TightGate-Pro, die weitreichende Sicherheitsrisiken bergen oder zu schwerwiegenden Betriebs­störungen führen können.

Inhaltsverzeichnis

OPSWAT - File clean-up for the TightGate file transfer

With the product MetaDefender, the company OPSWAT offers the possibility to check files with multiple virus scanners for malicious code and furthermore to remove potentially dangerous code from files (file cleaning). With file cleaning, it is possible, for example, to remove macros from Office documents without rendering the Office document as such unusable. m-privacy GmbH has recognised the possibilities of OPSWAT and offers all customers who use the OPSWAT product an interface to improve the quality of the TightGate file transfer. The following instructions describe how to configure the OPSWAT interface in TightGate-Pro.

The menu items and functionality of OPSWAT are only available if the optional opswat-integration package has been installed.

Enabling OPSWAT changes the functionality of the TightGate file transfer so that all MIME types are automatically enabled for download, so that only the OPSWAT product decides whether a file type is allowed to be transferred. However, there is no change for the use of the file upload. This is configured as usual at TightGate-Pro and the permissions (MIME types) are assigned. The TightGate file transfer must always be used for the file upload.

Please make sure that the IP address of the OPSWAT server is not in the client network, otherwise no connection to the OPSWAT server can be established.

Menu item	Description
OPSWAT Integration*	Disables the download via the local gateway and uses only the add-on product OPSWAT for the file transfer. To configure the OPSWAT interface, the IP address of the OPSWAT server, the corresponding port and the OPSWAT rules are required. As soon as the menu item has been set to Yes, further menu items open below it for entering the OPSWAT details.
OPSWAT Host*	Specify the IP address or host name of the OPSWAT server. If an encrypted connection via HTTPS is used, the host name must always be entered.
OPSWAT-API-Port*	Port via which the OPSWAT server is addressed, default is 8008.
OPSWAT-Rules*	Create the rules that can be used on the OPSWAT server. The rules must correspond exactly to the name on the OPSWAT server.
Import OPSWAT-SSL-Custom-CA*	If the connection to the OPSWAT server is to be made via the encrypted HTTPS protocol, the SSL-CA of the OPSWAT server must be stored here. The CA must have been transferred to the administrator's transfer directory config in advance. If a CA has been imported and applied, an attempt is always made to communicate with the OPSWAT server via the HTTPS protocol.
Remove OPSWAT SSL Custom CA*	If a custom CA is imported, the custom CA can be removed again via this menu item.
OPSWAT client folder*	Here you can define where on the client the files cleaned or checked by the OPSWAT are transferred from the TightGate file transfer.

If the user authentication is done via Active Directory, all user IDs that are to use the OPSWAT procedure must be included in the AD security group TGopswat. An overview of all AD security groups can be found here: Overview of AD security groups for TightGate-Pro .

Accessibility of the OPSWAT interface

If you would like to access the OPSWAT web interface from TightGate-Pro in addition to the API, the following additional settings are required:

As administrator config:

Under Network > HTTP Out, enter the IP address of the OPSWAT server.

Under Network > HTTP Ports, enter the port via which OPSWAT can be reached. The default is port 8008.

If you use a proxy in TightGate-Pro, the OPSWAT server must be entered as a proxy exception. This is done via the menu item Proxy > Proxy Exceptions. Type in the name or IP address of the OPSWAT server.

Please do not forget to Save and Apply.

Test the setting by logging in again with a TightGate-Viewer after applying all settings and surfing to the OPSWAT server in Firefox. The call could look like this:

https://opswat.m-privacy.local:8008