Thank you for using Network Associates' products. This ReadMe file contains important information regarding the PGP Keyserver. Network Associates strongly recommends that you read this entire document. Network Associates welcomes your comments and suggestions. Please use the information provided in this file to contact us. Warning: Export of this software may be restricted by the U.S. Government. WHAT'S IN THIS FILE New Features Documentation System Requirements Known Issues Installation Starting the PGP Keyserver Starting the PGP Replication Engine Contacting Network Associates NEW FEATURES Easy-to-Use Web Console The new PGP Keyserver Web Console provides secure access to the Keyserver's console from remote web browsers, giving administrators the ability to remotely monitor and manage their PGP Keyserver from any client with a supported web browser. The Web Console now features an intuitive, easy-to-use interface for Keyservers on both Windows and Solaris platforms. The bundled web server enables all console communications to be encrypted using SSL, providing a secure foundation for remote management using a turnkey installation process. Keyserver access logs and logged system events are now available from the Web Console, improving the information available to remote administrators. Keyserver search and key-add functionality is now available through a web browser interface for use by administrators or remote web users. Enterprise Management of PGP Client Preferences PGP 7.0 introduces a valuable feature that helps administrators keep deployed PGP client configurations up-to-date. By storing configuration options on the PGP Keyserver, administrators can easily roll out enterprise-wide configuration changes to deployed PGP clients. Configuration Wizard A new Configuration Wizard enables turnkey configuration of everything necessary to begin using the PGP Keyserver, making it easy to set or change such options as security certificates for the Keyserver and Web Console as well as port numbers, hostname, and administrator email address. Database Performance Improvements This version includes numerous performance improvements and database optimizations as well as further options for performance enhancements based on configuration requirements. PGP userids can be indexed by substring for complete searchability, as with earlier versions of the Keyserver, or they can be indexed word by word, providing a shorter time for adding keys and smaller index files for the database. Windows 2000 Support PGP Keyserver now fully supports the Windows 2000 operating system. Auto-delete from pending area The pending area has an enhanced self-maintenance feature. When a key added to the Keyserver passes signature policies (having been signed by an Employee Certification Key, for instance), the key is automatically removed from the pending area, eliminating the need for additional administrative steps. Key Reconstruction Support for PGP Clients PGP 7.0's new key reconstruction feature helps users recover from lost keys or forgotten passphrases. PGP Keyserver 7.0 supports the optional storage of reconstruction data, supporting PGP's cryptographic key splitting technology to provide a secure means for users to recover their private keys after answering five questions whose answers only the user would know. Enhanced logging format PGP Keyserver 7.0's enhanced logging format provides additional statistics useful for usage analysis, including request processing time, number of user id's and signatures added, and the size of the key information transmitted to or from the client machine. Compatibility with the earlier logging format is available by configuration option. New PGP Key format support PGP 7.0 introduces a new RSA key format that provides support for PGP's Additional Decryption Key (ADK), designated revoker, multiple encryption subkeys and photo ID features. Previously these features were only available to users with Diffie-Hellman keys. PGP Keyserver 7.0 now supports the use of these keys. Support Utilities PGPexport now creates ASCII-armored keyfiles by default when exporting keys and reconstruction data. The binary export format used in earlier versions can be enabled if reconstruction data is not required. PGPimport now reads both ASCII-armored keyfiles and binary keyrings. DOCUMENTATION Included with this release is the following manual, which can be viewed on-line as well as printed: PGP Keyserver Administrator's Guide This document is saved in Adobe Acrobat Portable Document Format (.PDF). You can view and print the document with Adobe's Acrobat Reader. PDF files can include hypertext links and other navigation features to assist you in finding answers to questions about your Network Associates product. To download Adobe Acrobat Reader from the World Wide Web, visit Adobe's Web site. The Adobe Acrobat Reader is also included on this product CD. Adobe Acrobat 4.0 is required for best viewing of the screenimages. Opening the Administrator's Guide: *Windows NT/2000* After installing Adobe Acrobat Reader, bring up the Windows Start Menu. Then select Programs -> Network Associates -> PGP Keyserver -> Documentation -> Administrator's Guide. *Windows NT/2000 and UNIX* If the web server support for PGP Keyserver is installed, the Administrator's Guide is also available through a link found on the page: https://YOUR-HOST-NAME:PORT Substitute the hostname of the machine running the PGP Keyserver for the YOUR-HOST-NAME value. For PORT, substitute the port number for the web server that you are running on YOUR-HOST-NAME (this defaults to 443 if it is not specified). Documentation feedback is welcome. Send e-mail to tns_documentation@nai.com. SYSTEM REQUIREMENTS *Windows NT/2000* To install PGP Keyserver on a Windows NT/2000 server: Windows NT version 4.0 Service Pack 6a or Windows 2000 Service Pack 1 64MB RAM minimum 15MB disk space for software Additional disk space for database (10MB - 500MB) Network interface card PGP 7.0 (Only required for management of secure keys). Microsoft Internet Explorer 4.01 SP2 or later, or Netscape 4.x. *UNIX* To install PGP Keyserver on a UNIX server: Sun Solaris for SPARC (UNIX) version 2.6 or later 64MB RAM minimum 30MB disk space for software Additional disk space for database (10MB - 500MB) Network interface card PGP 7.0 (Only required for management of secure keys). Microsoft Internet Explorer 4.01 SP2 or later, or Netscape 4.x. NOTE: The latest recommended patches from Sun are REQUIRED for Solaris 7 support. They can be obtained as a single patch bundle at the following web site: http://sunsolve.sun.com/pub-cgi/show.pl?target=patches/patch-access KNOWN ISSUES If any other service or daemon (such as Microsoft Internet Information Server or Apache Web Server) is using port 443, the Configuration Wizard will issue a warning that port 443 is in use. You should either disable that service, or assign the PGP Keyserver's Web Console to a port other than 443. To use the Web Console, a browser with 128-bit encryption is required. If you use a browser that does not include support for 128-bit encryption, using the Web Console will result in a blank browser display or a message stating that there are no common encryption algorithms. Any PGP 7.0 client or server product installed after PGP Keyserver 7.0 will cause failure to start PGP Keyserver (error message: DLL entry point not found). Any such product must be installed BEFORE PGP Keyserver 7.0. Any PGP 7.0.1 software can be safely installed before or after PGP Keyserver 7.0. When entering the Organization Name and Organizational Unit to generate the X.509 Certificate in the Configuration Wizard, the use of more than 100 characters in each field or the use of non-alphanumeric characters is unsupported. If PGPapache encounters such usage, it may fail to start, and the webserver error log in web/logs/error_log will contain the message "Key does not have a valid X.509 signature". INSTALLATION Warning: If you are installing PGP Desktop Security 7.0 and PGP Keyserver 7.0, install PGP Desktop Security 7.0 first. *Windows NT/2000* PGP Keyserver is distributed in either a self-extracting file or on a CD-ROM. To install the product from a CD-ROM: Start Windows. Insert the CD-ROM. Double-click the installation program icon found in the PGP Keyserver subdirectory. Follow the on-screen prompts. To install the product from a downloaded self-extracting file: Start Windows. Download the PGP Keyserver installation program onto your computer’s hard drive. Double-click the installation program. Follow the on-screen prompts. *UNIX* PGP Keyserver is distributed as a Solaris package file. This section includes instructions to install the product for the first time and to upgrade from a previous version. To install the product for the first time: Sign on as root. Change to the directory containing the package file. Run the command: pkgadd -d PGPkeyserv_7.0.0_Solaris.pkg Run the post-install script: Run the command: cd /opt/PGPkeysrv/web/ ; ./config-wiz.pl Verify that the product is installed properly: Run the command: pkginfo -l PGPkeysrv The status should be "Completely Installed." To upgrade from a previous version of the product: Sign on as root. Export the existing database. - Stop the PGP Keyserver (use the use ps -fu root to locate the process ID, and use the kill command to send a SIGTERM signal to the PGP Keyserver: kill <process ID>). - Change to the /opt/PGPcertd/bin directory. - Use the PGPexport utility to export the database: ./pgpexport ../data /opt/dump.pgp Install the PGP Keyserver as you would for a brand new installation. For more information, see the instructions in the next section. Configure the PGP Keyserver as described in the documentation and restart the program to institute the updated policies. Re-import the keys from the old database. - Change to the /opt/PGPkeysrv/bin directory. - Use the PGPimport utility to re-import the database: ./pgpimport /opt/dump.pgp ldap://localhost Re-disable any keys that were disabled in the old installation. STARTING THE PGP KEYSERVER *Windows NT/2000* The PGP Keyserver starts automatically after installation and reboot. *UNIX* To start the PGP Keyserver after configuring it, use the Web Console's Restart button (Server Control panel), or run the SysV init script: /etc/init.d/pgpkeyserver start *Both Windows and UNIX* To view the PGP Keyserver's Web Console, enter the following URL in the location field of any Web browser: https://<hostname or IP address>[:<port>]/keyserver/ To test to see if the PGP Keyserver is running properly: Start PGP version 5.5 or later. Add the URL of the machine running PGP Keyserver to PGP's configuration by selecting PGP Preferences from PGPtray's popup menu (or from the Edit/Preferences menu of PGPkeys). On the Servers page, add a new server: A. Enter a new domain or choose an existing one. B. Enter an LDAP server using the format: ldap://YOUR-HOST-NAME From PGPkeys, select any key from your list of keys, then select the Send Key to Server item on the Server menu. Be sure to select the name of your new PGP Keyserver. If the key is successfully sent to the PGP Keyserver, it is running properly. You can also use the Search dialog box in PGPkeys to search the keys on the server. Again, be sure to set the name of your new PGP Keyserver as the server to search. STARTING THE PGP REPLICATION ENGINE *Windows NT/2000 and UNIX* If you installed the optional PGP Replication Engine component, you must install the PGP Keyserver on the slave servers. After you have installed the additional software, you must identify the hosts that you want to replicate the database to, and the replication log file before you start the PGP Replication Engine. To do so, follow these steps: Display the Web Console by entering the following URL in the location field of any Web browser: https://<hostname or IP address>[:<port>]/keyserver/ Click Replication, left side of console. Identify the PGP Keyservers you want to replicate the database to, for example, ldap://mirror.company.com. Identify the replication log file, for example, rep.log. Click Save Changes (top of console). Click Server Control (left side of Web Console). Click Restart under Replication, top right corner of Web Console. See the Administrator's Guide for exact details on on the configuration parameters. CONTACTING NETWORK ASSOCIATES *FOR QUESTIONS, ORDERS, PROBLEMS, OR COMMENTS* Contact the Network Associates Customer Service department: Network Associates Customer Service 4099 McEwen, Suite 500 Dallas, Texas 75244 U.S.A. The department's hours or operation are 8 a.m. to 8 p.m. Central time, Monday through Friday. Contact information for corporate-licensed customers: Phone: (972) 308-9960 Email: services_corporate_division@nai.com World Wide Web: http://www.pgp.com Contact information for retail-licensed customers: Phone: (972) 308-9960 Email: cust_care@nai.com World Wide Web: http://www.pgp.com * FOR TECHNICAL SUPPORT* PGP Security and Network Associates are famous for their dedication to customer satisfaction. The companies have continued this tradition by making their sites on the World Wide Web valuable resources for answers to technical support issues. PGP Security encourages you to make this your first stop for answers to frequently asked questions, for updates to PGP Security and Network Associates software, and for access to news and virus information. World Wide Web: http://support.nai.com If the automated services do not have the answers you need, contact Network Associates at one of the following numbers between 8 a.m. and 8 p.m. Central time, Monday through Friday, to find out about Network Associates technical support plans. For corporate-licensed customers: Phone: (972) 308-9960 For retail-licensed customers: Phone: (972) 855-7044 To provide the answers you need quickly and efficiently, the Network Associates technical support staff needs some information about your computer and your software. Please have this information ready when you call: Program name and version number Computer brand and model Any additional hardware or peripherals connected to your computer Operating system type and version numbers Network name, operating system, and version Network card installed, where applicable Modem manufacturer, model, and speed, where applicable Relevant browsers or applications and their version numbers, where applicable How to reproduce your problem: when it occurs, whether you can reproduce it regularly, and under what conditions Information needed to contact you by voice, fax, or e-mail We also seek and appreciate general feedback. *FOR PRODUCT UPGRADES* To make it easier for you to receive and use Network Associates products, we have established a reseller's program to provide service, sales, and support for our products worldwide. For a listing of resellers, see the resellers.txt file or contact Network Associates Customer Service for resellers near you. *TO REPORT PROBLEMS* Network Associates prides itself on delivering a high-quality product. If you find any problems, please take a moment to review the contents of this file. If the problem you've encountered is documented, there is no need to report the problem to Network Associates. If you find any feature that does not appear to function properly on your system, or if you believe an application would benefit greatly from enhancement, please contact Network Associates with your suggestions or concerns. *FOR ON-SITE TRAINING INFORMATION* Contact Network Associates Customer Service at (972) 308-9960.