Januar 2014
Autor:in des Beitrags
Markus
Head of Innovation and Product Development
Veröffentlicht am
27.01.2014 von Markus
Jetzt Blogbeitrag teilen
Xing LinkedIn Facebook Twitter

Mobile Device Management and Secured Email Access

Overview

Nowadays, everyone is talking about MDM (Mobile Device Management), which is a technique to secure, monitor and manage mobile devices like smart phones and tablets. By controlling and protecting data and configuration settings, it can reduce support costs and business risks. The MDM’s approach of taking control of the whole device differentiates it from MAM (Mobile Application Management) – a strategy which aims to control and secure access to data by a fine-grained management of the application side.
In our case, MDM was used to enforce policies like an unlock code and to push some applications to the devices. Furthermore, access to emails should only be granted to managed (company owned) devices while there is no web-access to Exchange. The choice for a MDM solution went in favor for Citrix’s XenMobile MDM as it integrates MDM, MAM (formely known as CloudGateway) and the ability to share and sync data seamlessly (ShareFile).

Scenario

One pecularity in our proof-of-concept setup was the availability of only one public IP address and SSL certificate for the load balancing of Active Sync as well as for the MDM. This necessitated a special solution:

  • The Citrix NetScaler Content Switch handles the SSL off-loading and forwards to ZDM or Exchange server accordingly to the respective requests
  • The NetScaler Callout communicates via HTTP callouts with the XNC (XenMobile NetScaler Connector). This service can query the status of the mobile device and depending on it either allow or deny requests to Active Sync.

Prerequisites

XenMobile Device Manager

XenMobile NetScaler Connector

  • for the proof-of-concept the XNC was simply installed on the MDM server

NetScaler

  • deployed as a HA pair with a standard license
  • the wizzard for the Active Sync callouts fails to configure the cache feature which is only available for the NetScaler Platinum Edition
  • For larger deployments (in contrast to this proof-of-concept), caching is strongly recommended as each refresh of the mail client triggers a HTTP callout
  • IP Addresses, Firewall and Certificates
    • One public IP address, either directly or via NAT to the NetScaler
    • One officially signed certificate (e.g. from Verisign) installed on NetScaler
    • Device Manager certificates downloaded from from the MDM server and installed on NetScaler as described in the Citrix Blog
    • For details on the firewall settings, please look up the port list from the product documentation
Source Destination Port Protocol Description
ANY (Internet) NetScaler VIP 80,443,8443 TCP Internet → NetScaler VIP
NetScaler SNIP Device Manager 80,9080 TCP NetScaler → Device Manager
XenMobile → XNC for HTTP Callouts
NetScaler SNIP Exchange Server 443 TCP NetScaler → Active Sync Dienst

NetScaler Load Balancing Configuration

add server [DEVICEMANAGER-FQDN] [DEVICEMANAGER-FQDN]
add server [EXCHANGESERVER-FQDN] [EXCHANGESERVER-FQDN]
add service 0301_lb_sv_mdm [DEVICEMANAGER-FQDN] HTTP 80 -gslb NONE -maxClient 0 -maxReq 0 -cip DISABLED -usip NO -useproxyport YES -sp OFF -cltTimeout 180 -svrTimeout 360 -CKA NO -TCPB NO -CMP NO
add service 0302_lb_sv_mdm [DEVICEMANAGER-FQDN] SSL 443 -gslb NONE -maxClient 0 -maxReq 0 -cip DISABLED -usip NO -useproxyport YES -sp OFF -cltTimeout 180 -svrTimeout 360 -CKA NO -TCPB NO -CMP NO
add service 0303_lb_sv_exchange [EXCHANGESERVER-IP] SSL 443 -gslb NONE -maxClient 0 -maxReq 0 -cip DISABLED -usip NO -useproxyport YES -sp OFF -cltTimeout 180 -svrTimeout 360 -CKA NO -TCPB NO -CMP NO
add service 0304_lb_sv_xnc [XNCSERVER-IP] HTTP 9080 -gslb NONE -maxClient 0 -maxReq 0 -cip DISABLED -usip NO -useproxyport YES -sp OFF -cltTimeout 180 -svrTimeout 360 -CKA NO -TCPB NO -CMP NO
add lb vserver 1201_lb_vs_mdm_80 HTTP [PUBLIC-IP] 80 -persistenceType NONE -cltTimeout 120
add lb vserver 1202_lb_vs_mdm_8443 SSL [PUBLIC-IP] 8443 -persistenceType NONE -cltTimeout 120
add lb vserver 1203_lb_vs_mdm_exchange SSL 0.0.0.0 0 -persistenceType NONE -cltTimeout 180
add lb vserver 1204_lb_vs_mdm_xnc SSL 0.0.0.0 0 -persistenceType NONE -cltTimeout 180
bind lb vserver 1201_lb_vs_mdm_80 0301_lb_sv_mdm
bind lb vserver 1202_lb_vs_mdm_8443 0301_lb_sv_mdm
bind lb vserver 1203_lb_vs_mdm_exchange 0303_lb_sv_exchange
bind lb vserver 1204_lb_vs_mdm_xnc 0304_lb_sv_xnc
bind ssl vserver 1203_lb_vs_mdm_exchange -certkeyName [PUBLICCERTIFICATE-NAME]
bind ssl vserver 1204_lb_vs_mdm_xnc -certkeyName [PUBLICCERTIFICATE-NAME]

NetScaler Content Switch Configuration

add cs vserver cs_vs_mdm_01 SSL [PUBLIC-IP] 443 -cltTimeout 180
add cs policy cs_vs_mdm_01 -rule true
add cs policy cs_vs_mdm_exchange_01 -rule "HTTP.REQ.URL.STARTSWITH("/Microsoft-Server-ActiveSync")"
bind cs vserver cs_vs_mdm_01 -policyName cs_vs_mdm_exchange_01 -targetLBVserver 1203_lb_vs_mdm_exchange -priority 100
bind cs vserver cs_vs_mdm_01 -policyName cs_vs_mdm_01 -targetLBVserver 1201_lb_vs_mdm_80 -priority 110
set ssl vserver cs_vs_mdm_01 -clientAuth ENABLED -clientCert Optional
add ssl action SSL_act -clientCert ENABLED -certHeader NSClientCert
add ssl policy SSL_pol_mdm -rule "CLIENT.SSL.CLIENT_CERT.EXISTS && HTTP.REQ.URL.STARTSWITH("/Microsoft-Server-ActiveSync").NOT" -action SSL_act
bind ssl vserver cs_vs_mdm_01 -certkeyName [PUBLICCERTIFICATE-NAME]
bind ssl vserver cs_vs_mdm_01 -certkeyName CA_XenMobile_Device_CA -CA -ocspCheck Optional
bind ssl vserver cs_vs_mdm_01 -certkeyName CA_XenMobile_Root_CA -CA -ocspCheck Optional
bind ssl vserver cs_vs_mdm_01 -policyName SSL_pol_mdm -priority 100

NetScaler Responder Policy

add policy httpCallout httpCalloutXNC

set policy httpCallout httpCalloutXNC -vServer 1204_lb_vs_mdm_xnc -returnType TEXT -hostExpr ""callout.asfilter.internal"" -urlStemExpr ""/services/ActiveSync/Authorize"" -parameters user(HTTP.REQ.HEADER("authorization").AFTER_STR("Basic ").B64DECODE.BEFORE_STR(":").HTTP_URL_SAFE) agent(HTTP.REQ.HEADER("user-agent").HTTP_URL_SAFE) ip(CLIENT.IP.SRC) url(("https://"+HTTP.REQ.HOSTNAME+HTTP.REQ.URL).B64ENCODE) resultType("json") DeviceId(HTTP.REQ.URL.QUERY.VALUE("DeviceId")) -scheme http -resultExpr "HTTP.RES.BODY(20)"

XenMobile Device Manager

The device manager configuration and the mobile device rollout followed the standard procedures. Only the devices with access to Active Sync have to be defined in a few additional steps.

XenMobile NetScaler Connector

In our case, the communication was configured to be over HTTP, port 9080. With the initial startup of the XNC, it is strongly recommended to start the requested Windows services.

Now, the XNC policy has to be configured

  • Policy: Static + XenMobile Device manager: Block Mode
  • Http path: Microsoft-Server-ActiveSync
  • Http host name: All
  • Http verb: POST
  • Active Sync Protocol: enable
  • Active Sync Command: All


Configure the provider properties, then test the connection to the Device Manager


Finally, the access scenario had to be tested. This was accomplished by using a managed iPhone and an unmanaged iPad.

Das könnte dich auch interessieren

Blogbeitrag

Passkeys: Die Schlüssel zu einer sichereren und passwortlosen Zukunft

Die Frequenz von Phishing-Attacken steigt immer weiter. Wie sieht also die Authentifizierung der Zukunft aus?
Weiterlesen
Blogbeitrag

Entra Private Access – Zero Trust für den hybriden Arbeitsplatz?

Mit Entra Private Access entwickelt Microsoft derzeit die wohl weitsichtigste Lösung für einem Hybriden Arbeitsplatz.
Weiterlesen
Blogbeitrag

Microsoft Copilot

Microsoft läutet mit dem Copiloten eine neue Ära der KI ein. Der Copilot ist mit dem neusten 23H2-Feature-Update für Windows 11 verfügbar und beinhaltet mehr als 150 neue Funktionen.
Weiterlesen
Whitepaper

Lizenzänderungen bei Citrix – Was Sie jetzt wissen müssen

In unserem kostenfreien Whitepaper bringen wir Licht ins Dunkle und erklären Ihnen, was Sie über die aktuelle Situation bei Citrix und die damit einhergehenden Änderungen wissen müssen.
Weiterlesen
Blogbeitrag

Datenschutzkonformer Einsatz von Microsoft 365 bei Sozialdatenträgern

Wir erklären, was Sie beachten sollten, wenn Sie Microsoft 365 als Sozialdatenträger DSGVO-konform einsetzen möchten.
Weiterlesen
Blogbeitrag

Verlängerter Support für Windows Server 2012/R2

Der Support für Windows Server 2012/R2 läuft aus, was bedeutet, dass Microsoft keine Sicherheitsupdates mehr bereitstellt.
Weiterlesen
Blogbeitrag

Verified Credentials

In diesem Beitrag geht es um die Konfiguration der Verified Credentials und die dafür benötigten Azure-Komponenten.
Weiterlesen
Blogbeitrag

Neuer Angemessenheits-beschluss für den Datenverkehr EU-USA

Die EU-Kommission hat einen neuen Angemessenheitsbeschluss für den transatlantischen Datenschutzrahmen EU-USA angenommen,
Weiterlesen
Blogbeitrag

How to: Zuweisung des Citrix Renewal Partner

Wir erklären Ihnen, wie Sie Ihren Renewal Partner bzw. Solution Advisor in Citrix „My Account“ hinzufügen oder ändern.
Weiterlesen
Blogbeitrag

Citrix NetScaler ADC und Gateway – Kritische Schwachstellen

Citrix warnt seine Kunden vor den kritischen Sicherheitslücken. Administratoren sollten deshalb ihr Security Bulletin überprüfen.
Weiterlesen
Jetzt Blogbeitrag teilen
Xing LinkedIn Facebook Twitter