Difference between revisions of "MailStore Server Service Configuration"
| [unchecked revision] | [checked revision] |
Ltalaschus (talk | contribs) |
Ltalaschus (talk | contribs) |
||
| (23 intermediate revisions by 4 users not shown) | |||
| Line 2: | Line 2: | ||
== General== | == General== | ||
| − | On this page you can select the storage location of the master database, configure where audit events should be stored and enable or disable | + | On this page you can select the storage location of the master database, configure where audit events should be stored and enable or disable support for the Volume Shadow Copy Service (VSS). |
[[File:tech_config_01.png|center|500px]] | [[File:tech_config_01.png|center|500px]] | ||
| Line 9: | Line 9: | ||
Select the storage location of an existing master database. If you chose an empty directory, a new master database will be created therein. If you want to move an existing archive to a new storage location, refer to the instructions in [[Moving the Archive]]. | Select the storage location of an existing master database. If you chose an empty directory, a new master database will be created therein. If you want to move an existing archive to a new storage location, refer to the instructions in [[Moving the Archive]]. | ||
| − | + | === Audit Log === | |
| + | Select the preferred location for storing audit log events. | ||
| − | + | * ''Windows Event Log''<br/>Audit events will be stored in the Windows Event Log, which allows to access and monitor audit event with other 3rd party tools | |
| − | |||
| − | * '' | + | * ''Integrated Audit Log''<br/>Audit events will be stored in the current archive and MailStore administrators may use the [[Audit Log|MailStore Client]] to search inside the audit log. |
| − | + | ||
| − | + | === Volume Shadow Copy Services (VSS) Support === | |
| − | + | Third party backup solutions may utilize Windows' Volume Shadow Copy Service to create consistent backups of data. Please refer to [[Backup and Restore]] to learn more about the various backup scenarios and in which enabling MailStore's VSS support might be beneficial. | |
| − | + | ||
| − | * ''VSS Writer''<br/>Activates the MailStore | + | The following settings are available in this section: |
| + | |||
| + | * ''VSS Writer''<br/>Activates the MailStore VSS Writer for enabling live backups of the archive using an [[Backup_and_Restore#Using_External_Backup_Software|external backup software]]. | ||
** ''Exclude Indexes from VSS Backup''<br/>Location of index files will not be reported by the VSS Writer. | ** ''Exclude Indexes from VSS Backup''<br/>Location of index files will not be reported by the VSS Writer. | ||
| − | == | + | === Controlling the Service === |
| − | In addition to enabling and disabling individual network | + | The current status of the MailStore Server service is shown at the bottom of the window. By using the buttons you can control the MailStore Server service. |
| + | |||
| + | ==== Safe Mode ==== | ||
| + | The MailStore Server service can be started in ''Safe Mode'' to perform configuration changes or execute maintenance task without interference of background jobs or users. | ||
| + | |||
| + | While the ''Safe Mode'' is active: | ||
| + | * Only administrators can log in to MailStore | ||
| + | * Automatic archiving and export profiles are not started | ||
| + | * Jobs are not started automatically | ||
| + | * All internal heartbeats are disabled | ||
| + | * The ''MailStore Server Service Configuration'' cannot be closed | ||
| + | |||
| + | == Network Settings == | ||
| + | === Certificate === | ||
| + | Shows the current TLS certificate used by all integrated services. Click on the name of the TLS certificate to view further details. Using the ellipsis button (…) next to the name you can: | ||
| + | * Select a TLS certificate from the certificate store of the MailStore Server computer. | ||
| + | * Import a TLS certificate from a file directly into the certificate store of the MailStore Server computer. The file must be in PKCS #12 format and usually has the file extension ''.pfx'' or ''.p12''. | ||
| + | * Request a TLS certificate from Let's Encrypt | ||
| + | * Create a new self-signed TLS certificate. | ||
| + | |||
| + | Further information about certificates and TLS security can be found in the following articles: | ||
| + | |||
| + | * [[Using_Your_Own_SSL_Certificate|Using Your Own SSL Certificate]] | ||
| + | * [[Enhancing_SSL_Security|Enhancing SSL Security]] | ||
| + | * [[Using_Lets_Encrypt_Certificates|Using Let's Encrypt Certificates]] | ||
| + | |||
| + | === Services === | ||
| + | In addition to enabling and disabling individual network services provided by MailStore Server, you can choose the IP address and the port to which a service is to be bound. | ||
| + | |||
[[File:tech_config_02.png|center|550px]] | [[File:tech_config_02.png|center|550px]] | ||
| − | + | * ''MailStore Client''<br/>Access for the [[Accessing_the_Archive_with_the_MailStore_Client_software|MailStore Client]] application via a TLS encrypted TCP connection. This service cannot be disabled because the MailStore Client is essential for managing MailStore Server. The default TCP port is 8460. | |
| + | * ''MailStore Web Access / Outlook Add-In (HTTPS)''<br/> This service provides TLS-encrypted archive access through [[Accessing_the_Archive_with_MailStore_Web_Access|MailStore Web Access]] and the [[Accessing_the_Archive_with_the_Microsoft_Outlook_integration|MailStore Outlook Add-in]]. The default TCP port is 8462. This service cannot be disabled. | ||
| + | * ''IMAP Server (STARTTLS)''<br/>Enables the STARTTLS-encrypted archive access through the integrated [[Accessing_the_Archive_via_Integrated_IMAP_Server|IMAP server]] (explicit TLS). Login over unencrypted connections is not supported. | ||
| + | * ''IMAP Server (SSL)''<br/>Enables TLS-encrypted archive access through the integrated IMAP server (implicit TLS). | ||
| + | * ''MailStore Administration API (HTTPS)''<br/>Enables TLS-encrypted access to the [[Administration_API_-_Using_the_API|MailStore Administration API]]. The default TCP port is 8463. Since this API is only used for administrating MailStore Server, this port only needs to be reachable from computers within the organisation. | ||
| + | * ''Let's Encrypt HTTP-01 Challenge Port''<br/>This port is used temporarily when [[Using_Lets_Encrypt_Certificates|requesting or renewing certificates from Let's Encrypt]]. | ||
| + | |||
==== IP Address ==== | ==== IP Address ==== | ||
| − | The IP address on which the | + | The IP address on which the service accepts connections. Generally, it is recommended to bind the MailStore Server services to all IP addresses (default). |
==== Port ==== | ==== Port ==== | ||
| − | Indicates the TCP port on which the | + | Indicates the TCP port on which the service accepts connections. |
| − | :'''Hint:''' If no web server other than MailStore Web Access is installed (e.g. an IIS website, Microsoft Outlook Web Access or SharePoint), you can specify the | + | :'''Hint:''' If no web server other than MailStore Web Access is installed (e.g. an IIS website, Microsoft Outlook Web Access or SharePoint), you can specify the HTTPS standard port (443). This way, users can access MailStore Web access directly using the URL <code>https://<server name></code> without port numbers. |
| − | ==== | + | === Outlook App === |
| − | |||
| − | |||
| − | |||
| − | |||
| − | + | Here you can generate the manifest that is required to make the MailStore Outlook App [[MailStore Outlook App Deployment|available in the new Outlook]]. | |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
== Security and Encryption == | == Security and Encryption == | ||
| Line 61: | Line 79: | ||
=== Restore Default Admin === | === Restore Default Admin === | ||
| − | Through this feature you can restore the default admin user ''admin'' with the likewise password ''admin''. If the recovery key of the archive whose default admin you want to restore is not the product key of the current MailStore Server installation, you will be asked to enter the associated recovery key.<br /> | + | Through this feature, you can restore the default admin user ''admin'' with the likewise password ''admin''. [[Multi-factor Authentication]] will be disabled, if it has been enabled before. Stored auto-login credentials on this system will be removed.<br />If the recovery key of the archive whose default admin you want to restore is not the product key of the current MailStore Server installation, you will be asked to enter the associated recovery key.<br /> |
A restore of the default admin user is written into the audit log. | A restore of the default admin user is written into the audit log. | ||
| Line 83: | Line 101: | ||
You can reset the recovery key to the current product key of your MailStore Server installation at any time. Before the reset you will be asked to enter the current recovery key. By default, MailStore Server already uses the current product key as recovery key and the button is disabled. | You can reset the recovery key to the current product key of your MailStore Server installation at any time. Before the reset you will be asked to enter the current recovery key. By default, MailStore Server already uses the current product key as recovery key and the button is disabled. | ||
| − | == | + | == Network Shares == |
| − | The MailStore Server service can | + | The MailStore Server service can connect to network shares before startup and disconnect on shutdown. In chapter [[Using Network Attached Storage (NAS)]] further details on connecting to a network resource using special connection parameters are described. |
== Event Viewer == | == Event Viewer == | ||
Latest revision as of 12:51, 7 October 2024
With the MailStore Server Service Configuration you can configure low level features of a MailStore Server installation as well as control the MailStore Server service. The current status of the MailStore Server service is shown at the bottom of the window.
General
On this page you can select the storage location of the master database, configure where audit events should be stored and enable or disable support for the Volume Shadow Copy Service (VSS).
Master Database
Select the storage location of an existing master database. If you chose an empty directory, a new master database will be created therein. If you want to move an existing archive to a new storage location, refer to the instructions in Moving the Archive.
Audit Log
Select the preferred location for storing audit log events.
- Windows Event Log
Audit events will be stored in the Windows Event Log, which allows to access and monitor audit event with other 3rd party tools
- Integrated Audit Log
Audit events will be stored in the current archive and MailStore administrators may use the MailStore Client to search inside the audit log.
Volume Shadow Copy Services (VSS) Support
Third party backup solutions may utilize Windows' Volume Shadow Copy Service to create consistent backups of data. Please refer to Backup and Restore to learn more about the various backup scenarios and in which enabling MailStore's VSS support might be beneficial.
The following settings are available in this section:
- VSS Writer
Activates the MailStore VSS Writer for enabling live backups of the archive using an external backup software.- Exclude Indexes from VSS Backup
Location of index files will not be reported by the VSS Writer.
- Exclude Indexes from VSS Backup
Controlling the Service
The current status of the MailStore Server service is shown at the bottom of the window. By using the buttons you can control the MailStore Server service.
Safe Mode
The MailStore Server service can be started in Safe Mode to perform configuration changes or execute maintenance task without interference of background jobs or users.
While the Safe Mode is active:
- Only administrators can log in to MailStore
- Automatic archiving and export profiles are not started
- Jobs are not started automatically
- All internal heartbeats are disabled
- The MailStore Server Service Configuration cannot be closed
Network Settings
Certificate
Shows the current TLS certificate used by all integrated services. Click on the name of the TLS certificate to view further details. Using the ellipsis button (…) next to the name you can:
- Select a TLS certificate from the certificate store of the MailStore Server computer.
- Import a TLS certificate from a file directly into the certificate store of the MailStore Server computer. The file must be in PKCS #12 format and usually has the file extension .pfx or .p12.
- Request a TLS certificate from Let's Encrypt
- Create a new self-signed TLS certificate.
Further information about certificates and TLS security can be found in the following articles:
Services
In addition to enabling and disabling individual network services provided by MailStore Server, you can choose the IP address and the port to which a service is to be bound.
- MailStore Client
Access for the MailStore Client application via a TLS encrypted TCP connection. This service cannot be disabled because the MailStore Client is essential for managing MailStore Server. The default TCP port is 8460. - MailStore Web Access / Outlook Add-In (HTTPS)
This service provides TLS-encrypted archive access through MailStore Web Access and the MailStore Outlook Add-in. The default TCP port is 8462. This service cannot be disabled. - IMAP Server (STARTTLS)
Enables the STARTTLS-encrypted archive access through the integrated IMAP server (explicit TLS). Login over unencrypted connections is not supported. - IMAP Server (SSL)
Enables TLS-encrypted archive access through the integrated IMAP server (implicit TLS). - MailStore Administration API (HTTPS)
Enables TLS-encrypted access to the MailStore Administration API. The default TCP port is 8463. Since this API is only used for administrating MailStore Server, this port only needs to be reachable from computers within the organisation. - Let's Encrypt HTTP-01 Challenge Port
This port is used temporarily when requesting or renewing certificates from Let's Encrypt.
IP Address
The IP address on which the service accepts connections. Generally, it is recommended to bind the MailStore Server services to all IP addresses (default).
Port
Indicates the TCP port on which the service accepts connections.
- Hint: If no web server other than MailStore Web Access is installed (e.g. an IIS website, Microsoft Outlook Web Access or SharePoint), you can specify the HTTPS standard port (443). This way, users can access MailStore Web access directly using the URL
https://<server name>without port numbers.
Outlook App
Here you can generate the manifest that is required to make the MailStore Outlook App available in the new Outlook.
Security and Encryption
This page provides several security features related to archive access and encryption. Please note that you cannot use these features while the MailStore Server service is running; it has to be stopped first.
Restore Default Admin
Through this feature, you can restore the default admin user admin with the likewise password admin. Multi-factor Authentication will be disabled, if it has been enabled before. Stored auto-login credentials on this system will be removed.
If the recovery key of the archive whose default admin you want to restore is not the product key of the current MailStore Server installation, you will be asked to enter the associated recovery key.
A restore of the default admin user is written into the audit log.
Reinitialize Archive Encryption
For security reasons the archive encryption is bound to the Windows installation of the MailStore Server machine. Therefore it might be necessary to reinitialize the archive encryption when moving the archive to another computer. If the recovery key of the archive whose encryption you want to reinitialize is not the product key of the current MailStore Server installation, you will be asked to enter the associated recovery key.
Set Recovery Key
The recovery key is used to authorize several security related tasks in MailStore Server, such as restoring the default admin, moving the archive to another machine or attaching archive stores from another MailStore installation. That way the number of people that may perform such tasks can be kept small and administrative archive and system duties can be kept separate.
By default, MailStore Server uses the product key provided during setup as recovery key and most security related tasks are carried out automatically without the need to enter the recovery key for authorization.
To improve security you can change your recovery key to an automatically generated, random value. In that case, every security related tasks must be authorized by entering the recovery key. For easier reference, each recovery key has a unique identifier that is displayed when the related recovery key must be provided. Only the most recent recovery key can be used for authorization.
Changing the Recovery Key
- Click on Change to change the recovery key to an automatically generated, random value.
- You will be asked to save the recovery key to a file and/or print it. You have to choose at least one option to continue.
- After successfully changing the recovery key only the new key can be used henceforth.
Important notice: Always store the recovery key in a secure location. Without the recovery key carrying out security related tasks is no longer possible.
Resetting the Recovery Key
You can reset the recovery key to the current product key of your MailStore Server installation at any time. Before the reset you will be asked to enter the current recovery key. By default, MailStore Server already uses the current product key as recovery key and the button is disabled.
The MailStore Server service can connect to network shares before startup and disconnect on shutdown. In chapter Using Network Attached Storage (NAS) further details on connecting to a network resource using special connection parameters are described.
Event Viewer
Events such as starting or stopping the MailStore Server service are displayed here. If there are any errors, click on the corresponding entry to view additional details below the list.
Debug Log
On this page you can enable, view or delete all debug logs created by MailStore Server.
Enable Debug Log
Enable this feature if any problems or errors have occurred while running MailStore Server. After restarting the server service via Restart Service in the same window, a detailed log file is recorded. This file can be evaluated by the MailStore support team, for example.
Enable IMAP Connection Debug Log
Enable this feature if problems or errors have occurred while accessing MailStore Server using the integrated IMAP server. After restarting the server service via Restart Service in the same window, a detailed log file is recorded. This file can be evaluated by the MailStore support team, for example.
The table shows an overview of all debug log files. To view the contents of a debug log file in a text editor, double-click on the file name or click on Open. To delete a debug log file, highlight the file name and click on Delete.
