329 lines
29 KiB
Plaintext
329 lines
29 KiB
Plaintext
<%@ Control Language="C#" Inherits="BaseContentUserControls"%>
|
||
<%@ Register Namespace="TeamLab.Controls" Assembly="__Code" TagPrefix="cc" %>
|
||
<%@ Register TagPrefix="cc" TagName="InvitePeopleTag" Src="~/Controls/Help/Tags/invite-people/invite-people.ascx" %>
|
||
|
||
<script runat="server">
|
||
protected override void Init()
|
||
{
|
||
PageTitle = PageCaption = "Workspace Enterprise Edition Security Guide.";
|
||
MetaKeyWords = "portal settings, security, SSL, encryption, protection, backup, private rooms";
|
||
MetaDescription = "ONLYOFFICE provides many ways to ensure that your portal is properly protected.";
|
||
|
||
var guides = new GuidesModel();
|
||
|
||
(Page as BasePage).Guides = guides;
|
||
}
|
||
|
||
</script>
|
||
<div class="MainHelpCenter GettingStarted">
|
||
<ul class="TableOfContents">
|
||
<li><span class="gs_link gs_active" id="all">All</span></li>
|
||
<li><span class="gs_link" id="Introduction">Introduction</span></li>
|
||
<li><span class="gs_link" id="SSLCertificate">SSL Certificate</span></li>
|
||
<li><span class="gs_link" id="AutoBackup">Automatic backup</span></li>
|
||
<li><span class="gs_link" id="PortalSettings">Portal security settings adjustment</span></li>
|
||
<li><span class="gs_link" id="LDAP">LDAP for access centralization</span></li>
|
||
<li><span class="gs_link" id="SMTP">Usage of private SMTP server</span></li>
|
||
<li><span class="gs_link" id="ActionsMonitoring">User logins and other actions monitoring</span></li>
|
||
<li><span class="gs_link" id="DisableRoot">Disabling root access</span></li>
|
||
<li><span class="gs_link" id="ClosingPorts">Closing all unnecessary ports</span></li>
|
||
<li><span class="gs_link" id="AdjustingFileVersions">Adjusting parameters for storing file versions</span></li>
|
||
<li><span class="gs_link" id="SettingPermissionsRighs">Setting up document permissions and portal access rights</span></li>
|
||
<li><span class="gs_link" id="PrivateRooms">Private rooms for secure work with documents</span></li>
|
||
<li><span class="gs_link" id="DataEncryption">Data encryption protection</span></li>
|
||
</ul>
|
||
<div class="keyword_block">
|
||
<ul>
|
||
<li><cc:LocalizeContent runat="Server" ControlName="~/Controls/Help/Tags/portal-settings/portal-settings.ascx" /></li>
|
||
<li><cc:LocalizeContent runat="Server" ControlName="~/Controls/Help/Tags/custom-domain-name/custom-domain-name.ascx" /></li>
|
||
<li><cc:LocalizeContent runat="Server" ControlName="~/Controls/Help/Tags/trusted-domains/trusted-domains.ascx" /></li>
|
||
<li><cc:LocalizeContent runat="Server" ControlName="~/Controls/Help/Tags/password-strength/password-strength.ascx" /></li>
|
||
<li><cc:InvitePeopleTag ID="InvitePeopleTag1" runat="server" /></li>
|
||
<li><cc:LocalizeContent runat="Server" ControlName="~/Controls/Help/Tags/customize-portal/customize-portal.ascx" /></li>
|
||
<li><cc:LocalizeContent runat="Server" ControlName="~/Controls/Help/Tags/data-backup/data-backup.ascx" /></li>
|
||
<li><cc:LocalizeContent runat="Server" ControlName="~/Controls/Help/Tags/view-statistics/view-statistics.ascx" /></li>
|
||
<li><cc:LocalizeContent runat="Server" ControlName="~/Controls/Help/Tags/restrict-access-to-module/restrict-access-to-module.ascx" /></li>
|
||
<li><cc:LocalizeContent runat="Server" ControlName="~/Controls/Help/Tags/disable-module/disable-module.ascx" /></li>
|
||
<li><cc:LocalizeContent runat="Server" ControlName="~/Controls/Help/Tags/enable-module/enable-module.ascx" /></li>
|
||
<li><cc:LocalizeContent runat="Server" ControlName="~/Controls/Help/Tags/sso/sso-tag.ascx" /></li>
|
||
<li><cc:LocalizeContent runat="Server" ControlName="~/Controls/Help/Tags/smtp-settings/smtp-settings.ascx" /></li>
|
||
<li><cc:LocalizeContent runat="Server" ControlName="~/Controls/Help/Tags/security/security.ascx" /></li>
|
||
<li><cc:LocalizeContent runat="Server" ControlName="~/Controls/Help/Tags/restore-backup/restore-backup.ascx" /></li>
|
||
<li><cc:LocalizeContent runat="Server" ControlName="~/Controls/Help/Tags/ldap-settings/ldap-settings.ascx" /></li>
|
||
</ul>
|
||
</div>
|
||
|
||
|
||
|
||
<div class="gs_content" id="Introduction_block">
|
||
<h2>Introduction</h2>
|
||
<div class="PortalHelp">
|
||
<p>ONLYOFFICE provides many ways to ensure that your portal is properly protected. In this guide, all the features and tools that can enhance the security level of a portal, sensitive data, and work in the cloud and desktop editors are presented.</p>
|
||
</div>
|
||
</div>
|
||
|
||
<div class="gs_content" id="SSLCertificate_block">
|
||
<h2>SSL Certificate</h2>
|
||
<div class="PortalHelp">
|
||
<p>SSL certificate is a digital certificate that authenticates a website's identity and enables an encrypted connection. You can generate an SSL certificate or upload a third-party one using the <b>Control Panel</b>.</p>
|
||
|
||
<h5>Certificate Generation</h5>
|
||
<p>The Let’s encrypt service is used to provide CA-signed certificates.</p>
|
||
<div class="notehelp">
|
||
Port 80 must be open in order to successfully generate letsencrypt certificates.
|
||
</div>
|
||
<p>To generate a new certificate,</p>
|
||
<ol>
|
||
<li>open the <b>HTTPS</b> page in the <b>COMMON SETTINGS</b> section on the left sidebar,</li>
|
||
<li>click the <b>GENERATE AND APPLY</b> button. A popup message box will appear informing that the certificate and private key are successfully generated.</li>
|
||
</ol>
|
||
<p><b>Control Panel</b> and portal will be restarted and become unavailable during this process. It can take up to 5 minutes. Once the certificate installation process is over, your portal will be available over HTTPS.</p>
|
||
<div class="inner_delimiter"></div>
|
||
<h5>Certificate Upload</h5>
|
||
<p>To upload a third-party certificate (<em>e.g.</em> Amazon or GoDaddy),</p>
|
||
<ol>
|
||
<li>open the <b>HTTPS</b> page in the <b>COMMON SETTINGS</b> section on the left sidebar,</li>
|
||
<li>click the <b>Plus</b> button next to the <b>CRT certificate</b> field and select your <code>.crt</code> certificate to upload it,</li>
|
||
<li>click the <b>Plus</b> button next to the <b>HTTPS key</b> field and select your private <code>.key</code> key to upload it,
|
||
<div class="notehelp">
|
||
Before uploading, please make sure that the private key is not encrypted. If you have a password-protected .key file, you will need to decrypt it first.
|
||
</div>
|
||
</li>
|
||
<li>once the <code>.crt</code> and <code>.key</code> files are uploaded, click the <b>APPLY</b> button at the bottom of the page.</li>
|
||
</ol>
|
||
<p>After that your <b>Control Panel</b> and portal will be restarted and become unavailable during this process. It can take up to 5 minutes. Once the certificate installation process is over, your portal will be available over HTTPS. The domain name that your certificate was issued for is now displayed in the <b>Generated on domain</b> section of the <b>HTTPS</b> page in the <b>Control Panel</b>.</p>
|
||
<div class="screen_block">
|
||
<img alt="SSL Certificate" target="img1_eventcom_guides" class="screenphoto screen_guides" src="<%=VirtualPathUtility.ToAbsolute("~/images/help/gettingstarted/security/small/ssl.png")%>" />
|
||
<img alt="SSL Certificate" id="img1_eventcom_guides" class="bigphoto_screen" src="<%=VirtualPathUtility.ToAbsolute("~/images/help/gettingstarted/security/big/ssl.png")%>" />
|
||
<div target="img1_eventcom_guides" class="screenphoto magnifier"></div>
|
||
</div>
|
||
<p>Once you’ve generated a certificate or bought one and uploaded it, you can check your security level using the SSL Labs service or some other service of the same kind. Your security level must be not lower than A.</p>
|
||
<p>To learn more about switching to HTTPS, please, read <a class="links" target="_blank" href="<%=VirtualPathUtility.ToAbsolute("~/administration/control-panel-https.aspx.aspx")%>">this</a> article.</p>
|
||
</div>
|
||
</div>
|
||
|
||
<div class="gs_content" id="AutoBackup_block">
|
||
<h2>Automatic backup</h2>
|
||
<div class="PortalHelp">
|
||
<p>The automatic backup can be enabled in the <b>Control Panel</b>. It also can be a good decision to make copies of the portal using third-party services from time to time.</p>
|
||
<p>To turn the <b>Automatic bakckup</b> on,</p>
|
||
|
||
<ol>
|
||
<li>switch to the <b>Backup page</b> in the <b>COMMON SETTINGS</b> section on the left sidebar and find the <b>Automatic backup</b> section,</li>
|
||
<li>click the <b>Disabled</b> switcher to enable the feature,
|
||
<div class="screen_block">
|
||
<img alt="Automatic backup" target="img2_eventcom_guides" class="screenphoto screen_guides" src="<%=VirtualPathUtility.ToAbsolute("~/images/help/gettingstarted/security/small/automaticbackup.png")%>" />
|
||
<img alt="Automatic backup" id="img2_eventcom_guides" class="bigphoto_screen" src="<%=VirtualPathUtility.ToAbsolute("~/images/help/gettingstarted/security/big/automaticbackup.png")%>" />
|
||
<div target="img2_eventcom_guides" class="screenphoto magnifier"></div>
|
||
</div>
|
||
</li>
|
||
<li>select the necessary <b>Storage</b> for the backup files (the available options are Amazon AWS S3, Google, Rackspace, and Selectel cloud storage services or other WebDAV services, except for the <b>Temporary</b> storage which is only available in the <b>Data Backup</b> section),</li>
|
||
<li>specify the time interval at which backups should be created: <b>Every day</b>, <b>Every week</b>, or <b>Every month</b> with an indication of the necessary part of the time period,</li>
|
||
<li>set <b>The maximal number of backup copies to be stored</b> by selecting the necessary value (from 1 to 30) from the corresponding drop-down list,</li>
|
||
<li>check the <b>Include Mail in backup</b> box if you want to backup the <b>Mail</b> data as well,</li>
|
||
<li>click the <b>SAVE</b> button.</li>
|
||
</ol>
|
||
<p>Backups will be created automatically with the specified periodicity.</p>
|
||
<p>To learn more about the backup and restore options, please, read <a class="links" target="_blank" href="<%=VirtualPathUtility.ToAbsolute("~/administration/control-panel-backup.aspx")%>">this</a> article.</p>
|
||
</div>
|
||
</div>
|
||
|
||
<div class="gs_content" id="PortalSettings_block">
|
||
<h2>Portal security settings adjustment</h2>
|
||
<div class="PortalHelp">
|
||
<p>Portal access rules must be set up before adding users to the portal. It can be done via the portal <b>Portal Access</b> page. You can reach the page in the following way: <b>Settings</b> > <b>Security</b> > <b>Portal access</b>.</p>
|
||
<p>You can restrict the portal access by determing the password settings: <b>Adjusting number of password characters</b>, <b>Requiring inclusion of capital letters</b>, and <b>Digits and special characters</b> in users’ passwords.</p>
|
||
<div class="screen_block">
|
||
<img alt="Portal security settings adjustment" target="img3_eventcom_guides" class="screenphoto screen_guides" src="<%=VirtualPathUtility.ToAbsolute("~/images/help/gettingstarted/security/small/portalsettings.png")%>" />
|
||
<img alt="Portal security settings adjustment" id="img3_eventcom_guides" class="bigphoto_screen" src="<%=VirtualPathUtility.ToAbsolute("~/images/help/gettingstarted/security/big/portalsettings.png")%>" />
|
||
<div target="img3_eventcom_guides" class="screenphoto magnifier"></div>
|
||
</div>
|
||
<p>The two-factor authentication is available for portal login. It can be set to use an application - Authy or Google Authenticator, the second is highly recommended. The other way is the 2FA via SMS. To use it, you need to use SMC, Clickatell or Twillio (They can be turned on the <b>Thrid-Party Services</b> page of the <b>Integration tab</b>, using the API key of the corresponding service).</p>
|
||
<p>As some of the mass mail domains have known security issues, you can specify the trusted mail domains that can be used for registration. To turn this function on, in the <b>Trusted mail domain settings</b>, you need to select the <b>Custom domains</b> checkbox and provide trusted domains names in the appeared fields.</p>
|
||
<p>To set a whitelist for trusted users’ IPs, use the <b>IP Security</b> feature.</p>
|
||
<div class="notehelp">
|
||
This limitation will restrict even existing portal user access to the portal, if they try to authorize from a new location.
|
||
</div>
|
||
<p>The ONLYOFFICE Workspace also has the <b>Session Lifetime</b> feature. Enabling it, you can set the session duration for each user after which the automatic log-out will be committed.</p>
|
||
<p>To learn more on how to control portal access, please, read <a class="links" target="_blank" href="<%=VirtualPathUtility.ToAbsolute("~/administration/configuration.aspx#ChangingSecuritySettings_block")%>">this</a> article.</p>
|
||
</div>
|
||
</div>
|
||
|
||
<div class="gs_content" id="LDAP_block">
|
||
<h2>LDAP for access centralization</h2>
|
||
<div class="PortalHelp">
|
||
<p>You can import user credentials from your LDAP server. It can be done via the <b>Control Panel</b>, in the <b>Portal Settings</b> section, on the <b>LDAP</b> page.</p>
|
||
<p>Turn the <b>Enable LDAP Authentication</b> switch on, then provide the following data:</p>
|
||
<ul>
|
||
<li>your server information, as URL address,</li>
|
||
<li>port number that is used to access the LDAP server,</li>
|
||
<li>the path to directory with users data (User DN) that you want to import,</li>
|
||
<li>the user filter, if you need to import only certain users from that directory and the login attribute value.
|
||
<div class="screen_block">
|
||
<img alt="LDAP settings" target="img4_eventcom_guides" class="screenphoto screen_guides" src="<%=VirtualPathUtility.ToAbsolute("~/images/help/gettingstarted/security/small/ldap.png")%>" />
|
||
<img alt="LDAP settings" id="img4_eventcom_guides" class="bigphoto_screen" src="<%=VirtualPathUtility.ToAbsolute("~/images/help/gettingstarted/security/big/ldap.png")%>" />
|
||
<div target="img4_eventcom_guides" class="screenphoto magnifier"></div>
|
||
</div>
|
||
</li>
|
||
</ul>
|
||
<p>Importing groups is performed the same way as you import users from your LDAP server.</p>
|
||
<div class="notehelp">
|
||
Login domain for authentication on the ONLYOFFICE portal corresponds with the LDAP Domain.
|
||
</div>
|
||
<p>You can also synchronize the LDAP server data with the ONLYOFFICE portal to make it correctly visible in user profiles.</p>
|
||
<p>To learn more on how to import users and groups using LDAP Server, please, read <a class="links" target="_blank" href="<%=VirtualPathUtility.ToAbsolute("~/administration/control-panel-ldap.aspx")%>">this</a> article.</p>
|
||
</div>
|
||
</div>
|
||
|
||
<div class="gs_content" id="SMTP_block">
|
||
<h2>Usage of private SMTP server</h2>
|
||
<div class="PortalHelp">
|
||
<p>In the ONLYOFFICE Workspace the default server for user notification (for example, about portal or community updates, document access grant or poject changes) is the ONLYOFFICE SMTP server. For higher security, we recommend to use your own SMTP server, so that your messages won’t pass through any third-party services.</p>
|
||
<p>To do so, follow the instructions below:</p>
|
||
<ol>
|
||
<li>Open the <b>Settings</b> module, then in the <b>Integration</b> section, open the <b>SMTP Settings</b> page.</li>
|
||
<li>Specify the SMTP server domain and port.</li>
|
||
<li>Specify login credentials</li>
|
||
<li>Specify the sender name for recipients and the sender email address for recipients.</li>
|
||
<li><b>OPTIONAL</b>. For better security, if your server supports it, select the <b>Enable SSL</b> checkbox.
|
||
<div class="screen_block">
|
||
<img alt="Usage of private SMTP server" target="img5_eventcom_guides" class="screenphoto screen_guides" src="<%=VirtualPathUtility.ToAbsolute("~/images/help/gettingstarted/newconfig/small/SMTP.png")%>" />
|
||
<img alt="Usage of private SMTP server" id="img5_eventcom_guides" class="bigphoto_screen" src="<%=VirtualPathUtility.ToAbsolute("~/images/help/gettingstarted/newconfig/big/SMTP.png")%>" />
|
||
<div target="img5_eventcom_guides" class="screenphoto magnifier"></div>
|
||
</div>
|
||
</li>
|
||
</ol>
|
||
<p>After setting up the SMTP server settings, try to send a test mail, by clicking the <b>Send Test Mail</b> button. If the letter is delivered successfully, click the <b>Save</b> button.</p>
|
||
<p>To learn more on how to set up SMTP Server, please, read <a class="links" target="_blank" href="<%=VirtualPathUtility.ToAbsolute("~/installation/groups-smtp-settings.aspx")%>">this</a> article.</p>
|
||
</div>
|
||
</div>
|
||
|
||
<div class="gs_content" id="ActionsMonitoring_block">
|
||
<h2>User logins and other actions monitoring</h2>
|
||
<div class="PortalHelp">
|
||
<p>Using the ONLYOFFICE Workspace you can easily track user actions and logins. You can see the list of users actions and logins using the <b>Control Panel</b>.</p>
|
||
<p>The login information is kept on the <b>Login History</b> page:</p>
|
||
<div class="screen_block">
|
||
<img alt="Tracking login history" target="img6_eventcom_guides" class="screenphoto screen_guides" src="<%=VirtualPathUtility.ToAbsolute("~/images/help/Guides/small/guide143/login_history.png")%>" />
|
||
<img alt="Tracking login history" id="img6_eventcom_guides" class="bigphoto_screen" src="<%=VirtualPathUtility.ToAbsolute("~/images/help/Guides/big/guide143/login_history.png")%>" />
|
||
<div target="img6_eventcom_guides" class="screenphoto magnifier"></div>
|
||
</div>
|
||
<p>To view the detailed statistics for the latest half year click the <b>Download and open report</b> button. The report will open in an .xlsx spreadsheet <em>(LoginHistory_ReportStartDate-EndDate.xlsx)</em>.</p>
|
||
<p>The login history report includes the following details: user <b>IP</b> address, <b>Browser</b> and <b>Platform</b> which were being used when the registered event occurred, <b>Date</b> and time of the event, name of the <b>User</b> who made an attempt to log in/log out, portal <b>Page</b> where the action has been performed, specific <b>Action</b> (for example, <em>Login Fail. Associated Social Account Not Found</em>).</p>
|
||
<p>The actions history is kept on the <b>Audit Trail</b> page:</p>
|
||
<div class="screen_block">
|
||
<img alt="Receiving audit trail data" target="img7_eventcom_guides" class="screenphoto screen_guides" src="<%=VirtualPathUtility.ToAbsolute("~/images/help/Guides/small/guide144/audit_trail.png")%>" />
|
||
<img alt="Receiving audit trail data" id="img7_eventcom_guides" class="bigphoto_screen" src="<%=VirtualPathUtility.ToAbsolute("~/images/help/Guides/big/guide144/audit_trail.png")%>" />
|
||
<div target="img7_eventcom_guides" class="screenphoto magnifier"></div>
|
||
</div>
|
||
<p>To view the detailed statistics for the latest half year click the <b>Download and open report</b> button. The report will open in an .xlsx spreadsheet <em>(AuditTrail_ReportStartDate-EndDate.xlsx)</em>.</p>
|
||
<p>The audit trail report includes the following details: user <b>IP</b> address, <b>Browser</b> and <b>Platform</b> which were being used when the registered event occurred, <b>Date</b> and time of the event, name of the <b>User</b> who performed the operation, portal <b>Page</b> where the action has been performed, generic <b>Action Type</b> (for example, <em>download, attach, updated access</em>), specific <b>Action</b> (for example, <em>Projects [Product development and promotion]. Tasks [Distribute coupons]. Status Updated: Closed </em>), <b>Product</b> and <b>Module</b> that the changed entity is referred to.</p>
|
||
<p>It is also possible to set the storage period for both Login history and Audit trail on the corresponding pages.</p>
|
||
</div>
|
||
</div>
|
||
|
||
<div class="gs_content" id="DisableRoot_block">
|
||
<h2>Disabling root access</h2>
|
||
<div class="PortalHelp">
|
||
<p>To avoid data leaks, it is better to disallow logging as root as the root user has full access to all data of the system. This can be done via server’s terminal, by setting the root login permission to <b>No</b>.</p>
|
||
</div>
|
||
</div>
|
||
|
||
<div class="gs_content" id="ClosingPorts_block">
|
||
<h2>Closing all unnecessary ports</h2>
|
||
<div class="PortalHelp">
|
||
<p>You should keep open only the ports you need for portal functioning, as extra open ports can be the cause of data leaks. The list of necessary ports for ONLYOFFICE Workspace functioning is <a class="links" target="_blank" href="<%=VirtualPathUtility.ToAbsolute("~/installation/groups-open-ports.aspx")%>">here</a>.</p>
|
||
</div>
|
||
</div>
|
||
|
||
<div class="gs_content" id="AdjustingFileVersions_block">
|
||
<h2>Adjusting parameters for storing file versions</h2>
|
||
<div class="PortalHelp">
|
||
<p>For data protection, if some of the users have poor internet connection, you can adjust the file versioning, using the <b>Settings</b> section of the <b>Documents module</b>. It is possible to keep all the intermediate versions and allow to automatically create copies of the updated files or just update the existing files after applying changes. You can read more <a class="links" target="_blank" href="<%=VirtualPathUtility.ToAbsolute("~/userguides/groups-tipstricks-documents-document-versions.aspx")%>">here</a>.</p>
|
||
</div>
|
||
</div>
|
||
|
||
<div class="gs_content" id="SettingPermissionsRighs_block">
|
||
<h2>Setting up document permissions and portal access rights</h2>
|
||
<div class="PortalHelp">
|
||
<p>You should provide access to documents only to authorized members of certain working groups. You can adjust access level, by clicking the <b>Share</b> button near the required document. In the opened window you can add users and set their access level including:</p>
|
||
<ul>
|
||
<li><b>Read Only</b>,</li>
|
||
<li><b>Filling Forms</b>,</li>
|
||
<li><b>Custom Filter</b>,</li>
|
||
<li><b>Commenting</b>,</li>
|
||
<li><b>Reviewing</b>,</li>
|
||
<li><b>Full Access</b>.</li>
|
||
</ul>
|
||
<p>Developers also can set up the document permission levels separately and more detailed: forbid access to document history, content copying, document download e.t.c. More information about config document access parameters can be found <a class="links" href="https://api.onlyoffice.com/editors/config/document/permissions">here</a>.</p>
|
||
<p>It is also possible to set the portal access rights. You can restrict access to certain modules for different users and groups, using the <b>Settings</b> module. You need to open the <b>Access Rights</b> page from the <b>Security</b> section. There you can adjust administrators and change their access rights. Also, you can grant or deny access to certain modules lower on that page.</p>
|
||
</div>
|
||
</div>
|
||
|
||
<div class="gs_content" id="PrivateRooms_block">
|
||
<h2>Private rooms for secure work with documents</h2>
|
||
<div class="PortalHelp">
|
||
<p>In ONLYOFFICE every user can use private rooms to create secure workspace for working with documents. The <b>Private Room</b> is a section in <b>Documents</b>. The .docx, .xlsx and .pptx office files in a private room are ecrypted with the <b>AES-256</b> encryption algorithm.</p>
|
||
<p>To work with private rooms,</p>
|
||
<ol>
|
||
<li>enable the feature in the <b>Control Panel</b>,</li>
|
||
<li>download the desktop editor and connect it to the cloud on the application main page.</li>
|
||
</ol>
|
||
<p>You can work within your private room on portal, using the appropriate section in the <b>Documents</b> module. You may share documents from your private room the same way you usually share documents on portal.</p>
|
||
</div>
|
||
</div>
|
||
|
||
<div class="gs_content" id="DataEncryption_block">
|
||
<h2>Data encryption protection</h2>
|
||
<div class="PortalHelp">
|
||
<p>ONLYOFFICE has a feature of data encryption, that can be managed using the <b>Control Panel</b> on server version.</p>
|
||
<p>Encryption allows to convert data for confidential and secure storage. ONLYOFFICE encryption is based on a Encrypt-then-MAC type of encryption (AES-256-CBC + HMAC-SHA256) of the entire body of data. It is compliant with <b>AES-256</b> international data encryption standard.</p>
|
||
<p>To prepare the portal for encryption, you need to:</p>
|
||
<ol>
|
||
<li>Sign in to your portal and click the <b>Control Panel</b> icon on the <b>Start Page.</b><br />
|
||
Alternatively, you can go to the portal <b>Settings</b> and select the <b>Control Panel</b> link on the left-side panel.</li>
|
||
<li>Switch to the <b>Backup</b> section and <a class="links" target="_blank" href="<%=VirtualPathUtility.ToAbsolute("~/administration/control-panel-backup.aspx")%>">backup data</a>.</li>
|
||
<li>Disable the <b>Automatic Data Backup</b> feature.</li>
|
||
<li>Select the <b>Local storage</b> option for both <b>Connect storage for static data</b> and <b>Connect storage as CDN</b>.</li>
|
||
<li>Make sure there is enough space on your hard drive.</li>
|
||
</ol>
|
||
<p>After the preliminary preparations are ready, you can proceed to the next step.</p>
|
||
<p>To encrypt the storage, you need to:</p>
|
||
<ol>
|
||
<li>Switch to the <b>Storage</b> section in the <b>Control Panel</b>.</li>
|
||
<li>Check the <b>Notify users that the portal will be unavailable</b> checkbox to notify all active users via email when the encryption process starts.
|
||
<div class="notehelp">
|
||
Upon the successful completion of the encryption process, all active users will also receive email notifications. If an error occurs during the encryption process, then all administrators (regardless of the Notify users option) will receive email notifications of the unsuccessful encryption process.
|
||
</div>
|
||
</li>
|
||
<li>Click the <b>Encrypt storage</b> button and then <b>OK</b> to launch the encryption process.
|
||
<div class="notehelp">
|
||
When encryption is enabled, a newly created <b>backup copy</b> of the data archive will contain <b>decrypted</b> files. When such a copy is restored, the files will be encrypted on the disk again.
|
||
</div>
|
||
</li>
|
||
</ol>
|
||
<p>The time required to complete the procedure depends on the data volume. All portals will be unavailable during the encryption process. As soon as the encryption is over, the portal data will be available for work.</p>
|
||
<div class="screen_block">
|
||
<img alt="Encrypt storage" target="img8_eventcom_guides" class="screenphoto screen_guides" src="<%=VirtualPathUtility.ToAbsolute("~/images/help/Guides/small/guide123/step1.png")%>" />
|
||
<img alt="Encrypt storage" id="img8_eventcom_guides" class="bigphoto_screen" src="<%=VirtualPathUtility.ToAbsolute("~/images/help/Guides/big/guide123/step1.png")%>" />
|
||
<div target="img8_eventcom_guides" class="screenphoto magnifier"></div>
|
||
</div>
|
||
<p>To decrypt the storage, you need to:</p>
|
||
<ol>
|
||
<li>Switch to the <b>Storage</b> section in the <b>Control Panel</b>.</li>
|
||
<li>Check the <b>Notify users that the portal will be unavailable</b> checkbox to notify all active users via email when the decryption process starts.
|
||
<div class="notehelp">
|
||
Upon the successful completion of the decryption process, all active users will also receive email notifications. If an error occurs during the decryption process, then all administrators (regardless of the <b>Notify Users</b> option) will receive email notifications of the unsuccessful decryption process.
|
||
</div>
|
||
</li>
|
||
<li>Click the <b>Decrypt storage</b> button and then <b>OK</b> to launch the decryption process.</li>
|
||
</ol>
|
||
<p>The time required to complete the procedure depends on the data volume. All portals will be unavailable during the encryption process. As soon as the encryption is over, the portal data will be available for work.</p>
|
||
<div class="screen_block">
|
||
<img alt="Decrypt storage" target="img9_eventcom_guides" class="screenphoto screen_guides" src="<%=VirtualPathUtility.ToAbsolute("~/images/help/Guides/small/guide123/step2.png")%>" />
|
||
<img alt="Decrypt storage" id="img9_eventcom_guides" class="bigphoto_screen" src="<%=VirtualPathUtility.ToAbsolute("~/images/help/Guides/big/guide123/step2.png")%>" />
|
||
<div target="img9_eventcom_guides" class="screenphoto magnifier"></div>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
</div> |