Novell GROUPWISE 7 - SECURITY POLICIES User manual

GroupWise 7
novdocx (en) 6 April 2007
1
GroupWise 7
August 15, 2005
Updated October 5, 2007, with upgrade instructions for Open Enterprise Server 2 and SUSE®Linux
Enterprise Server 10.
1 Product Overview
Novell®GroupWise®7 provides substantial improvements over GroupWise 6.xin six areas:
Windows Client Enhancements: The Windows* client has a new look and feel that includes
the Navigation Bar, Panels, Home Folder, color schemes, and new icons. In addition to the new
look and feel, you can now create and view multiple calendars, create all day events, spell
check as you type, perform Quick Filters, see the Messenger presence information for users,
create HTML signatures, and control inline quotations.
Cross-Platform Client Enhancements: The Cross-Platform client has added many features
including spell checking, rules, junk mail handling, cleanup tools for your mailbox, backup and
restore, and the ability to set your default views, create all day events, and control inline
quotations.
WebAccess Client Enhancements: The WebAccess client has a new look and feel that brings
it closer to the look and feel of the Windows client. Some of the new features include the ability
to drag and drop items, right-click items to display menus, easier tabbed navigation, and name
completion from your Frequent Contacts address book.
Administration Enhancements: GroupWise administrators have additional control over
users' working environments, including granting rights to users to edit distribution lists,
appending global signatures to users' messages, and controlling the appearance of the
GroupWise Windows client interface.
Agent Enhancements: The POA now supports SOAP, so that SOAP clients such as
EvolutionTM can connect to GroupWise. The Internet Agent can fail over to an alternate Internet
Agent to provide redundancy for outbound Internet mail. The GroupWise Linux* agents can
now run as a non-root user and the new High Availability service automatically restarts the
Linux agents if they go down unexpectedly. The Linux and Windows agents support IPV6.
GroupWise Connector for Outlook: The GroupWise Connector for Outlook* allows you to
use Microsoft* Outlook to connect to your GroupWise System. The GroupWise Connector for
Outlook includes support for e-mail, meeting requests and appointments, recurring
appointments, scheduling, tasks, contacts, shared folders, delegates, and proxy.
For a complete list of new features in GroupWise 7, see What's New in Update in the GroupWise 7
Installation Guide (http://www.novell.com/documentation/gw7).
2 NetWare/Windows: GroupWise System
Installation Instructions
To install GroupWise 7 on NetWare®or Windows:
1Run setup.exe at the root of the GroupWise 7 Administrator (NetWare/Windows) CD.

2GroupWise 7
novdocx (en) 6 April 2007
The GroupWise Installation program lets you view the Readme, the Quick Start, and the
Installation Guide before you start installing GroupWise.
2Click Create or Update a GroupWise System.
3Follow the on-screen instructions.
For detailed system requirements, installation and update instructions, and a complete list of new
features, see the GroupWise 7 Installation Guide (GroupWiseInstallationGuide.pdf) in the \docs\us
directory on the GroupWise 7 Administrator (NetWare/Windows) CD or on the GroupWise 7
Documentation Web site (http://www.novell.com/documentation/gw7).
3 Linux: GroupWise System Installation
Instructions
1For ease of installation, make sure that ConsoleOne®is installed on the Linux server where you
want to create your GroupWise system.
ConsoleOne is located in /usr/ConsoleOne/bin.
If necessary, you can download ConsoleOne from the Novell Downloads Web site (http://
download.novell.com).
2At the server where you want to create your GroupWise system, open a new terminal window,
then become root by entering sux and the root password.
When creating your GroupWise system, you must run the GroupWise Installation program in
an environment where The X Window System* is running.
3Change to the root of the GroupWise 7 Administrator (Linux) CD.
4Start the GroupWise Installation program:
./install
5Click Create or Update a GroupWise System.
6Follow the on-screen instructions.
For detailed system requirements, installation and update instructions, and a complete list of new
features, see the GroupWise 7 Installation Guide (GroupWiseInstallationGuide.pdf) in the \docs\us
directory on the GroupWise 7 Administrator (NetWare/Windows) CD of the GroupWise 7
Documentation Web site GroupWise 7 Documentation Web site (http://www.novell.com/
documentation/gw7).
3.1 Linux: Operating System Update
If you are updating your version of Linux as well as updating GroupWise, perform the Linux
operating system upgrade first. In addition, when you upgrade on a server where GroupWise
WebAccess or Monitor is installed, you need to run a script that reconfigures the WebAccess
Application or the Monitor Application for the new Apache and Tomcat configuration and directory
structure.
“Open Enterprise Server 1 to Open Enterprise Server 2” on page 3
“SUSE Linux Enterprise Server 9 to SUSE Linux Enterprise Server 10” on page 5
“Updating the WebAccess Application and the Monitor Application after the Operating System
Upgrade” on page 6

GroupWise 7 3
novdocx (en) 6 April 2007
3.1.1 Open Enterprise Server 1 to Open Enterprise Server 2
When you upgrade from Open Enterprise Server (OES) 1 to OES 2 with GroupWise installed on
your OES server, you encounter package conflicts that must be resolved. A pop-up message appears
immediately before the Installation Settings screen that informs you that the Delete Unmaintained
Packages option is selected under Update Options. OES 2 considers GroupWise an “unmaintained
package.” This means that, by default, your GroupWise software will be deleted as part of the
upgrade process, unless you follow the instructions below.
1Read the pop-up warning carefully, then click OK to close the pop-up.
The pop-up describes three possible actions you can take to resolve the GroupWise status as an
unmaintained package. This procedure steps you through the second of the three possible
actions. This alternative works most efficiently for preserving your GroupWise installation.
2When ConsoleOne®is installed on the server:
The following message displays below the Packages link on the Installation Settings screen:
Cannot solve all conflicts. Manual intervention is required.
2a Click the Packages link.
The upgrade process checks for package conflicts, then displays the following message:
NOVLc1-1.3.6-1.i386 is locked and cannot be uninstalled.
2b Select Keep NOVLc1, then click OK - Try Again.
The upgrade process checks again for conflicts for NOVLc1 and displays one or more
package-related warnings, providing you with alternatives for how to handle each conflict.
The specific warnings you receive depend on the packages installed on the server you are
upgrading. Therefore, warnings vary. Here are some examples:
NOVLc1-1.3.6-1.i386 cannot be installed due to missing
dependencies.
novell-eguide-2.1.32.noarch cannot be installed due to
missing dependencies.
The messages fall into two categories of problems:
Missing dependencies for ConsoleOne (the NOVLc1 package)
Missing dependencies for some other product package besides ConsoleOne (for
example, eGuide)
The following steps help you decide which action to take for each type of message.
2c If the message indicates missing dependencies for ConsoleOne (NOVLc1), select Ignore
This Requirement Just Here.
2d If the message indicates missing dependencies for some other product package besides
ConsoleOne, and you are sure that you do not want that product package, select Delete
package_name.
WARNING: ConsoleOne is dependent on a variety of packages. Delete packages only
when you are certain that they are not required by ConsoleOne. If in doubt, select Keep
package_name.
2e When you have selected an action for each conflict message, click OK - Try Again.

4GroupWise 7
novdocx (en) 6 April 2007
The upgrade process checks again for conflicts for NOVLc1. Additional messages might
be displayed for you to select actions to resolve the conflicts. This cycle repeats until all
conflicts have been resolved, then you successfully reach the Packages page.
3On the Packages page, select Search in the Filter field.
4Search for the GroupWise packages that are installed on the server by typing the following in
the Search field:
novell-groupwise
5Click Search.
Depending on what GroupWise components are installed on the server, the search results
include some of the following packages:
novell-groupwise-admin
novell-groupwise-agents
novell-groupwise-dbcopy
novell-groupwise-gwcheck
novell-groupwise-gwha
novell-groupwise-gwia
novell-groupwise-gwinter
novell-groupwise-gwmon
novell-groupwise-monitor
novell-groupwise-webaccess
6Right-click the first GroupWise package in the list, then click All in This List > Keep.
This changes the status of each GroupWise package from Delete to Keep.
7Search for the NOVLc1 package.
The NOVLc1 and NOVLc1Linuxjre packages should be listed and marked as locked. This
means that they will not be deleted.
8If these packages are marked with a Delete status, change their status to Keep.
9Click Accept on the Packages page.
10 If you are presented with a font License Agreement, click Accept.
11 Click Continue to return to the Install Settings page.
12 Verify that the package conflict message is now gone from under the Packages link, then
continue with the upgrade process.
13 After you have finished the upgrade, reinstall the NDSbase RPM that was originally installed
with ConsoleOne.
The upgrade process removed it, but it is still needed by ConsoleOne.
13a In a Linux terminal window, log in as root, then change to the directory where you
originally extracted the ConsoleOne files.
13b Change to the Linux subdirectory.
13c Use the following command to reinstall the NDSbase RPM:
rpm -ivh NDSbase-8.7.3.7-38.i386.rpm
If you encounter problems with GroupWise after you have upgraded from OES 1 to OES 2, see TID
3570778 in the Novell Knowledgebase (http://www.novell.com/support/supportcentral) for
assistance.

GroupWise 7 5
novdocx (en) 6 April 2007
3.1.2 SUSE Linux Enterprise Server 9 to SUSE Linux Enterprise Server 10
When you upgrade from SLES 9 to SLES 10 with GroupWise installed on your SLES server, you
encounter package conflicts that must be resolved.
1When ConsoleOne is installed on the server:
The following message displays below the Packages link on the Installation Settings screen:
Cannot solve all conflicts. Manual intervention is required.
1a Click the Packages link.
The upgrade process checks for package conflicts, then displays the following message:
NOVLc1-1.3.6-1.i386 is locked and cannot be uninstalled.
1b Select Keep NOVLc1, then click OK - Try Again.
The upgrade process checks again for conflicts for NOVLc1 and displays one or more
package-related warnings, providing you with alternatives for how to handle each conflict.
The specific warnings you receive depend on the packages installed on the server you are
upgrading. Therefore, warnings vary. Here are some examples:
NOVLpkia-2.7.0-6.i386 is locked and cannot be
uninstalled.
NOVLc1-1.3.6-1.i386 cannot be installed due to missing
dependencies.
The messages fall into two categories of problems:
A locked package
Missing dependencies for ConsoleOne (the NOVLc1 package)
The following steps help you decide which action to take for each type of message.
1c If the message indicates a locked package, select Keep package_name.
1d If the message indicates missing dependencies for ConsoleOne (NOVLc1), select Ignore
This Requirement Just Here.
1e When you have selected an action for each conflict message, click OK - Try Again.
The upgrade process checks again for conflicts for NOVLc1. Additional messages are
displayed for you to select actions to resolve the conflicts. This cycle repeats until all
conflicts have been resolved (approximately nine times), then you successfully reach the
Packages page.
2On the Packages page, select Search in the Filter field.
3Search for the GroupWise packages that are installed on the server by typing the following in
the Search field:
novell-groupwise
4Click Search.
Depending on what GroupWise components are installed on the server, the search results
include some of the following packages:
novell-groupwise-admin
novell-groupwise-agents
novell-groupwise-dbcopy
novell-groupwise-gwcheck
novell-groupwise-gwha
novell-groupwise-gwia

6GroupWise 7
novdocx (en) 6 April 2007
novell-groupwise-gwinter
novell-groupwise-gwmon
novell-groupwise-monitor
novell-groupwise-webaccess
5Right-click the first GroupWise package in the list, then click All in This List > Keep.
This changes the status of each GroupWise package from Delete to Keep.
6Search for the NOVLc1 package.
The NOVLc1 and NOVLc1Linuxjre packages should be listed and marked as locked. This
means that they will not be deleted.
7If these packages are marked with a Delete status, change their status to Keep.
8Click Accept on the Packages page.
9If you are presented with a font License Agreement, click Accept.
10 Click Continue to return to the Install Settings page.
11 Verify that the package conflict message is now gone from under the Packages link, then
continue with the upgrade process.
12 After you have finished the upgrade, reinstall the NICI RPM and the NDSbase RPM that were
originally installed with ConsoleOne.
The upgrade process removed them, but they are still needed by ConsoleOne.
12a In a Linux terminal window, log in as root, then change to the directory where you
originally extracted the ConsoleOne files.
12b Change to the Linux subdirectory.
12c Use the following commands to reinstall the RPMs:
rpm -ivh nici-version-i386
rpm -ivh NDSbase-version.i386.rpm
If you encounter problems with GroupWise after you have upgraded from SLES 9 to SLES 10, see
TID 3570778 in the Novell Knowledgebase (http://www.novell.com/support/supportcentral) for
assistance.
3.1.3 Updating the WebAccess Application and the Monitor Application after the
Operating System Upgrade
When you upgrade your Linux operating system, OES 2 installs new versions of Apache and
Tomcat by default. SLES does not; you must install them manually by following the procedure in
this section. In addition, the GroupWise 7 installations of the WebAccess Application and the
Monitor Application must be modified to accommodate changes made in Apache and Tomcat. The
WebAccess/Monitor Update script takes care of this process for you. This script is available with
TID 3624780 in the Support Knowledgebase (http://www.novell.com/support/supportcentral).
1If you have upgraded to SLES 10, use YaST to install Apache and Tomcat if they were not
already installed on SLES 9:
1a Start YaST, then provide the root password.
1b Click Software Management.
1c In the Search field, type Apache, click Search, then select apache2 from the list.
1d In the Search field, type Tomcat, click Search, then select tomcat5 from the list.

GroupWise 7 7
novdocx (en) 6 April 2007
Apache 2 was part of your SLES 9 installation, so it should have been automatically
upgraded. Tomcat changed from Tomcat 4 to Tomcat 5, so unless Tomcat 5 was installed
on SLES 9, Tomcat 5 needs to be installed.
1e Click Accept.
1f Follow the prompts to install the needed packages to your SLES 10 server.
1g Exit YaST.
2Download the WebAccess/Monitor Update script from TID 3624780 in the Novell Support
Knowledgebase (http://www.novell.com/support/supportcentral) to a convenient location on
your Linux server.
3Change to the directory where you downloaded the script file.
4Give the script file execute permissions:
chmod +x fixgwweb.sh
5Run the script.
The script makes some slight reconfigurations of GroupWise files and directories that were
originally set up when the WebAccess Application and the Monitor Application were installed
on your previous version of Linux.
Apache 2: On OES 1 and SLES 9, Apache 2 used the mod_jk connector to facilitate
communication between Apache and Tomcat. On OES 2 and SLES 10, Apache 2 uses the
mod_proxy module instead. The WebAccess/Monitor Update script modifies the
gw.conf file with this change. On SLES 10, the script also creates a symbolic link from
/etc/opt/novell/gw/gw.conf to the new Apache 2 location of /etc/
apache2/conf.d/gw.conf.
Tomcat 5: On OES 1 and SLES 9, the WebAccess /var/opt/novell/gw directory
was linked to /var/opt/novell/tomcat4/webapps/gw. The script changes this
link to /var/opt/novell/tomcat5/webapps/gw. For Monitor, the /var/opt/
novell/gwmon directory now links to/var/opt/novell/tomcat5/webapps/
gwmon.
6Start or restart Tomcat.
7Start or restart Apache.
8If you are upgrading to OES 2:
You might receive the following message when starting Apache 2:
Module "Jk" is not installed, ignoring.
You can safely ignore this message, but if you want to eliminate it:
8a Start YaST, then provide the root password.
8b Click NetWork Services > HTTP Server.
OES 2: /etc/init.d/novell-tomcat5 restart
SLES 10: /etc/init.d/tomcat5 start
OES 2: /etc/init.d/apache2 restart
SLES 10: /etc/init.d/apache2 restart

8GroupWise 7
novdocx (en) 6 April 2007
8c On the Server Modules tab, select the jk module in the list of services, then toggle the
status to Off.
8d Click Finish to save your change.
8e Exit YaST.
You should now be able to run WebAccess and Monitor successfully on your upgraded Linux
operating system.
4 GroupWise Client Installation
Section 4.1, “Windows: Installation Instructions,” on page 8
Section 4.2, “Linux: Installation Instructions,” on page 8
Section 4.3, “Macintosh: Installation Instructions,” on page 8
Section 4.4, “GroupWise Connector for Outlook,” on page 8
For detailed installation instructions, see the GroupWise 7 Installation guide
(GroupWiseInstallationGuide.pdf) in the \docs\us directory on the GroupWise 7 Administrator CD.
4.1 Windows: Installation Instructions
1Run setup.exe at the root of the GroupWise 7 Client (Windows) CD.
or
Run setup.exe from the client\win32 subdirectory on the GroupWise 7 Client (Windows) CD.
2Follow the on-screen instructions.
4.2 Linux: Installation Instructions
1From a terminal window, change to the \linux directory of the GroupWise 7 Client (Linux/
Macintosh) CD.
2Run the GroupWise Setup Advisor to install the GroupWise Cross-Platform client software:
./install
3To start the Cross-Platform client after installation, click the GroupWise icon on your Linux
desktop.
4.3 Macintosh: Installation Instructions
1Browse to the \mac directory of the GroupWise 7 Client (Linux/Macintosh) CD.
2Double-click the GroupWise.dmg file to install the GroupWise Macintosh* client.
3To start the Cross-Platform client after installation, click the GroupWise icon on your
Macintosh desktop.
4.4 GroupWise Connector for Outlook
For instructions on how to install and for additional information about the GroupWise Connector for
Outlook, see the GroupWise Connector for Outlook Readme. The GroupWise Connector for

GroupWise 7 9
novdocx (en) 6 April 2007
Outlook Readme is available in the \client\doc\us\ directory of the GroupWise 7 Client (Windows)
CD.
5 Installation Issues
Section 5.1, “General Installation Issues,” on page 9
Section 5.2, “NetWare/Windows Installation Issues,” on page 10
Section 5.3, “Linux Installation Issues,” on page 10
5.1 General Installation Issues
“Version Compatibility” on page 9
“GroupWise 7 Reinstallation” on page 9
“WebAccess and Monitor on the Same Web Server” on page 9
“Web Clipping Application (PQA) Support with WebAccess and Monitor” on page 9
“Additional Installation Issues” on page 10
5.1.1 Version Compatibility
If you install GroupWise on multiple platforms, or if you run multiple versions (for example,
GroupWise 6.5 and GroupWise 7 in the same GroupWise system), refer to the GroupWise Version
Compatibility appendix in the GroupWise 7 Installation Guide (http://www.novell.com/
documentation/gw7) to make sure that the combinations you are using are supported. For example,
you cannot run a GroupWise 7 client against a GroupWise 6.5 or earlier post office. Earlier POAs
cannot support later GroupWise clients. However, you can run a GroupWise 6.5 or earlier client
against a GroupWise 7 POA.
5.1.2 GroupWise 7 Reinstallation
If you install GroupWise 7 components from a software distribution directory located on your local
drive or a network drive and then try to update those components by installing from a CD, the
installation fails by erroneously prompting for a disk:
Please insert the disk: 1
Uninstall the existing software, then install from the CD.
5.1.3 WebAccess and Monitor on the Same Web Server
The WebAccess Application, WebPublisher Application, and Monitor Application share a common
library. If you are updating from an earlier GroupWise version and if you run these applications on
the same Web server, you must update all three before any of them can work properly.
5.1.4 Web Clipping Application (PQA) Support with WebAccess and Monitor
Palm OS* devices are no longer supported in GroupWise 7. However, the Installation program still
offers the opportunity to configure this feature. If you have been using a PQA in an earlier version of
GroupWise, you can continue to do so, but it is no longer a supported feature.

10 GroupWise 7
novdocx (en) 6 April 2007
5.1.5 Additional Installation Issues
Platform-specific installation issues are listed in separate sections below. Installation issues for
individual GroupWise components are located under the heading for each component.
5.2 NetWare/Windows Installation Issues
“Software Distribution Directory Dependency” on page 10
“Problem Installing from a Windows XP Service Pack 2 Machine” on page 10
“GroupWise Version Compatibility” on page 10
5.2.1 Software Distribution Directory Dependency
When you create a new system and are prompted for software to copy to the software distribution
directory, select at least the agent and client software. The GroupWise Installation program launches
the Agent Installation program and the Client Installation program. It currently must run those
programs from the software distribution directory.
5.2.2 Problem Installing from a Windows XP Service Pack 2 Machine
When installing any GroupWise agent (Post Office Agent, Message Transfer Agent, Internet Agent,
WebAccess Agent, Monitor Agent) to a NetWare server from a Windows XP machine where
Service Pack 2 has been installed, you must have the Novell ClientTM 4.90 SP2 or later installed on
the Windows machine. If you have an earlier Novell Client, the GroupWise Installation program
claims that it cannot find some of the directories to which you want to install software.
5.2.3 GroupWise Version Compatibility
If you still have GroupWise 4.1 domains or post offices in your GroupWise system, you must update
them to at least GroupWise 5.2 before updating your primary domain to GroupWise 7. If you try to
update a 4.1 domain or post office to 7 after the primary domain has already been updated to 7, you
need to rebuild each 4.1 secondary domain database using the GroupWise 7 or later snap-ins to
ConsoleOne, and you also need to have each rebuilt secondary domain database manually edited by
Novell Support before it can function correctly with the 7 primary domain.
5.3 Linux Installation Issues
“Configuring a GroupWise 6.5 Upgrade Installation” on page 10
“Upgrading from an Incomplete Software Distribution Directory” on page 11
“Moving a GroupWise 4.1 System from NetWare or Windows to Linux” on page 11
5.3.1 Configuring a GroupWise 6.5 Upgrade Installation
When you upgrade any GroupWise component to GroupWise 7, all GroupWise components on a
server must be updated at the same time. A message prompts you to update all components.
However, you must still run the Configure option for each component so that the software that was
automatically installed is also configured. If you do not run Configure, the new GroupWise High
Availability service is not properly configured for the agents.