{"id":34955,"date":"2019-10-31T22:01:30","date_gmt":"2019-10-31T19:01:30","guid":{"rendered":"https:\/\/prohoster.info\/blog\/zimbra-collaboration-suite-i-kontrol-za-mobilnymi-ustrojstvami-s-pomoshhyu-abq\/"},"modified":"2019-10-31T22:01:30","modified_gmt":"2019-10-31T19:01:30","slug":"zimbra-collaboration-suite-i-kontrol-za-mobilnymi-ustrojstvami-s-pomoshhyu-abq","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/zimbra-collaboration-suite-i-kontrol-za-mobilnymi-ustrojstvami-s-pomoshhyu-abq","title":{"rendered":"Zimbra Collaboration Suite i upravljanje mobilnim ure\u0111ajima pomo\u0107u ABQ","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Hiter razvoj prenosne elektronike, zlasti pametnih telefonov in tablic, je prinesel \u0161tevilne nove izzive za korporativno informacijsko varnost. Res je, da je bila celotna kibernetska varnost prej osredoto\u010dena na ustvarjanje za\u0161\u010ditenega perimetra in njegovo nadaljnje varovanje, vendar je zdaj, ko prakti\u010dno vsak zaposleni uporablja svoje mobilne naprave za re\u0161evanje delovnih nalog, postalo zelo te\u017eko nadzorovati varnostni perimetar. To je \u0161e posebej pomembno za velika podjetja, kjer ima vsak zaposlenec dostop do svojih prijavnih podatkov za elektronsko po\u0161to in druge korporativne vire. Pogosto, ko zaposleni pridobijo nov pametni telefon ali tablico, vneso svoje prijavne podatke, pri \u010demer pogosto pozabijo, da se odjavijo na prej\u0161nji napravi. Tudi \u010de je takih neodgovornih zaposlenih v podjetju le 5%, brez ustreznega nadzora s strani administratorja postane dostop mobilnih naprav do po\u0161tnega stre\u017eniku<\/a> zelo hitro spremeni v pravi kaos.<\/p>\n

\"Zimbra<\/a><\/noindex><\/p>\n

Poleg tega se mobilne naprave pogosto izgubijo ali ukradejo ter jih nato uporabljajo za iskanje kompromitirajo\u010dih informacij, pa tudi za dostop do korporativnih virov in podatkov, ki predstavljajo poslovno skrivnost. Na splo\u0161no najve\u010djo \u0161kodo korporativni kibernetski varnosti povzro\u010di dostop zlonamernih oseb do elektronske po\u0161te zaposlenega. S tem lahko pridobijo dostop do globalnega seznama naslovov in stikov, do \u010dasovnih razporedov sestankov, v katerih naj bi sodeloval nesre\u010dni zaposleni, \u010deprav tudi do njegove korespondence. Poleg tega zlonamerne osebe, ki dostopajo do korporativne po\u0161te, pridobijo mo\u017enost po\u0161iljanja phishing ali oku\u017eenih e-po\u0161tnih sporo\u010dil s zaupanja vrednega e-po\u0161tnega naslova. Vse to skupaj daje zlonamernim osebam prakti\u010dno neomejene mo\u017enosti za izvajanje kibernetskih napadov in uporabo socialne in\u017eeniringa za dosego svojih ciljev.<\/p>\n

Za nadzor mobilnih ure\u0111aja unutar sigurnosnog perimetra postoji tehnologija ABQ, odnosno Allow\/Block\/Quarantine. Ova tehnologija omogu\u0107ava administratoru da kontroli\u0161e listu mobilnih ure\u0111aja koji imaju dozvolu za sinhronizaciju podataka s e-mail serverom, a po potrebi mo\u017ee blokirati kompromitovane ure\u0111aje i staviti sumnjive mobilne ure\u0111aje u karantenu.<\/p>\n

Me\u0111utim, kao \u0161to zna svaki administrator besplatne verzije Zimbra Collaboration Suite Open-Source Edition, mogu\u0107nosti njenog delovanja s mobilnim ure\u0111ajima su veoma ograni\u010dene. Strogo re\u010deno, korisnici besplatne verzije Zimbre mogu samo da primaju i \u0161alju e-mailove putem POP3 ili IMAP protokola, pri \u010demu nemaju ugra\u0111enu funkcionalnost za sinhronizaciju podataka dnevnika, adresara i bele\u0161ki s serverom. Tehnologija ABQ nije dostupna u besplatnoj verziji Zimbra Collaboration Suite, \u0161to automatski onemogu\u0107ava sve poku\u0161aje da se stvori zatvoren informativni perimetar u kompaniji. U situacijama kada administrator ne zna koji ure\u0111aji se povezuju na njegov server, mo\u017ee do\u0107i do curenja informacija, a tako\u0111e se drasti\u010dno pove\u0107ava verovatno\u0107a da \u0107e se izvr\u0161iti cyber napad prema ranije opisanom scenariju.<\/p>\n

Re\u0161enje za ovaj problem u Zimbra Collaboration Suite Open-Source Edition pru\u017ei\u0107e modularno pro\u0161irenje Zextras Mobile. Ova ekstenzija omogu\u0107ava dodavanje potpune podr\u0161ke za ActiveSync protokol u besplatnu verziju Zimbre, otvaraju\u0107i tako mno\u0161tvo mogu\u0107nosti za interakciju izme\u0111u mobilnih ure\u0111aja i va\u0161eg e-mail servera. Pored raznih drugih funkcija, pro\u0161irenje Zextras Mobile implementira punu podr\u0161ku za ABQ.<\/p>\n

Odmah upozoravamo da mo\u017ee do\u0107i do situacije u kojoj pogre\u0161no konfigurisan ABQ mo\u017ee onemogu\u0107iti neke korisnike da sinhronizuju podatke sa svojim mobilnim ure\u0111ajima sa serverom, stoga se prema pitanju njegove konfiguracije treba pristupiti s maksimalnom pa\u017enjom i oprezom. Konfiguracija ABQ vr\u0161i se iz komandne linije Zextras. U komandnoj liniji se postavlja na\u010din rada ABQ u Zimbri, kao i upravlja listama ure\u0111aja.<\/p>\n

To implement this, after a user logs into their corporate email on a mobile device, they send authorization data as well as the identification data of their device to the server, which encounters an obstacle in the form of ABQ. The ABQ reviews the identification data and compares it with those found in the lists of allowed, quarantined, and blocked devices. If the device is not on any of the lists, the ABQ proceeds according to the mode in which it operates. <\/p>\n

ABQ in Zimbra provides for three operating modes:<\/p>\n

Permissive<\/b>: In this mode, after the user authentication, synchronization is carried out automatically upon the first request from the mobile device. In this mode, there is the possibility to block individual devices, but all others can freely synchronize data with the server. <\/p>\n

Interactive<\/b>: In this mode, immediately after user authentication, the security system requests the identification data of the device and matches it against the list of allowed devices. If the device is on the allowed list, synchronization automatically continues. If it is not on the 'whitelist', it will be automatically placed into quarantine, allowing the administrator to later decide whether to allow synchronization with the server or block it. The user will receive a corresponding notification. The administrator is regularly informed, once during a configurable period of time, with each new notification containing only new devices that have entered quarantine.<\/p>\n

Strict<\/b>: In this mode, after user authentication, the system immediately checks for the identification data of the device in the allowed list. If it is on the list, synchronization automatically continues. If the device is not on the allowed list, it is immediately placed on the blocked list, and the user receives a corresponding notification by email.<\/p>\n

Administrator Zimbra lahko po \u017eelji popolnoma onemogo\u010di ABQ na svojem po\u0161tnem sistemu. stre\u017enikom<\/a>.<\/p>\n

Nastavitev na\u010dina delovanja ABQ se izvede z ukazi:<\/p>\n

zxsuite config global set attribute abqMode value Permissive
\nzxsuite config global set attribute abqMode value Interactive
\nzxsuite config global set attribute abqMode value Strict
\nzxsuite config global set attribute abqMode value Disabled<\/b><\/p><\/blockquote>\n

\nTrenutni na\u010din delovanja ABQ lahko izveste z ukazom zxsuite config global get attribute abqMode<\/b>.<\/p>\n

\u010ce uporabljate interaktivne ali stroge na\u010dine delovanja ABQ, boste pogosto morali delati s seznami dovoljenih in blokiranih naprav ter naprav, ki so v karanteni. Predpostavimo, da sta se povezali dve napravi: en iPhone in en Android z ustreznimi identifikacijskimi podatki. Kasneje se izka\u017ee, da je iPhone pred nekaj dnevi kupil generalni direktor podjetja in se je odlo\u010dil, da bo delal s po\u0161to na njem, medtem ko je Android v lasti obi\u010dajnega managerja, ki nima pravice uporabljati delovne po\u0161te na pametnem telefonu zaradi varnostnih razlogov.<\/p>\n

V primeru interaktivnega na\u010dina bodo vse naprave za\u0161le v karanteno, od koder bo moral administrator premakniti iPhone v seznam dovoljenih naprav, Android pa v seznam blokiranih. Za to bo uporabil ukaze zxsuite mobile abq allow iPhone<\/b> in zxsuite mobile abq block Android<\/b>. Po tem bo generalni direktor lahko popolnoma delal s po\u0161to s svojih naprav, medtem ko bo manager \u0161e vedno moral dostopati do nje izklju\u010dno z delovne prenosne ra\u010dunalnika.<\/p>\n

Omeniti velja, da pri uporabi interaktivnega na\u010dina, tudi \u010de manager na svojem Androidu pravilno vnese svoje uporabni\u0161ko ime in geslo, \u0161e vedno ne bo imel dostopa do svojega ra\u010duna, ampak bo vstopil v virtualno po\u0161tno predal, kjer bo prejel obvestilo, da je njegova naprava dodana v karanteno in da ne more dostopati do po\u0161te z nje.<\/p>\n

\"Zimbra
\n
\nV primeru strogega na\u010dina bodo vse nove naprave blokirane, in po tem, ko bo jasno, komu pripadajo, bo administratorju ostalo le to, da z ukazom doda iPhone generalnega direktorja v seznam dovoljenih naprav: zxsuite mobile ABQ set iPhone Allowed<\/b>, medtem ko bo telefon managerja ostal na seznamu blokiranih.<\/p>\n

Modus operandi je slabo uskla\u0111en s bilo kojim sigurnosnim pravilima u preduze\u0107u, me\u0111utim, ako se ipak pojavi potreba da se blokira bilo koje od dozvoljenih mobilnih ure\u0111aja, na primer, ako menad\u017eer iznenada napusti firmu sa skandalom, to se mo\u017ee u\u010diniti pomo\u0107u komande zxsuite mobile ABQ set Android Blocked<\/b>.<\/p>\n

U slu\u010daju da zaposlenici koriste slu\u017ebene ure\u0111aje za rad s e-po\u0161tom, prilikom promene vlasnika ure\u0111aja, mo\u017ee se potpuno ukloniti iz ABQ liste, kako bi se kasnije donela odluka o tome da li \u0107e mu omogu\u0107iti sinhronizaciju sa serverom. To se obavlja pomo\u0107u komande zxsuite mobile ABQ delete Android<\/b>.<\/p>\n

Dakle, kao \u0161to mo\u017eete videti, uz pomo\u0107 ekstenzije Zextras Mobile u Zimbri, mogu\u0107e je implementirati veoma fleksibilan sistem kontrole kori\u0161\u0107enih mobilnih ure\u0111aja, koji odgovara i preduze\u0107ima sa prili\u010dno strogom politikom kada je re\u010d o kori\u0161\u0107enju korporativnih resursa van kancelarije, kao i onim kompanijama koje su prili\u010dno liberalne po tom pitanju.
\n
Izvor: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0421\u0442\u0440\u0435\u043c\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0435 \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u043f\u043e\u0440\u0442\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u0438\u043a\u0438 \u0438, \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u0441\u043c\u0430\u0440\u0442\u0444\u043e\u043d\u043e\u0432 \u0438 \u043f\u043b\u0430\u043d\u0448\u0435\u0442\u043e\u0432, \u0441\u043e\u0437\u0434\u0430\u043b\u043e \u043c\u0430\u0441\u0441\u0443 \u043d\u043e\u0432\u044b\u0445 \u0432\u044b\u0437\u043e\u0432\u043e\u0432 \u0434\u043b\u044f \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0418 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u043e, \u0435\u0441\u043b\u0438 \u0440\u0430\u043d\u044c\u0448\u0435 \u0432\u0441\u044f \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0441\u0442\u0440\u043e\u0438\u043b\u0430\u0441\u044c \u043d\u0430 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0438 \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u0435\u0440\u0438\u043c\u0435\u0442\u0440\u0430 \u0438 \u0435\u0433\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0439 \u043e\u0445\u0440\u0430\u043d\u0435, \u0442\u043e \u0442\u0435\u043f\u0435\u0440\u044c, \u043a\u043e\u0433\u0434\u0430 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043a\u0430\u0436\u0434\u044b\u0439 \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0434\u043b\u044f \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0447\u0438\u0445 \u0437\u0430\u0434\u0430\u0447 \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u043c\u043e\u0431\u0438\u043b\u044c\u043d\u044b\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u0435\u0440\u0438\u043c\u0435\u0442\u0440 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0441\u0442\u0430\u043b\u043e \u043e\u0447\u0435\u043d\u044c \u0441\u043b\u043e\u0436\u043d\u043e. \u041e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u044d\u0442\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":26308,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-34955","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zimbra Collaboration Suite i kontrola mobilnih ure\u0111aja pomo\u0107u ABQ | ProHoster","description":"Brzi razvoj prenosive elektronike, a posebno pametnih telefona i tableta, stvorio je brojne nove izazove za korporativnu informati\u010dku sigurnost.","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/zimbra-collaboration-suite-i-kontrol-za-mobilnymi-ustrojstvami-s-pomoshhyu-abq","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Zimbra Collaboration Suite \u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u0437\u0430 \u043c\u043e\u0431\u0438\u043b\u044c\u043d\u044b\u043c\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u043c\u0438 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e ABQ | ProHoster","og:description":"\u0421\u0442\u0440\u0435\u043c\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0435 \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u043f\u043e\u0440\u0442\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u0438\u043a\u0438 \u0438, \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u0441\u043c\u0430\u0440\u0442\u0444\u043e\u043d\u043e\u0432 \u0438 \u043f\u043b\u0430\u043d\u0448\u0435\u0442\u043e\u0432, \u0441\u043e\u0437\u0434\u0430\u043b\u043e \u043c\u0430\u0441\u0441\u0443 \u043d\u043e\u0432\u044b\u0445 \u0432\u044b\u0437\u043e\u0432\u043e\u0432 \u0434\u043b\u044f \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/zimbra-collaboration-suite-i-kontrol-za-mobilnymi-ustrojstvami-s-pomoshhyu-abq","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:01:30+00:00","article:modified_time":"2019-10-31T19:01:30+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"34955","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 21:50:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:12:27","updated":"2026-02-09 21:50:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/34955","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=34955"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/34955\/revisions"}],"predecessor-version":[{"id":160132,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/34955\/revisions\/160132"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media\/26308"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=34955"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=34955"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=34955"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}