Search <book_title>...

Enterprise Vault™ Installing and Configuring

Last Published: 2024-09-02

Product(s): Enterprise Vault (15.1)

Default security for the Enterprise Vault Web Access components

The Enterprise Vault Web Access components are configured in the Default Web Site in IIS. By default in a new installation of Enterprise Vault 12.3 or later, Enterprise Vault configures HTTPS on port 443, and enables SSL on each Enterprise Vault virtual directory. If the Default Web Site does not have a valid certificate, the configuration wizard creates and installs a self-signed certificate. Configuration assigns this certificate to the HTTPS binding.

If the Default Web Site already has an HTTPS binding on port 443 using a valid certificate, then the Enterprise Vault configuration wizard just enables SSL on the Enterprise Vault virtual directories.

We strongly recommend that you replace the self-signed certificate as soon as possible with a certificate obtained from a trusted authority. The self-signed certificate is not trusted beyond the Enterprise Vault server. This may prevent some functionality in the Enterprise Vault Outlook Add-In, Enterprise Vault Search, and the Veritas Information Classifier from working, if the clients connect from a remote computer.

If you have upgraded Enterprise Vault from a version that is earlier than 12.3, then the existing configuration of the Default Web Site and Enterprise Vault virtual directories remains unchanged. However, to ensure the security of web connections to Enterprise Vault, we recommend that you manually configure and enable SSL on the Enterprise Vault virtual directories.

You can change the port or protocol that is used to access the Enterprise Vault Web Access components.

See Customizing the port or protocol for the Enterprise Vault Web Access components.

Warning:

If you use HTTP, communication between Enterprise Vault clients and the Enterprise Vault Web Access components is unencrypted, and therefore vulnerable to interception on the network.

Both Basic authentication and Integrated Windows authentication are configured automatically.

The authentication that is automatically set up affects users when they log in, as follows:

A user logging in with a browser that supports Integrated Windows Authentication, such as Internet Explorer, must supply domain name and username separately:
Username: username
Password: password
Domain: domain
This domain can never be defaulted.
An Internet Explorer user with suitably-customized browser settings does not need to supply logon details manually because the logon is automatic; Internet Explorer automatically uses the details of the account to which the user is currently logged on.
A user logging in to the Web Access components with a browser that does not support Integrated Windows Authentication must supply both domain name and username in response to a single username prompt:
Username: domain\username
Password: password
It is possible for you to set up a default domain.

Note:

Enterprise Vault recommends configuring Windows account lockout policies to prevent threats, such as Brute force password attacks, where an attacker can attempt to log on with user accounts using every possible combination of password characters. When the Windows account lockout is configured, Windows locks the user account after a certain number of failed logon attempts for a specified duration.

For details on how to configure Windows account lockout, please refer to your Microsoft Windows documentation.

More Information

Customizing security for the Web Access components on client computers

Customizing authentication for the Enterprise Vault Web Access components