Initial situation:

The authorisation for implementing cryptographic actions is to be checked during live operation. The query of authorisation is to be realised by querying an LDAP directory service.

 

Configuration suggestion

 

 

•Navigate to Mail Processing Ruleset generator Custom Commands Custom commands for outgoing emails BEFORE encryption:

•Activating the option and insertion of the following code into the input field below:

 

Code

 

Description

In this example, the static parameters for the following LDAP query are first written into the variable "ldap_bind" (line 05). Via an LDAP query (in this case AD), the affiliation of the sender to the authorised group is checked (line 06). If the sender is authorised, the system checks whether they already have an account on the SEPPmail Secure E-Mail Gateway (line 07). If an account exists, the rights for encrypting/signing are assigned to it and the GINA message according to the respective GINA domain settings is released (line 08). Otherwise, a log entry is created (line 10), the Windows user and the display name are read from the AD and each is provided as a variable (line 11/12). Now, a new user account is created for the sender (line 13). Here, the values read from the AD before will be used for the "User ID" and "Name". The newly created user is then provided with key material according to the setting in Mail Processing Ruleset generator Key generation (line 14).

If the sender has an account on the SEPPmail Secure E-Mail Gateway, but is no longer a member of the corresponding AD group (line 17), this is noted in the log (line 18) and the user’s rights for encryption/signing will be withdrawn (line 19) (to ensure that the key material is not removed from the appliance, the account is only deactivated, not deleted. By deactivating the user account, the used user licence is released again). The decryption of possibly still incoming emails would continue to work.

For senders who are neither in possession of a user account nor members of the authorising AD group, no action is required. This is entered in the log (line 21).

 

The commands delimited by the comment lines ## force domain encryption and ## end forcing domain encryption are only necessary if the option "Always use S/MIME or OpenPGP if user keys are available" of the section Mail Processing Ruleset generator Encryption/Decryption was activated and Mail Processing Ruleset generator User creation is not set to Do not create accounts (also disables custom commands for user creation) .

This guarantees for the described configuration case that the Domain encryption can be used even if a public domain key is available from the recipient but the sender is not in the group of persons authorised to encrypt.

This first checks whether a public S/MIME domain key of the target email domain(s) exists (line 26). If this is the case, this is logged (line 27) and the email is encrypted to the target domain with the corresponding key (line 28), documented in the log (line 29) and the email is delivered (line 30). If the S/MIME encryption fails, this is also logged (line 32), as if no S/MIME key of the recipient was present (line 35). For recipient domains for which no S/MIME key is known or the encryption has failed, it is now attempted to encrypt with a public OpenPGP domain key. Here, too, the system first checks whether a public OpenPGP domain key of the target email domain(s) exists (line 37). If this is the case, this is logged (line 38) and the email is encrypted to the target domain with the corresponding key (line 39), documented in the log (line 40) and the email is delivered (line 41). If the encryption fails, this is also logged (line 43), as if no OpenPGP key of the recipient was present (line 46).

Unless already delivered due to a successful domain encryption, it is sent without encryption (line 49), irrespective of any possibly existing control marks (see Controlling The Appliance). This behaviour may be adapted by a corresponding additional code, if required.

 

Used

commands

authenticated()

createaccount()

createkeys()

deliver()

domain_pgp_keys_avail()

domain_smime_keys_avail()

encrypt_domain_pgp()

encrypt_domain_smime()

ldap_compare()

log()

setuserattr()