Untitled

Sentry
Sentry => MIFS Portal SSL CA not Trusted
Sentry => ATS (Apple Transport Security) compliance failed on MIFS Portal (Port 443) for minimum keysize

==> Neues Sentry-SSL-Zertifikat einspielen!
27.07.2018 läuft Wildcard-Zertifikat aus (über 1 Jahr)
Sentry 1
nur ActiveSync / nur PassThrough
kein Attachement Control
für Louts Notes Server 1: 217.5.167.22
IP: 217.5.167.16 (sentry.schunk.com)
Sentry 2
nur ActiveSync / nur PassThrough
kein Attachement Control
für Lotus Notes Server 2: (POP) 217.5.167.13
IP: 217.5.167.28 (sentry2.schunk.com)
Sentry 3
nur AppTunnel / IdentityCertificate (CN=com, CN=schunk, CN=apptunnel; 2043-08-14)
TCP_ANY / ANY (kein CIF_ANY; kein IP_ANY)
IP: 217.5.167.14 (sentry3.schunk.com)
Alle Sentry: Zertifikat ist nicht Trusted. Es wird kein Trusted Certificate verteilt.
==> SSL Zertifikat erneuern / eintragen!

MDM
Settings
Delete Retired Devices
	aktuell werden die Geräte gar nicht gelöscht. => evtl. 21 - 49 Tage
APNS-Zertifikat läuft aus 2017-11-04 (noch 5 Monate)
Application Management
Aktualisieren der Anwendungen:
(Android) IBM Verse, Lookout for Work, Secure Apps Manager (In-House; alte Version hochgeladen)
Entfernen der alten (nicht mehr installierten Versionen)
Aktualisieren der MobileIron Applikationen (Mobile@Work)
(iPad) CRM-Pad (neu Wrappen) [2.1.0.3062]
CRMpad_v2.1.0_12.12.2016 70c9da07-4c91-4f5f-b536-dcfae434fa3c

(iPad) Sales Toolbox (neu Wrappen) [2.2.6]
STB Distrib 2017-09 8afadd04-ccba-4fe8-8a41-20ec0685eb9a

Verantwortlich für die Apps:
Hr. Gey, Ronny (+49 7133 103-2100)
Hr. Schieferdecker, Marcel (+49 7133 103-2545)

System Manager / CLI

Admin Portal
user-test: admin (local), administrator (local),


Dokumentation

Mobile-Test

Hostname: mobile-test.schunk.com
IP: 217.5.167.3 / 255.255.255.224
DNS: 194.25.0.60 / 194.25.0.68 / 217.5.167.2
Gateway: 217.5.167.17
[keine Static Hosts]
NTP: 217.5.167.2
CLI: ssh-yes; telnet-no
SNMP: [keine]
SMTP: 217.5.167.18:25 / mobileiron-test@de.schunk.com / no-auth / no-ssl
user: (system) admin, (portal) admin
zertifikate: *.schunk.com / *.schunk.com / *.schunk.com / 2018-07-27
ACL: User: 10.149.0.0/16 , System: 10.149.0.0/16,10.49.0.0/16
Update: user. schunk; auto-platform-update
storage: 3 partitionen; 12% used
service-diag: alles okay
Version: 9.3.0.0 Build 44

Mobile(Prod.)

Hostname: mobile.schunk.com
IP: 217.5.167.15 / 255.255.255.224
DNS: 194.25.0.60 / 194.25.0.68 / 217.5.167.2
Gateway: 217.5.167.17
Static-Host: sentry3.schunk.com
NTP: 217.5.167.2
CLI: ssh-yes, telnet-no
SNMP: 10.149.20.1:162 / SNMPSCHUNK / v2
SMTP: 10.77.22.88:25 / mobileiron@de.schunk.com / no-auth / no-ssl
user: (system) Admin, (portal) Admin
Zertifikate: *.schunk.com / *.schunk.com / *.schunk.com / 2018-07-27
ACL: User: 10.149.0.0/16;10.49.0.0/16, Admin: 10.149.0.0/16;10.49.0.0/16, System: 10.149.0.0/16;10.49.0.0/16, Atlas: 10.149.0.0/16;10.49.0.0/16
Update: user: schunk; auto-platform-update
storage: 3 partitions; 22% used
service-diag: !! mail-server not reachable; alles andere okay
Version: 9.0.1.1 Build 2

Sentry-Test

Hostname: sentry-test.schunk.com
IP: 217.5.167.25 / 255.255.255.224
DNS: 194.25.0.60 / 194.25.0.68 / 217.5.167.2
Gateway: 217.5.167.17
Static-Host: traveler-test.schunk.int
NTP: 217.5.167.2
CLI: ssh-no; telnet-no
SNMP: [keine]
SMTP: no
User: admin
Zertifikate: *.schunk.com
adm-Zertifikat: mobileiron !!!!!!! ändern
Update: User: schunk
Storage: 3 disks - okay
Service-Diag: alles okay
Version 9.0.2 Build 5

Sentry-1:

Hostname: sentry.schunk.com
IP: 217.5.167.16 / 255.255.255.224
DNS: 217.5.167.2 / 8.8.8.8 / -.-.-.-
Gateway: 217.5.167.17
Static-Host: [keine]
NTP: 217.5.167.2
CLI: ssh-yes, telnet-yes
SNMP: 10.149.20.1:162 / SNMPSCHUNK / v2
SMTP: [keine]
User: Admin
Zertifikat: *.schunk.com / 2018-07-27
adm-Zertifikat: mobileiron !!!!!!! ändern
Update: User: schunk
Storage: 10 disks - keine Updates möglich!
Service-Diag: alles okay
Version: 7.5.1 Build 16

Sentry-2:

Hostname: sentry2.schunk.com
IP: 217.5.167.28 / 255.255.255.224
DNS: 217.5.167.2 / 8.8.8.8 / -.-.-.-
Static-Host: [keine]
NTP: 217.5.167.2
CLI: ssh-yes, telnet-yes
SNMP: 10.149.20.1:162 / SNMPSCHUNK / v2
SMTP: [keine]
User: Admin
Zertifikate: *.schunk.com / 2018-07-27
adm-Zertifikat: mobileiron !!!!!!! ändern
Update: User: schunk
Storage: 10 disks - keine Uodates möglich!
Service-Diag: alles okay
Version: 7.5.1 Build 16

Sentry-3:

Hostname: sentry3.schunk.com
IP: 217.5.167.14 / 255.255.255.224
DNS: 194.25.0.60 / 194.25.0.68 / 217.5.167.2
Static-Host: mobile.schunk.com / sentry3.schunk.com
NTP: 217.5.167.2
CLI: ssh-no, telnet-no
SNMP: 10.149.20.1:162 / SNMPSCHUNK / v2
SMTP: [keine]
User: Admin
Zertifikate: *.schunk.com
adm-Zertifikat: mobileiron !!!!!!! ändern
Update: User: schunk
Storage: 3 disks - alles okay.
Service-Diag: alles okay
Version: 7.5.1 Build 16

Local CAs

(prod) iOS Enterprise AppStore CA [default]
RSA / 2048 / SHA1 / 10950 / CN=iOS Enterprise AppStore CA
CLIENT_AUTHENTICATION

(prod) Windows Phone Enrollment CA [default]
RSA / 2048 SHA1 / 10950 / CN=Windows Phone Enrollment CA
CLIENT_AUTHENTICATION

(prod) AppTunnel CA [2013-08-21]
RSA / SHA1 / 10950 / CN=com, CN=schunk, CN=apptunnel
CLIENT_AUTHENTICATION

(test) iOS Enterprise AppStore CA [default]
RSA / 2048 / SHA1 / 10950 / CN=iOS Enterprise AppStore CA
CLIENT_AUTHENTICATION

(test) Windows Phone Enrollment CA [default]
RSA / 2048 SHA1 / 10950 / CN=Windows Phone Enrollment CA
CLIENT_AUTHENTICATION

(test) AppTunnel CA [2015-01-21]
RSA / SHA256 / 10950 / CN=apptunnel, CN=schunk, CN=com

(test) Tunnel CA [2016-08-01]
RSA / SHA256 / 10950 / CN=Tunnel

(test) Windows Cert Auth CA [default]
RSA / SHA384 / 3650 / CN=Windows Cert Auth CA

Notes
Passwort von Sentry3 unterscheidet sich von den anderen Systemen. Benutzernamen des Administrators sind nicht auf allen Systemen identisch. (Case-Sensitive)
SSH und Telnet Einstellungen sind nicht auf allen Systemen identisch.
DNS Einstellungen sind nicht auf allen Systemen identisch.
Static-Host Einträge sind nicht auf allen Systemen eingetragen.

Config
Zwei Sentry für zwei Mail-Server:
Sentry1: IBM Traveler (traveler.schunk.com; 217.5.167.22) | v9
Sentry2: IBM Traveler (xxxx; 217.5.167.13) | v9

Auf iPhone wird nativer E-Mail Client verwendet.
Auf Android wird aktuell Symantec Touchdown verwendet (früher Nitrodesk).

SCEP
Schunk AppTunnel SCEP
RSA / 2048 / SHA1 / CN=AppTunnelCer, CN=Schunk, CN=com / AppTunnel CA


LDAP
ldap://10.49.4.23:389 | ldap://10.49.4.24:389 (emea.ads.local)
User: emea\s000025

ldap://10.49.4.93:389 | ldap://10.49.4.93:389 (na.ads.local)
User: na\s000025

ldap://10.49.4.128:389 | ldap://10.49.4.128:389 (apac.ads.local)
User: apac\s000025

VPN
Schunk VPN (nur IT; 3 devices)
Server: 217.5.167.6
User: $USERID$
Type: PPTP
Password: Password

SCHUNK Tunnel (0 devices)
Server: sentry3.schunk.com
User: -
Type: MobileIron Tunnel
Password: Certificate

VPP
Apple-ID: apple-id.vpp@de.schunk.com
Expires on: 2017-07-29
Licences: 52.500 Licences

DEP
Apple-ID: apple-id.vpp@de.schunk.com
Expires on: 2017-07-11
Devices: 289
Profiles: 1 (default)

Policys


Labels
Es gibt 79 Labels.
Für AD-Anbindung gibt es "DELFN-MDM-xxx"-Gruppen. Diese sind mit den gleichnamigen AD-Gruppen verknüpft und werden verwendet, um E-Mail Konfiguration, In-House Apps und WLAN Profile zu verteilen.

Beispiele:

DELFN-MDM-OUTSIDE-SALES-GERMANY
("user.ldap.groups.name" =  "DELFN-MDM-OUTSIDE-SALES-GERMANY") AND "common.retired" = false
(Devices: 107 | User 87) enthält WiFi-Konfig

DELFN-MDM-TRAVELER-Android
("user.ldap.groups.name" =  "DELFN-MDM-TRAVELER"  AND "common.platform_name" starts with  "Android") AND "common.retired" = false
(Devices: 28 | User 28) enthält Exchange-Konfig für Android (ink. Touchdown)

GLO-APP-JAM
("user.ldap.groups.name" =  "GLO-APP-JAM") AND "common.retired" = false
Enthält App "SAP JAM" für iOS-Geräte


Auflistung aller Labels inkl. Criteria:

All-Smartphones ( "common.retired"=false)
Android ("common.platform"="Android" AND "common.retired"=false)
Android WLAN (manual)
CNSGH-MDM-SAP-C4C-TEST ("user.ldap.groups.name" =  "CNSGH-MDM-SAP-C4C-TEST") AND "common.retired" = false
Company-Owned "common.owner"="COMPANY" AND "common.retired"=false
DELFN-ADM-MDM ("user.ldap.groups.name" =  "DELFN-ADM-MDM") AND "common.retired" = false
DELFN-MDM-CRMPAD ("user.ldap.groups.name" =  "DELFN-MDM-CRMPAD") AND "common.retired" = false
DELFN-MDM-OUTSIDE-SALES-GERMANY ("user.ldap.groups.name" =  "DELFN-MDM-OUTSIDE-SALES-GERMANY") AND "common.retired" = false
DELFN-MDM-SCHUNK-IPAD ("user.ldap.groups.name" =  "DELFN-MDM-SCHUNK-IPAD" AND "common.model" starts with  "iPad" AND "common.retired" = false AND "common.retired" = false) AND "common.retired" = false
DELFN-MDM-SCHUNK-IPAD-GERMANY ("user.ldap.groups.name" =  "DELFN-MDM-SCHUNK-IPAD"  AND "user.email_address" ends with  "de.schunk.com" AND "common.model" starts with  "iPad" AND "common.retired" = false AND "common.retired" = false) AND "common.retired" = false
DELFN-MDM-STANDARD ("user.ldap.groups.name" =  "DELFN-MDM-STANDARD") AND "common.retired" = false
DELFN-MDM-TRAVELER-Android ("user.ldap.groups.name" =  "DELFN-MDM-TRAVELER"  AND "common.platform_name" starts with  "Android") AND "common.retired" = false
DELFN-MDM-TRAVELER-iOS ("common.platform_name" starts with  "iOS"  AND "user.ldap.groups.name" =  "DELFN-MDM-TRAVELER") AND "common.retired" = false
DELFN-MDM-TRAVELER-POP-Android ("user.ldap.groups.name" =  "DELFN-MDM-TRAVELER-POP"  AND "common.platform_name" starts with  "Android") AND "common.retired" = false
DELFN-MDM-TRAVELER-POP-iOS ("common.platform_name" starts with  "iOS"  AND "user.ldap.groups.name" =  "DELFN-MDM-TRAVELER-POP") AND "common.retired" = false
DELFN-MDM-VIP ("user.ldap.groups.name" =  "DELFN-MDM-VIP") AND "common.retired" = false
Employee-Owned ("common.owner"="EMPLOYEE" AND "common.retired"=false)
GLO-APP-C4C ("user.ldap.groups.name" =  "GLO-APP-C4C") AND "common.retired" = false
GLO-APP-JAM ("user.ldap.groups.name" =  "GLO-APP-JAM") AND "common.retired" = false
GLO-APP-STB ("user.ldap.groups.name" =  "GLO-APP-STB") AND "common.retired" = false
INTEC-PL (manual)
iOS ("common.platform"="iOS" AND "common.retired"=false)
IOS 8.3 ("common.os_version" =  "8.3") AND "common.retired" = false
IOS Asia (manual)
iOS Enterprise AppStore  (manual)
IOS Europa (manual)
iOS Germany (manual)
IOS USA (manual)
IOS USA/MX/CA/BR (manual)
iOS-Asia (("common.platform" =  "iOS"  AND "user.email_address" ends with  "kr.schunk.com"  OR "user.email_address" ends with  "cn.schunk.com"  OR "user.email_address" ends with  "in.schunk.com"  OR "user.email_address" ends with  "sg.schunk.com") AND "common.retired" = false)
iOS-Europa (("common.platform" =  "iOS"  AND "user.email_address" ends with  "at.schunk.com"  OR "user.email_address" ends with  "be.schunk.com"  OR "user.email_address" ends with  "cz.schunk.com"  OR "user.email_address" ends with  "dk.schunk.com"  OR "user.email_address" ends with  "fi.schunk.com"  OR "user.email_address" ends with  "fr.schunk.com"  OR "user.email_address" ends with  "tr.schunk.com"  OR "user.email_address" ends with  "hu.schunk.com"  OR "user.email_address" ends with  "it.schunk.com"  OR "user.email_address" ends with  "nl.schunk.com"  OR "user.email_address" ends with  "no.schunk.com"  OR "user.email_address" ends with  "pl.schunk.com"  OR "user.email_address" ends with  "es.schunk.com"  OR "user.email_address" ends with  "ru.schunk.com"  OR "user.email_address" ends with  "sk.schunk.com"  OR "user.email_address" ends with  "se.schunk.com"  OR "user.email_address" ends with  "ch.schunk.com"  OR "user.email_address" ends with  "gb.schunk.com") AND "common.retired" = false)
iOS-Germany (("common.platform" =  "iOS"  AND "user.email_address" ends with  "de.schunk.com") AND "common.retired" = false)
iOS-USA (("common.platform" =  "iOS"  AND "user.email_address" ends with  "us.schunk.com") AND "common.retired" = false)
iOS-USA/MX/CA/BR (("common.platform" =  "iOS"  AND "user.email_address" ends with  "us.schunk.com"  OR "user.email_address" ends with  "mx.schunk.com"  OR "user.email_address" ends with  "br.schunk.com"  OR "user.email_address" ends with  "ca.schunk.com") AND "common.retired" = false)
IT-Admin (manual)
Lookout for Work (manual)
MES - Deactivated (manual)
MES - High Risk (manual)
MES - LostConnectivity (manual)
MES - Low Risk (manual)
MES - Medium Risk (manual)
MES - Pending (manual)
MES - Secured (manual)
MES - Threats Present (manual)
No App Control (manual)
no Lock Screen (manual)
OS X ("common.platform"="OS X" AND "common.retired"=false)
Retired Devices ("common.retired" = true  AND "common.last_connected_at" <=  "now-1d")
SAP C4C (manual)
SAP JAM (manual)
Schunk Multiuser iPads (manual)
Schunk outside sales Germany iPads (manual)
Schunk Traveler (manual)
Schunk Traveler Android (manual)
Schunk Traveler Mailbox C4C-Support (manual)
Schunk Traveler Mailbox JAM-Support (manual)
Schunk Traveler Mailbox SAP-Basis Admin (manual)
Schunk Traveler Mailbox SAP-Servicedesk (manual)
Schunk Traveler Mailbox SAP-Servicedesk (manual)
Schunk Traveler Mailbox SAP-Servicemanagement (manual)
Schunk Traveler POP(manual)
Schunk Traveler POP Android (manual)
Signed-Out ("common.noncompliance_reasons" = "LOGGED_OUT" AND "common.retired"=false)
Test CRMpad (manual)
Test CRMpad 2 (manual)
Test HPW (manual)
Test IBM Verse (manual)
Test Sales Toolbox (manual)
Test Sales Toolbox v2 (manual)
Test SAP (manual)
Test Tunnel App (manual)
TestSecurityPolicy (manual)
VIP GL No App Control (manual)
Windows (("common.platform_name" = "Windows 8.1" OR "common.platform_name" = "Windows 10" AND "windows_phone.wp_phone" = false) AND "common.retired" = false)
Windows Phone (("common.platform" = "Windows Phone" OR "common.platform_name" = "Windows 10" AND "windows_phone.wp_phone" = true) AND "common.retired" = false)