Best Practice Guide UMA NG v3

---

Kurzfassung für Inbetriebnahme und Grundkonfiguration des UMA NG

Last adaption: 12.2022 (v3.3)

New:

• The setup wizard has been updated
• The article Backups has been updated

notempty

This article refers to a Resellerpreview

2.5.24

---

Mailserver konfigurieren

Für den Betrieb des UMA muss auf dem Mailserver ein dafür erforderliches Journal Konto angelegt werden. Alle E-Mails die den Mailserver passieren, eingehende sowie ausgehende, müssen in das Journal Konto kopiert werden damit das UMA diese dann von dem Konto via IMAP abholen und archivieren kann.

---

IMAP Einstellungen

Authentifizierungsmethode des IMAP-Servers einstellen

Zur Anmeldung muss die Nur-Text-Anmeldung aktiviert werden.

• Öffnen der Exchange-Verwaltungskonsole Abb.1
• Menüpunkt Server / Schaltfläche Bearbeiten
• Auswahl Menü IMAP4
• Anmeldemethode
  Standardauthentifizierung (Nur-Text) Abb.2
• Übernehmen mit Speichern

Starttyp des Dienstes ändern

Die Microsoft Exchange Dienste IMAP4 und IMAP4-Back-End müssen zur Übernahme der Änderung der Authentifizierungsmethode neu gestartet werden und sollen zukünftig automatisch gestartet werden:

• Aufruf Server-Manager / Tool Computerverwaltung / Menü Dienste und Anwendungen / Untermenü Dienste
• Eintrag Microsoft Exchange IMAP4
• Kontextmenü (durch Klick mit der rechten Maustaste auf diesen Eintrag) Abb.3
• Menüpunkt Eigenschaften
• Registerkarte Allgemein / im Dropdownmenü des Feldes Starttyp den Wert Automatisch auswählen Abb.4
• Klicken auf Starten
• abschließen mit Übernehmen

Die gleichen Einstellungen müssen ebenfalls für den Dienst Microsoft Exchange IMAP4-Back-End durchgeführt werden. Abb.5 & 6

Anlegen des Postfaches

Auf der Verwaltungskonsole des Exchange muss ein neues Postfach angelegt werden, von dem das UMA die E-Mails abholen kann.

• Menü Empfänger
• Abschntt Postfächer Abb.7
• Klick auf um ein neues Benutzerpostfach anzulegen
• In dem nun geöffneten Fenster müssen ein Alias, ein Anzeigename und ein Name eingetragen werden Abb.8
• Es muss ein Benutzeranmeldename und ein Kennwort eingetragen werden.
  Diese Daten werden später im UMA verwendet.

Abschließen mit Speichern

Hinzufügen einer neuen Journalregel

Exchange 2019 stellt die folgenden Journaloptionen bereit:

• Standardjournale Standardjournale werden für eine Postfachdatenbank konfiguriert. Dadurch kann der Journal-Agent alle Nachrichten in Journalen erfassen, die an und von Postfächern in einer bestimmten Postfachdatenbank gesendet werden. Wenn alle Nachrichten an alle Empfänger und von allen Absendern in Journalen aufgezeichnet werden sollen, müssen Sie Journale für alle Postfachdatenbanken auf allen Postfachservern in der Organisation konfigurieren.

• Premium-Journale Mit Premium-Journalen kann der Journal-Agent mithilfe von Journalregeln Journale mit größerer Granularität erstellen. Anstatt alle Postfächer in einer Postfachdatenbank in Journalen aufzuzeichnen, können Sie in Abstimmung auf die Anforderungen Ihrer Organisation Journalregeln konfigurieren, mit denen einzelne Empfänger oder Mitglieder von Verteilergruppen in Journalen erfasst werden. Zur Verwendung der Premium-Journalfunktion muss eine Exchange Enterprise-Clientzugriffslizenz (Client Access License, CAL) vorliegen.
  
  
  Quelle: http://technet.microsoft.com/de-de/library/aa998649(v=exchg.150).aspx

Hinzufügen einer neuen Standard-Journalregel

• Aufruf Exchange-Verwaltungskonsole
• Menü Server
• Untermenü Datenbanken
• Bearbeiten aufrufen mit Mausklick auf oder Doppelklick auf die Datenbank
• Menü Wartung Abb.10
• Als Journalempfänger den Namen des eben angelegten Benutzers für das UMA-Benutzerpostfach auswählen
• Übernehmen der Angaben mit Speichern

Hinzufügen einer neuen Premium-Journalregel (mit Exchange Enterprise-CAL)

• Wechsel in der Exchange-Verwaltungskonsole zum Menü Verwaltung der Compliance Abb.11
• Untermenü Journalregeln
• Öffnen des Fensters zur Einrichtung einer neuen Journalregel mit

• Unter Journalberichte senden an: wird das UMA Benutzerpostfach eingetragen, das gerade erstellt wurde (s.o.). Abb.12
• Namen für die Regel eintragen
• Da die Regel sich auf alle Empfänger beziehen soll, muss unter Beim Senden der Nachricht an oder Empfangen der Nachricht von... die Option [Auf alle Nachrichten anwenden] ausgewählt werden
• Weiterhin soll die Regel auf alle Nachrichten, unabhängig vom Ursprung oder Ziel, angewendet werden, daher muss unter Folgende Nachrichten im Journal erfassen ... die Option Alle Nachrichten ausgeählt werden
• Anlegen der Journalregel abschließen mit Klick auf Speichern

Fig. 1

Zur Anmeldung muss die Nur-Text-Anmeldung aktiviert werden.

• Öffnen der Exchange-Verwaltungskonsole
• Menüpunkt Server / Schaltfläche Bearbeiten

Fig. 2

• Auswahl Menü IMAP4
• Anmeldemethode
  Standardauthentifizierung (Nur-Text)
  
• Übernehmen mit Speichern

Fig. 3

Aufruf Server-Manager / Tool Computerverwaltung / Menü Dienste und Anwendungen / Untermenü Dienste

• Eintrag Microsoft Exchange IMAP4
• Kontextmenü (durch Klick mit der rechten Maustaste auf diesen Eintrag)
• Menüpunkt Eigenschaften

Fig. 4

IMAP4 Dienst bearbeiten:

• Registerkarte Allgemein / im Dropdownmenü des Feldes Starttyp den Wert Automatisch auswählen
• Klicken auf Starten
• abschließen mit Übernehmen

Fig. 5

Die gleichen Einstellungen müssen ebenfalls für den Dienst Microsoft Exchange IMAP4-Back-End durchgeführt werden.

Fig. 6

IMAP4 Backup Dienst bearbeiten:

• Registerkarte Allgemein / im Dropdownmenü des Feldes Starttyp den Wert Automatisch auswählen
• Klicken auf Starten
• abschließen mit Übernehmen

Fig. 7

Exchange Verwaltungskonsole:

• Menü Empfänger
• Gruppe Postfächer
• Klick auf um ein neues Benutzerpostfach anzulegen

Fig. 8

UMA-Postfach mit folgenden Angaben einrichten :

• Alias
• Anzeigename
• Name
• Benutzeranmeldename
• Kennwort

Diese Daten werden später im UMA verwendet.

Fig. 9

Dieser Schritt ist alternativ zum Premiumjournal (Abb.11+12)

Hinzufügen einer neuen Standard-Journalregel:

• Aufruf Exchange-Verwaltungskonsole
• Menü Server
• Untermenü Datenbanken Abb.9
• Bearbeiten aufrufen mit Mausklick auf oder Doppelklick auf die Datenbank

Fig. 10

Dieser Schritt ist alternativ zum Premiumjournal (Abb.11+12)

Hinzufügen einer neuen Standard-Journalregel

• Menü Wartung
• Journalempfänger: eben angelegten Benutzer für das UMA-Benutzerpostfach auswählen
• Übernehmen der Angaben mit Speichern

Fig. 11

Dieser Schritt ist alternativ zum Standardjournal (Abb. 9+10)

Hinzufügen einer neuen Premium-Journalregel (mit Exchange Enterprise-CAL)

• Wechsel in der Exchange-Verwaltungskonsole zum Menü Verwaltung der Compliance
• Untermenü Journalregeln
• Öffnen des Fensters zur Einrichtung einer neuen Journalregel mit

Fig. 12

Dieser Schritt ist alternativ zum Standardjournal (Abb. 9+10)

Journalregel anlegen:

• Journalberichte senden an: das UMA Benutzerpostfach, das gerade erstellt wurde (s.o.).
• Name für die Regel
• Beim Senden der Nachricht an oder Empfangen der Nachricht von... die Option [Auf alle Nachrichten anwenden] ausgewählen
• Bei Folgende Nachrichten im Journal erfassen ... die Option Alle Nachrichten ausgeählen
• Anlegen der Journalregel abschließen mit Klick auf Speichern

Nach Anlage einer der beiden Journalregeln werden alle Nachrichten/E-Mails in das neu angelegte Postfach kopiert, wo sie von dem UMA via IMAP abgeholt werden können.

---

UMA konfigurieren

Das erfolgreich angelegte Konto im Exchangeserver muss nun im UMA hinterlegt werden:

System-Einstellungen → E-Mail-Server → Remote E-Mail-Konten Schaltfläche Konto hinzufügen

• Protokoll: Auto versucht immer zunächst einen Abruf per IMAP und anschließen mit POP3
• Keep Mails Sollte nur in der Einrichtungsphase aktiviert sein. Andernfalls läuft das Postfach über kurz oder lang voll
• SSL: Aktivierung erforderlich für die Kommunikation mit einenm Exchange Server

Netzwerkanbindung

Der erste Schritt stellt die Einbindung des UMA in das Netzwerk dar.

---

Positioning of the UMA in the internal network

The so-called hub mode is used to integrate the UMA into the existing network. This has the advantage that the existing network structure does not need to be changed. In addition, the mode is also able to archive emails based on protocols other than POP3, IMAP or SMTP (e.g. via Outlook via MAPI).

---

Network Settings

In the delivery state some settings are preconfigured. For example, the IP address and administrator access.
Preferences:

IP address:	192.168.175.254
Subnet mask:	255.255.255.0
User name:	admin
Password:	insecure

---

Adjusting the IP address

To access the UMA web interface, either

• The computer with which the UMA is to be configured is located in the UMA network, i.e. in the subnet 192.168.175.0/24, or
• The UMA is set to the existing network.To add the UMA to the existing network, the IP address must be adjusted.

The console port is used for this purpose.

• On an appliance, the console is accessed by connecting a monitor and keyboard to the hardware. Here the IP address can be configured before the UMA is integrated into the existing network.
• On a VM, the console can be reached directly via a connection to the hypervisor
  

The console is only used to temporarily adjust the IP address and prepare it for network use without changing the IP address of the workstation PC.
Login is performed using the preconfigured administrator account. Since there is only one administrator on the UMA, only the password is requested for the login:
Default password: insecure
In the console environment, the administrator has very limited rights in the machine.
In this example, the subnet 192.168.145.0/24 is used. It is recommended that you select the subnet where the email server is located.
Make sure that the selected IP address for the UMA is not used by another device on the network.
The IP address of the UMA is changed with the following command:

ipconfig ip-address/subnet mask Gateway-ip z.B.: ipconfig 192.168.145.110/24 192.168.145.1

The IP address change carried out in this way is temporary and is reset to the delivery status after a restart.
For permanent storage, the IP address must be changed in the Web Interface.
Then the UMA is connected to the network.

Access to the administration interface

The configuration is done via the web interface of the UMA. Using an Internet browser, the setup is performed via an encrypted connection.
After connecting to the network, an Internet browser is used to enter the IP address including the port of the UMA in the URL input field:

https://192.168.145.110:11115

Since this is an encrypted connection with a certificate created by the UMA itself, which the browser cannot yet know, this connection must be explicitly permitted. The browser's warning notice must be ignored!

Message in Firefox
Button Advanced / Accept Risk and Continue

Message in Chrome
Link Show extended information / Go to xyz (unsafe)

Message in Edge
Link Details / Load web page anyway

Message in Safari
Button Show details / Link Open this website

UMA-Administration-Center

Login

Next, the login window of the UMA Administration Center is displayed. User name and password of the UMA are in the delivery state:

User name:	admin
Password:	insecure

After a click on the button  Login(Admin) or pressing the Enter key, a window appears with the licence conditions, which must be confirmed.
This is followed by the setup wizard for the initial setup of the UMA. Due to it's scope, a separate article has been dedicated to this in Setting Up the UMA with the Setup Wizard.

Der Einrichtungsassistent

Wesentliche Einstellungen zur Inbetriebnahme werden im Einrichtungsassistenten erfasst.

---

Fundamental settings

Depending on whether the UMA is being installed for the first time or whether a backup is to be restored after a new installation, various steps are required:

New installation with existing backup

As type configuration file is selected. This must have been exported before on the old UMA under Adminsitration Tab Backup or from UMA NG v3 under Maintenance Tab Backup in the section Configuration Import/Export.
With the button Complete among other things the data from step 1 of the setup wizard are taken over:

• Network configuration
  • UMA IP address
  • Gateway, DNS
  • Host name, domain
• Admin password and email address
• Remote Smarthost settings

After the reboot, step two of the setup wizard is called directly.

Initial installation

As type is selected license. The license mandatory for operation can be downloaded reseller portal

Setup Wizard

Step	Description
Step 1	Network Connection Data: UMA IP address: Permanent IP address of the UMA The address set via CLI is temporary and will be replaced by the default IP or by the address specified here at the next boot. default gateway, hostname, domain, DNS, NTP server admin data: password Email address: Important system emails (status or error messages) are sent to this address. Remote Smarthost Settings Access data to a mail server for sending system mails. Continue with button Next
	Sending test mail. Confirm sending with OK. If no mail arrives, please check the access data for the smarthost and the network connection
Step 2	Initialize storage hard drive The hard drives for the archive must be initialized. This is done automatically with the archive hard drives recognized by the UMA. If a hardware RAID controller has been installed in the UMA, only one drive is displayed in this view. During this process, all data on the specified hard drives will be irretrievably deleted. Continue with button Next Restart after the initialization of the storage Initialize storage
Step 3	Set up accounts: Depending on the type of authentication (Repository Type:) Windows Active Directory Other LDAP Server Local Users Azure AD
	Windows Active Directory Windows domain: The corresponding domain in which the Active Directory resides. workgroup: Must match the NetBIOS name of the domain IP or hostname of the DC: username: / password: A user with permission to perform an LDAP search. Account selection Account selection When using an authentication service such as Active Directory, care should be taken to determine which email accounts really need to be archived. In the section "Selection of individual accounts" there is the possibility to select the accounts to be archived exactly and thus to work much more "license-friendly". This is done by activating the field "Activate manual selection".
	LDAP For the use of another LDAP server, the following is entered in the fields: base: The domain in the form dc=localdomain dc=local IP or hostname of DC: username: User name for the LDAP server in the form cn=admin password: Password to the previously specified username User Container: The organizational unit in the form ou=users LDAP User Filter: In the form (objectClass=inetOrgPerson) User Attribute(s) e.g. uid Mail Attribute(s) LDAP communication security To enable this, you must first create a CA Import
	Local users If no authentication server is operated, the users can also be stored locally in a list. For this purpose, there is the possibility to import a list in CSV format via the Import button. The content of the *.csv file must have the following format: userid,password,firstname,lastname,email,optionalemail
	Azure AD Client: ••••••• Directory ID (tenant) from the app registry in Azure AD. Client-ID: ••••••• Application ID (Client) from the app registry in Azure AD. Client-Secret: ••••• Value of the client secret key from the Certificates & Secrets section of Azure AD. Azure Cloud: Azure Cloud Global Azure Cloud USA Azure Cloud Deutschlandnotempty Is no longer available as of UMA version 3.3.4. Microsoft has closed Azure Cloud Germany.    Azure Cloud China Selection of the Azure Cloud that hosts the AD. User authentification method Username and Password Anmeldung im DMS erfolgt ausschließlich mit den Daten aus den oben konfigurierten Benutzer Konten Single Sign-on Authentifizierung im DMS über Microsoft Azure. Der Login Dialog bietet hierzu eine Schaltfläche, die zum Microsoft Login führt. Dies ermöglicht z.B. eine Zwei-Faktor-Authentifizierung (2FA) Single Sign-on or username and Password Authentifizierung im DMS mit den Daten aus den oben konfigurierten Benutzer Konten oder über Microsoft Azure. Der Login Dialog bietet die Möglichkeit zur Anmeldung mit Benutzername und Passwort und alternativ eine zusätzliche Schaltfläche, die zum Microsoft Azure Login führt. Continue Verify the credentials and go to the next step.	Azure AD credentials in step 3 of the setup wizard.
Step 4	Archive rules define the duration of archiving. The global rule applies if no other rule takes effect. The default is 6 years Continue with button Next E-mails that have a header but no body (i.e. "empty e-mails") are retrieved by the UMA and stored in the user mailbox. However, these are not indexed and therefore do not appear in the DMS!
Step 5	Remote email accounts receive all journal emails from a mail server. This usually includes several individual user email accounts. The remote email accounts must be created in the Mail Server as journal accounts, so that all associated mails (outgoing and incoming mails of the mail server) can be received here. Archiving only takes place if the following settings have been made under System settings / Email accounts users with a corresponding email address can be created. Protocol: POP3 / IMAP Caption Value Description Name: Journal Account Freely selectable name Protocol: IMAP used protocol Servername: imap.mailsever.anyideas.de Mail server that hosts the journal address. Username: tttpointcloud User name for the Journal-emai account Password: ••••• Password for the journal email account Keep Mails: Usually, emails are deleted after they have been picked up. Activating Keepmails prevents this deletion. Connection Security: New as of UMA v3.3.1 STARTTLS STARTTLS is used for connection encryption. Default SSL SSL is used for connection encryption None (insecure) The connection is not encrypted. Should only be used temporarily if the remote station does not support encrypted communication! An update of the remote station is urgently required! E-mails and Passwords are sent in plain text. Use is not recommended. Use of this option is a security risk Max. email size disabled A size can be defined up to which the email is archived Email header evaluation: Enable MS Journal-Envelope autodetection default The recognition of the header entries "MS journal envelope" enables the UMA BCC recipient to recognize in the Exchange-own header and assign it to a user account. BCC recipients are not in the original mail header    Disable MS Journal-Envelope autodetection Uses the original header of the email to assign it to a user account X-Envelope-To Uses only the X-Envelope-To entry from the original header of the email to assign it to a user account X-Original-To Uses only the X-Original-To entry from the original header of the email to assign it to a user account Delivered-To Uses only the Delivered-To entry from the original header of the email to assign it to a user account Custom Recipient Header A custom defined header part to be evaluated. Example: envelope-from
	Protocol: OAuth (IMAP) New as of UMA NG v3.3 Requirement: Configured apps in Azure with OAuth (→Wiki) Caption Value Description Name: Journal Account Freely selectable name Protocol: OAuth 2 (IMAP) used protocol Servername: outlook.office365.com Tenant ID: aaaabbbb-1111-2222-3333-… In Microsoft Azure in the menu Azure Active Directory / Overview under Tenant ID Client ID: 11111111-aaaa-bbbb-2222-… In Microsoft Azure, in the menu Enterprise Applications / All Applications / Application Name / Overview under Application ID Username: ttt-point@anyideas.onmicrosoft.com Username for the journal email account in Azure Client Secret: 33334444-dddd-eeee-ffff-… In Microsoft Azure in the menu Certificates & secrets in the tab Client secrets under Value Fetch emails every: 1 minute Specifies how often the external mail server is checked for new emails Keep Mails: Usually, emails are deleted after they have been picked up. Activating Keepmails prevents this deletion. When activated, external mailboxes can fill up! Keepmails should only be used temporarily for test purposes, or if it is otherwise ensured that the external mailbox does not reach its capacity limit. Connection Security: New as of UMA v3.3.1 STARTTLS STARTTLS is used for connection encryption. SSL SSL is used for connection encryption. Default None (insecure) The connection is not encrypted. Should only be used temporarily if the remote station does not support encrypted communication! An update of the remote station is urgently required! E-mails and Passwords are sent in plain text. Use is not recommended. Use of this option is a security risk Max. email size disabled A size can be defined up to which the email is archived Email header evaluation: Enable MS Journal-Envelope autodetection default The recognition of the header entries "MS journal envelope" enables the UMA BCC recipient to recognize in the Exchange-own header and assign it to a user account. BCC recipients are not in the original mail header    Disable MS Journal-Envelope autodetection Uses the original header of the email to assign it to a user account X-Envelope-To Uses only the X-Envelope-To entry from the original header of the email to assign it to a user account X-Original-To Uses only the X-Original-To entry from the original header of the email to assign it to a user account Delivered-To Uses only the Delivered-To entry from the original header of the email to assign it to a user account Custom Recipient Header A custom defined header part to be evaluated. Example: envelope-from
Setup Wizard Exit

---

Backups konfigurieren

Backups sind auf verschiedenen Medien möglich:

• Windows Share
• SFTP
• USB

Kein Backup - kein Mitleid...

---

---

Introduction

The UMA is an audit-proof archiving system. All archived information should be kept unchanged and be easily and permanently available to users.

When considering a holistic backup strategy, this information must be considered so that it can be made available again in the event of a failure of the UMA and the subsequent reinstallation.

The backup strategy is extended by one of the following backup options of the UMA.

---

Backup of the UMA configuration

Section Configuration Import/Export
Since the archive store of the UMA is encrypted and the backup files are also encrypted during creation, it is necessary to backup this key.
The container encryption information is located in the UMA configuration. Therefore it must be backed up first. The Export button creates a file which can then be Download. A click on this button saves the UMA configuration as a file named "uma-config.db" in the folder designated for your downloads.

A backup copy should absolutely be kept in a further safe place.
Only in this way it is guaranteed that this is also available in case of emergency.

Additionally, the Encryption Key, which can also be found on the Backup tab, can also be backed up.
With it, a restore is also possible without configuration data.

---

Backup devices

Backup devices

Backup devices

The archive system can either be backed up on a network storage or on an external storage medium. External storage media are connected to the appliance via an USB port. Both external hard drives and flash storage media (USB sticks, etc.) are supported.

First, in the section Backup Devices the device or devices to which the backups are to be saved are defined. The following types are distinguished:

• iSCSI (Recommended)
• Windows Share
• Windows Share (signed)
• SFTP
• FTP
• USB device

iSCSI (Recommended)

Establishment

Backup iSCSI

First, an iSCSI target must be set up on a NAS or server. Please follow the instructions for the corresponding storage devices or servers.

The following settings must be made in the UMA:

• Choose a meaningful name
• select backup type iSCSI
• Enter the IP address of the drive or server on which the iSCSI Target was created
• Via the button Change Target the connection is established and the information about the target is requested
• Complete the process by pressing the Register button
• All previous data on this drive will be overwritten
• After completing the registration, the created backup device must be saved using the Save Devices button
• Finally a test must be performed using the Test Device button, which should of course be confirmed with a success message from the UMA

The port used for this is 3260

The iSCSI (internet Small Computer System Interface) is a very efficient network data transfer method.
The storage devices on which the data are then to be stored are called "targets". Many server systems or NAS (Network Attached Storage) can be set up as iSCSI targets.

Caption	Value	Description
Name	iSCSI-Backup-Drive	Meaningful name with which a backup job can access this device
Type	iSCSI	Device type
Host name or IP address:	192.168.192.192	Host name or IP address of the drive or server where the iSCSI Target was created
Current Target:	Value is determined and entered automatically
UUID:	Value is determined and entered automatically
Change Target		Searches for iSCSI targets under the specified host name or IP address
iSCSI Targets:	Please select an iSCSI target	Since it is possible to set up multiple iSCSI targets on a target drive, the desired target must be selected here.
Register		Establishes the connection and enters the UUID
Authorization method:	CHAP	If an authentication method was configured, the access data for the target can be stored here.

Windows Share

Backup Windows Share

A Windows share is a shared drive or folder accessible over a network using the SMB (Server Message Block) protocol, usually on a Windows server or on a NAS.

It is important that the correct share name is entered.

Caption	Value	Description
Name	WindowsShare-Device	Meaningful name with which a backup job can access this device
Type	Windows Share	Device type
Share Name	backup	The name of the shared folder
Host name or IP address:	192.168.192.192	Host name or the IP address of the device on which the share was set up
Folder	uma	If you want to save in a subdirectory of the share, enter the name of the corresponding folder here Please note that on the UMA, due to the underlying Linux system, no backslash \ is used for addressing further subfolders, as is common on Windows systems, but a slash / .
	or /	If you save directly to the release, the field can remain empty or contain a slash /.
Username	uma-backup-user	Credentials on the target server for the backup Only releases for which access data are available can be used.
Password	•••••
SMB Version	SMBv1 SMBv2 SMBv3	Used SMB version.
Use deprecated NTLMv1 authorization:		Enables the NTLMv1 authorization The NTLMv1 protocol is often still used on the shares for authorization. If it is not clear whether this is still in use, it should be activated for use on the UMA.

The user must have write permission in the share.

The port used for this is 445

Windows Share (Signed)

Uses SMB signatures for the connection.
The same settings apply as for Windows Share
exception:

• No SMB version is specified
• NTLMv2 is always used for authorization

FTP

Backup FTP

If an FTP server (File Transfer Protocol) is available, it can also be used for backing up the UMA archive.

When using FTP, the data will not be transferred encrypted.

Please note for which folders FTP has been shared with the user on the server.
.

Caption	Value	Description
Name	FTP-Device	Meaningful name with which a backup job can access this device
Type	FTP	Device type
Host name or IP address:	ftp.anyideas.de	Host name or IP address of the ftp server
Folder	/Backup/UMA/	When sharing the entire host and a folder structure Hostname/Backup/UMA
	or /	If only the UMA folder is shared in a Hostname/Backup/UMA folder structure, the field may remain empty or contain a / slash.
Username	uma-backup-user	Credentials on the target server for the backup
Password	•••••

The port used for this is 21

SFTP

Backup SFTP

The complete path must be entered here in any case.

Caption	Value	Description
Name	SFTP-Device	Meaningful name with which a backup job can access this device
Type	SFTP	Device type
Host name or IP address:	sftp.anyideas.de	Host name or IP address of the sftp-server
Absolute Path:	/Backup/UMA/	When sharing the entire host and a folder structure Hostname/Backup/UMA
	/	When sharing only the UMA folder in a Hostname/Backup/UMA folder structure, the field must contain a / slash. The field Absolute path must not be left empty.
Username	uma-backup-user	Credentials on the target server for the backup
Password	•••••

The port used for this is 22

USB

Backup USB

A USB drive is always practical when a backup is to be created "just quickly". Both hard disks and flash memory such as USB sticks are supported here.

Always disconnect USB devices from the UMA before rebooting.

An inserted USB device could be recognized by the BIOS as a boot drive and then block the restart of the UMA.

The following settings must be made in the UMA:

• Choose a meaningful name
• select backup type USB Device
• Via the button Change Device the connection is established and the information about the target is requested
• Complete the process by pressing the Register button
• After completing the registration, the created backup device must be saved using the Save Devices button
• Finally a test should be performed using the Test Device button, which should of course be confirmed with a success message from the UMA

Caption	Value	Description
Name	USB Backup Device	Meaningful name with which a backup job can access this device
Type	USB device	Device type
Current device	Value is determined and entered automatically
UUID:	Value is determined and entered automatically
Change device		Triggers a search of the connected USB devices
Available devices:	Please select an USB device	If several USB devices are connected, the desired device can be selected
Register		Establishes the connection and enters the UUID

Test device

After saving the created backup device, the connection to this device must be tested. To do so, press the Test Device button, which will trigger a success message after a short time.

---

Backup Jobs

A backup job controls when, on which device and with which backup format a backup should be created. Furthermore, it is defined here how many backups are to be kept for the restore process.

First, the job is given a name and a device is selected on which the backups are to be stored.

Schedule

Backup Job Scheduling

For scheduling, it is important to consider some of the features of the UMA.

If a backup is performed, a snapshot of the archive is created first.

Before creating this snapshot, some services on the UMA will be stopped.

These include, among others:

• Dovecot:

  
  

  This checks the user name and email address, the filter rules and initiates the indexing of incoming emails

  
  

• LTA-Push:

  
  

  This service takes care of the transport from the LTA folders to the XML long-term archive

  
  

• LTA service:

  
  

  Converts the emails into XML format, creates a "hash tree" and retrieves the qualified timestamp.
  This is fetched daily from 22:00 on.

Please note the following when scheduling:

No emails are checked or indexed during the backup. Therefore, it is not advisable to perform a backup during the time when users need to access the archive.

Backup jobs should not start on the hour because the UMA automatically starts its own cron jobs on the hour as well. Due to the collection of the qualified timestamp and the subsequent creation of the "hash tree", no backup can be created between 10:00pm and 00:00am.

backup jobs should not start on the hour because the UMA automatically starts its own cron jobs on the hour as well.

The days Monday to Sunday are available for scheduling. This means, for example, that once a week, on every Sunday, a backup will be performed on the specified device.
Furthermore, the backup can be performed every working day (Monday - Friday) or every day.

After the backup is completed, a confirmation email will be sent to the address specified under System Settings / System Users / System Administrator.

Number of retained Backups

Number of backups

Besides the creation of a single backup, it is also possible to keep several of different days. You can choose between the last one (1) and the ten last ones (10).

It is also possible to keep all backups, but this is only useful when using the Time Machine backup format.
For the format Mirror there is always only one backup.

Backup Format

Backup Formats

To be selected here:

Caption	Description
Mirror (recommended) Mirror (recommended)	Creates an incremental backup using rsync. This method is particularly stable and tolerant of disconnections. Requires an encrypted drive and can therefore only be used with the backup devices iSCSI and USB
Tar Tar	With this archive format a complete backup file is always created
Time Machine Time Machine	An incremental format that saves only the changes after an initial full backup. You can select any point in time when restoring. Requires an encrypted drive and can therefore only be used with the backup devices iSCSI and USB

Create Backup

With the button of the same name the Run Backup Job Manually can be started at any time

Checking the backup

If the first backup was created, it must be ensured that it can be restored. This can be done with the button Restore.
A specific backup can be selected depending on the number of backups held: Choose a backup to restore

Desaster Recovery

To ensure that the backup can also be restored on newly installed hardware, a disaster recovery test is always included in a full backup.
For example, a UMA can be installed on a virtual machine. The previously backed up UMA configuration file is then imported on this virtual machine. Using the installation wizard or under System Settings / Archive Storage the mounted archive hard disk is initialized and then the backup is restored via Restore.

Once the backup is successful, it can be assumed that it works.

---

Restore Backup

Restoring a backup is only possible with the configuration that was active during the backup run, since the backup depends on the configuration ID.

Backup list

Since the backup jobs have different formats and/or different locations, the function is inserted with the individual jobs.
A backup must be selected beforehand: Select a backup to restore

The Update will update the list of backups and a click on Restore will start the restore.

---

Delete Backup

To be able to delete a backup that is no longer needed, under Backup Jobs at Select a backup to restore select the backup to be deleted.

The pop-up message

If the Delete Backup button is clicked without a backup selected, a pop-up message will appear.

The warning window for deleting a backup

When the Delete Backup button is clicked, a window with a confirmation prompt appears.
This serves to query whether this backup should really be deleted.

The deletion process may take some time.

---

Final information

Contained are in an archive backup

• all emails
• Email attachments
• Documents
• and backup information (e.g. the encryption key)

Not included are

• Index databases
  These must be recreated again.
  This usually happens when the user wants to access his documents via the UMA user interface for the first time after restoring a backup.
  
  The first login will then take a little longer than usual, because the index database for this user has to be created again first.