Visit the Macrium web site Browse our Support Forum
	Complete User Guide
	Export this page

Search

This section is intended to discuss the security involved in Site Manager and show how these features and other features can be configured through the Site Manager interface.

Security

The various forms of network communication in Site Manager have some built in security with options for further configuring them. 

Agent Communications

Communications between agent and Site Manager server are always encrypted using 256-bit AES encryption. This happens automatically, key generation, negotiation and encryption are all done without any additional configuration. In addition, a passphrase can be set in the Site Manager. This passphrase is set on any successfully connected agent and prevents any other Site Manager taking over that agent unless the new Site Manager has the same passphrase set. 

The purpose of this passphrase is for use in high integrity or untrusted environments where a guarantee that only the Site Manager server that has been configured for that agent can access that agent is required.

The agent passphrase can be set in the Agent Security section of the Security settings below.

Web Interface Access

The web interface used to access the Site Manager interface can use HTTP or HTTPS. By default the Site Manager uses HTTP access but is only accessible from the computer it is installed on. This restriction can be removed in the Connection Settings section of the Settings page. 

If the interface is exposed to a potentially insecure network or the internet, we recommend using HTTPS. When HTTPS is first enabled, a default self-signed certificate is used. This certificate is not recommended for use outside secure networks as it is shipped with every Site Manager installation. Any certificate in OpenSSL .PEM file format can be used in place of the built in certificate. If you have keys in a different format, the OpenSSL command line utility can convert a variety of formats. See https://www.openssl.org for details.

Configuration

To configure the settings for Site Manager, access the Settings page from the main menu:

This is divided into a number of sections which are explained in more detail below.

User Settings - User Interface

This section controls the logged in users configuration of the Site Manager Dashboard and interface.

Systems Settings - User Interface

This section controls the configuration of the Site Manager Dashboard and interface for all users.

Email

The Email section is divided into three subsections - SMTP Configuration for setting up server details, Notification Email for configuring where notifications (Backup start, end and others) are sent to and Backup Summary for configuring daily status emails.

SMTP Configuration 

This section allows Email server settings to be configured, including security settings.

Notification Email

This section allows the recipients and subject to be specified for notification emails. These setting are applied to any notification emails sent according to the Settings → Notifications section.

The Email Subject can be specified using replaceable parameters.

Replaceable parameters are specified by starting them with a dollar character (and optionally surrounding them in curly braces) - {$example}. Available parameters are:

If a variable doesn't expand to anything and it's in a curly brace section, the whole curly brace section will be omitted. This can be used to hide extra spacing and text. For example, if the variable string

Notification - $notificationtype{ on computer $agent}

is used, it will expand to "Notification - Backup Started on computer MYCOMPUTER" for a backup start notification and "Notification - Disk Space Low" for a disk space low notification.

Backup Summary

The summary section allows configuration of daily backup summary emails as below:

The options available are: 

A preview of the daily email with the selected columns is shown below the settings.

The Email Subject can be specified using replaceable parameters.

Replaceable parameters are specified by starting them with a dollar character (and optionally surrounding them in curly braces) - {$example}. Available parameters are:

Slack

The Management Console supports sending notifications to Slack. Once configured, the types of notifications can be configured in the Notifications section, below.

Security

Here you can customize the various security options for the Management Console.

Access Restriction

This section controls general access settings to Site Manager - which network interfaces the Site Manager UI is available on and whether user login is required.. Finer control is provider under the User Permissions section.

User Permissions

Dialogs to manage login providers and Site Manager access permissions can be accessed here. The provider manager is used to create, configure and delete login providers and the permissions manager is used to set role based user and group permissions for each provider. For more information see: Access Control. 

Connection Settings

This section allows you to configure HTTP/HTTPS connection settings for the Management Console. The defaults should be fine for most installations but you may wish to provide your own SSL credentials and possibly alter the ports if they conflict with other applications on your server.

Agent Security

This section contains additional security settings for Agent communications. It allows an additional passphrase to be set - using a passphrase means that once communication has been established with an agent on a remote computer, the remote computer will only communicate with Site Manager servers which have the same passphrase set. This is intended to prevent any rogue processes emulating a Site Manager server and gaining access to the agent on a remote computer. 

If a computer is added after previously having a passphrase set, the computer will be listed as Unauthorized in the computers list. To manage the computer, either the Site Manager server must have the correct passphrase, the passphrase on the agent must be changed (Requires local administrator access to the computer) or a passphrase can be entered on the Site Manager server to allow one-off access. 

Notifications

Here you can select which notifications appear in the User Interface, the Windows Event Log, over Slack or email (if configured). 

Notification types

Additionally, there are options to set whether relevant backup logs should be attached to emails and how many days without a backup should be allowed before the daily summary email warns that a computer is unprotected.

Warnings

The number of days a computer can go without backups before being flagged as having an error in the dashboard, computers page and daily status email is configurable here via the Backup expiry period setting.

System

The system section contains options for modifying the behavior of the overall system. The options available are as follows:

Server Name

Configuration Transfer

This section has options for backup up, downloading and restoring the Site Manager configuration:

Log Retention

This section allows logs (both backup logs and event logs) to be automatically deleted after a number of days. This will only happen if the Keep Logs Forever option is unselected. This option will affect both the backup logs and event logs. An agent computer's copy of the backup logs will also be permanently deleted.

Support Information

This section allows gathering of support information and upload to Macrium servers or download as a zip file. It should only be used under the direction of Macrium Support.

Macrium Image Guardian 

This section provides convenient access to the Macrium Image Guardian installers. The installers can be used to install Macrium Image Guardian on Windows computers that host repositories separately to the Site Manager server.

MultiSite

The MultiSite section controls integration with Macrium MultiSite for remote management of Site Manager. If MultiSite is enabled and the HTTPS port configured in the Security section is exposed to the internet, Site Manager can be managed by Macrium MultiSite.

The options in the MultiSite section are as follows:

The MultiSite Connection Status section will only appear if MultiSite is enabled. This section will show the current status of the Site Manager's connection to MultiSite. The Refresh button retries the MultiSite connection if there are issues. 

Agent

This section controls how Site Manager agents and remote agent installation work.

Network

This section contains options controlling how the Site Manager server access the internet.

Proxy Settings

A proxy server may be configured here. Site Manager will use this for all HTTP/HTTPS requests to the internet.

Rescue Media

This section contains options controlling how Site Manager builds rescue media.

Working Directory

The Working Directory is the folder on the Site Manager server which is used as temporary space for Rescue Media building and to store the Rescue Media ISO images.

Export Drivers

Site Manager collects drivers needed to build Rescue Media from connected Agents. These drivers may be exported for use in disaster recovery by using the Export all Drivers or Export Selected Drivers options.  This will copy all the drivers to the drivers\export folder in the Rescue Media working directory,

The Group extracted drivers by Agent Rescue Media configuration option places the exported drivers into subfolders based on the relevant Windows PE version for that computer - e.g. all computers which require Rescue Media based on Windows PE 10 64-bit will have their drivers exported to the drivers\export\PE10x64 folder. 

This can be useful when extracting drivers to create custom rescue media.

Daily Data Export

This section controls Site Manager's creation of a number of CSV files that can be exported on a daily basis to assist in auditing, third-party integration or custom scripting.

The initial options allow the types of export to be selected and the export time. The export types are:

This section configures the file and folder information for the export. The credentials used to write the files can be controlled by specifying a username, password and domain for the account. If left blank, the SYSTEM account on the Site Manager server is used.

The folder and file paths can be specified here using replaceable parameters - this allows a number of configurations, including creating each day's exports in the same place (overwriting old files), giving each day's export file a name based on the date, or placing each day's exports into a different subfolder.

Replaceable parameters are specified by starting them with a dollar character (and optionally surrounding them in curly braces) - {$example}. Available parameters are: