Sophos UTM 9.6 user portal - navigation and settings

The Sophos UTM user portal is a special browser-based application that provides personalised email services and remote access services to authorised users. URL of possible, for example https://192.168.2.100. (Note the HTTPS protocol and the missing port number 4444 that you would normally enter to access the WebAdmin interface). Access is possible via the URL of the Sophos UTM, for example https://192.168.2.100.(Note the HTTPS-protocol and the missing port number 4444 that you would normally enter to access the WebAdmin interface).

The user portal includes, among other things, the email quarantine, which contains those messages that are either infected with malicious software, have suspicious attachments, have been identified as spam or contain expressions that are explicitly prohibited.

Users can select a language on the login page from the drop-down list located on the right-hand side of the header bar.

Through the User Portal, users have access to the following services:

• SMTP Quarantine: Users can view messages in quarantine and release them if necessary. The types of messages they are allowed to release can be set on the Email Protection > Quarantine Report > Advanced tab. (The tab is called Mail Quarantine if POP3 is disabled).
• SMTP Log: Users can view the SMTP log of their mail traffic here. (The tab is called Mail Log if POP3 is disabled).
• POP3 Quarantine: Users can view messages in quarantine and release them if necessary. The types of messages they are allowed to release can be set on the Email Protection > Quarantine Report > Advanced tab. (The tab is called Mail Quarantine if SMTP is disabled).
• POP3 Accounts: Users can enter their login details for POP3 accounts they use here. Only spam e-mails for which POP3 account access data are stored are displayed in the user portal. Users for whom POP3 account access data is stored will receive a separate quarantine report for each email address. Note that authorised POP3 servers must be entered on the Email Protection > POP3 > Advanced tab.
• Sender Whitelist: Users can create a positive list (whitelist) for certain senders, this way messages from them will not be classified as spam. However, e-mails with viruses or unscannable e-mails are always quarantined. However, e-mails with viruses or unscannable e-mails are always quarantined. Both individual valid e-mail addresses (e.g. mmustermann@beispiel.de) and addresses of a specific domain can be entered in the whitelist, with an asterisk serving as a placeholder (e.g. *@example.de)). If exactly the same e-mail address is present in both lists, the blacklist applies.
• Sender blacklist: Here users can put e-mail senders on the negative list (blacklist), e.g. phishing@hotmail.com, or also entire domains, e.g. *@hotmail.com. The blacklist is applied to both SMTP and POP3 e-mails if they are activated on the system. Senders can be blacklisted by clicking on the plus symbol, entering the address and clicking on the tick to save.
• Hotspots: Here users can find the access data of hotspots and manage them. This tab is only available if at least one hotspot has been activated for a particular user. For hotspots with daily password changes, the current password is displayed and can also be changed. For hotspots that can be used via vouchers, vouchers can be created, printed, exported and deleted. Usage information is displayed on a list of created vouchers. For more information, see Wireless Protection > Hotspots.
• Client Authentication: Allows users to download a Sophos Authentication Agent (SAA) setup file. The SAA can be used as an authentication method for the web filter. The Client Authent ication tab is only available if the corresponding function has been enabled. For more information, see Definitions & Users > Client Authentication.
• OTP token: Here, users can find one or more QR codes as well as the corresponding detailed information for configuring the UTM 's one-time password (OTP) service on their mobile devices. For more information, see Definitions & Users > Authentication Services > One-time Password (OTP).
• Remote Access: Users can download client software for remote access here as well as configuration files provided for them. However, the Remote Access menu item is only visible if remote access has been activated for the respective user.
• HTML5 VPN portal: Here, users can open VPN connections to predefined hosts via predefined services. This tab is only available if at least one VPN connection has been activated for the respective user. For more information, see Remote Access > HTML5 VPN Portal.
• Change password: Users can change their password for access to the user portal here.
• HTTPS Proxy: Users can import the HTTPS proxy CA certificate from here to get rid of the error messages that are displayed when they visit secure websites. After clicking the Import Proxy CA Certificate button, the user will be asked by their browser if they trust the CA for various purposes. For more information, see Web Protection > Filter Options > HTTPS CAs.
• Logout: Click here to log out of the user portal. However, this is only necessary if you had marked Remember my login when logging in - a cookie is created - and you now want to log out explicitly. The cookie will be deleted. Otherwise, there is no reason to use the logout function; it is sufficient to close the browser tab or the browser window.

On the Administration > User Portal > General tab, you can activate the user portal. In addition, you can define which networks and which users are to be granted access to the User Portal.

Activate access to the User Portal

To activate access to the User Portal, proceed as follows:

1. Activate the User Portal. Click on the slider. The slider turns yellow and the User Portal Options area can now be edited.
2. Select the permitted networks. Select or add the networks that should have access to the User Portal. Adding a definition is explained on the Definitions & Users > Network Definitions > Network Defin itions page.
3. Select the authorised users. Select the users or user groups that should have access to the User Portal or add new users. Adding a user is explained on the Users page. If you do not want to allow access to all users, uncheck Allow all users and select the users or user groups individually.
4. Click Apply. Your settings are saved. The slider turns green.

On the Advanced tab, you can define an alternative host name and port number for the user portal and make language and security settings.

Language

During login, the User Portal evaluates the language settings of the web browser and loads the appropriate locale to display the User Portal in the browser's default language. If the browser has a language as default setting that is not available in the User Portal, you can specify here which language should be used as a substitute. Users also have the option of selecting a language on the login page of the user portal.

Security

The User Portal uses cookies for session management. Persistent cookies allow the user to return later after closing a session without having to log in again. Cookies can be deleted by the user at any time by clicking Logout in the User Portal.

Deactivating Portal Entries

For the functions specified here, a menu entry is displayed in the User Portal if the corresponding function has been activated in WebAdmin. However, you can specify menu items that are not to be displayed in the user portal. To do this, select the corresponding option(s) and click Apply.

Network settings

Host Name: By default, the host name of the UTM is preset as specified on the Administration > System Settings > Host Name tab. However, if you want to allow access to the User Portal via the Internet, then it is useful to enter an alternative host name here that can be publicly resolved.

Listening Address: The default value is Any. If you use the Web Application Firewall, you must enter a fixed interface address on which the service listens for connections to the user portal. This setting is necessary so that the connection management for the user portal and the Web Application Firewall can distinguish the incoming SSL connections.

Port: By default, port 443 is preset for HTTPS. However, you can change the port to any value between 1024 and 65535. Note that you cannot select port 10443 or the WebAdmin TCP port configured on the Administration > WebAdmin Settings > Advanced tab. Regardless of the port selected, the User Portal can only ever be accessed via HTTPS.

Welcome text

You can customise the welcome text of the User Portal. Simple HTML commands and hyperlinks are permitted.

Note - The welcome text cannot be changed if you are using a home-use licence.