24 Cyclades™ ACS 6000 Advanced Console Server Installation/Administration/User Guide
System Tools
Click System Tools to display icons which can be clicked to reboot or shut down the console server, upgrade the console server’s firmware, save or restore its configuration or open a terminal session with the console server.
System
Click System to display information about the console server and allow an administrator to configure the console server’s system parameters. The following tabs are listed under System in the side navigation bar.
Security
Security Profile
A Security Profile determines which network services are enabled on the console server.
During initial configuration, the console server administrator must configure security parameters to conform with the site security policy. The following security features can be configured either in the web manager, CLI or the DSView 3 software:
• Configure the session idle time-out
• Enable or disable RPC
• Allow all users to access enabled ports or allow the configuration of group authorizations to restrict access
• Select a Security Profile, which defines:
• Enabled services (FTP, ICMP, IPSec and Telnet)
• SSH and HTTP/HTTPS access
The administrator can select either a preconfigured Security Profile or create a custom profile.
All the services and the SSH and HTTP/HTTPS configuration options that are enabled and disabled for each Security Profile are shown in the Wizard - Security and the System - Security
- Security Profile pages.
To configure a Security Profile:
1.
Select System - Security - Security Profile.
2.
In the Idle Timeout field, enter the number of minutes before the console server times out open sessions.
Chapter 3: Accessing the Console Server via the Web Manager 25
NOTE: This value applies to any user session to the appliance via HTTP, HTTPS, SSH, Telnet or CONSOLE port.
The new idle time-out will be applied to new sessions only.
3.
Under the Enabled Services section, enable or disable the RCP checkbox.
4.
Under the Serial Devices heading, enable or disable the Port access is controlled by
authorizations assigned to user groups checkbox.
5.
Select the checkbox for Custom, Moderate, Open or Secure under the Security Profile heading.
6.
Click Save.
DSView 3 software security
You can also configure DSView 3 software security settings. When the console server is managed by the DSView 3 software, the DSView 3 server will supply the certificate to the console server. Under normal conditions, the DSView 3 software will manage the certificate to clear and replace it with a new certificate as needed. If communication with the DSView 3 software is lost, the DSView server will be unable to clear the certificate and the console server cannot be used. Click the Clear DSView Certificate button to configure the console server in
Trust All mode.
To configure DSView 3 software security settings:
1.
Select System - Security - DSView.
2.
Click the Allow appliance to be managed by DSView checkbox and click Save.
FIPS module
The console server has embedded the FIPS-capable OpenSSL that is the combination of the
FIPS Object Module (the FIPS 140-2 validated module) along with a FIPS-compatible OpenSSL
(it is a version of the OpenSSL product that is designed for compatibility with the FIPS Object
Module API).
If an administrator enables the FIPS module, the console server will use the FIPS Object
Module to perform encryption operations. The FIPS module is disabled by default.
When the FIPS module is enabled, the Monitoring - FIPS mode page will show what service
(SSHv2, HTTPS, SNMPv3 and ADSAP2) is in FIPS mode. All security functions and cryptographic algorithms used by the service are performed in FIPS 140-2 Approved mode.
To enable the FIPS module:
1.
Select System - Security - FIPS 140.
2.
Check the box to Enable the FIPS 140-2 Module and click Save.
26 Cyclades™ ACS 6000 Advanced Console Server Installation/Administration/User Guide
The console server will automatically reboot. During the reboot, the console server will erase
SSH keys, update the configuration of HTTPD, SSHD, ADSAP2d and SNMPD files and test the integrity of the FIPS Object Module. Once the reboot is complete, the console server will accept SSH and HTTPS connections using only FIPS-approved ciphers.
When FIPS is enabled the following restrictions apply:
For SSH sessions:
• Protocol version 1 will be disabled.
• Triple-DES CBS and AES 128/192/256 CBS are the only encryption ciphers that will be accepted.
• HMAC-SHA1 and HMAC-SHA1-96 are the only message integrity algorithms that will be accepted.
• Only RSA keys 1024 to 16384 bits will be accepted.
HTTPS sessions will accept only the SSL v 3.1(TLSv1) protocol to establish the
SSL tunnel with one of the following encryption ciphers:
• AES-256-SHA
• AES-128-SHA
• Triple DES SHA (DES-CBC3-SHA)
SNMP version 3 requests will be accepted when authentication is SHA and the encryption cipher is AES.
Bootp Configuration Retrieval
You can set your console server to be reconfigured during boot or at IP renewal.
To generate configuration to be retrieved:
1.
Click System Tools - Save Configuration and save the configuration to either an FTP site or locally.
-or-
Use the list_configuration command to get the CLI template scripts, edit the configuration of the console server and save it as a text file.
-or-
Edit a file with CLI commands and save it.
2.
Transfer the saved file to a DHCP server.
3.
Configure the DHCP server to transfer the configuration file to the console server.
Chapter 3: Accessing the Console Server via the Web Manager 27
To reconfigure a console server with bootp:
1.
Click System - Security - Security Profile. Under the Bootp Configuration Retrieval heading, ensure the box next to Enabled is checked.
2.
Uncheck the box next to Enable Live Configuration. The saved configuration will be retrieved and applied on the next reboot.
-or-
Ensure the box next to Enable Live Configuration is checked. The saved configuration will be retrieved and applied on the next IP renewal.
NOTE: You must configure your DHCP server in order to transfer the configuration file to your console server.
Date and Time
The console server provides two options for setting the date and time. It can retrieve the date and time from a network time protocol (NTP) server, or you can set the date and time manually so that the console server’s internal clock is used to provide time and date information.
NOTE: The Current Time displayed in the Date & Time screen shows only the time when the screen was opened. It does not continue to update in real time.
To set the time and date using NTP:
1.
Click System - Date And Time.
2.
Select Enable network time protocol.
3.
Enter the NTP server site of your choice and click Save.
To set the time and date manually:
1.
Click System - Date And Time.
2.
Select Set manually.
3.
Using the drop-down menus, select the required date and time and click Save.
To set the time zone using a predefined time zone:
1.
Click System - Date And Time - Time Zone.
2.
Select Predefined.
3.
Select the required time zone from the drop-down menu and click Save.
To define custom time zone settings:
1.
Click System- Date And Time - Time Zone.
2.
Select Define Time Zone.
28 Cyclades™ ACS 6000 Advanced Console Server Installation/Administration/User Guide
3.
Enter the Time Zone Name and Standard Time Acronym of your choice.
4.
Enter the GMT Offset.
5.
Select Enable daylight savings time if needed.
6.
Select or enter the required values for daylight savings time settings and click Save.
Help and Language
Click System - Help And Language and use the drop-down menu to select the console server’s language. Enter the full URL of the online help, ending in /index.html, on the local web server in the Online Help URL field. Click Save.
Online help
When the online help feature is configured for your console server, clicking the Help button from any form on the web manager opens a new window and redirects its content to the configured path for the online help product documentation.
NOTE: Using the online help feature from the Avocent/Cyclades server is not always possible due to firewall configurations, nor is it recommended. It is generally advisable for you to use the online help system provided with the product or download the online help .zip file and run it from a local server.
The system administrator can download the online help from Avocent. For more information on downloading the online help, contact Technical Support.
Once the online help file is obtained (in zip format), the files must be extracted and put in to a user-selected directory under the web server’s root directory. The web server must be publicly accessible.
NOTE: The default URL for online help is http://global.avocent.com/us/olh/acs6000/v_2.2.0/en/index.html.
General
An administrator can configure a login banner to display when a user begins a SSHv2, Telnet,
Console or web manager session.
To create a login banner:
1.
Click System - General in the side navigation bar.
2.
Check the box to enable the login banner.
3.
Enter the text you want displayed upon login in the Login Banner field and click Save.
Chapter 3: Accessing the Console Server via the Web Manager 29
Boot Configuration
Boot configuration defines the location from which the console server loads the operating system. The console server can boot from its internal firmware or from the network. By default, the console server boots from Flash memory. Clicking System- Boot Configuration will display the Boot Configuration screen.
If you need to boot from the network, make sure the following prerequisites are met:
• A TFTP or BootP server must be available on the network
• An upgraded console server boot image file must be downloaded from Avocent and made available on the TFTP or BootP server
• The console server must be configured with a fixed IP address
• The boot filename and the IP address of the TFTP or BootP server is known
To configure boot configuration:
1.
Click System - Boot Configuration.
2.
Under Boot Mode, select From Flash, and select Image 1 or Image 2.
-or-
Select From Network and enter the following information:
• Appliance IP Address: Enter the fixed IP address or a DHCP assigned IP address to the console server.
• TFTP Server IP: Enter the IP address of the TFTP boot server.
• Filename: Enter the filename of the boot firmware.
3.
Using the drop-down menu, select whether the Watchdog Timer is enabled. If the
Watchdog Timer is enabled, the console server reboots if the software crashes.
4.
Using the drop-down menu, select one of the following speeds for both Ethernet 0 Mode and Ethernet 1 Mode: 100BT full, 100BT half, 10BT full, 10BT half or Auto.
5.
Using the drop-down menu, select the console port speed and click Save.
NOTE: Ethernet Mode will be affected after saving. The rest of the configuration will be applied after rebooting.
Information
Click System - Information to view the console server’s identity, versions, power and CPU information.
