C H A P T E R
8
Security Menu and Forms
Users and Groups
The Users and Groups form allows you to perform the following tasks:
• Set up user access to the console server Web Manager
• Assign users to specific groups that share common access rights
• Assign or change passwords
• Create new groups and add to the group list
The two groups to which you can assign a user are:
• Admin - Read/Write Access
• Regular User - Limited Read/Write Access
CAUTION: There are two root users for the initial setup of the console server by the administrator. These usernames are root with the default password tslinux and admin with the password cyclades. For security purposes make sure you change this default password as soon as possible.
Selecting Security - Users and Groups in Expert mode displays the form shown in the following figure.
109
Figure 8.1: Expert - Security - Users and Groups Form
110 Cyclades ACS Advanced Console Server Installation/Administration/User Guide
You can use the Users and Groups form to perform the following:
• Add or delete users
• Assign or change user passwords
• Add or delete groups for serial port access configuration
• Add users to a group
• Delete users from a group
Adding a User
If you click the Add button on the Security - Users and Groups form under the Users List, the Add
User dialog box appears. The following table describes the fields in the Add User dialog box.
Table 8.1: Expert - Add User Dialog Field Names and Definitions
Field Name Definition
User Name
Password
Group
Shell
Comments
Name of the user to be added.
The password associated with the username.
On the Group pull-down menu, select Regular User [Default] or Admin.
NOTE: To configure a user to be able to perform all administrative functions, select the Admin group.
Optional. The default shell is /bin/sh when the user makes a SSH or
Telnet connection.
Optional notes about the user’s role or configuration.
Adding a Group
If you click the Add button on the Security - Users and Groups form under the Group List, the Add
Group dialog box appears. Add a new group by entering a group name and add individual users separated by commas.
To add a user:
1.
Go to Security - Users and Groups The Users and Groups form displays.
2.
Click Add. The Add User dialog box displays.
3.
Enter the username in the User Name field.
4.
Enter the password in the Password and Repeat Password fields.
5.
Assign a group from the Group pull-down menu.
6.
Optional: Select a shell from the Shell pull-down menu.
7.
Optional: Enter information, as desired, about the user’s role or responsibilities.
8.
Click OK.
9.
Click apply changes.
Chapter 8: Security Menu and Forms 111
To delete a user or group:
1.
Go to Security - Users and Groups. The Users and Groups form displays.
2.
Select the name of a user or group to delete.
3.
Click Delete.
4.
Click apply changes.
To change a user’s password:
1.
Go to Security - Users and Groups. The Users and Groups form displays.
2.
Select the name of the user whose password you wish to change.
3.
Click Change Password. The Change User Password dialog box displays.
4.
Enter the new password in the New Password field and enter it again in the Repeat New
Password field.
5.
Click OK.
6.
Click apply changes.
To add a group:
1.
Go to Security - Users and Groups. The Users and Groups form displays.
2.
Under the list of groups, click Add. The Add Group dialog box displays.
3.
Enter the name for the new group in the Group Name field.
4.
Enter one username or multiple comma-separated usernames in the Users field.
5.
Click OK.
6.
Click apply changes.
To modify a group:
1.
Go to Security - Users and Groups. The Users and Groups form displays.
2.
Select the name of a group to modify.
3.
Click Edit. The Edit Group form displays.
4.
Add or delete users from the group as desired.
5.
Click OK.
6.
Click apply changes.
112 Cyclades ACS Advanced Console Server Installation/Administration/User Guide
Active Ports Sessions
Selecting Security - Active Ports Sessions displays the form shown in the following figure.
Figure 8.2: Expert - Security - Active Ports Sessions
The Active Ports Sessions form provides status and usage information related to all active serial ports sessions. You can use the form to view who is logged into each port and the processes they are running. Open sessions are displayed with their identification and statistical data, the related data such as CPU usage for a specific client, JCPU processes and PCPU processing time.
The Kill Sessions and Refresh buttons either end or refresh the selected session.
The following table defines the active ports sessions form fields.
Table 8.2: Expert - Active Ports Sessions Information
Field Name Definition
User
TTY
From
Login
Idle
JCPU
PCPU
What
First eight characters of the username.
Connection method.
Where the network connection is from.
Login time in hours and minutes. If login was not on the same day, the date of login also appears.
How long since last activity.
The amount of CPU time consumed by all active processes including currently running background jobs.
The amount of CPU time consumed by the current process.
Name of the current process.
Chapter 8: Security Menu and Forms 113
To view, kill or refresh active user sessions:
1.
Go to Security - Active Ports Sessions. The Active Ports Sessions form appears.
2.
To refresh the display, click the Refresh button. If you are using this form to view the information you are done.
3.
To kill a session, select the desired session and click the Kill Sessions button.
Authentication
Selecting Security - Authentication displays the form shown in the following figure, which includes six tabs, AuthType, RADIUS, TACACS+, LDAP, Kerberos and NIS.
Figure 8.3: Expert - Security - Authentication
You can use the Authentication forms to select a method for authenticating logins to the console server or to identify authentication servers that are configured for logins either to the console server or to the serial ports.
Configuring authentication for console server logins
The default authentication method for the console server is Local. You can either accept the default or select another authentication method from the Unit Authentication pull-down menu on the
AuthType form.
Any authentication method selected for the console server is used for authentication of any user attempting to log into the console server through Telnet, SSH or the Web Manager.
To configure the console server login authentication method:
1.
Go to Security - Authentication. The AuthType form is displayed.
2.
To specify an authentication method for login to theconsole server, select a method from the
Unit Authentication pull-down menu.
NOTE: Make sure an authentication server is specified for the selected authentication type.
114 Cyclades ACS Advanced Console Server Installation/Administration/User Guide
3.
Click apply changes.
Configuring authentication servers for logins to the console server and connected devices
If you are configuring any authentication method other than Local, make sure an authentication server is set up for that method.
The following is a summary of the things you need to know about setting up authentication servers.
• The ACS console server must be on the same subnet as the authentication server.
• Each authentication server must be configured and operational.
• The console server administrator should obtain the necessary information from each authentication server administrator, in order set up and identify those servers on the ACS console server.
For example, if LDAP authentication were to be used for logins to the console server and Kerberos for logins to serial ports, then the console server needs to have network access to an LDAP and a
Kerberos authentication server. The administrator needs to perform setup on the console server for both types of authentication servers.
The administrator completes the appropriate form through the Web Manager Expert - Security -
Authentication to setup an authentication server for every authentication method to be used by the console server and its ports.
The following table lists the procedures that apply to each authentication method.
Table 8.3: Tasks for Setting up Authentication Servers
Procedures Variations
To configure a RADIUS authentication server: on page 114
RADIUS, Local/RADIUS, RADIUS/Local or RADIUS/
DownLocal
To configure a TACACS+ authentication server: on page 115
TACACS+, Local/TACACS+, TACACS+/Local or
TACACS+/DownLocal
To configure an LDAP authentication server: on page 116
LDAP, LDAP/Local or LDAPDownLocal, LDAPDownLocal/
Radius
Kerberos, Kerberos/Local or KerberosDownLocal
To configure a Kerberos authentication server: on page 117
To configure a NIS authentication server: on page 119
NIS, Local/NIS, NIS/Local or NISDownLocal
To configure a RADIUS authentication server:
Perform the following procedure to configure a RADIUS authentication server when the console server or any of its ports are configured to use RADIUS authentication method or any of its variations (Local/RADIUS, RADIUS/Local or RADIUS/DownLocal).
Chapter 8: Security Menu and Forms 115
1.
Go to Security - Authentication - RADIUS in Expert mode.
2.
Fill in the form according to your local RADIUS server configuration.
3.
Click apply changes.
Group authorization on RADIUS
Group information retrieval from a RADIUS authentication server adds another layer of security by adding a network-based authorization. It retrieves the group information from the authentication server and performs an authorization through the console server.
NOTE: When configuring the RADIUS authentication server, select the Enable Service-Type attribute checking checkbox to authorize the ACS console server to retrieve the level of the user (admin or regular) based on the
Service-Type attribute from the RADIUS server. Deselect the checkbox to authorize the ACS console server to retrieve the level of user based on the group_name attribute sent by the RADIUS server.
To configure a TACACS+ authentication server:
Perform the following procedure to configure a TACACS+ authentication server when the console server or any of its ports are configured to use TACACS+ authentication method or any of its variations (Local/TACACS+, TACACS+/Local or TACACS+/DownLocal).
1.
Go to Security - Authentication - TACACS+ in Expert mode. The TACACS+ form displays.
2.
Fill in the form according to your local TACACS+ server configuration.
3.
To apply Authorization in addition to authentication to the box and ports, select the Enable
Raccess Authorization checkbox.
By default, Raccess Authorization is disabled and no additional authorization is implemented.
When Raccess Authorization is enabled, the authorization level of users trying to access the console server or its ports using TACACS+ authentication is checked. Users with administrator privileges have administrative access and users with regular user privileges have regular user access.
4.
To specify a time out period in seconds for each authentication attempt, type a number in the
Timeout field.
If the authentication server does not respond to the client’s login attempt before the specified time period, the login attempt is cancelled. The user may retry depending on the number specified in the Retries field on this form.
5.
To specify a number of times the user can request authentication verification from the server before sending an authentication failure message to the user, enter a number in the
Retries field.
6.
Click apply changes.
Group authorization on TACACS+
Using an authorization method in addition to authentication provides an extra level of system security. Selecting Security - Authentication - TACACS+ in Expert mode displays the TACACS+
116 Cyclades ACS Advanced Console Server Installation/Administration/User Guide form where an administrators can configure a TACACS+ authentication server and can also enable user authorization checking.
By checking the Enable Raccess Authorization checkbox, an additional level of security checking is implemented. After each user is successfully authenticated through the standard login procedure, the console server uses TACACS+ to determine whether or not each user/group is authorized to access specific serial ports.
By default the Enable Raccess Authorization is disabled allowing all users full authorization. When this feature is enabled by placing a check mark in the box, users/groups are denied access unless they have the proper authorization, which must be set on the TACACS+ authentication server itself. To see the configuration procedures for a TACACS+ authentication server, refer to the
Cyclades ACS Command Reference Guide.
To configure an LDAP authentication server:
Perform the following procedure to configure an LDAP authentication server when the console server or any of its ports are configured to use the LDAP authentication method or any of its variations (LDAP, LDAP/Local, LDAPDownLocal or LDAPDownLocal/Radius).
Before starting this procedure, you will need the following information from the LDAP server administrator:
• The distinguished name of the search base
• The LDAP domain name
• Whether to use secure LDAP
• The authentication server’s IP address
You can enter information in the LDAP User Name, LDAP Password and LDAP Login Attribute fields, but an entry is not required:
Work with the LDAP server administrator to ensure that the following types of accounts are set up on the LDAP server and that the administrators of the console server and the connected devices know the passwords assigned to the accounts:
• An account for admin.
• If LDAP authentication is specified for the console server, accounts for all users who need to log into the console server to administer connected devices.
• If LDAP authentication is specified for serial ports, accounts for users who need administrative access to the connected devices.
To configure LDAP authentication:
1.
Select Security - Authentication - LDAP in Expert mode. The LDAP form displays with LDAP
Server and LDAP Base fields filled in from with the current values in the /etc/ldap.conf file.
Chapter 8: Security Menu and Forms 117
Figure 8.4: Expert - Security - Authentication - LDAP
2.
Supply the IP address of the LDAP server in the LDAP Server field.
3.
If the LDAP authentication server uses a different distinguished name for the search base than the one displayed in the LDAP Base field, change the definition.
The default distinguished name is dc, as in dc=value,dc=value. If the distinguished name on the LDAP server is
o
, then replace dc in the base field with
o
, as in
o=value
,
o=value
.
4.
Replace the default base name with the name of your LDAP domain.
For example, for the LDAP domain name avocent.com, the correct entry is:
dc=avocent
,
dc=com
.
5.
Enable Secure LDAP, if required.
6.
Enter optional information in LDAP User Name, LDAP Password and LDAP Login
Attribute fields.
7.
Click apply changes. The changes are stored in /etc/ldap.conf on the console server.
Group Authorization on LDAP
Group information retrieval from an LDAP authentication server adds another layer of security by adding a network-based authorization. It retrieves the group information from the authentication server and performs an authorization through the console server.
To configure a Kerberos authentication server:
Perform the following procedure to configure a Kerberos authentication server when the console server or any of its ports is configured to use Kerberos authentication method or any of its variations (Kerberos, Kerberos/Local or KerberosDownLocal).
Before starting this procedure, find out the following information from the Kerberos server administrator:
• Realm name and KDC address
• Host name and IP address for the Kerberos server
118 Cyclades ACS Advanced Console Server Installation/Administration/User Guide
Also, work with the Kerberos server’s administrator to ensure that following types of accounts are set up on the Kerberos server and that the administrators of the console server and connected devices know the passwords assigned to the accounts:
• An account for admin
• If Kerberos authentication is specified for the console server, accounts will be needed for all users who need to log into the console server to administer connected devices
• If Kerberos authentication is specified for the serial ports, accounts for users who need administrative access to connected devices
Make sure an entry for the console server and the Kerberos server exist in the console server’s /etc/ hosts file.
1.
Go to Network - Host Table in Expert mode. The Host Table form appears.
2.
Add an entry for the console server if none exists and an entry for the Kerberos server.
a.
Click Add. The New/Modify Host dialog appears.
b.
Enter the address in the IP Address field.
c.
Enter the name in the Name field.
d.
Enter an optional alias in the Alias field.
3.
Make sure that time, date and timezone settings are synchronized on the console server and on the Kerberos server.
NOTE: Kerberos authentication depends on time synchronization. Time and date synchronization can be achieved by setting both the console server and the Kerberos server to use the same NTP server.
4.
To specify an NTP server, see To configure time and date using an NTP server: on page 161.
5.
To set the time and date on the console server manually, see To set the time and date manually: on page 161.
6.
Work with the Kerberos authentication server administrator to synchronize the time and date between the console server and the Kerberos server.
7.
Set the timezone on the console server by going to Administration - Time/Date in Expert mode as shown in the following figure. The default is GMT.
Chapter 8: Security Menu and Forms 119
Figure 8.5: Expert - Administration - Time/Date
8.
Go to Security - Authentication- Kerberos in Expert mode. The Kerberos form displays as shown in the following figure.
Figure 8.6: Expert - Security - Authentication - Kerberos
9.
Fill in the form according to your local setup of the Kerberos server.
10. Click apply changes.
To configure a NIS authentication server:
Perform the following procedure to configure a NIS authentication server when the console server or any of its ports are configured to use NIS authentication method or any of its variations (Local/
NIS, NIS/Local or NISDownLocal).
1.
Go to Security - Authentication - NIS in Expert mode. The NIS form displays as shown in the following figure.
120 Cyclades ACS Advanced Console Server Installation/Administration/User Guide
Figure 8.7: Expert - Security - Authentication - NIS
2.
Fill in the form according to your configuration of the NIS server.
3.
Click apply changes.
NOTE: NIS does not work if the Security Profile is set to "Moderate" or "Secured.” It only works if the Security
Profile is "Open.”
Security Profiles
Selecting Security - Security Profile displays the form shown in the following figure.
Figure 8.8: Expert - Security - Security Profile
A Security Profile consists of a set of parameters that can be configured in order to have more control over the services that are active at any time.
Pre-defined security profiles
There are three pre-defined security profiles:
• Secure - The Secure profile disables all protocols except sshv2, HTTPS and SSH to Serial
Ports. Authentication to access Serial Ports is required and SSH root access is not allowed.
Chapter 8: Security Menu and Forms 121
NOTE: SSH root access is enabled when the security profile is set to Moderate or Open. If a Secured security profile is selected, you need to switch to a Custom security profile and enable the allow root access option.
• Moderate - The Moderate profile is the recommended security level. This profile enables sshv1, sshv2, HTTP, HTTPS, Telnet, SSH and Raw connections to the Serial Ports. In addition,
ICMP and HTTP redirection to HTTPS are enabled. Authentication to access the serial ports is not required.
• Open - The Open profile enables all services such as Telnet, sshv1, sshv2, HTTP, HTTPS,
SNMP, RPC, ICMP and Telnet, SSH and Raw connections to the Serial Ports. Authentication to access serial ports is not required.
Default security profile
The Default Security Profile sets the parameters to same as Moderate profile. See the following tables for the list of enabled services when the Default security profile is used.
Custom security profile
The Custom Security Profile opens up a dialog box to allow custom configuration of individual protocols or services.
NOTE: By default, a number of protocols and services are enabled in the Custom profile, however, they are configurable to user’s custom requirements.
The following tables illustrate the properties for each of the Security Profiles. The enabled services in each profile is designated with a P
.
Table 8.4: Enabled Services to Access the Console Server Under Each Security Profile
Access to the Console Server Secure Moderate Open Default
Telnet sshv1 sshv2
Allow SSH root access
HTTP
HTTPS
HTTP redirection to HTTPS
N/A
N/A
P
N/A
N/A
P
N/A
P
P
P
P
P
N/A
P
P
P
P
P
P
P
N/A
P
P
P
P
P
N/A
P
Table 8.5: Enabled Services to Access the Serial Ports Under Each Security Profile
Access to Serial Ports Secure Moderate Open Default
Console (Telnet)
Console (ssh)
N/A
P
P
P
P
P
P
P
122 Cyclades ACS Advanced Console Server Installation/Administration/User Guide
Table 8.5: Enabled Services to Access the Serial Ports Under Each Security Profile (Continued)
Access to Serial Ports Secure Moderate Open Default
Console (Raw)
Serial Port Authentication
Bidirect (Dynamic Mode Support)
N/A
P
N/A
P
N/A
P
P
N/A
P
P
N/A
P
Table 8.6: Enabled Protocols for Each Security Profile Shown with a P
Other Services Secure Moderate Open
SNMP
RPC
N/A
N/A
N/A
N/A
P
P
ICMP
FTP
IPSec
N/A
N/A
N/A
P
N/A
N/A
P
N/A
N/A
Default
N/A
N/A
P
N/A
N/A
NOTE: The Default security profile parameters are the same as the Moderate security parameters.
The first step in configuring your ACS console server is to define a Security Profile. One of the following situations is applicable when you boot up the console server unit.
• The console server is starting for the first time or after a reset to factory default parameters.
In this situation when you boot up your console server and log in as an administrator to the
Web Manager, a security warning dialog box appears. The Web Manager is redirected to
Step1: Security Profile in the Wizard mode. Further navigation to other sections of the Web
Manager is not possible without selecting or configuring a Security Profile. Once you select or configure a Security Profile and save the changes, the console server restarts.
• The console server firmware is upgraded and the system is restarting with the new firmware.
In this situation the console server was already in use and certain configuration parameters were saved in the flash memory. In this case the console server automatically retrieves the
Custom Security Profile parameters saved in the flash memory and behaves as it was a normal reboot.
• The console server is restarting normally.
In this situation the system detects the pre-defined security profile. You can continue working in the Web Manager.
Chapter 8: Security Menu and Forms 123
Serial port settings and security profiles
All serial ports on ACS console servers shipped from the factory are disabled by default. The administrator can enable ports individually or collectively and assign specific users to individual ports. The following figure shows the default factory settings of serial ports.
Figure 8.9: Expert - Physical Ports Default Factory Settings
The following situations apply to serial ports when you modify or change a security profile.
• If you reconfigure the security profile and restart the Web manager, you need to make sure the serial ports protocols and access methods match the selected security profile.
• If the serial port connection protocol is incompatible with the selected security profile the following dialog box appears when you try to access Expert - Ports - Physical Ports
Figure 8.10: Serial Ports Protocol Incompatibility Dialog Box
To select or configure a security profile:
The following procedure assumes you have installed a new console server at your site or you have reset the unit to factory default.
1.
Enter the assigned IP address of the console server in your browser and log in as an administrator.
2.
Review the Security Advisory and click the Close button.
3.
The Web Manager is redirected to Wizard - Step 1: Security Profile.
124 Cyclades ACS Advanced Console Server Installation/Administration/User Guide
4.
Select a pre-defined Security Profile by pressing one of the Secure, Moderate, Open or Default profiles or create a Custom profile. The following dialog box appears when you select the
Custom profile.
Figure 8.11: Custom Security Profile Dialog Box
CAUTION: Take the required precautions to understand the potential impacts of each individual service configured under the Custom profile.
It is not possible to continue working in the Web Manager without selecting a Security Profile.
Once you select a security profile or configure a custom profile and apply the changes, the console server Web Manager restarts in order for the changes to take effect.
5.
Select apply changes to save the configuration to Flash. The console server Web Manager restarts.
6.
Login after Web Manager restarts.
7.
The Web Manager defaults to Ports - Ports Status page.
Security certificates
The ACS console server generates its own self-signed SSL certificate for HTTPS using OpenSSL.
NOTE: It is highly recommended that you use the openssl tool to replace the console server generated certificate.
Chapter 8: Security Menu and Forms 125
Certificate for HTTP security
A certificate for HTTP security is created by a Certificate Authority. Certificates are most commonly obtained through generating public and private keys using a public key algorithm like
RSA or X.509. The keys can be generated by using a key generator software. The procedures to obtain a Signed Digital Certificate is documented in the ACS Command Reference Guide, Chapter
3 Authentication, Section 3.7 Certificate for HTTP Security.
User configured digital certificate
You can generate a self-signed digital certificate. It is highly recommended that you use the openssl tool to generate a self-signed certificate and replace the console server generated certificate.The procedures to configure a self-signed digital certificate is documented in the Cyclades ACS
Command Reference Guide.
X.509 certificate on ssh
The OpenSSH software included with the console server has support for X.509 certificates. The administrator must activate and configure the SSH to use X.509. In order to implement authentication of SSH sessions through exchange of X.509 certificates please refer to the configuration procedures described in the Cyclades ACS Command Reference Guide.
126 Cyclades ACS Advanced Console Server Installation/Administration/User Guide
