Celerra Security Configuration Guide P/N 300-009-990 REV A01
Total Page:16
File Type:pdf, Size:1020Kb
EMC® Celerra® Network Server Release 6.0 Celerra Security Configuration Guide P/N 300-009-990 REV A01 EMC Corporation Corporate Headquarters: Hopkinton, MA 01748-9103 1-508-435-1000 www.EMC.com 2 of 102 Release 6.0 Celerra Security Configuration Guide Contents Introduction . .5 System requirements . .5 Cautions and warnings . .5 User interface choices . .5 Terminology . .6 Related information . .8 Concepts. .10 Planning considerations for user identification and authentication . .20 Planning considerations for using an external LDAP-based directory server for user identification and authentication . .22 Planning considerations for role-based user access . .25 Planning considerations for password security . .29 Planning considerations for Public Key Infrastructure. .30 Configuring the use of an external LDAP-based directory server for user identification and authentication . .34 Configuring password policy . .37 Define password policy interactively . .37 Define specific password policy definitions . .38 Set password expiration period . .38 Configuring session timeout . .39 Prerequisites . .39 Change the session timeout value . .39 Customizing a login banner . .41 Creating a message of the day (MOTD) . .42 Protecting session tokens . .43 Configuring network encryption and authentication using the SSL protocol . .44 Using HTTPS . .44 Using SSL with LDAP. .44 Change the default SSL protocol . .44 Change the default SSL cipher suite . .45 Postrequisites . .46 Configuring PKI . .47 Creating the certificate provided by the persona . .47 Obtaining CA certificates. .47 Using the Control Station as the CA. .47 Generate a key set and certificate request. .48 Send the certificate request to the CA . .51 Import a CA-signed certificate. .52 List the available CA certificates . .54 Acquire a CA certificate . .54 Import a CA certificate . .57 Generate a new Control Station CA certificate . .57 Display the certificate. .58 Distribute the Control Station CA certificate . .60 Managing PKI . .61 Display key set and certificate properties . .61 Check for expired key sets . .62 Clear key sets . .62 Celerra Security Configuration Guide Release 6.0 3 of 102 Display CA certificate properties . .63 Check for expired CA certificates . .63 Delete CA certificates. .64 Troubleshooting. .65 Where to get help . .65 EMC E-Lab Interoperability Navigator . .65 Troubleshooting the Control Station connection to a LDAP-based directory server . .65 Troubleshooting local user accounts. .66 Troubleshooting domain-mapped user accounts . .68 Troubleshooting certificate imports . .68 Error messages. .70 Training and Professional Services . .70 Appendix A: CLI role-based access setup . .71 Appendix B: Supported SSL cipher suites . .81 Appendix C: Understanding your LDAP-based directory server configuration . .83 Active Directory Users & Computers . .83 Ldap Admin . .90 Index . .99 4 of 102 Release 6.0 Celerra Security Configuration Guide Introduction The EMC® Celerra® Network Server implements a variety of security features to control user and network access, monitor system access and use, and support the transmission of encrypted data. These security features are implemented on the Control Station and Data Movers. This document explains why, when, and how to use these security features. A basic understanding of these features is important to understanding Celerra security. "Concepts" on page 10 provides more details. This document is part of the Celerra Network Server documentation set and is intended for administrators responsible for the overall configuration and operation of the Celerra. System requirements Table 1 on page 5 describes the Celerra Network Server software, hardware, network, and storage configurations. Table 1 Security system requirements Software Celerra Network Server version 6.0 Hardware No specific hardware requirements Network No specific network requirements Storage No specific storage requirements Cautions and warnings If any of this information is unclear, contact your EMC Customer Support Representative for assistance. If you do not change the default passwords during installation, you should change them as soon as possible. User interface choices The Celerra Network Server offers flexibility in managing networked storage that is based on your support environment and interface preferences. This document describes how to configure security features by using the command line interface (CLI). You can also perform many of these tasks by using the EMC Unisphere™ software. The Unisphere online help contains additional information about managing your Celerra. The Celerra Network Server Release Notes contain additional, late-breaking information about Celerra management applications. Celerra Security Configuration Guide Release 6.0 5 of 102 Terminology The Celerra Glossary provides a complete list of Celerra terminology. access control entry (ACE): In a Microsoft Windows environment, an element of an access control list (ACL). This element defines access rights to a file for a user or group. access control list (ACL): A list of access control entries (ACEs) that provide information about the users and groups allowed access to an object. access policy: The policy that defines what access control methods (NFS permissions and/or Windows ACLs) are enforced when a user accesses a file on a Celerra system in an environment configured to provide multiprotocol access to some file systems. The access policy is set with the server_mount command and also determines what actions a user can perform against a file or directory. authentication: The process for verifying the identity of a user trying to access a resource or object, such as a file or a directory. Certificate Authority (CA): A trusted third party that digitally signs public key certificates. Certificate Authority Certificate: A digitally signed association between an identity (a Certificate Authority) and a public key to be used by the host to verify digital signatures on Public Key Certificates. command line interface (CLI): An interface for entering commands through the Control Station to perform tasks that include the management and configuration of the database and Data Movers and the monitoring of statistics for the Celerra cabinet components. Common Internet File System (CIFS): A file-sharing protocol based on the Microsoft Server Message Block (SMB). It allows users to share file systems over the Internet and intranets. Control Station: A hardware and software component of the Celerra Network Server that manages the system and provides an administrative user interface to Celerra components. Data Mover: A Celerra Network Server cabinet component running its own operating system that retrieves files from a storage device and makes them available to a network client. digital certificate: An electronic ID issued by a certificate authority that establishes a user’s credentials. It contains the user’s identity (a hostname), a serial number, expiration dates, a copy of the certificate holder's public key (used for encrypting messages and digital signatures), and a digital signature from the certificate-issuing authority so that a recipient can verify that the certificate is valid. directory server: A server that stores and organizes information about a computer network's users and network resources, and that allows network administrators to manage users' access to the resources. X.500 is the best-known open directory service. Proprietary directory services include Microsoft’s Active Directory. Hypertext Transfer Protocol (HTTP): The communications protocol used to connect to servers on the World Wide Web. Hypertext Transfer Protocol Secure (HTTPS): HTTP over SSL. All network traffic between the client and server system is encrypted. In addition, there is the option to 6 of 102 Release 6.0 Celerra Security Configuration Guide verify server and client identities. Typically server identities are verified and client identities are not. Kerberos: An authentication, data integrity, and data privacy encryption mechanism used to encode authentication information. Kerberos coexists with NTLM (Netlogon services) and, using secret-key cryptography, provides authentication for client/server applications. LDAP-based directory: A directory server that provides access by LDAP. Examples of LDAP-based directory servers include OpenLDAP or iPlanet (also known as Sun Java System Directory Server and Sun ONE Directory Server). Lightweight Directory Access Protocol (LDAP): An industry-standard information access protocol that runs directly over TCP/IP. It is the primary access protocol for Active Directory and LDAP-based directory servers. LDAP Version 3 is defined by a set of Proposed Standard documents in Internet Engineering Task Force (IETF) RFC 2251. Network File System (NFS): A distributed file system providing transparent access to remote file systems. NFS allows all network systems to share a single copy of a directory. OpenLDAP: The open source implementation of an LDAP-based directory service. persona: A means of providing an identity for a Data Mover as either a server or a client through a private key and associated public key certificate. Each persona can maintain up to two sets of keys (current and next), to allow for the generation of new keys and certificates prior to the expiration of the current certificate. Public Key Infrastructure (PKI): A means of managing private keys and associated public key certificates for use in Public Key Cryptography. Simple Network Management Protocol (SNMP): Method