A Security of the DIANE System ASCALE 7000 DPS7000/XT NOV Security REFERENCE 47 A2 02EL 01 DPS7000/XTA NOVASCALE 7000 Security of the DIANE System Security September 2004 BULL CEDOC 357 AVENUE PATTON B.P.20845 49008 ANGERS CEDEX 01 FRANCE REFERENCE 47 A2 02EL 01 The following copyright notice protects this book under Copyright laws which prohibit such actions as, but not limited to, copying, distributing, modifying, and making derivative works. Copyright Bull SAS 2004 Printed in France Suggestions and criticisms concerning the form, content, and presentation of this book are invited. A form is provided at the end of this book for this purpose. To order additional copies of this book or other Bull Technical Publications, you are invited to use the Ordering Form also provided at the end of this book. Trademarks and Acknowledgements We acknowledge the right of proprietors of trademarks mentioned in this book. Intel® and Itanium® are registered trademarks of Intel Corporation. Windows® and Microsoft® software are registered trademarks of Microsoft Corporation. UNIX® is a registered trademark in the United States of America and other countries licensed exclusively through the Open Group. Linux® is a registered trademark of Linus Torvalds. The information in this document is subject to change without notice. Bull will not be liable for errors contained herein, or for incidental or consequential damages in connection with the use of this material. Preface Preface Purpose This document targets customers requiring information about security issues on the Diane system (DPS7000/XTA). Several aspects of security are dealt with: NTFS permissions, essential services for the smooth running of the system and its maintenance, user groups and accounts, the NetBios share, the use of an antivirus software and the Windows updates. The responses to these different points have been validated in conditions of maximum security. The effect of stopping the various services is described in Windows 2000 Services in Appendix B. 47 A2 02EL iii Security on the DIANE System iv 47 A2 02EL Preface Table of Contents Security on the DIANE System 1 NTFS Permissions ......................................................................................... 1 1.1 Partition C............................................................................................... 1 1.2 Partition E............................................................................................... 1 1.3 Partition F............................................................................................... 2 2 Services Installed on DIANE......................................................................... 2 2.1 Services Used by ESMPRO ................................................................... 2 2.2 Services on the 180Rc4 System ............................................................. 3 2.3 Services for ECC (Emc Control Center). ............................................... 3 2.4 Service for the Emulex V2.20a12 driver................................................ 3 2.5 Service for PowerPath ............................................................................ 3 2.6 Services for Navisphere 6.X................................................................... 4 2.7 WEB Service .......................................................................................... 4 2.8 Microsoft FTP Service............................................................................ 4 2.9 Interop7Adm .......................................................................................... 5 2.10 Navisphere Agent ................................................................................... 5 2.11 NetOp Helper ver. 6.50 (2000271)......................................................... 5 2.12 Telnet...................................................................................................... 5 2.13 V7000 Administration ............................................................................ 5 2.14 V7000 System Control ........................................................................... 5 2.15 Other Services ........................................................................................ 5 47 A2 02EL v Security on the DIANE System 3 User Accounts................................................................................................ 6 3.1 GTS User Account.................................................................................. 6 3.2 IUSR-DIANE-013 User Account (IUSR-<<system name>>) ............... 6 3.3 TsinternetUser User Account.................................................................. 6 3.4 V7000Engine Account ........................................................................... 6 3.5 Administrator User Account................................................................... 7 3.6 IWAM<<system name>> User Account ................................................ 7 4 User Groups................................................................................................... 7 4.1 "Replicator" and "Backup Operator" User Groups ................................ 7 4.2 NetopActivity Groups ............................................................................ 7 5 The NETBIOS Share ..................................................................................... 7 6 Norton Antivirus............................................................................................ 8 6.1 Antivirus choice ..................................................................................... 8 6.2 Methods of use ....................................................................................... 8 6.3 Recommendations for Using Norton Antivirus...................................... 9 6.4 Performance............................................................................................ 9 7 Operational Security of Gcos Files:............................................................. 10 8 Windows Updates........................................................................................ 10 9 DCOM / RPC ports used by the V7000 remote administration : case of a firewall usage...................................................................................................... 11 A. Table of Services B. Windows 2000 Services B.1 Introduction............................................................................................ B-1 B.2 Windows 2000 Services......................................................................... B-2 vi 47 A2 02EL Security on the DIANE System 1 NTFS Permissions 1.1 Partition C • The ESM and DMI directories are used by ESMPRO. They are created using the standard product installation procedure. • For the DRIVERS directory, access rights can be granted only to the administrator group and the V7000BULLSERVICES group. They should have Full Control. • For the fix_manufacturing directory, access rights can be granted only to the administrator group and the V7000BULLSERVICES group. They should have Full Control. 1.2 Partition E • Protection of GCOS7 disks is validated from the GCOS_DISK directory that is placed after the mount point in order to allow the use of disk space not allocated to GCOS7 disks (customer request). • Partition E: can be protected. But with modify/write permission for the V7000BULLSERVICES group: − Administrator -> Full control − EveryOne -> List folder contents / Read − V7000BullServices -> Modify/Write In this case, you must use the Windows 2000 "Disk Manager" to set up the same permissions on the volumes (external disk mount points) because there is no permission inheritance at this level. 47 A2 02EL 1 Security on the DIANE System Note: Implementing this protection excludes the use of disk space not allocated to gcos 7 by other users and applications. 1.3 Partition F Scratch partition: Full control for everyone. 2 Services Installed on DIANE The following services are used by the Diane system. (The logons for these services must not be modified) 2.1 Services Used by ESMPRO The following services are used by ESMPRO (monitoring and event notification linked to hardware status - the equivalent of the remote alarm on Artemis systems). Do not remove these services. Alert Manager ALIVE(S) Service Alert Manager Main Service Alert Manager Socket(S) Service ESM Common Service ESM DMI Component Provider Service ESM Storage Service ESM System Management Service ESMFSService ESMLANService WIN32SL 2 47 A2 02EL Security on the DIANE System 2.2 Services on the 180Rc4 System The following services are present on a 180Rc4 system with Director Agent. Do not remove these services. Director Remote Control Service Director Support Program IBM Active PCI Alert Service IBM Advanced System Management Remote Mouse TME10RC 2.3 Services for ECC (Emc Control Center). Do not remove these services. EMC Control Center Master Agent EMC storapid EMC symapisrvEMC - Executes remote WideSky API functions over TCP/IP connectionsSymmetrix Integration Utilities Provides support for volume locking functionality 2.4 Service for the Emulex V2.20a12 driver Do not remove this service. Emulex HBAnyware Remote Management 2.5 Service for PowerPath Do not remove this service. EMC PowerPath Service 3.0.2 47 A2 02EL 3 Security on the DIANE System 2.6 Services for Navisphere 6.X Do not remove these services. NaviGovernor Navisphere Agent IIS Admin Service 2.7 WEB Service The interop7 installation places the interop client modules in the Diane Web pages in order to make it easier to download them