No relevant resource is found in the selected language.
Enterprise
Worldwide
Search
Support Documentation
Atlas 900 Compute Node iBMC (V3.01.00.00 or Later) User Guide 09
Rate and give feedback:
Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).
Security Mgmt

Security Mgmt

Function Description

On the Security Configuration page, you can perform the following operations:

  • View and configure user security hardening rules for iBMC users.
  • View and manage the permissions of local iBMC users.

GUI

Choose User and Security > Security Mgmt.

The page shown in Figure 3-42, Figure 3-43, Figure 3-44, and Figure 3-45 is displayed.

Figure 3-42 Security Mgmt
Figure 3-43 Login Rules
Figure 3-44 Rights Management
Figure 3-45 Login Security Banner

Parameter Description

Table 3-51 Security

Parameter

Description

System Lock

iBMC system lock mode, which can be enabled or disabled.

By default, this parameter is disabled.

After this parameter is enabled, only the following operations are allowed:

  • Power on or off the server.
  • Turn on or off the UID indicator or a drive indicator; or make the indicator blinking.
  • Use the HTML5 or Java Integrated Remote Console.
  • Use virtual media.
  • Test the syslog, SNMP, and SMTP functions and simulate alarms.
NOTE:

This parameter is available only in the advanced iBMC edition under the license control. Only the system administrator have rights to set it.

OS User Management

Function of user management on the service system.

If this function is enabled, the service system can send user management commands, such as adding or deleting users, user roles, and passwords, to manage iBMC users.

It is enabled by default.

  • If it is enabled, the service side can manage the iBMC users.
  • If it is disabled, the service side cannot manage the iBMC users.

For security purposes, set this parameter to Disable.

Password Check

Password check verifies whether the passwords meet complexity requirements. It is enabled by default.

The password check function is enabled by default. The check includes:
  • Complexity check of local user passwords, trap community names, SNMPv1/v2c community names, SNMPv3 encryption passwords, and VNC passwords.
  • Minimum length check of local user passwords and SNMPv3 encryption passwords.
NOTE:
  • For security purposes, enable password check.
  • If weak password check is enabled, the password cannot be the same as the passwords contained in the weak password dictionary. (You can run the ipmcset -t user -d weakpwddic -v export command to export the weak passwords from the weak password dictionary.)

SSH Password Authentication

SSH password authentication allows users to log in to the iBMC over SSH by using the password or public key.

  • Disable: allows users to log in over SSH by using only public keys.
  • Enable: allows users to log in over SSH by using passwords or public keys.

It is enabled by default.

TLS Versions

TLS protocol version used to ensure data security and integrity during communication between two applications.

TLS can be enabled to ensure a secure connection between a web browser and a web server.

  • TLS 1.2 or later: TLS 1.2 or 1.3 is supported.
  • TLS 1.3 only: Only TLS 1.3 is supported.
NOTE:
  • If only TLS 1.3 is enabled, two-factor authentication cannot be enabled.
  • If only TLS 1.3 is enabled, AdoptOpenJDK 11 must be used to access the Java Integrated Remote Console.
  • If selected, the TLS version infomation effective only the iBMC is restarted.

Password Validity (days)

Validity period (in days) of a user password.

Value range: 0 to 365

The value 0 indicates that the password never expires.

Default value: 0

NOTE:

For security purposes, set a proper password validity period and change the password periodically.

Minimum Password Length

Minimum length of the local user password or SNMPv3 encryption password.

This parameter is valid only when the password check function is enabled.

Value range: 8 to 20

Default value: 8

Minimum Password Age (days)

Minimum time (in days) for which the password must be used. The password cannot be changed during this period.

Value range: 0 to 365

The value 0 indicates that the passwords do not have a minimum password age.

Default value: 0

NOTE:

The minimum password age must be at least ten days earlier than the password expiration day.

  • If Password Expiration (Days) is 10 or less, Minimum Password Age (Days) can only be 0.
  • If Minimum Password Age (Days) is 355 or more, Password Expiration (Days) can only be 0.

Inactive Timelimit (days)

Maximum idle period (in days) after which the user account will be disabled.

Value:

  • 0
  • 30 to 365

The value 0 indicates unlimited time, that is, idle user accounts will never be disabled.

Default value: 0

Emergency Login User

User name for logging in to the iBMC in emergencies.

This user is not restricted by any login rules or login interfaces, and the password of this user will never expire.

NOTE:
  • Only an administrator can be set as the emergency login user.
  • The emergency login user is visible only to the administrator.

Previous Passwords Disallowed

Number of previous passwords that cannot be reused as a new password.

Value range: 0 to 5

The value 0 indicates that all previous passwords are allowed.

Default value: 5

User Lockout Policy

Maximum number of consecutive invalid login attempts allowed and the account locking duration.

  • The maximum number of consecutive invalid login attempts allowed is an integer ranging from 1 to 6 or Unlimited (account locking disabled), and the default value is 5.
  • The account locking duration (in minutes) is an integer ranging from 1 to 30, and the default value is 5.

After a user account is locked, the user can attempt to log in only after the account locking duration expires.

NOTE:
  • For security purposes, enable the account lock function.
  • To unlock a user account in emergencies, run the unlock command on the CLI. For details, see the iBMC User Guide of the server.

Certificate Expiry Notification (days)

Number of days in advance users are notified that the iBMC certificates are about to expire. For example, if it is set to 7, an alarm will be reported when the certificate expiry time is less than or equal to 7 days.

Value range: 7 to 180

Default value: 90
Table 3-52 Login Rules

Parameter

Description

Time

Time period in which users are allowed to log in.

The value can be in one of the following formats:

  • YYYY-MM-DD:

    Example value: 2013-08-30 to 2013-12-30

  • HH:MM:

    Example value: 08:30 to 20:30

  • YYYY-MM-DD HH:MM:

    Example value: 2013-08-30 08:30 to 2013-12-30 20:30

NOTE:
  • The time must be between 1970 and 2050.
  • The start and end time for a login rule must be in the same format.

IP

IP address or IP address range allowed for login. The value can be in one of the following formats:

  • IPv4 (xxx.xxx.xxx.xxx) address: indicates an IP address.
  • IPv4/subnet mask (xxx.xxx.xxx.xxx/mask): indicates an IP address segment.

MAC

MAC address or MAC address range allowed for login. The value can be in one of the following formats:

  • xx:xx:xx:xx:xx:xx: indicates a MAC address.
  • xx:xx:xx: indicates a MAC address segment.
Table 3-53 Rights Management

Parameter

Description

Administrator

User who can perform all operations.

The permissions of Administrator cannot be changed.

Operator

User who can perform basic management, KVM management, VMM management, and power control, query information, and configure their own passwords.

The permissions of Operator cannot be changed.

Common User

User who can query information and configure their own passwords.

The permissions of Common User cannot be changed.

Custom Role 1 to 4

User who can perform the specified operations.

User Mgmt

Perform user and password configuration.

User Mgmt includes the following:

  • Configuration of local, online, LDAP, and Kerberos users
  • Configuration of two-factor authentication and SSH password authentication
  • License management and rights management
  • SNMPv1/v2c/v3 configuration
  • OS user management
  • Switch from the KVM/VMM page to the Online Users page
  • Restoration of factory settings

Basic Mgmt

Perform basic configuration of server out-of-band management.

Basic Mgmt includes the following:

  • Configuration of product information
  • Performance monitoring
  • Storage management, network configuration, firmware update, and language management
  • NTP & time zone settings
  • Smart cooling
  • Alarm and event management
  • Web session mode and timeout period settings
  • Alarm settings (SMTP/trap settings)

Remote Console
  • Perform remote server management using the HTML5 or Java integrated remote console, independent remote console, or VNC client.
  • Set the KVM timeout period, communication encryption, local KVM, persistent virtual keyboard and mouse, maximum number of sessions, and number of active sessions
  • Set the VNC timeout period, keyboard layout, VNC password, login rules, and SSL encryption
  • Configure the serial port redirection

VMM
  • Set the VMM communication encryption and forcibly disconnect sessions
  • Use virtual media

Security Mgmt

Perform configuration and query of security features.

Security Mgmt includes the following:

  • Operation log management
  • Security log management
  • Security enhancement settings
  • Configuration of login rules
  • Login security banner configuration
  • Port service management
  • Web service management (setting HTTP and port, HTTPS and port, and server certificates)
  • KVM settings (enabling or disabling the KVM and setting the KVM port)
  • VMM settings (enabling or disabling the VMM and setting the VMM port)
  • VNC settings (enabling or disabling the VNC and setting the VNC port)
  • SNMP settings (enabling or disabling the NMP and setting the NMP port)
  • Alarm settings (syslog settings)
  • One-click information collection

Power Control
  • PSU settings
  • Power capping settings
  • Power-on and power-off of the server
  • CPU adjustment

Diagnostics

Perform fault locating and commissioning operations.

Diagnostics includes the following:

  • FDM
  • System log management
  • Access to the maintenance and commissioning interface
  • Sensor simulation
  • Configuration of automatic video recording
  • Manual and automatic screenshots
  • Serial port data
  • Black box

Query

Query information excepting security settings, diagnostics, two-factor authentication settings, online user settings, and system information.

Own password & SSH

Configure their own passwords and manage the SSH public key, SNMPv3 encryption password, and SNMPv3 encryption and authentication algorithms.

System default users have this permission by default. Custom users can be assigned with this permission.
Table 3-54 Login Security Banner

Parameter

Description

Security Banner

Login security banner, which can be enabled or disabled.

If it is set to , security information configured here will be displayed on the iBMC login page.

It is enabled by default.

Security Banner Text

Security banner text to be displayed on the login page.

Value: a string of up to 1024 characters.

Enabling the Security Hardening Function

  1. Set parameters as required. For details about the parameters, see Table 3-51.
  2. Click Save.

Configuring Login Rules

The iBMC supports up to three login rules. Users who comply with any one of the three rules can log in to the iBMC.

A login rule is effective for local users, LDAP groups, SNMPv3 services or interfaces of CLI(SSH), KVM_VMM, RMCP, and Redfish interfaces only when it meets the following two conditions:

  • The login rule is configured and enabled in the Login Rules area.
  • The login rule is selected in the configuration area.
  • If a login rule is empty and the rule status is enabled and saved, there is no login restrictions.
  • If the login rule text box is empty, there is no login rule restriction.
  1. In the Login Rules area, click Edit in the Operation column.
  2. Set the rule status to .
  3. Set the login rules. For details about the parameters, see Table 3-52.
  4. Click Save.

Setting the Login Security Banner

  1. On the Login Security Banner tab page, set Security Banner to .
  2. Enter the security information in the security banner text box.
  3. Click Save.

Restoring the Default Login Security Banner

  1. On the Login Security Banner tab page, set Security Banner to .
  2. Click Restore Defaults.
  3. Click Save.
Translation
简体中文
Download
Updated: 2023-08-04

Document ID: EDOC1100152759

Views: 271247

Downloads: 101

Average rating:
This Document Applies to these Products

Related Version

Related Documents

Digital Signature File

Digital Signature Authentication Mode
Share
Previous Next

Copyright © 2023 Huawei Technologies Co., Ltd. All rights reserved.

You are going to visit :