Rev X 341. Table 111. Access Levels and Descriptions

Transcription

1 Rev X 341 Multiple levels of security give personnel the level of access appropriate for the tasks they routinely perform while securing critical settings from unauthorized access. Access Levels Passwords provide access security for six distinct functional access areas: Read, Control, Operator, Settings, Design, and Administrator (Admin). Each functional area can be assigned a unique password or one password can be assigned to multiple areas. Functional areas are not independent of one another. For example, an Admin password is used to access levels 6, 5, 4, 3, 2, and 1; a Design password is used to access levels 5, 4, 3, 2, and 1. Table 111 lists the access levels and descriptions. Access Level Table 111. Access Levels and Descriptions Description 6 - Admin (highest) Create, edit, and delete users and device security. 5 - Design Create or change programmable logic and reboot device. 4 - Settings Change all settings values. Logic equations cannot be created or changed. 3 - Operator Set date and time, reset accumulated metering values, and erase event data. 2 - Control Operate real-time controls. 1 - Read Read all system parameters. No changes or operation allowed. 0 - None All access denied. Additional security is provided by controlling the functional areas that can be accessed through a particular communication port. For example, security can be configured so that front panel access is permitted at a lower access level than BESTCOMSPlus or Modbus access. The communication ports and password parameters act as a two-dimensional control to limit changes. The entered password must be correct and the command must be entered through a valid port. Only one port at a time can be in use with higher than Read access. For example, if a user gains Settings access at the front-panel USB port, users at other areas (rear Ethernet and front panel) will be able to gain Read access only after the user with Settings access at the front-panel USB port disconnects from the device. Read access is always allowed for all simultaneous users with access level 1 or higher. If a port holding higher than Read access sees no activity for the duration of the Access Timeout setting, access privileges will automatically be lowered to Read access. This feature ensures that password protection cannot be accidentally left in a state where access privileges are enabled for one area and other areas locked out for an indefinite period. Username Setup 1. Use the Settings Explorer in BESTCOMSPlus to select Username Setup under General Settings, Device Setup. The Login dialog box appears. See Figure 263. An administrator access level is required to set up usernames and passwords. Figure 263. Login Screen

2 Rev X 2. Enter the username and password of the administrator and then click the Log In button. The default Administrator username is A and the default Password is A. 3. Only an administrator can modify usernames and passwords on the Username Setup screen (Figure 264). Complex usernames and passwords up to 16 characters in length are accepted. Acceptable characters include uppercase letters, lowercase letters, numbers, and certain special characters. Figure 264. Username Setup Screen 4. In the left-hand column, highlight any username labeled NOT ASSIGNED or highlight a specific username to change it. 5. On the right side of the screen, enter a username. 6. Enter a password for the user. 7. Re-enter the password to verify it. 8. Using Table 111 as a reference, enter the maximum access level allowed for the user. 9. Enter the number of days to expiration of the password or leave at default (0) for no expiration. 10. Click the Save User button to save to the settings to BESTCOMSPlus memory. 11. Pull down the Communication menu and select Upload to Device. The Login dialog box pops up. An administrator level is required to upload security settings to the device. 12. Enter the username and password of the administrator and then click the Log In button. The default administrator username is A and the default password is A. BESTCOMSPlus notifies you when the upload is successful. Port Access Setup 1. Use the Settings Explorer in BESTCOMSPlus to select Port Access Setup under General Settings, Device Setup. The Port List screen is shown in Figure 265. Figure 265. Port List Screen

3 Rev X The Login dialog box pops up. See Figure 263. An administrator access level is required to set up port access. Enter the username and password of the administrator and then click the Log In button. The default administrator username is A and the default Password is A. 3. In the side column, highlight a port to change. 4. On the right side of the screen, use the drop-down menus to select the Unsecured Access Level and Secured Access Level for the highlighted port. The Unsecured Access Level setting sets the max level of access which can be gained without entering a username/password. The Secured Access Level setting sets the max level of access which can be gained with a password. Caution Setting the Secured Access Level to None on any port will make that port unusable. If the Secured Access Level is set to None on all available ports, the must be returned to Basler Electric for repair. 5. Click the Save Port button to save to the settings to BESTCOMSPlus memory. 6. Pull down the Communication menu and select Upload to Device. The Login dialog box pops up. An administrator level is required to upload security to the device. 7. Enter the username and password of the administrator and then click the Log In button. The default administrator username is A and the default password is A. BESTCOMSPlus notifies you when the upload is successful. Access Control The Access Timeout setting defines the amount of time before access expires. The timer resets every time a setting is changed. If a username or password is entered incorrectly more than x times (Login Attempts) in y seconds (Login Time Window), then access is prohibited for z seconds (Login Lockout Time). When the HMI Login Required Reset setting is disabled, target and alarm reset can be set outside of security control, allowing reset without logging in. The BESTCOMSPlus Access Control screen is illustrated in Figure 266. Settings are listed in Table 112. Figure 266. Access Control Screen

4 Rev X Table 112. Settings for Access Control Setting Range Increment Unit Default Access Timeout Delay 10 to 3,600 1 seconds 300 Login Failure Login Attempts 1 to 10 1 units 1 Login Failure Login Time Window 1 to 99,999 1 seconds 1 Login Failure Lockout Time 1 to 99,999 1 seconds 1 HMI Login Required - Alarm Reset Enabled or Disabled n/a n/a Enabled HMI Login Required - Target Reset Enabled or Disabled n/a n/a Enabled 1. Use the Settings Explorer in BESTCOMSPlus to select Access Control under General Settings, Device Setup. The Access Control screen is shown in Figure Configure the Access Timeout and Login Failure settings. 3. Pull down the Communication menu and select Upload to Device. The Login dialog box pops up. An administrator level is required to upload security to the device. 4. Enter the username and password of the administrator and then click the Log In button. The default administrator username is A and the default password is A. BESTCOMSPlus notifies you when the upload is successful. Viewing the Log BESTCOMSPlus Navigation Path: Metering Explorer, Reports, Log HMI Navigation Path: Not available through the front panel The records information about user logins including the port used to log in, the access level granted, the type of action performed, and the time of logout and creates security logs. A log will also be triggered when a user attempts to log in, but fails due to an invalid username or incorrect password. A maximum of 200 entries are stored in nonvolatile memory. When a new entry is generated, the discards the oldest of the 200 entries and replaces it with a new one. Use the Metering Explorer to open the Reports, Log screen. If an active connection to a is present, the security log will automatically download. Using the Options button, you can copy, print, or save the security log. The Refresh button is used to refresh/update the security log. The Clear button clears the security log. The Toggle Sorting button enables sorting. Click on a column header to sort. See Figure 267. Figure 267. Log

5 Rev X 345 Authenticity and Encryption The supports authentication and encryption of communications with BESTCOMSPlus. This is done using the Transport Layer protocol, version 1.2 (TLS 1.2). To enable this mode, an X.509 certificate and private key must be uploaded to the. In TLS 1.2, a certificate is used to verify the authenticity of the server (). The supported certificate formats are Standard PEM, DER/Binary, and PFX (PKCS#12). The supports RSA encryption up to 8192 bit keys. The recommended key length is 2048 as longer keys will slow the initial connection. DER and PEM formats commonly have the private key stored in a separate file. If this is the case, you will be asked for an additional file containing the key. If a password is required for the key, you will also need to enter it into the form. It is recommended that certificates be uploaded over a trusted connection or through the USB port. Generate a Certificate BESTCOMSPlus is used to generate a self-signed X.509 certificate for use in identifying a connected device. In order for the certificate to work, the common name must match the domain name or the IP address of the device. Alternate names can be used if multiple domain names match the device. The valid dates specify how long the certificate may be used. A new certificate should be issued after one expires. To generate a certificate, click on the Tools drop-down menu in BESTCOMSPlus and select Generate Certificate. Fill in all applicable fields. A password is optional. Click Save to generate a.pfx file which is the certificate and the private key required to upload to the. Self-signed certificates can be less secure than using a Certificate Authority to sign the certificate for the device. It will allow encryption from end to end. Use caution when choosing this method. Distribution of the generated file compromises security.

6 Rev X Upload a Certificate to the Device Figure 268. Generate Certificate Screen To upload a security certificate, click on the Communication drop-down menu in BESTCOMSPlus and select Certificate > Upload Certificate to Device. Then, select the certificate type, browse for the certificate file, and click the Upload button. See Figure 269.

7 Rev X 347 Remove a Certificate from the Device Figure 269. Upload Certificate Screen To remove a security certificate, click on the Communication drop-down menu in BESTCOMSPlus and select Certificate > Remove Certificate from Device. Authenticate a Certificate Two methods for authenticating certificates are available. In the first method, a built-in Windows mechanism verifies that the certificate chain is signed by a trusted root certificate authority. If you upload a certificate chain to the with a root trusted by Windows, it will automatically authenticate and connect. If it is not trusted, there is a second option to manually accept the certificate. All information about the certificate is displayed. The certificate can be accepted once (temporarily) or permanently. See Figure 270. If the certificate changes in any way, the prompt to manually accept the certificate is shown again.

8 Rev X Figure 270. Error Screen A lock symbol in the lower status bar of BESTCOMSPlus means the connection is secure. Remove Accepted Device To remove a previously accepted device, click on the Tools drop-down menu in BESTCOMSPlus and select Accepted Certificates. See Figure 271. Figure 271. Accepted Devices