EMC ControlCenter Navisphere Security ADMINISTRATOR S GUIDE. Version 6.X P/N REV A04

Transcription

1 EMC ControlCenter Navisphere Security Version 6.X ADMINISTRATOR S GUIDE P/N REV A04 EMC Corporation Corporate Headquarters: Hopkinton, MA (800) 424-EMC2

2 Copyright 2002, 2003 EMC Corporation. All rights reserved. Published February, 2003 EMC believes the information in this publication is accurate as of its publication date. The information is subject to change without notice. THE INFORMATION IN THIS PUBLICATION IS PROVIDED "AS IS." EMC CORPORATION MAKES NO REPRESENTATIONS OR WARRANTIES OF ANY KIND WITH RESPECT TO THE INFORMATION IN THIS PUBLICATION, AND SPECIFICALLY DISCLAIMS IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Use, copying, and distribution of any EMC software described in this publication requires an applicable software license. Trademark Information EMC 2, EMC, CLARiiON, and Navisphere are registered trademarks and Access Logix, ControlCenter, MirrorView, PowerPath, SAN Copy, and SnapView are trademarks of EMC Corporation. All other trademarks used herein are the property of their respective owners. ii EMC ControlCenter Navisphere Security Version 6.X Administrator s Guide

3 Contents Preface... v Chapter 1 Chapter 2 About Navisphere Security About This Manual Finding Current Information Terminology Introducing Navisphere Manager 6.X Security Authentication Authorization Privacy Audit Navisphere Manager 6.X Security Benefits Centralized User Account Management Single Login Strong Encryption Intrusion Protection Navisphere Management Environments Storage Management Software Using Navisphere 6.X With Storage Systems That Do Not Have Storage Management Server Software Planning for Security: Domains and User Accounts About Security Initialization States About Domains and User Accounts Initial Global Administrator Account Usernames and Passwords Domain High Availability Features Guidelines for Using Global and Local Accounts EMC ControlCenter Navisphere Security Version 6.X Administrator s Guide iii

4 Contents Security Planning Worksheets Domain Worksheets Portal Worksheet Global Account Worksheet Local Account Worksheet Chapter 3 Appendix A Appendix B Setting Up and Maintaining Your Security System Starting a Manager Session Adding or Modifying a Domain Selecting or Changing a Master Node Configuring the Domain Removing a Storage System from a Domain Removing a Domain Adding, Modifying, or Deleting User Accounts Changing a Password Moving a Storage System to a Different Domain Comparing Manager 6.X and Manager 5.x Security Manager 5.x vs. Manager 6.X Security... A-2 Authentication... A-2 Authorization... A-3 Privacy... A-4 Audit... A-5 Network Configurations Configuring Networks for Additional Security... B-2 Index... i-1 iv EMC ControlCenter Navisphere Security Version 6.X Administrator s Guide

5 Preface How This Manual Is Organized This manual describes how to set up domains and use the security features of EMC ControlCenter Navisphere Manager 6.X. You should read this manual if you are a system administrator who is responsible for EMC Navisphere security. Chapter 1 Chapter 2 Chapter 3 Introduces EMC security terms and features. Describes security states, domains, and user accounts, and ends with worksheets you can use to plan your security structure. Lists the steps needed to create domains and user accounts and to move a storage system from one domain to another. Appendix A Compares the security functions of Navisphere 5.X and Navisphere 6.X. Appendix B Describes security policies that require special network configurations. EMC ControlCenter Navisphere Security Version 6.X Administrator s Guide v

6 Preface Related Manuals EMC ControlCenter Navisphere Manager 6.X Administrator s Guide (P/N ) EMC Storage Systems CX400-Series and CX600-Series Configuration Planning Guide (P/N ) EMC FC Storage System Configuration Planning Guide (P/N ) EMC FC4700 Storage System Configuration Planning Guide (P/N ) FC Storage System Hardware Reference (P/N ) EMC ControlCenter Navisphere 6.X CLI Reference (P/N ) Conventions Used in This Manual This manual uses the following format conventions: This type Indicates text (including punctuation) that you type verbatim, all commands, pathnames, and filenames, and directory names. This type Represents a variable; an item for which you substitute a valid value. This type or Represents a system response (such as a message or This type prompt), a file or program listing. [ ] Encloses optional entries. Do not type the brackets. x y Represents a menu path. For example, Change Parameters Change Storage System Parameters tells you to select the Change Parameters item from the menu that appears, and then select the Change Storage System Parameters item from the next menu that appears. vi EMC ControlCenter Navisphere Security Version 6.X Administrator s Guide

7 Preface Where to Get Help For questions about technical support and service, contact your service provider. If you have a valid EMC service contract, contact EMC Customer Service at: United States: (800) (SVC-4EMC) Canada: (800) (543-4SVC) Worldwide: (508) Follow the voice menu prompts to open a service call, then select CLARiiON Product Support. Sales and Customer Service Contacts Your Comments For the list of EMC sales locations, please access the EMC home page at: For additional information on the EMC products and services available to customers and partners, refer to the EMC Powerlink Web site at: Your suggestions will help us continue to improve the accuracy, organization, and overall quality of the user publications. Please send a message to techpub_comments@emc.com with your opinions of this guide. EMC ControlCenter Navisphere Security Version 6.X Administrator s Guide vii

8 Preface viii EMC ControlCenter Navisphere Security Version 6.X Administrator s Guide

9 Invisible Body Tag 1 About Navisphere Security The EMC ControlCenter Navisphere Manager 6.X security mechanism provides simple and flexible yet robust and effective methods for setting up secure domains and management accounts. This chapter includes the following major sections: Terminology Introducing Navisphere Manager 6.X Security Navisphere Manager 6.X Security Benefits Navisphere Management Environments About Navisphere Security 1-1

10 About Navisphere Security About This Manual This manual describes the tasks for setting up, configuring, and managing domains and user accounts using EMC ControlCenter Navisphere 6.X Manager. Each major section includes introductory information and a general procedure for completing a task. This manual is not intended for use during the actual setup, configuration, and management of storage systems so the steps in the procedures purposely do not include screen captures of the dialog boxes. The introductory information and detailed steps for each procedure appear in the Navisphere Manager online help so you have the complete information available when you actually set up, configure, and manage storage systems, should you require help. Finding Current Information To ensure that you have the most up-to-date information about the EMC ControlCenter Navisphere Manager software, EMC posts the release notes for this software on the EMC Powerlink website. We recommend that you download a copy of the release notes before you start the Manager software. Accessing EMC Powerlink To access EMC Powerlink, use the following link: After you log in, select Support (or Services) Document Library CLARiiON CLARiiON Fibre Channel Storage CLARiiON FC Software, and find the following release notes: EMC ControlCenter Navisphere Manager 6.X Release Notes 1-2 EMC ControlCenter Navisphere Security Version 6.X Administrator s Guide

11 About Navisphere Security Terminology Table 1-1 Navisphere 6.X Terms That Relate to Security Term administrator (role) client CX-Series, FC4700- Series storage systems domain global account local account Manager Monitor (role) node pre-fc4700-series storage system portal provider Description A person with privileges to access all administrative and management interfaces and data; to change a user's role; and to add or delete user accounts and storage systems from the domain. A global administrator can add, delete, or modify domain and global information. A local administrator can add, delete, or modify local user accounts. A host (computer or laptop) that has an internet browser and connects to a storage application server via network. You use it to manage connected storage systems. CX-Series and FC4700-Series storage systems only. In the context of EMC ControlCenter Navisphere 6.X, a group of storage systems and/or portal servers that you can manage from a single management application session. You can divide the storage systems into multiple domains as long as each storage system or portal is in only one domain. A type of user account used for storage-system management. A global account has access to all storage systems in the domain. A type of user account used for storage-system management.a local account has access only to the storage system on which the account creator was logged in when he or she created it. Either the Navisphere Manager application graphical user interface (GUI) or, in a security role, a person with privileges to view all management server data and perform all storage-system operations (such as binding LUNs), but who cannot add, modify, or delete user or domain information. A person with privileges to view all storage-system data, but who cannot add, modify, or delete information in the domain. Usually a server (HBA connection) or storage system (SP connection). In the context of Navisphere 6.X, a node is an SP in a current storage system. The master node maintains the master copy of global domain information and distributes it to all storage systems in the domain. A portal (see next) can also be a node. A class of storage systems whose SPs do not have a network management connection: FC4500, FC5300, FC5500, and FC5700 storage systems. A server or storage system through which you manage one or more storage systems using Navisphere 6.X. Generally the managed systems are legacy systems such as FC4500s and FC5300s. Software that runs in the storage application server and provides management or monitor features. Terminology 1-3

12 About Navisphere Security Table 1-1 Navisphere 6.X Terms That Relate to Security (continued) Term security user role security initialization states states storage application server storage domain storage management server Storage Management Server Software system Description One of several different roles (privilege levels) assigned to storage-system management personnel. Each role can be local to one or more specific storage systems or global to all systems in the domain. For Navisphere security, the pre-defined roles are Administrator, Manager, and Monitor. For security to be effective, at least one global administrator account is required. Usually a system engineer creates this account after the storage system is installed and he or she initializes security. There are three security initialization states in Navisphere 6.X. Uninitialized. This is how storage systems leave the factory. Security initialized. This is an intermediate state. In this state, you can perform configuration commands on the storage system. A global administrator account exists for this system but it is not part of a storage domain. Initialized. A storage system in this state is fully configured and part of a storage domain. Configuration access is completely restricted to authorized users. These states have meaning only in relation to global accounts. Local accounts remain valid until you explicitly delete them. see security initialization states. A storage system that has both the Navisphere Manager GUI and Storage Management Server software. You can log into it and manage other storage systems in the same domain. See domain. A storage-system SP that has Storage Management Server software but not the Navisphere Manager GUI installed. Software that runs in a storage system or portal server and lets a person manage it over a network. See storage management server. 1-4 EMC ControlCenter Navisphere Security Version 6.X Administrator s Guide

13 About Navisphere Security Introducing Navisphere Manager 6.X Security EMC ControlCenter Navisphere Manager 6.X security consists of four basic functions authentication, authorization, privacy, and audit. The following sections briefly describe how Navisphere 6.X implements these functions. For a more complete description, see Appendix A, Comparing Manager 6.X and Manager 5.x Security. Authentication Navisphere Manager 6.X security uses password-based authentication that is implemented by the Storage Management Server Software installed on each storage system in the domain. You will assign a username and password when you create either global or local user accounts. Global user accounts apply to all storage systems within a domain, while local user accounts apply to a specific storage system. Authorization Manager 6.X security bases authorization on the role associated with the authenticated user. Manager 6.X supports three basic roles administrator, manager and monitor. All users can monitor the status of a storage system. In addition, users with the manager role can configure a storage system, and users with the administrator role can maintain user accounts as well as configure a storage system. Privacy Manager 6.X security encrypts all data that passes between the browser and a storage management server as well as data that passes between storage management servers. This encryption protects the transferred data whether it is on local LANs behind corporate firewalls, or over the Internet. Audit Manager 6.X maintains an SP event log that contains a time-stamped record for each event. This record includes information such as event code and event description. Manager 6.X also adds time-stamped audit records to the SP event log each time a user logs in or enters a request. These records include information about the request and the requestor. Introducing Navisphere Manager 6.X Security 1-5

14 About Navisphere Security Navisphere Manager 6.X Security Benefits The enhanced security features of Navisphere Manager 6.X provide the following benefits: Centralized user account management Single login Strong encryption Intrusion protection Centralized User Account Management Manager 6.X supports centralized user account management through the use of global user accounts. Centralized user account management lets you manage user accounts from a single location. When you create or change a global user account, or add a new storage system to the domain, Manager 6.X automatically distributes the global account information to all storage systems in the domain. Centralized management provides the following: Allows you to manage a storage system from any browser-equipped client without the need to pre-install any software or hardware. Gives geographically dispersed data centers more flexibility in scheduling staff to manage the sites at the required times. Single Login Single login lets users access any storage system in a managed domain through a single authentication. They do not need to reenter their usernames and passwords each time they access a different storage system. Manager 6.X supports single login for the same manager session by: Distributing global user account information to all storage management servers in the domain. Caching the last-entered username and password and using the inherent authentication capabilities of HTTP. Once cached, Manager places the username and password in the authentication header of each HTTP request that is sent by the browser, even when the request is targeting a different storage 1-6 EMC ControlCenter Navisphere Security Version 6.X Administrator s Guide

15 About Navisphere Security system. When the new storage system receives the HTTP request, Manager extracts the username and password from the authentication header, and compares them to the locally stored global account information. Since the locally stored global account information is the same for all storage management servers in the management domain, a match exists, and Manager authenticates the request. You now have access to the new storage system. Strong Encryption Manager 6.X security uses strong encryption to protect data passed between the browser and the storage system. The strong encryption keeps sensitive information private on both sides of the corporate firewall by encrypting the data from its origin (the browser) to its destination (the storage system). Manager 6.X security protects transactions that originate outside the corporate infrastructure as well as those that are local. Intrusion Protection Another aspect of Internet security is the vulnerability of the web server. A web server is vulnerable for three reasons. It is a comprehensive application that supports various services. It is widely distributed. It is usually distributed with unobstructed access. To provide support for management from a browser, some web server functionality is built into the Storage Management Server Software. This software limits server services to the very basics necessary for specifically supporting Manager 6.X functionality. The Storage Management Server Software web services are proprietary and distributed only with Navisphere products. As a result, the well-known vulnerabilities of other web severs cannot be exploited. Navisphere Manager 6.X Security Benefits 1-7

16 About Navisphere Security Navisphere Management Environments You can assign each storage system that runs Storage Management Server Software to a storage domain a group of storage systems on an internet or intranet you define using Manager. You can create one or more domains for any installation. Each storage management server can be defined in only one domain. Each domain must have at least one member node ideally at least two for high availability that has Manager installed. Each storage system in the domain is accessible from any other in the domain. Log in to a computer that has an Internet browser and, in the browser window, enter the IP address of a storage-system SP that has Navisphere Manager installed. The security software then prompts you to log in. After logging in, depending on the privileges of your account, you can monitor, manage and define user accounts for any system in the domain. Storage systems outside the domain are not viewable from the domain. The web browser can run on any supported workstation or laptop with a network controller and the required version of the Java Runtime Environment (JRE). See the Release Notes for the required version. The following figure shows an intranet that connects nine storage systems. It shows two domains, a US Division domain with five storage systems (four systems on SANs) and a European Division domain with four storage systems. The 13 servers that use the storage may be connected to the same or a different network, but the intranet shown is the one used to manage the storage systems. 1-8 EMC ControlCenter Navisphere Security Version 6.X Administrator s Guide

17 About Navisphere Security Server Server Server Server Server Server Switch Fabric Switch Fabric Switch Fabric Switch Fabric Server Storage System Storage System Storage System Storage System Storage System Domain 1 - U.S. Division Internet Browser Domain 2 - European Division Internet Storage System Storage System Storage System Storage System Server Server Server Server Server Server EMC2276 Figure 1-1 Storage Domains on the Internet Storage Management Software Storage-system software consists of two pieces: server software and application software. Both are installed in storage-system SPs. The server software provides the basis for domain and storage-system management. Application software - that is, Manager - is downloaded and run within a browser and passes commands to the server software. The server software is called Storage Management Server Software. A storage system running Storage Management Server Software is called a storage management server. A storage system that also includes Manager is called a storage application server. Navisphere Management Environments 1-9

18 About Navisphere Security You can use any storage application server to set up and maintain user accounts for people who will manage and/or monitor storage systems in the domain. You access Manager using an internet browser running on a computer called a client on a network connected to the storage application server. The following figure shows several servers connected to storage systems: one storage system that is a storage application server -- with Manager -- and two storage systems that are just storage management servers. Internet Browser LAN UNIX Server UNIX Server Windows Server Host Agent Host Agent Host Agent Fibre Channel Switch Fabrics SP A and SP B SP A and SP B SP A and SP B Access Logix Access Logix Access Logix Domain SP Agent Storage Management Server Software SP Agent Storage Management Server Software SP Agent Storage Management Server Software Manager 6.X CX-Series or FC4700-Series Storage Systems Management Interface EMC2402 Figure 1-2 Navisphere Management Application and Storage Management Server Storage Systems 1-10 EMC ControlCenter Navisphere Security Version 6.X Administrator s Guide

19 About Navisphere Security Using Navisphere 6.X With Storage Systems That Do Not Have Storage Management Server Software Some storage systems do not run Storage Management Server Software. These storage systems are referred to as legacy storage systems. Examples of legacy storage systems are FC4500s and FC5300s. You can manage legacy storage systems using Navisphere 6.X via a portal. A portal can be a host or storage system with Storage Management Server Software installed. From a security viewpoint, the portal and its subsidiary storage systems are treated as a single node in a domain. Manager 6.X authorization extends to all legacy storage systems being managed via a portal. For example, if a user is defined as having a manager role, then that user has manager role access privileges on all legacy systems being managed by that portal. Any server used as a portal must run Windows 2000 or Windows NT. For more information on portals, see the EMC ControlCenter Navisphere Manager Version 6.X Administrator s Guide, P/N , or the online help. Figure 1-3 shows a three-node domain, with one node composed of an FC5300 and FC4500 storage system (managed through a portal) and other nodes that are CX600 and FC4700 systems, each with Storage Management Server Software. Navisphere Management Environments 1-11

20 About Navisphere Security Windows Server Portal Internet Browser Storage Management Server Software Manager 6.X LAN To UNIX Server Host Agent UNIX Server Host Agent Windows Server Host Agent Fibre Channel Switch Fabrics SP A and SP B SP A and SP B SP A and SP B SP A and SP B Access Logix Access Logix Access Logix Access Logix Domain SP Agent Storage Management Server Software Manager 6.X SP Agent Storage Management Server Software CX-Series* FC4700-Series* FC4500** FC5300** Management network connection * Manageable by any connected internet browser, including one run from the UNIX or Windows servers. **These storage systems are managed via Host Agents through the Windows Server Portal. From the security standpoint, these systems are treated as a single node in a domain. EMC2401 Figure 1-3 What Next? Sample Installation with a Three-Node Domain Including a Windows Portal and Two Storage Systems That Do Not Run Storage Management Server Software Continue to the next chapter to learn about domains and user accounts EMC ControlCenter Navisphere Security Version 6.X Administrator s Guide

21 Invisible Body Tag 2 Planning for Security: Domains and User Accounts This chapter describes the concepts you need to plan and implement efficient and effective security for your storage system installation. Major sections are About Security Initialization States About Domains and User Accounts Security Planning Worksheets Planning for Security: Domains and User Accounts 2-1

22 Planning for Security: Domains and User Accounts About Security Initialization States A storage system can be in any of three security initialization states: uninitialized security initialized initialized The following table explains these states. Table 2-1 Security Initialization States State Details When active Uninitialized The storage system does not belong to any domain. A storage system is in this No global users are defined. state when it leaves the The system is very vulnerable in this state since all factory. configuration requests are processed without any A system returns to this security checks. state when removed from Systems should be in the uninitialized state during a domain. configuration or reconfiguration only. Security Initialized In this state a global user exists and can log into and configure the storage system. This state offers some protection as other users cannot directly log into the system and perform unauthorized operations. The system is ready to be added to an existing or new domain. Systems are in this state right after security is initialized. They remain in this state until they are added to a domain. How to get to next state Create a global user account. Add the storage system to a domain. Initialized Since the system can be imported into any existing domain, it is somewhat vulnerable. The system should be added to a domain as soon as possible to be protected. In this state the system is a member of a domain and fully protected. Any user who can log in to any storage system in the domain can manage and/or monitor this system (depending on the person s role: administrator, manager, or monitor). This is the normal state for configured systems. You can return a system to the Uninitialized state by removing it from its domain. This removes all global user accounts and makes the system fully accessible to anybody until it has been initialized again. Systems are in this state after security is initialized and they are members of a domain. 2-2 EMC ControlCenter Navisphere Security Version 6.X Administrator s Guide

23 Planning for Security: Domains and User Accounts About Domains and User Accounts A domain is a group of one or more storage systems with Storage Management Server Software whose SPs are connected to a network and which have been assigned to the domain by Manager. Each domain has a master node (master storage system) that maintains the master copy of the domain data the storage systems and global accounts that make up the domain. Setting up a domain allows a group of storage systems to be monitored and managed using a single login. If a storage system is not part of a domain, an administrator can add it to a different domain. Even if you plan to use a storage system by itself (manage it separately), we suggest that you create a domain for that system. A user (that is, someone who needs to view or manage storagesystem operation) can have one of three roles: Administrator Manager Monitor Any access privileges of a user account that apply to a portal storage system also extend to all legacy storage systems managed through the portal. For example, if you define a user with manager role privileges for the portal system, then that user has manager role privileges on all legacy systems being managed via the portal. Table 2-2 User Account Roles and Privileges User Role Administrator Manager Monitor Definition The user can access all administrative and management interfaces and data, can change a user s role, can add or delete users, and depending on the scope of the account can add or delete information from a domain. The user can view all storage system information and perform storage-system operations (such as binding LUNs), but cannot add, modify, or delete user or domain information. The user can view all storage system information, but cannot add, modify, or delete informations from a domain or perform configuration operations such as binding LUNs. About Domains and User Accounts 2-3

24 Planning for Security: Domains and User Accounts Table 2-3 You can assign a user a role globally (the user has the role across all storage systems in the domain) or locally (the user has the role on a specific storage system only). Each global username must be unique in the domain; each local username must be unique within the local management server. If a user has a local account with the same username and password on two storage system in a domain, when that person logs in he or she will see the two storage systems on which the accounts were created. To allow communication, each local user must have an account on a storage system that has Manager installed in addition to any local accounts on other storage systems. The account on the Manager system must have the same username and password (but not necessarily the same role) as any other local accounts. An important benefit of local accounts is that you can assign the same person different privilege levels on different systems. For example, a domain has System A with Manager and System B without Manager. You want Sam to have administrative access to System B only. You can give Sam a local account with monitor access on System A and a local account with administrative privileges on System B. Sam can then log into System A and use its Manager to manage System B. He cannot change System A, since he has only Monitor access. The following table defines the roles. Operations that Users with Different Roles Can Perform Anyone Logged in as Can View Can Add, Modify, or Delete Global administrator Local administrator Global Manager All domain and storage-system settings, and global and local accounts. Note that local accounts on a storage system can be viewed only when one is logged into that storage system. Local management-server storage system settings and local user accounts. All management-server storage-system settings in domain All domain and storage-system settings, and global and local accounts (but cannot delete the last global administrator account) Local storage-system settings and local user accounts All storage-system settings in domain Local Manager Local management-server storage system information Local storage system settings Global Monitor All storage-system settings and accounts in domain. Nothing Local Monitor Local storage-system settings and accounts in domain. Nothing 2-4 EMC ControlCenter Navisphere Security Version 6.X Administrator s Guide

25 Planning for Security: Domains and User Accounts Initial Global Administrator Account After installing Manager on a storage system or server, someone (an EMC engineer or you) creates one or more global administrator accounts, complete with username and password. After being created, at least one global administrator account persists; that is, no one can delete the last remaining global administrator account. Usernames and Passwords Usernames can be 1 to 32 letters (case sensitive), numbers, and/or underscores, and must start with a letter. Passwords can be 1 to 32 letters (case sensitive) and/or numbers. Manager stores all global account information in a secure part of the master node.the software then replicates global data to all management-server storage systems in the domain. Therefore the global security accounts are available on all storage systems. Important If the person who manages a storage-system installation cannot log in as a global administrator (perhaps because he or she forgot the password), then global management of the domain will be impossible. Any local administrators and managers retain their local management privileges. However, EMC support will need to recreate a global administrative account. You should make sure that people who will manage the system keep a good record of this password. Domain High Availability Features All domain and global/account information is replicated to all management servers in the domain, so if a storage system goes off line, the information is retained and other systems in the domain remain accessible. If the storage system that goes off line is the master node, no global updates are allowed until you choose a new master or the storage system comes back on line. About Domains and User Accounts 2-5

26 Planning for Security: Domains and User Accounts Guidelines for Using Global and Local Accounts Global accounts streamline management because their information is copied automatically to all storage systems in the domain. However, you can achieve the same security level by creating a local account, with the same username and password, on all storage systems in the domain. Creating local accounts has the advantage of letting you give access to a subset of the storage systems in the domain; for example, in a domain of four systems, you can give a specific person access to only two. One disadvantage of many local accounts is maintenance: if you want to change a user s role, you must make the change on all pertinent local accounts. Similarly, if you add a storage system to a domain, you must explicitly add the local account. A global account would be replicated automatically to the new storage system. The following figures show two arrangements: one with two domains, each with a global administrator; the other with one domain and two administrators, each administrator controlling four local accounts. For clarity, the figures omit the servers. 2-6 EMC ControlCenter Navisphere Security Version 6.X Administrator s Guide

27 Planning for Security: Domains and User Accounts US Global admin Paul Storage System A US Global admin Paul Storage System B with Manager US Global admin Paul Storage System C Domain 1 - US Division US Global admin Paul Storage System D Domain 2 - European Division Internet Europe Global admin Rene Storage System M Europe Global admin Rene Storage System N with Manager Europe Global admin Rene Storage System O Europe Global admin Rene Storage System P EMC2278 Figure 2-1 Two Domains with Two Global Administrator Accounts US Local admin Paul Storage System A US Local admin Paul Storage System B with Manager Domain US Local admin Paul Storage System C US Local admin Paul Storage System D Europe Local admin Rene Storage System M Europe Local admin Rene Storage System N with Manager Europe Local admin Rene Storage System O Europe Local admin Rene Storage System P Internet Figure 2-2 SIngle Domain with Two Sets of Four Local Administrator Accounts EMC2279 Guidelines for Using Global and Local Accounts 2-7

28 Planning for Security: Domains and User Accounts Security Planning Worksheets The worksheets shown in this section will help you plan your domains and user accounts. Domain Worksheets For each domain you plan, enter the domain name, all storage system names that will be part of the domain, and the node (SP A or SP B) IP address in Table 2-4. A sample completed worksheet for the domains is shown in Table 2-5. After creating a domain, you can rename a storage system or change its IP addresses and have it remain part of the domain. Table 2-4 Domain Worksheet Domain Name Storage System Name Node (SP A or SP B) IP address (you need to specify only one SP per storage system) Domain Name Storage System Name Node (SP A or SP B) IP address (you need to specify only one SP per storage system) 2-8 EMC ControlCenter Navisphere Security Version 6.X Administrator s Guide

29 Planning for Security: Domains and User Accounts Table 2-5 Sample Domain Worksheet Domain Name Storage System Name or Server Portal Hostname Node (SP A or SP B) IP address (you need to specify only one SP per storage system) US_Division Storage_system_A (SP A) Storage_system_B (SP A) w Manager - Master Node Storage_system_C (SP A) Storage_system_D (SP A) Domain Name Storage System Name Node (SP A or SP B) IP address (you need to specify only one SP per storage system) Europe_Division Storage_system_M (SP A) Storage_system_N (SP A) w Manager - Master Node Storage_system_O (SP A) Storage_system_P (SP A) Security Planning Worksheets 2-9

30 Planning for Security: Domains and User Accounts Portal Worksheet Table 2-6 In a domain, a server or storage system can serve as a portal to storage systems that do not run Storage Management Server Software. A blank portal worksheet is shown in Table 2-6. Portal Worksheet Server Portal l IP Address Hostname or IP Address of Server whose Storage Systems will be Managed via Portal 2-10 EMC ControlCenter Navisphere Security Version 6.X Administrator s Guide

31 Planning for Security: Domains and User Accounts Global Account Worksheet Table 2-7 For every global account you plan, enter in Table 2-7 the domain name, the person s username, and the role that he or she will have in the domain. Additional global accounts are optional; you can use the initial global account for all administrative functions if you want. Global Account Worksheet Global Accounts for Domain: Username: Administrator Manager Monitor Username: Administrator Manager Monitor Username: Administrator Manager Monitor Username: Administrator Manager Monitor Local Account Worksheet Table 2-8 For every local account you plan, enter in Table 2-8 the domain name, the person s username, and the role that he or she will have in the domain. Local accounts are optional; you do not need to create any. Local Account Worksheet Local Accounts for Domain: Storage System: Username: Administrator Manager Monitor Username: Administrator Manager Monitor Username: Administrator Manager Monitor Username: Administrator Manager Monitor Storage System: Username: Administrator Manager Monitor Username: Administrator Manager Monitor Username: Administrator Manager Monitor Username: Administrator Manager Monitor Security Planning Worksheets 2-11

32 Planning for Security: Domains and User Accounts 2-12 EMC ControlCenter Navisphere Security Version 6.X Administrator s Guide

33 Invisible Body Tag 3 Setting Up and Maintaining Your Security System This chapter describes tasks involved in setting up your Navisphere security system. Major sections are Starting a Manager Session Adding or Modifying a Domain Removing a Storage System from a Domain Removing a Domain Adding, Modifying, or Deleting User Accounts Moving a Storage System to a Different Domain Setting Up and Maintaining Your Security System 3-1

34 Setting Up and Maintaining Your Security System Starting a Manager Session This section explains starting a Navisphere Manager session. Before starting a session, make sure that all storage systems you want to manage with this session are powered up. 1. Log in to a computer that has the required version of Microsoft Internet Explorer or Netscape browser and Java Runtime Environment (JRE). 2. Start the browser. 3. In the browser, enter the IP address of a storage management server SP or Windows portal that has Manager installed. The software displays a dialog box that requests your username, password, and scope (local or global) under which you want to log in. If you know the username and password of a valid account, go to step 4. If no global administrator account exists, the software displays the message Security not initialized and asks if you want to initialize it, that is, if you want to create a global administrator account. Continue with this step. a. Answer Yes. The software asks for a username. b. Define a username (1 to 32 letters (case sensitive), numbers, and/or underscores, must start with a letter). The software asks for a password. c. For Password, enter 1 to 32 characters, including letters (case sensitive) and/or numbers. Important If the person who manages a storage-system installation cannot log in as a global administrator (perhaps because he or she forgot the password), then global management of the domain will be impossible. Any local administrators and managers retain their local management privileges. However, EMC support will need to recreate a global administrative account. So you should make sure that people who will manage the system keep a good record of the username and password. 3-2 EMC ControlCenter Navisphere Security Version 6.X Administrator s Guide

35 Setting Up and Maintaining Your Security System d. Click OK. e. From the File menu, select Log In. 4. Enter the username and password for the account and select the scope. The Enterprise Storage Window opens and the software displays an icon for each storage system you are entitled to access. If you logged in to an account with a global scope, it displays icons for all storage systems in the domain. What Next? Continue to the next section to learn about adding domains and user accounts. Starting a Manager Session 3-3

36 Setting Up and Maintaining Your Security System Adding or Modifying a Domain To add or modify a domain, you must be logged in to a global administrator account. All storage systems that you want to add to (or remove from) the domain must be running the Storage Management Server Software. If you completed the domain worksheet in Chapter 2, you can use that information when you configure your domain. Selecting or Changing a Master Node Before configuring a domain, you should select a master node for it. The master node (the SP you designate) holds the master copy of all global information in the domain. This information will be copied to all member nodes in the domain. If there is any discrepancy between node information, the information on the master is considered the correct version. If there is already a master node and you define a new one, the old master node will be automatically demoted. 1. Log in to a global account as explained in the previous section. The Enterprise Storage Window opens and the software displays an icon for each storage system in the domain. 2. On the File menu, click Setup Domain and then click Select Master to open the Select Master dialog box. 3. In Master Node IP Address, either enter the IP address for the node you want to be the master node; or, from Available Nodes, select a node from the list defined in the domain directory. If this is a first-time installation, Master Node IP Address displays the IP address of the node that the browser is pointing to, and there are no nodes listed in Available Nodes. 4. Click Apply or OK to make the node you selected the master node. 3-4 EMC ControlCenter Navisphere Security Version 6.X Administrator s Guide

37 Setting Up and Maintaining Your Security System Configuring the Domain You can change the name of the domain, and add other storage systems to the domain, as follows: 1. On the File menu, click Set Up Domain and then click Configure Domain. The Configure Domain dialog box opens and displays a default domain name. 2. To change the name of the domain, click Change next to Domain Name. 3. Replace the default domain name with the name you want. A domain name can consist of letters and numbers only. While multiple domains can have the same name, we recommend that you give them unique names to distinguish them from one another. 4. To search subnets for storage systems you want to add to the domain, under Scan Subnets, in the Subnets To Add box, enter the IP address of the subnet that you want to search, and click >. The IP address moves to the Subnets To Scan box. To remove selected subnets from Subnets To Scan, click the subnet you want to delete and then click Clear. 5. Repeat step 4 until Subnets To Scan contains all subnets you want to scan, and then click Scan. To stop the scan at any time, click Stop Scan. The application starts searching the subnets for any management servers that are not already part of a domain. When it finds any unassigned management servers, it displays them in Available Systems. 6. From the Available Systems list, click the systems you want to include in the domain, and click >. The selected systems move into Selected Systems. 7. If you know the IP address of a system you want to include in the domain, enter the IP address for the system in IP Address of System, and then click >. Adding or Modifying a Domain 3-5

38 Setting Up and Maintaining Your Security System Normally, the IP address will be that of an SP, but if you want to use a Windows host as a server portal to manage legacy storage systems, specify that server s IP address. The server must have storage management server software installed. This moves the system into Selected Systems. 8. When Selected Systems contains all the systems you want to include in the domain, click OK or Apply. To add portals, see the Manager Administrator Guide chapter on managing legacy and NAS storage systems. After you finish configuring, the application does the following updates the master node to include the newly added systems. from the master node, distributes the updated domain configuration to all other systems in its domain. You have selected a master node and/or configured a domain. To change the master and/or reconfigure the domain, repeat the pertinent steps. What Next? The next step, if you have any storage systems such as FC4500 or FC5300 that cannot run storage management server software, is to assign storage systems to a portal system. Assigning Storage Systems to a Storage System Portal or Host Portal If any of the storage systems you added to the domain will act as a portal (that is, it will pass management commands to storage systems such as FC4500s that do not have storage management server software), then you should assign those systems to be portals as explained in the Manager Administrator s guide. The same applies to any host portal that will pass management commands to such storage systems. You can use the worksheet on page 2-10 for the portal information. 3-6 EMC ControlCenter Navisphere Security Version 6.X Administrator s Guide

39 Setting Up and Maintaining Your Security System Removing a Storage System from a Domain Removing a storage system from a domain deletes its domain information and all global account information; however, any local accounts remain usable. If the storage system is a portal (that is, it has been set up with Manager to manage storage systems that do not have Storage Management Server Software), then you must remove each such system from the portal list using the Manager Portal Configuration dialog box. That dialog box will let you remove all such systems in one step. You can then remove the portal from the domain. For more information on portals, refer to the EMC ControlCenter Navisphere Manager 6.X Administrator s Guide, P/N The storage system may be the only one in the domain. In this case the domain is automatically deleted after the storage system is removed. You will then need to re-initialize security; that is, point your web browser at the storage system, answer Yes to the Initialize Security prompt, and create a Global Administrator account for the new domain (refer to Starting a Manager Session on page 3-2). If the storage system you want to remove is the master node in the domain, and you want to retain the domain, then you should change the master node to another system in the domain before removing the old master (refer to Selecting or Changing a Master Node on page 3-4). To remove a storage system from a domain, follow these steps: 1. Log into a storage application server in the desired domain, using a global administrator account. 2. On the File Menu, select Set Up Domain -> Configure Domain. The Configure Domain dialog box appears. 3. In the Configure Domain dialog box, select the IP addresses of an SP in the storage system you want to remove. (The addresses appear on a single line so you must select them together.) 4. Move the system from Selected Systems to Available, and click OK. You have removed the storage system from the domain. By removing it, you also removed all its global security information, and it remains vulnerable to anyone who wants to add it to a domain or initialize security on it. Removing a Storage System from a Domain 3-7

40 Setting Up and Maintaining Your Security System Removing a Domain To remove a domain, remove the storage system that is the master node. Or you can remove all storage systems in the domain. Removing the domain removes all global user accounts (but not the local accounts on each node). The software warns you about the consequences of deleting the master. If you confirm, the software removes the domain, placing each storage system in the Uninitialized state. If the domain has any portals in it, you must remove systems managed via the portal before you can remove the domain. See the previous section for more detail. Adding, Modifying, or Deleting User Accounts To add, modify, or delete an account, you must be logged on as an administrator. For global accounts, you must be logged on as a global administrator. When you create or modify a global account, all storage systems in the domain should be on-line, so that changes will be applied to them all. If you completed the global and local account worksheets in Chapter 2, you can use that information when you add user accounts. To add a user account, follow these steps: 1. Log into a storage application server in the desired domain, using an administrator account. To create a local account for any system, you must be logged into that system. You cannot create a local account for a system other than the one you re logged in to. 2. On the Tools Menu, click Security. 3. On the Security menu, click User Management. The User Management dialog box appears. 3-8 EMC ControlCenter Navisphere Security Version 6.X Administrator s Guide