System Manager Security ensures that the HMC can operate securely in the client-server mode. Managed machines are servers and the managed users are clients. Servers and clients communicate over the Secure Sockets Layer (SSL) protocol, which provides server authentication, data encryption, and data integrity. Each HMC System Manager server has its own private key and a certificate of its public key signed by a Certificate Authority (CA) that is trusted by the System Manager clients. The private key and the server certificate are stored in the server's private key ring file. Each client must have a public key ring file that contains the certificate of the trusted CA.
Define one HMC as a Certificate Authority. You will use this HMC to generate keys and certificates for your HMC servers and client systems. The servers are the HMCs you want to manage remotely. A unique key must be generated and installed on each server. You can generate the keys for all your servers in one action on the CA and then copy them to diskette, install them at the servers, and configure the servers for secure operation.
The client systems are the systems from which you want to do remote management. Client systems can be HMCs, AIX, or PC clients. Each client system must have a copy of the CA's public key ring file in its System Manager codebase directory. You can copy the CA public key ring file to the diskette on the CA and copy it from the diskette to each client.
To use the System Manager Security application, you must be a member of the System Administrator role. To ensure security during configuration, users of this application must be logged in to the HMC locally.
This chapter describes configuration tasks associated with System Manager Security.
The following steps are required to configure HMC System Manager servers and clients for secure operation.
Define one HMC as a Certificate Authority (CA) to generate keys and certificates for your HMC servers and clients.
A Certificate Authority verifies the identities of the HMC servers to ensure secure communications between clients and servers. To define a system as a Certificate Authority, you must be logged in as the hscroot user at the machine being defined as the internal Certificate Authority. This procedure defines a system as an internal Certificate Authority for HMC security and creates a public key ring file for the Certificate Authority that you can distribute to all of the clients that access the HMC servers.
To configure a system as a Certificate Authority, do the following:
After you define the internal Certificate Authority, you can use the CA to create the private key ring files for the HMCs that you want to manage remotely.
Each HMC server must have its private key and a certificate of its public key signed by a Certificate Authority that is trusted by the HMC clients. The private key and the server certificate are stored in the server's private key ring file.
To create private key ring files for your servers, do the following:
After you generate the private key ring files for your HMC servers, you can copy them to a diskette and install them on the servers.
This procedure copies the servers' private key ring files to a tar diskette so that you can install them on your servers.
To copy the servers' private key ring files to a diskette, do the following:
This procedure installs a server's private key ring file from a tar diskette.
Install the private key ring files from the tar diskette onto each server. Repeat the following steps for each server for which you generated a private key ring file.
To install a server's private key ring file, do the following:
Use the help to guide you through completing the task. To view help in the dialog, click Help to open the Help window, then move the cursor over the item for which you want to display help.
Configure the system as a secure server. Repeat the following steps for each server on which you installed a private key ring file.
To configure a server as a secure server, do the following:
Each client must have a copy of the Certificate Authority's public key ring file (SM.pubkr) installed in its System Manager codebase directory. The remote client and remote client security must be installed on your client systems before you distribute the CA's public key. For more information about installing the remote client and remote client security, see Installing and Using the Remote Client.
The public key ring file can be copied from the CA to a tar diskette or as a PC DOS file, then copied from the diskette onto each client.
To copy the Certificate Authority's public key ring file to diskette, do the following on the CA system:
All clients must have a copy of the Certificate Authority's public key ring file (SM.pubkr) installed in its System Manager codebase directory.
To copy a Certificate Authority's public key ring file from diskette to an HMC client, do the following on each HMC that you want to use as a client for remotely managing HMCs:
To view help in the dialog, click Help to open the Help window, then move the cursor over the item for which you want to display help.
To copy a Certificate Authority's public key ring file from a tar diskette to an AIX client, use the tar command to extract the SM.pubkr file to the /usr/websm/codebase directory.
To copy a Certificate Authority's public key ring file from diskette to a PC Client, use a DOS copy command to copy the SM.pubkr file into the codebase directory in the location where you installed PC Client.
After the security configuration has been completed, you can view the properties of the Certificate Authority (CA) and of any server.
To view CA properties, do the following:
To view a server's properties, do the following on the server:
Before performing this task, you must install the server private key ring file on the HMC. Then you can configure Object Manager Security to switch between plain sockets and SSL protocols.
To configure HMC Object Manager Security, do the following: