Hardware Management Console Installation and Operations Guide


System Manager Security

System Manager Security ensures that the HMC can operate securely in the client-server mode. Managed machines are servers and the managed users are clients. Servers and clients communicate over the Secure Sockets Layer (SSL) protocol, which provides server authentication, data encryption, and data integrity. Each HMC System Manager server has its own private key and a certificate of its public key signed by a Certificate Authority (CA) that is trusted by the System Manager clients. The private key and the server certificate are stored in the server's private key ring file. Each client must have a public key ring file that contains the certificate of the trusted CA.

Define one HMC as a Certificate Authority. You will use this HMC to generate keys and certificates for your HMC servers and client systems. The servers are the HMCs you want to manage remotely. A unique key must be generated and installed on each server. You can generate the keys for all your servers in one action on the CA and then copy them to diskette, install them at the servers, and configure the servers for secure operation.

The client systems are the systems from which you want to do remote management. Client systems can be HMCs, AIX, or PC clients. Each client system must have a copy of the CA's public key ring file in its System Manager codebase directory. You can copy the CA public key ring file to the diskette on the CA and copy it from the diskette to each client.

Note:
You must install a security fileset in order to configure an AIX client correctly. Refer to your AIX documentation for more information.

To use the System Manager Security application, you must be a member of the System Administrator role. To ensure security during configuration, users of this application must be logged in to the HMC locally.

This chapter describes configuration tasks associated with System Manager Security.


Configuring HMC System Manager Servers and Clients for Secure Operation

The following steps are required to configure HMC System Manager servers and clients for secure operation.

Configure One HMC as a Certificate Authority

Note:
You cannot perform this function using the Remote Client.

Define one HMC as a Certificate Authority (CA) to generate keys and certificates for your HMC servers and clients.

A Certificate Authority verifies the identities of the HMC servers to ensure secure communications between clients and servers. To define a system as a Certificate Authority, you must be logged in as the hscroot user at the machine being defined as the internal Certificate Authority. This procedure defines a system as an internal Certificate Authority for HMC security and creates a public key ring file for the Certificate Authority that you can distribute to all of the clients that access the HMC servers.

To configure a system as a Certificate Authority, do the following:

  1. In the Navigation area, click System Manager Security.
  2. In the Contents area, select Certificate Authority.
  3. In the System Manager Security: Certificate Authority window, select Configure This System as a Certificate Authority. You can also select Configure... from the Certificate Authority menu.
  4. Use the wizard panels to complete the task.

Generate Private Key Ring Files for the HMCs That You Want to Manage Remotely

After you define the internal Certificate Authority, you can use the CA to create the private key ring files for the HMCs that you want to manage remotely.

Each HMC server must have its private key and a certificate of its public key signed by a Certificate Authority that is trusted by the HMC clients. The private key and the server certificate are stored in the server's private key ring file.

To create private key ring files for your servers, do the following:

  1. In the Navigation area, select System Manager Security.
  2. In the Contents area, select Certificate Authority.
  3. In the System Manager Security: Certificate Authority window, select Generate Servers' Private Key Ring Files. You can also select Generate Keys... from the Certificate Authority menu.
  4. In the Password window, type the certificate authority private key file password. This password was created when the system was configured as the Certificate Authority.
  5. Click OK.
  6. In the Generate Server's Private Key Ring Files window, use the help to guide you through completing the task. To view help in the windows, click Help to open the Help window, then move the cursor over the item for which you want to display help.
  7. Click OK when you are finished.

Install the Private Key Ring Files and Configure Your HMC Servers as Secure System Manager Servers

After you generate the private key ring files for your HMC servers, you can copy them to a diskette and install them on the servers.

Copying Server Private Key Ring Files to Diskette

This procedure copies the servers' private key ring files to a tar diskette so that you can install them on your servers.

To copy the servers' private key ring files to a diskette, do the following:

  1. In the Navigation area, select System Manager Security.
  2. In the Contents area, select Certificate Authority.
  3. In the System Manager Security: Certificate Authority window, select Copy Servers' Private Key Ring Files to Diskette. You can also select Copy Servers' Keys... from the Certificate Authority menu.
  4. When the Copy Server's Private Key to Diskette dialog displays, insert a diskette. To view help in the dialog, click Help to open the Help window, then move the cursor over the item for which you want to display help.
  5. Click OK to copy the servers' private key ring files.

Installing the Private Key Ring File on Each Server

This procedure installs a server's private key ring file from a tar diskette.

Install the private key ring files from the tar diskette onto each server. Repeat the following steps for each server for which you generated a private key ring file.

To install a server's private key ring file, do the following:

  1. In the Navigation area, select System Manager Security.
  2. In the Contents area, select Server Security.
  3. In the System Manager Security:Server Security window, select Install the private key ring for this server. You can also select Install Key... from the Server Security menu.
  4. In the Install Private Key Ring File window, select tar diskette as the source for the server private key ring files. Insert the diskette containing the server's key into the diskette drive.
  5. Click OK.

Use the help to guide you through completing the task. To view help in the dialog, click Help to open the Help window, then move the cursor over the item for which you want to display help.

Configuring a System as an HMC Secure Server

Configure the system as a secure server. Repeat the following steps for each server on which you installed a private key ring file.

To configure a server as a secure server, do the following:

  1. In the Navigation area, select System Manager Security.
  2. In the Contents area, select Server Security.
  3. In the System Manager Security:Server Security window, select Configure this system as a secure HMC server. You can also select Configure... from the Server Security menu.
  4. Use the wizard panels to complete the task.

Distribute the Certificate Authority's Public Key to Your Clients

Each client must have a copy of the Certificate Authority's public key ring file (SM.pubkr) installed in its System Manager codebase directory. The remote client and remote client security must be installed on your client systems before you distribute the CA's public key. For more information about installing the remote client and remote client security, see Installing and Using the Remote Client.

The public key ring file can be copied from the CA to a tar diskette or as a PC DOS file, then copied from the diskette onto each client.

Copying the Certificate Authority's Public Key Ring File to Diskette

Note:
To copy the certificate authority's public key ring file to diskette, have a DOS-formatted diskette available for use.

To copy the Certificate Authority's public key ring file to diskette, do the following on the CA system:

  1. In the Navigation area, select System Manager Security.
  2. In the Contents area, select Certificate Authority.
  3. In the System Manager Security:Certificate Authority window, select Copy this Certificate Authority's Public Key Ring File to Diskette. You can also select Copy out CA Public Key... from the Certificate Authority menu.
  4. When the Copy CA Public Key to Diskette window opens, insert a diskette.
  5. Select the type of client to which you want the public key ring file to be copied. Selecting HMC or AIX client writes the file to a tar diskette. Selecting PC client writes the file to diskette in DOS file format. Use the help to guide you through completing the task. To view help in the dialog, click Help to open the Help window, then move the cursor over the item for which you want to display help.
  6. Click OK to copy the public key ring file.

Copying a Certificate Authority's Public Key Ring File from Diskette to an HMC Client

All clients must have a copy of the Certificate Authority's public key ring file (SM.pubkr) installed in its System Manager codebase directory.

To copy a Certificate Authority's public key ring file from diskette to an HMC client, do the following on each HMC that you want to use as a client for remotely managing HMCs:

  1. In the Navigation area, select System Manager Security.
  2. In the Contents area, select Certificate Authority.
  3. In the System Manager Security:Certificate Authority window, select Copy another Certificate Authorities Public Key Ring File from diskette. You can also select Copy in CA Public Key... from the Certificate Authority menu.
  4. When the Copy CA Public Key from Diskette window opens, insert the tar diskette that contains the copied Certificate Authority's public key ring file.

    To view help in the dialog, click Help to open the Help window, then move the cursor over the item for which you want to display help.

  5. Click OK to copy the public key ring file.

To copy a Certificate Authority's public key ring file from a tar diskette to an AIX client, use the tar command to extract the SM.pubkr file to the /usr/websm/codebase directory.

To copy a Certificate Authority's public key ring file from diskette to a PC Client, use a DOS copy command to copy the SM.pubkr file into the codebase directory in the location where you installed PC Client.


Viewing Configuration Properties

After the security configuration has been completed, you can view the properties of the Certificate Authority (CA) and of any server.

To view CA properties, do the following:

  1. In the Navigation area, select your local host.
  2. Underneath the local host, click the System Manager Security icon.
  3. Click Certificate Authority.
  4. Select Properties.
  5. Type the password.
Note:
This window provides read-only information for the CA.

To view a server's properties, do the following on the server:

  1. In the Navigation area, select your local host.
  2. Underneath the local host, click the System Manager Security icon.
  3. Click Server Security.
  4. Select View properties for this server from the task list.
Note:
This window provides read-only information for the server.

Configure HMCObject Manager Security

Before performing this task, you must install the server private key ring file on the HMC. Then you can configure Object Manager Security to switch between plain sockets and SSL protocols.

To configure HMC Object Manager Security, do the following:

  1. In the Navigation area, select your local host.
  2. Underneath the local host, click the System Manager Security icon.
  3. Click Object Manager Security.
  4. Select Configure Object Manager Security.
  5. Select a socket mode.
  6. Click OK.


[ Top of Page | Previous Page | Next Page | Table of Contents | Index ]