HP CloudSystem Foundation Guide de l'utilisateur télécharger pdf (Page 23)

The following table comprises a partial list of security best practices that HP recommends in both

physical and virtual environments. Differing security policies and implementation practices make

it difficult to provide a complete and definitive list.

Best PracticeTopic

• Limit the number of local accounts. Integrate the appliance with an enterprise directory solution

such as Microsoft Active Directory or OpenLDAP.

Accounts

• Use certificates signed by a trusted certificate authority (CA), if possible.

CloudSystem uses certificates to authenticate and establish trust relationships. One of the most

common uses of certificates is when a connection from a web browser to a web server is

established. The machine level authentication is carried out as part of the HTTPS protocol, using

SSL. Certificates can also be used to authenticate devices when setting up a communication

channel.

The appliance supports self-signed certificates and certificates issued by a CA.

The appliance is initially configured with self-signed certificates for the web server, database,

and message broker software. The browser will display a warning when browsing to the

appliance using self-signed certificates.

HP advises customers to examine their security needs (that is, to perform a risk assessment) and

consider the use of certificates signed by a trusted CA. For the highest level of security, HP

recommends that you use certificates signed by a trusted certificate authority:

◦ Ideally, you should use your company's existing CA and import their trusted certificates. The

trusted root CA certificate should be deployed to user’s browsers that will contact systems

and devices that will need to perform certificate validation

◦ If your company does not have its own certificate authority, then consider using an external

CA. There are numerous third-party companies that provide trusted certificates. You will need

to work with the external CA to have certificates generated for specific devices and systems

and then import these trusted certificates into the components that use them.

As the Infrastructure administrator, you can generate a CSR (certificate signing request) and,

upon receipt, upload the certificate to the appliance web server. This ensures the integrity and

authenticity of your HTTPS connection to the appliance. Certificates can also be uploaded for

the database and message broker.

Certificates

• Do not connect management systems (for example, the appliance, the iLO card, and Onboard

Administrator) directly to the Internet.

If you require access to the Internet, use a corporate VPN (virtual private network) that provides

firewall protection.

Network

• The appliance is preconfigured so that nonessential services are removed or disabled in its

management environment. Ensure that you continue to minimize services when you configure

host systems, management systems, network devices (including network ports not in use) to

significantly reduce the number of ways your environment could be attacked.

Nonessential

services

Passwords

• For local accounts on the appliance, change the passwords periodically according to your

password policies.

• Password contains between 8 and 40 characters

• The following special characters are not allowed:

< > ; , " ' & / \ | + =

• Clearly define and use administrative roles and responsibilities; for example, the Infrastructure

administrator performs most administrative tasks.

Roles

• Consider using the practices and procedures, such as those defined by the Information Technology

Infrastructure Library (ITIL). For more information, see the following website:

http://www.itil-officialsite.com/home/home.aspx

Service

Management

Best practices for maintaining a secure appliance 23

1 2 ... 18 19 20 21 22 23 24 25 26 27 28 ... 210 211

Commentaires sur ces manuels

Pas de commentaire

HP CloudSystem Foundation Guide de l'utilisateur Page 23

Commentaires sur ces manuels

Produits connexes et manuels pour Logiciel HP CloudSystem Foundation