Fujitsu BS2000, User Manual

Page: 53 / 374

Architecture and strategies Management Unit and SE Manager
U41855-J-Z125-3-76
51
D
ok
us
ch
a
bl
on
en 1
9x
24 V
e
rs
ion 7.
4
de f
ür
F
ram
e
M
ak
er
V
7.
x
vo
m
09
.0
2.
20
10
©
c
og
ni
ta
s Gm
b
H
20
01
-20
10
19
. M
ar
ch
201
8 S
ta
nd 18
:2
5.
47
P
fad
: P
:\F
T
S
-B
S
\S
er
ve
r\
S
E
-S
er
ve
r\
S
E
-D
ok
u\
13
039
12
_B
uV
_0
62
\B
u
V
_
e\
bu
v.
k0
2
Centrally managed accounts
In addition to local accounts, the administrator can also permit LDAP accounts for the
various roles. These accounts are managed centrally on an LDAP server (in particular also
the password).
In order to use LDAP accounts, the access to an LDAP server must be configured. In the
Management Cluster, access to the LDAP server can be configured specifically for one SE
server. See
section “Access to an LDAP server” on page 309 .
When this requirement is satisfied, the administrator, when creating an account, can
release an LDAP account by means of the account type for the desired role. If the central
account is the same as the existing local account, no LDAP account can be released. When
an LDAP account is removed, it is also locked again.
Accesses to BS2000
All administrator and BS2000 administrator accounts have access authorization to the
BS2000 console and BS2000 dialog of all BS2000 systems.
An administrator can assign these authorizations individually to an operator account, in
VM2000 mode specifically for particular guest systems.
For information on accesses to BS2000 for operator accounts, see section “Managing
individual rights” on page 306 .
Accesses to the operating system on XenVMs and Application Units
The customer is responsible for configuring accounts in the operating systems on XenVMs
and Application Units, possibly linked to a strategy for particular roles or authorizations. This
depends on the options of the operating system concerned.
2.6.2 IP-based access to the Management Unit
By default, access to the MUs of the SE server is unrestricted for all IP addresses and
networks. However, the administrator can configure access to the MU (applies for the SE
Manager and CLI) in such a manner that it is possible only for explicitly entered IP
addresses or for IP addresses from explicitly entered IP networks.
In a Management Cluster, the configuration is server-specific.
The current configuration of the access to the MUs is displayed in the
IP-based access rights
tab of the
Authorizations
→
Configuration
menu (see section “IP-based access restriction to
the MUs” on page 311 ).