
Fabric OS Administrator’s Guide
527
53-1002446-01
Preparing the switch for FIPS
C
Deleting an LDAP switch certificate
This procedure deletes the LDAP CA certificate from the switch.
1. Connect to the switch and log in using an account with admin permissions, or an account with
OM permissions for the PKI RBAC class of commands.
2. Enter the secCertUtil show -ldapcacert command to determine the name of the LDAP
certificate file.
3. Enter the secCertUtil delete -ldapcacert
file_name
command, where
file_name
is the name of
the LDAP certificate on the switch.
Example of deleting an LDAP CA certificate
switch:admin>
seccertutil delete -ldapcacert swLdapca.pem
WARNING!!!
About to delete certificate: swLdapca.pem
ARE YOU SURE (yes, y, no, n): [no]
y
Deleted LDAP certificate successfully
Preparing the switch for FIPS
It is important to prepare the switch for the following restrictions that exist in FIPS mode:
•
The root account and all root-only functions are not available.
•
HTTP, Telnet, RPC, and SNMP need to be disabled. Once these ports are blocked, you cannot
use them to read or write data from and to the switch.
•
The configDownload and firmwareDownload commands using an FTP server are blocked.
See
Table 87
on page 524 for a complete list of restrictions between FIPS and non-FIPS modes.
ATTENTION
You need the securityadmin and admin permissions to enable FIPS mode.
Overview of steps
•
Remove legacy OpenSSH DSA keys.
•
Optional:
Configure the RADIUS server or the LDAP server.
•
Optional
: Configure any authentication protocols.
•
For LDAP only
: Install an SSL certificate on the Microsoft Active Directory server and a CA
certificate on the switch for using LDAP authentication.
•
Ensure no filter policy rule permits access from Telnet, HTTP, or RPC.
•
Create separate IP filter policies for IPv4 and IPv6 and block access to Telnet (TCP port 23),
HTTP (TCP port 80), or RPC (TCP and UDP ports 897 and 898).
•
Undefined ports are blocked implicitly in FIPS mode.
•
Set the SNMP security level to off.
•
Disable the Boot PROM access.
•
Configure the switch for signed firmware.
Summary of Contents for Fabric OS v7.0.1
Page 1: ...53 1002446 01 15 December 2011 Fabric OS Administrator s Guide Supporting Fabric OS v7 0 1 ...
Page 22: ...xxii Fabric OS Administrator s Guide 53 1002446 01 ...
Page 26: ...xxvi Fabric OS Administrator s Guide 53 1002446 01 ...
Page 30: ...xxx Fabric OS Administrator s Guide 53 1002446 01 ...
Page 38: ...xl Fabric OS Administrator s Guide 53 1002446 01 ...
Page 40: ...2 Fabric OS Administrator s Guide 53 1002446 01 ...
Page 214: ...176 Fabric OS Administrator s Guide 53 1002446 01 Management interface security 7 ...
Page 228: ...190 Fabric OS Administrator s Guide 53 1002446 01 Brocade configuration form 8 ...
Page 248: ...210 Fabric OS Administrator s Guide 53 1002446 01 Validating a firmware download 9 ...
Page 334: ...296 Fabric OS Administrator s Guide 53 1002446 01 Setting up TI over FCR sample procedure 12 ...
Page 360: ...322 Fabric OS Administrator s Guide 53 1002446 01 Encryption and compression example 14 ...
Page 404: ...366 Fabric OS Administrator s Guide 53 1002446 01 ...
Page 430: ...392 Fabric OS Administrator s Guide 53 1002446 01 Ports on Demand 18 ...
Page 502: ...464 Fabric OS Administrator s Guide 53 1002446 01 Buffer credit recovery 23 ...
Page 572: ...534 Fabric OS Administrator s Guide 53 1002446 01 Hexadecimal overview D ...
Page 584: ...546 Fabric OS Administrator s Guide 53 1002446 01 ...