Novell SENTINEL LOG MANAGER 1.0.0.5 - 03-31-2010, Administration Manual

Page: 17 / 168

Security Considerations for Sentinel Log Manager 17
no
vd
ocx
(e
n)
19
Fe
bru
a
ry
20
10
home directory. By default, if a new user is created, the password for the user is not set in order to
maximize security. If you want to log in to the system as the user, you must set a password for the
user after installation. The default group is
esec
.
During the client installation, if the user already exists, the installer does not prompt for the user
again. This behavior is similar to the behavior during uninstallation or reinstallation of a software.
However, you can have the installer prompt for the user again:
1 Delete the user and group created at the time of first installation.
2 Clear the ESEC_USER environment variables from the
/etc/profile
file.
Windows: No users are created.
The password policies for system users are defined by the operating system that is being used.
2.2.2 Sentinel Application and Database Users
All Sentinel Log Manager application users are native database users and their passwords are
protected by the native database platform. These users have only read access to certain tables in the
database so that they can execute queries against the database.
The
admin
user is the administrator user for Sentinel Log Manager user applications.
By default, the following database users are created during installation:
dbuser: The
dbauser
is created as a superuser who can manage the database and is typically the
user who can log in to the pgAdmin. The password for the dbauser is accepted at the time of
installation. This password is stored in the
user home directory /.pgpass
file. The system
follows the PostgreSQL database password policies.
appuser: The
appuser
is the non-superuser used by Sentinel Log Manager to connect to the
database. By default, the appuser uses a password randomly generated at installation, which is stored
encrypted in the
Install_Directory /server.xml
file. To change the password for the
appuser
,
use the
Install_Directory /bin/dbconfig
utility.
For more information, see “Command Line Utilities” on page 141 .
NOTE: There is also a PostgreSQL database user that owns the entire database, including system
database tables. By default, the postgres database user is set to NOLOGIN, so that no one can log-in
as the PostgreSQL user.
2.3 Securing Sentinel Data
IMPORTANT: Because of the highly sensitive nature of the data on the Sentinel Log Manager, you
must keep the machine physically secure and in a secure area of the network. To collect data from
event sources outside the secure network, use a remote Collector Manager.
For certain components, passwords must be stored so that they are available to the components
when the system needs to connect to a resource such as a database or an event source. In this case,
when the password is stored, it is first encrypted to avoid unauthorized access to the clear-text
password.