Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 67 / 861

Chapter
3
Managing administrative access
This chapter includes the following topics:
■
Creating administrator accounts
■
Creating machine accounts for security gateway access from remote computers
■
Changing passwords
■
Enabling SSH for command-line access to the appliance
Providing access to the security gateway
Although you may be the chief administrator of your corporate security gateway, it is likely that other
people in your organization need access to the security gateway. For example, round the clock
monitoring of the security gateway requires additional accounts for the employees who perform
monitoring. If different access strategies are needed for different segments of your organization, there
may be multiple administrators who perform configuration tasks. The SGMI lets you create accounts
for these employees, with the appropriate privileges for their jobs.
You can also create machine accounts to define computers other than management workstations that
need to automatically access information from the security gateway. This access includes the ability to
view and manage logs, and to provide IDS blacklist entries.
The administrative and machine accounts you create are secured by passwords, which you should
change regularly to protect the integrity of your security gateway.
An additional administrative access feature is the ability to configure SSH as a means of providing
command line access to view configuration files or perform tasks that are not accessible through the
SGMI. SSH provides a cryptographically protected connection that prevents eavesdropping, hijacking,
and other attacks.
Creating administrator accounts
The security gateway creates a default administrator account, called admin, when it is set up using the
appliance LCD panel. You should not modify the privileges of the admin account unless you have
created additional accounts that have full administrative access.
A second administrator account called Cluster is created when security gateways are clustered. This
account is read-only with the exception of the Password field. If the Cluster account does not exist, you
cannot manually create it. Manual creation of the Cluster account prevents a valid cluster
configuration.
You can use the Symantec Gateway Management Interface (SGMI) to create additional administrator
accounts to delegate administrator responsibility for the security gateway. When you create an
administrator account, you specify the account’s access privileges to security gateway services. For
example, an administrator who creates configurations requires full configuration privileges, while an
administrator who monitors the security gateway may only need privileges to view and manage logs,
and issue alerts.