Bay Networks 5390, Администрирование

Страница: 433 / 888

893-741-B A15-13
Using Model 5390 Security
Encrypting Security Messages
Messages between the security server and the Model 5390 server are encrypted if the Model 5390
enable_security and acp_key parameters are set. The parameters do not take effect until the Model
5390 server is either rebooted or reset.
The acp_key parameter specifies the encryption key the Model 5390 server uses to exchange
messages with the security server. The security server maintains the encryption key for each Model
5390 server in the acp_keys file (see Creating the acp_keys File below and Configuring Hosts and
Servers starting on page A14-1).
The encryption key also validates the security host: the host must know the Model 5390 ACP key
for the Model 5390 server to consider the host valid. Without the appropriate key, the Model 5390
server denies the user’s request even if the host is defined as a preferred security host.
Creating the acp_keys File
The security server maintains the encryption key for each Model 5390 server in the acp_keys file.
Each entry in this file contains a list of Model 5390 names or IP addresses separated by commas
and an encryption key for those Model 5390 servers. The Model 5390 server or the list of Model
5390 servers and the key are separated by a colon. The order of placement in the file is important,
as the file is read sequentially.
When the security server receives an encrypted message from the Model 5390 server, the server
tries to match that key against the key assigned to the Model 5390 server in the file. If no match
exists, the Model 5390 server and the server cannot communicate.
NOTE:
The show annex command does not display the value of the
acp_key parameter. Instead, it displays “<set>” or “<unset>”.