Elseta WCC Lite, Руководство пользователя, Страница: 154 / 160

2020/04/07 WCC Lite user manual
2. make it more difficult to guess:
(a) don’t use the username root
(b) don’t use a weak password with 8 or less characters
(c) don’t let the SSH server dropbear listen on the default port (22)
3. use the combination of
(a) username different than root
(b) tell dropbear to listen on a random port (should be >1024): System > Administration >
Dropbear Instance > Port
(c) public key authentication. Your public keys can be specified in Administation > System
> SSH­keys
. An older guide to DropBear SSH public key authentication has detailed
information on generating SSH keypairs which include the public key(s) you should upload
to your configuration.
21.2 Groups rights
If user is logged on via external server, its authentification level is acquired. As no direct mapping
to existing users is used, authentification levels are a way to grant proper permissions for external
users. WCC Lite uses a CISCO­like authentification system, meaning that there are fifteen different
permission set level settings, of which the first 14 can be configured to enable or disable View and
Edit permissions.
21.2.1 SSH Access
SSH Access of WCC Lite is made by Dropbear software package. To extend the basic functionality,
Pluggable Authentification Module (PAM) for RADIUS is used. This enables user to add his own
authentification modules as long as they are properly configured.
Fifteen levels of authorization are mapped for SSH access, meaning that user should be able
to access SSH with credentials used to log into web interface. However, one should note that
permissions in command line interface are not configurable via web interface. This means that first
fourteen levels are restricted to basic permissions made my creating group by default. Highest level
user has all the permissions
root
user has.
If a user intends to change permissions for user groups, it should be done via command line
interfaces. It is only advised for advanced users.
21.2.2 Web interface permissions
Fifteen levels of authorization permission are mapped for web interface access, meaning that user
should be able to access web interface with credentials used to log into command line interface. User
assigned to a highest authorization level group is able to access every possible screen therefore this
groups cannot be edited.
Figure 37 shows a screen containing already existing groups in a device. Pressing
Add New
Groups... guides user to an Edit group screen, Edit and Delete buttons respectively Edit and Delete
configuration of a given user group.
153
1.4.0 | ELSETA | Cyber security