GE Multilin 850, Инструкция по эксплуатации

Страница: 20 / 664

1–10 850 FEEDER PROTECTION SYSTEM – INSTRUCTION MANUAL
SECURITY OVERVIEW CHAPTER 1: INTRODUCTION
When both 850 device and server authentication are enabled, the 850 automatically
directs authentication requests to the 850 device or the respective RADIUS server, based
on user names. If the user ID credential does not match one of the device local accounts,
the 850 automatically forwards the request to a RADIUS server when one is provided. If a
RADIUS server is provided, but is unreachable over the network, server authentication
requests are denied. In this situation, use local 850 device accounts to gain access to the
850 system.
USER ROLES
User Access Levels are used to grant varying permissions to specific user roles. User roles
are used by both Basic Security and CyberSentry.
The following user roles are supported:
•
Administrator : The Administrator role has complete read and write access to all
settings and commands. The role does not allow concurrent access. The Administrator
role also has an operand to indicate when it is logged on.
• Operator : The Operator role is present to facilitate operational actions that may be
programmed and assigned to buttons on the front panel. The Operator has read/write
access to all settings under the command menu/section. The Operator can also use
the Virtual Input command under the control menu/section. The Operator can view
settings from EnerVista or the front panel but does not have the ability to change any
settings. This role is not a concurrent role.
• Observer : The Observer role has read-only access to all 850 settings. This role allows
concurrent access. The Observer is the default role if no authentication has been done
to the device. This role can download settings files and records from the device.
• Factory : This is an internal non-user accessible role used for manufacturing
diagnostics. The ability to enable or disable this role is a security setting that the
Administrator controls.
GENERAL RULES FOR USER ROLES WITH CYBERSENTRY
1. The only concurrent role is Observer. If the user is logged in through serial, front panel,
or over the network, that counts as the role being logged in for concurrency reasons.
2. Both EnerVista and the front panel provide a one-step logoff. For the front panel, the
root menu has a logoff command. From EnerVista right-clicking on a device and
providing a logoff function from the context menu is sufficient.
3. The EnerVista Login Screen has “User Name:” and “Password:” fields for the default
remote (Radius) authentication, but when a “Local Authentication” checkbox is
selected the “User Name:” field changes to a drop down menu where the user can
select one of the predefined roles on the 850.