IBM System Storage TS3500, Введение и руководство по планированию

Страница: 92 / 290

The TS3500 Tape Library Tape Library Specialist Web interface does not allow any
access to customer data, and it does not allow FTP or TELNET type operations. It
only provides those functions that are specifically coded in the library firmware.
The only files it can offload are library logs, drive logs, a backup of the nonvolatile
random access memory (NVRAM) configuration information for the library, and
certain usage and error statistics files. It cannot be used to read or write a customer
cartridge or otherwise access customer data.
The Tape Library Specialist Web interface allows the customer to set up an
administrator password, and no one without the password can use the Tape
Library Specialist Web interface to do anything to the library. The Tape Library
Specialist Web interface also provides several levels of access through roles, and
these roles have lower levels of access than the administrator. In addition, when
password protection is enabled, the Tape Library Specialist Web interface also
provides an option to authenticate through the Storage Authentication Service
(SAS). See the section about Web security in the
IBM System Storage TS3500 Tape
Library with ALMS Operator Guide .
Security concerns when using the Tape Library Specialist Web interface are similar
to those of using the operator panel. For example:
v A specialist user could move a cartridge from one location to another within the
library, potentially confusing a host application or making a cartridge
unavailable by moving it to a different partition.
v
A user could re-configure the library, possibly causing problems at the hosts
because of changes in partitioning or device IDs.
v
A remote user could update library or drive code. However, since the library
and drives ignore any code they do not recognize, the only exposure is to
loading down level code.
These security concerns can be addressed by utilizing the password, user role, and
authentication features provided by the Tape Library Specialist Web interface and
also by enabling SNMP audit logging. When SNMP audit logging is enabled, the
library sends notifications when certain events occur in the library. For more
information, refer to “SNMP audit logging” on page 71.
Security considerations for the IBM TS3500 Tape Library RS/232
Port
This section describes security information for the IBM TS3500 Tape Library
RS/232 Port through the debug/CETool interface.
When servicing a TS3500 Tape Library, IBM Service Representatives may connect a
service terminal (laptop computer) to an RS-232 serial port on the TS3500 Tape
Library. Serial port J1 (also known as the CETool Port) provides an interface which
allows IBM Service Representatives to send messages to the library and receive
information from the library. This is a proprietary interface which provides specific
commands and only passes the data associated with those commands.
A program called CETool.exe is used to interface with the library through this port.
The CETool program provides the following capabilities:
v
Update library or drive firmware by transferring a library code image or a drive
code image from the service terminal to the library
v
Get error and statistics logs and configuration information from the library and
drive
v
Configure the library settings related to the Call Home facility
68
IBM System Storage TS3500 Tape Library with ALMS: Introduction and Planning Guide