Motorola PTP 25600, Руководство пользователя

Страница: 81 / 237

User Guide: PTP 600 Series System management
phn-0896_009v003
Feb 2010
UNDER DEVELOPMENT
1-39
Transport layer security
The PTP 600 management agent allows HTTP traffic at the web interface to be
encrypted using Transport Layer Security (TLS). PTP 600 uses AES to encrypt HTTP
traffic. Operation of HTTPS/TLS is enabled by purchase of an optional AES upgrade as
described in
Upgrading the PTP 600 on page 6-77 .
TLS operation requires installation of a key of keys, a private key, a related public key
certificate, and an entropy value. The subject of the public key certificate will be the IP
address or hostname of the ODU. If the subject of the certificate is the hostname, then
the network must include a DNS service capable of resolving the hostname to the IP
address of the ODU.
The private key and public key certificate must be installed as standard DER files.
The PTP 600 has no default public key certificate, and Motorola is not able to generate
public key certificates for specific network applications.
Security wizard
The web-based interface includes a Security Wizard. The Security Wizard is used to
enter configuration for TLS, including the key or keys, private key, public key
certificate and entropy value.
The Security Wizard additionally allows HTTP and Telnet interfaces to be disabled, and
encryption keys to be entered or updated for AES encryption at the wireless interface.
The Security Wizard is disabled until AES encryption or FIPS are enabled by license
key.
Management tasks using the Security Wizard are described in Configuring HTTPS/TLS
using the Security Wizard on page 6-98 .
Identity-based user accounts
The PTP 600 web-based interface provides two methods of authenticating users:
•
Role-based user authentication allows the user, on entry of a valid password, to
access all configuration capabilities and controls. This is the default method.
•
Identify-based user authentication supports up to 10 users with individual
usernames and passwords.
When identity-based user accounts are enabled, a security officer can define from one
to ten user accounts, each of which may have one of the three possible roles:
•
Security officer.
•
System administrator.