Netscape Certificate Management System 6.1, Руководство администратора

Страница: 692 / 840

Understanding Subsystem Setup
692 Netscape Certificate Management System Administrator’s Guide • February 2003
• Adding a custom plug-in, which in essence breaks the Common Criteria
assurance. If adding custom plug-ins is inevitable, it is the responsibility of all
role users to carefully evaluate these plug-ins before making them part of the
system.
• The default ACLs contain access control enforcement requirements specified in
the CIMC Security Level 3 protection profile. Caution must be taken when
making changes to them.
• Using the internal OCSP services of a Certificate Manager.
• CEP enrollments.
• Challenge Revocation.
You will be instructed on how to disable these features in order to conform to the
Common Criteria Environment.
Understanding Subsystem Setup
This section describes at a high-level what to expect when you configure a
subsystem following the instructions in the document CMS Common Criteria
Setup Procedure. This section contains links to the main guidance documents
where detailed information is provided for each feature, but you will need to
follow the CMS Common Criteria Setup Procedure in order to set up a Netscape
CMS Common Criteria evaluated environment.
CMS Role Users and Authorization
In CMS, you create role users and then assign them to groups (also roles) to give
them the privileges of the role represented by the group membership. You need to
set up at least one auditor role user, one agent role user, and one administrator role
user for each subsystem. You specify the first administrator role user when you
install the subsystem. You will be setting up the administrative interface (CMS
console) for SSL authentication; all agent role users, auditor role users, and
administrator role users you set up will need to obtain a certificate, and the
certificates for those role users will need to be stored with their role user entries. It
is recommended that you have the auditor role users, administrator role users, and
agent role users use their hardware tokens to submit requests to the end-entity
interface of the Certificate Manager or Registration Manager that will process the
request.