Novell ACCESS MANAGER 3.1 SP2 - README 2010, Руководство пользователя

Страница: 41 / 374

Configuring an Identity Server 41
n
ov
do
cx (e
n)
16
Ap
ril 20
10
fw_custom_before_masq() {
iptables -t nat -A POSTROUTING -s 10.8.0.0/16 -j SNAT --to 10.1.1.1
true
}
fw_custom_before_denyall() {
for chain in input_ext input_dmz input_int forward_int forward_ext
forward_dmz; do
iptables -A $chain -j ACCEPT -s 10.8.0.0/22
iptables -A $chain -j ACCEPT -d 10.8.0.0/22
done
true
}
3 Save the file.
4 Restart the firewall by executing the following command:
/etc/init.d/SuSEfirewall2_setup restart
5 Verify that the post SSL VPN routing iptables filters have been registered correctly by issuing
the following command:
iptables -t nat -nvL
You should see information similar to the following if the filters have been registered correctly:
Chain POSTROUTING (policy ACCEPT 20987 packets, 1266K bytes)
pkts bytes target prot opt in out source destination
0 0 SNAT all -- * * 10.8.0.0/16 0.0.0.0/0
to:10.1.1.1
1.6 Using netHSM for the Signing Key Pair
netHSM is a Hardware Security Module (HSM) from nCipher. The module is attached to the
network and provides cryptographic resources for multiple servers. Keys stored in a netHSM
keystore are secure because the key material can never be exposed outside of the module.
Access Manager has not been tested with any other HSM products; it has only been tested with the
netHSM module from nCipher.
Figure 1-2 illustrates a simple netHSM configuration with an Identity Server as a netHSM client.
Figure 1-2
A Simple netHSM Configuration
netHSM Server
Remote File System &
netHSM Client
Identity Server
and netHSM Client