SafeNet Luna SA, Руководство по настройке

Страница: 11 / 109

CHAPTER 1 Planning Your Configuration
Abilities or Privileges of Created Users
Named users empowered with the "admin" role can perform most actions that the original admin can perform.
User accounts granted the "operator" role have access to a reduced set of administrative commands.
User accounts granted the "monitor" role can take no actions on the appliance or HSM, and are restricted to commands
that view, list or show.
The commands available to the roles are listed in "User Accounts and Their Privileges" .
Why Create Extra Administrative Users?
One reason for creating multiple named users would be for the purpose of distinguishing individual persons' activities in
the logs.
For example, a user named 'john' running the lunash 'syslog tail' command would show in the April 13 log as:
Apr 13 14:17:15 172 -lunash: Command: syslog tail : john : 172.20.10.133/3107
Command Result : 0 (Success)
Perhaps you have people performing similar functions at physically separate locations, or you might have staff
assigned to teams or shifts for 24-hour coverage. It could be valuable (or required by your security auditors) to know and
be able to show which specific person performed which actions on the system.
You might find other uses. Please let us know.
Implications of Backup and Restore of User Profiles
The commands "sysconf config backup" and "sysconf config restore" allow you to store a snapshot of the
administrative user database (the names and status of all named Luna Shell users) that can later be restored if desired.
CAUTION:
Restoring from backup restores the database of user profiles that existed before the backup
was made. This includes:
- the set of users that existed when the backup was made
- the passwords that users had at the time of the backup
- the enabled/disabled status of users, at the time of the backup.
This means that:
- you will lose any user accounts created since the backup,
- passwords of existing users could be reverted without their knowledge,
- enabled users might be disabled (therefor unable to perform their tasks)
- disabled users might be enabled (therefore re-granted access that was suspended) and
- any user accounts removed since that backup will be restored.
The first three could be administrative inconveniences. The fourth and fifth outcomes could be
serious security issues.
Your records should indicate when user-profile changes were made, and what those changes were, so any time that
you restore a backup, be sure to reconcile the changed statuses and inform anyone who is affected. For example, users
need to know to use their previous password, and to change it immediately.
Luna SA Configuration Guide
Release 5.4.1 007-011136-007 Rev C July 2014 Copyright 2014 SafeNet, Inc. All rights reserved.
11