Brocade Communications Systems 53-1001778-01 Configuring mutual authentication for indications

Page 39

SMI Agent security

3

b.Configure the WBEM client to use client certificates to communicate with the SMI-A. (See “Client configuration to use client certificates” on page 48.)

The changes take effect when you restart the server. Click Start Server to restart the server.

Configuring mutual authentication for indications

By default, mutual authentication for indications is disabled, which means that the SMI-A uses SSL to send CIM-XML indications to a WBEM client listener, but does not attempt to verify the identity of the WBEM client listener. When mutual authentication for indications is enabled, then only those clients whose certificates have been added to the SMI-A Indications TrustStore can use SSL to receive indications from the SMI-A. That is, the SMI-A must have a TrustStore that contains a certificate for an entry in the client’s Indications KeyStore.

When you disable or enable mutual authentication for indications, the SMI-A server must be stopped.

1.Launch the Brocade SMI Agent Configuration Tool.

2.Click Mutual Authentication(Indication) in the menu tree (see Figure 10 on page 24). The content pane displays the current setting, which is selected and dimmed.

3.To enable mutual authentication for indications, click the Enable Indication Authentication radio button. If this option is unavailable, then mutual authentication for indications is already enabled.

To disable mutual authentication for indications, click the Disable Indication Authentication radio button. If this option is unavailable, then mutual authentication for indications is already disabled.

4.Click the Stop Server to stop the SMI-A, if it is running. This button is unavailable if the server is already stopped.

5.Click Apply.

6.If you enabled mutual authentication for indications, you can perform the following optional steps to allow only secure communication with trusted clients:

a.Disable HTTP access so that only HTTPS access is available to the clients. (See “Configuring HTTP access” on page 24.) Clients should preferably use HTTPS for all communications purposes if mutual authentication is enabled.

If you do not disable HTTP access, then any client can communicate with the SMI-A using HTTP access.

b.Configure the WBEM client to use client certificates to communicate with the SMI-A. (See “Client configuration to use client certificates” on page 48.)

The changes take effect when you restart the server. Click Start Server to restart the server.

Brocade SMI Agent User’s Guide

23

53-1001778-01

 

Page 38 Page 40
Image 39
Page 38 Page 40
Contents Brocade SMI Agent Brocade Communications Systems, Incorporated Title Publication number Summary of changes Date Brocade SMI Agent User’s Guide Contents Chapter Brocade SMI Agent Configuration Chapter Mutual Authentication for Clients and Indications Index How this document is organized This chapterSupported hardware and software What’s new in this document Document conventionsText formatting Key terms Identifies command syntax examplesAdditional information Brocade resourcesOther industry resources FT00X0054E9 Getting technical helpSupport@brocade.com Brocade SMI Agent supportDocument feedback Common Information Model CIM OverviewBrocade SMI Agent Brocade SMI-S InitiativeBrocade SMI Agent Brocade SMI Agent User’s Guide Starting the SMI-A Brocade SMI AgentStarting the SMI-A as a service Stop the Brocade SMI AgentStopping the SMI-A Stopping the SMI-A as a service Service Location Protocol SLP supportSLP on Linux, Solaris, and AIX Slptool commandsStopping SLP on Linux, Solaris, and AIX Starting SLP on Linux, Solaris, and AIXInstalling SLP on Windows SLP on WindowsStarting SLP on Windows Connection monitoring Disable Http for security reasonsFor example Enable multi-homed supportAbout the Brocade SMI Agent Configuration Tool Brocade SMI Agent ConfigurationApply Launching the Brocade SMI Agent Configuration Tool Windows Launch the Brocade SMI-A Configuration ToolProxy connections Reloading provider.xml on fabric segmentationAdding proxy connections Removing proxy connections Login failure status informationAccess control Login failure status messages Access controlMapping an SMI-A user to a switch user Setting up default SMI-A user mapping SMI Agent security Limitations of SMI-A user-to-switch user mappingConfiguring mutual authentication for clients Mutual authentication setupConfiguring mutual authentication for indications Mutual authentication for indications Configuring Http accessImporting client certificates Http accessExporting server certificates SMI Agent security Configuring user authentication User authentication Encode proxy details Encoding proxy connection detailsConfiguring or removing the SMI Agent as a service SMI Agent service configuration and removalPort configuration Configure Http and Https portsConfiguring the Http and Https ports Configuring the ARR and eventing ports Configure ARR and eventing portsConfigure ARR and eventing ports Fabric Manager database server configurationConfiguring software locations for firmware download Firmware download software locations configurationFile Path Debugging and logging options configuration Configuring debugging options for CimomDebugging options for Cimom Debugging options for the provider Configure debugging options for CimomDynamic Update Configuring debugging options for the providerLogging options for the provider Configuring logging options for providerLog file examples Configure logging optionsCapturing information from the provider cache Capture provider cache informationCollect support information Support information collectionXML dump Collecting support informationRunning an XML dump Configuring the Cimom server Cimom server configurationUncomment the following lines Configuring log file optionsIntroduction Mutual authentication for clientsEnabling mutual authentication for indications Mutual authentication for indicationsClient configuration to use client certificates Enabling mutual authentication for clientsClient.ind.truststore Clientind.cer Java -classpath SMIAgent/agent/wbem.jar Xmlerror TroubleshootingXmlerror General questions Frequently Asked QuestionsHow do I collect diagnostic data from the Brocade SMI Agent? Does the SMI Agent have support for Https communication? On Linux Type the following command Appendix Open source software used in SMI-ASource Code License Sun Industry Standards Source LicenseDistribution Obligations Inability to Comply DUE to Statute or Regulation Termination IBM Common Public License Grant of Rights Commercial Distribution OpenSLP License GNU Library General Public License Bouncy CastleSun Binary Code License Agreement Public DomainBrocade SMI Agent User’s Guide Supplemental License Terms Brocade SMI Agent User’s Guide Brocade SMI Agent User’s Guide 53-1001778-01 Sun Binary Code License Agreement Index Brocade SMI Agent User’s Guide
Top Page Image Contents