| Mgt Module Management |
|
You can access CMM management
options from the Mgt Module Management menu. |
| User Accounts |
The User Accounts page enables the user to define
login accounts to access the CMM through
the web interface. Note: CMM user
accounts are also used to log in to the service processor interfaces
of compute nodes.
The following information and options are
available from the User Accounts page:
- Accounts - Contains a table of defined users with information
related to each user account, and some options for managing user accounts.
The following options and account information are included:
- User Name - Click the user name to open User Properties, which enables the user to change or configure existing user information.
The following pages are available:
- General - Change the password for the selected user account or
update the simultaneous active session count.
- Permission Group - Change the permission group that is associated
with the selected user name.
- SNMPv3 - Configure SNMPv3 information including context name,
authentication protocol, privacy protocol, request access type, and
trap destination IP address or host name.
- SSH Client Public Key - Import and manage up to four SSH keys
used for SSH public key authentication. This option allows secure
CLI access, using SSH without the need for a user-supplied password.
- Number of active sessions - Number of active sessions for the
user account.
- Last Login - Last time and date the user account was authenticated.
- Dormant - Indicates whether the user account is dormant, according
to the current user account security policy of the chassis. When an
X is present, the account is dormant. When the account is no longer
dormant, the X is not be present. To recover an account from a dormant
state, the user must log in to the dormant account. No changes can
be made to the user account settings while the account is in a dormant
state.
- Days to password expiration - When password expiration is enabled,
this value indicates the amount of days that the user account will
remain active. The default is 90 days, and the maximal is 365 days.
When the value is set to zero, the passwords will never expire.
- Days since password expiration warning to password expiration:
When password expiration warning is enabled, this value indicates
the amount of days that the user will receive warnings before the
password expires. The default is five days, and the minimal is one
day. It cannot exceed the value specified for days to password expiration.
When the value is set to zero, the user will never be warned about
password expiration.
- Times of Password reuse cycle - This value indicates the amount
of times of using unique passwords before a users can reuse a previously
used combination for password. The default is five times, and the
maximal is ten. When the value is set to 0, any previously used passwords
may be reused anytime.
- Hours of password change interval - This value indicates the amount
of hours a combination must endure before the user can adopt another
one. It cannot exceed the value specified for days to password expiration.
The default is twenty-four hours, and the maximal is 240. When the
value is set to zero, passwords may be changed anytime.
- Times of password login failure - This value indicates the amount
of times of failed log-in attempts allowed before the user account
is locked out. The default is five times, and the maximal is ten.
When the value is set to zero, the user account is never locked due
to failed log-in attempts.
- Minutes of lockout period after login failure - This value indicates
the amount of an user account is locked out after certain number of
failed log-in attempts. The default is sixty minutes, and the maximal
is 1440. When the value is set to 0, the user account will be permanently
locked out after certain failed log-in attempts .
- Minutes of web inactivity session timeout - This value indicates
the amount of minutes of an inactive web session before a user account
is logged out. The default is twenty minutes, and the maximal is 1440.
When the value is set to zero, the web session will never expire.
- Minimal password length - This value indicates the minimal length
of password. The default and the minimal is eight characters, and
the maximal is twenty.
- Force password change upon first-time access - This is enabled
by default. If disabled, the user will not have to change password
at first-time access.
- State - Indicates the current state of the selected user account:
active, disabled, or locked. User accounts are generally in an active
state. An account becomes disabled if it has not been used for the
period of time that is defined by the user account security policy,
or if the account is manually disabled. A disabled account remains
disabled until it is manually enabled. An account is locked when too
many consecutive, unsuccessful login attempts are made to access the
account. The account remains locked for the period of time determined
by the user account security policy, after which it is unlocked automatically.
The account can also be manually unlocked.
- The following options are available to configure a new user on
the Accounts page:
- Create User - Define a new user, password and authorization profile.
This is a multiple step option that enables the creation of a user
name and password, and limits the maximum number of simultaneous login
sessions for the user (see methods of creating a new user in User authority management for detailed process). You can associate the user name with
one of the following authorization permission groups:
- Supervisor - Enables read-write permission for all operations
on all components in the chassis.
- Operator - Enables read-only permission for all configuration
and status information on all components in the chassis.
- Custom - Enables a user-defined policy that can be set to allow
read-only or read-write permission for selected components in the
chassis. The custom permission groups are defined on the Permission
Groups page.
- Global Login Settings- Enables
the user to apply some login settings to all users.
- General - Contains overall login settings that are typically used
on the chassis.
- User Authentication Method - Policy that sets how the user is
authenticated, through internal management module authentication,
external LDAP server, or both.
- Web inactivity session timeout - Specify the time that a web session
will remain open while inactive. You can set it for all users or indicate
that the value will be user-specified during login.
- CLI inactivity session timeout - Specify the time in seconds that
the CLI will remain connected during periods of inactivity.
- Number of simultaneous active sessions for LDAP users - Numerical
value of the simultaneous active sessions that the CMM will
allow for each user who logs in using the LDAP authentication method.
The minimum value is 1, and the maximum value is 20. A value of 0
means there is no limit of simultaneous active sessions for LDAP users.
- Authentication event logging - Limits the number of login events
for a user account for a specified period of time. This is to prevent
excessive logging of authentication events.
- Ignore client IP address when tracking user authentication events
- Specifies that a second login event by the same user, but from a
different client will be suppressed when tracking user login events.
When managing the chassis with the optional Lenovo XClarity Administrator or
the Flex System Manager management node, it ignores the setting and always suppresses login
events from the same IP address.
- User creation method - Switches between two available methods
of creating new users:
- username&password (default)
- username&email
See User authority management for more information.
- Account Security Level - Security setting that applies to all
user accounts that are defined on the CMM.
The Legacy and High settings specify fixed values that
manage the user accounts, with higher security requirements for the High setting. The Custom security setting allows the user
to customize a policy for the user accounts.
- Currently Logged In Users - List of the currently
logged-in users, including user name, source IP address, and access
protocol. Non-active users will be deleted according to the “inactivity
session timeout” settings.
- Delete - Removes the selected user account.
- Permission Groups - Enables user-defined custom permission groups,
which are used for defining the authorization policy for user actions.
The default supervisor group provides read-write access and the operator
group provides read-only access for all components in the chassis.
A custom permission group allows the user to define an authorization
policy by specifying the read-write and read-only authority for select
components in the chassis. The custom permission groups are generally
defined before a user account is created, so that the custom permission
group is available to be assigned to the new user account. You can
assign a custom permission group to an existing user account by clicking
the user name link in the table.
- Create Group - Multiple-step option that enables the user to define
a new custom permission group. The following options are available:
- Group Name - Descriptive text that identifies the custom permission
group.
- Authority - Roles that the permission group will allow. For example,
to allow a user to have read-only authority for IO modules and read-write
authority for all compute nodes, the I/O module operator and
all four Compute node xxx settings must be checked.
- Access Scope - Restrict the defined authorities to a subset of
components. For example, you can limit the I/O module operator authority to only slots 1 and 2 by selecting I/O Module 1 and I/O Module 2.
- Delete - Removes the selected custom permission group. The default
supervisor and operator groups cannot be removed.
- Group Profiles - Enables the configuration of local (in-chassis)
authorization specifications for groups of users. Each group profile
includes authorizations expressed as Authority Level (Roles) and Access
scope, similar to the user account permission groups. These group
profiles are used in conjunction with LDAP Active Directory servers
and not used when the LDAP client is configured for both authentication
and authorization. To use these group profiles for authorization and
LDAP for authentication, you must properly configure the LDAP Method option in the LDAP Client section.
- Add a Group - Multiple step option that enables the user to define
a new group. The following options are available:
- Group Name - Descriptive text that identifies the group.
- Role - Specifies the authorizations that are granted for the group.
The following authorizations are available:
- Supervisor - Read-write permission for all operations on all components
in the chassis.
- Operator - Read-only permission to view all configuration and
status information on all components in the chassis. No configuration
fields may be altered.
- Custom - User-defined policy that can be set to allow read-only
or read-write permission for selected components in the chassis.
- Authority - For a custom role, the user can select one or more
operations that the group profile will allow or deny. For example,
to allow a user to have only read-only authority for IO modules but
full read-write authority for compute nodes, the I/O module operator and all four Compute node xxx settings must be selected.
- Access Scope - For a custom role, you can restrict the defined
authorities to a subset of components by selecting only those components.
For example, you can limit the I/O module operator authority
can be limited to slots 1 and 2 by selecting I/O Module 1 and I/O Module 2.
- Delete - Removes the selected group from the configuration.
|
| Mgt Module Management |
Firmware |
The Firmware page has a table that contains
information about the level of firmware on each CMM and
an option to update the firmware. If there is a standby CMM,
the location of the primary CMM is
visible. When there is a standby CMM,
the primary CMM receives
the new level of firmware first. After the primary CMM has
been updated, the firmware is then applied to the standby CMM from
the primary CMM.
For additional information about updating firmware for Lenovo Flex
System, see Flex System Firmware Update Guides (an ID might be required to access this content). Attention:
- Installing the wrong firmware update might cause the CMM to
malfunction.
- Before you update the firmware for Power Systems compute nodes
using the optional Lenovo XClarity Administrator or
the Flex System Manager management software, make sure that the
passwords for the Power Systems compute node accounts on the CMM will
not expire before the update is complete. If the passwords expire
during a code update, the compute nodes might not reconnect to the
management software, and each Power Systems compute node might have
to be updated with a new password.
- After you update the CMM firmware,
the old version of the firmware will be the firmware backup after
the CMM has been restarted.
- After updating the firmware, to ensure proper rendering of the
web pages, it is recommended that you clear all browser-cached data.
|
| Security |
The Security page contains options for setting
the overall chassis security policy, including passwords, secure communication
and certificate management. The following option tabs are available:
Security Policies -
Note: The CMM HTTP and HTTPS ports
are open at all times. Port behavior is determined by the CMM HTTPS
port setting, which can be affected by the CMM chassis security policy
setting:
- When the CMM HTTPS port is enabled, the HTTP port (port 80) remains
open and redirects to the HTTPS port (port 443). When the chassis
security policy is set to secure, the CMM HTTPS port is automatically
enabled and its setting cannot be changed.
- When the CMM HTTPS port is disabled, the HTTPS port (port 443)
remains open and redirects to the HTTP port (port 80).
Set the overall chassis security policy on the Security
Policies tab. Use the vertical slider to adjust the security policy
level to one of the following:
- Legacy - Provides the least amount of security but the greatest
level of flexibility for managing platform security. Some attributes
of the policy are as follows:
- Weak password policies are permitted.
- Well-known passwords for network login are not required to be
changed.
- Unencrypted communication protocols may be enabled.
- Secure - Default security setting and the most secure, this policy
provides a moderate level of user control over the chassis. Some attributes
of the policy are as follows:
- Password policies are automatically checked and required to be
strong.
- Well-known passwords for network login are automatically required
to be changed after initial setup.
- Only secure communication protocols may be enabled.
- Certificates for establishing secure and trusted connections to
applications running on management processors are automatically generated
and managed by the system.
Secure - When you use the Secure Chassis policy, this tab
also provides feedback and detailed information regarding any problems
encountered in enforcing the Secure policy. For example, the user
might have unsecure Telnet enabled for CLI access when the users tries
to set the chassis policy to Secure. In addition, if any of the components
installed in the chassis are in violation of the overall chassis security
policy, this tab provides details about the violations with suggested
actions to remedy the problem.
- Cryptography - Displays the cryptography compatibility
mode and settings for the CMM.
The Cryptography tab provides the following options:
- NIST mode settings
- Compatibility - Default NIST mode setting with a Public/Private
key length minimum of 1024 bits.
- NIST SP 800-131A - Public/Private key length minimum is 2048 bits.
Hashes used for digital signatures are restricted to SHA-256 or stronger,
and the only symmetric encryption algorithms used are NIST-approved
algorithms with 128-bit or longer key lengths.
- TLS Settings
- Legacy - Default TLS setting that can use SSL v3.0 through TLS
v1.2.
- TLS 1.2 Server Only - Restricts server SSL apps to TLS v1.2 ciphers.
- TLS 1.2 Server and Client - Restricts client and server apps to
TLS v1.2 ciphers.
Note: The default
cryptographic setting for NIST mode settings is Compatibility. The
default for TLS/SSL Settings is Secure. In order to achieve NIST Strict
Compliance, the NIST mode setting must be set to NIST SP 800-131A and TLS/SSL setting must be set to TLS 1.2 Server and Client.
- SSL Servers and Certificates
Note: The CMM HTTP and HTTPS ports are open at all times. Port behavior
is determined by the CMM HTTPS port setting, which can be affected
by the CMM chassis security policy setting:
- When the CMM HTTPS port is enabled, the HTTP port (port 80) remains
open and redirects to the HTTPS port (port 443). When the chassis
security policy is set to secure, the CMM HTTPS port is automatically
enabled and its setting cannot be changed.
- When the CMM HTTPS port is disabled, the HTTPS port (port 443)
remains open and redirects to the HTTP port (port 80).
The CMM can
either act as the certificate authority for all locally signed certificates
or manage the SSL server certificates. The SSL Servers and Certificates
tab provides the following options:
- Enable HTTPS server - Shows if the HTTPS server for the CMM is
enabled or disabled. When the CMM is
operating in Secure mode, the HTTPS server is enabled, disabling the
HTTP server. When the CMM is
operating in Legacy mode, the HTTPS server can be enabled or disabled,
allowing use of the HTTP server.
- CMM Locally-Internally Signed SSL Certificate The CMM acts
as the certificate authority for all locally-signed certificates that
are generated. This selection provides the following options:
- View the internally-signed server certificates
- View the internally-installed root CA certificates
- Set the cipher strength value
- Generate and install a new internally-signed server certificate
CMM Externally Signed SSL Server Certificate and Bundled Chain
of Trust The CMM manages
the SSL server certificates. This section provides the following options:
- View the externally-signed server certificates
- View the externally-installed root CA certificates
- View the internally-signed LDAP server certificates
- Generate a new key pair and CSR
- Install an SSL certificate from a file or using cut-and-paste
- Install an intermediate bundle certificate from a file or using
cut-and-paste
- Install a root CA certificate from a file or using cut-and-paste
- Set the cipher strength value
- Generate and install an internally signed server certificate for
the LDAP server
- LDAP Client Security - Enable secure LDAP support
and manage associated certificates from this tab. The following options
are available:
- CMM External LDAP Connection Security
- Select the connection security level
- CMM External LDAP Client Certificate Management
- Add, view, delete, and export trusted root CA certificates
- Add, view, delete, and export LDAP certificate relocation lists
- Enable an external server CRL check
- Generate and import an externally-signed LDAP client certificate
- View and delete an installed LDAP client certificate
- SSH Server - Enable the SSH server for the secure CLI user interface,
and generate private host keys from this tab.
- Access Control - User can configure to allow or deny user access
based on their IP/MAC. The list associated with a policy can include
maximum of 10 IPV4, 10 IPV6 and 10 MAC (30 in total). There are three
policies available:
White List
Only users with IP/MAC in the table of the
granted are allowed access.
Black List
All users are allowed access except those
with IP/MAC in the table of the denied.
No policies
Any other policy and IP/MAC are removed.
Note:
User can set a timeframe for the policy to take place by entering
starting and ending date. Otherwise, the newly selected policy takes
effects immediately.
The selected policy persists after system reboot, but will
be erased after system downgrade when the system goes to a version
lower than 1.3.0(1AON08A).
Backup or restoration of policies is not available yet, but
will be included in a future release.
|
| Mgt Module Management |
Network |
The Network page contains settings to configure
how the CMM communicates through the Ethernet, using different network
protocols. The following tabs are available from the Network page:
|
| Mgt Module Management |
Configuration |
The Configuration page
provides a means of backing up the management module configuration
settings to a file and the ability to restore these settings from
a file. For example, to configure a set of chassis, a single machine
may be configured, that configuration saved in a file, which can then
be transferred to the other chassis and restored. Optional encryption
of sensitive configuration data can also be specified. "Use legacy
backup file" option should only be selected for backup files that
were created with IBM CMM build older than 2PET12K Some restore
operations may cause a temporary loss of web connectivity. Under these
circumstances, the final confirmation popup and restore log may not
be available. If web connectivity is lost, clear the browser cache
(Ctrl+F5)and restart your session. For example, SSL certificates are
dependent upon IPv6 addressing. If you change the IPv6 configuration,
then the certificate becomes obsolete and a new one has to be generated.
As a result, the user will lose browser connectivity.
This page
also is the launching point for the initial setup wizard, which provides
a guided sequence of steps to configure many common functions on a
newly deployed chassis, including:
Checking initial hardware status and inventory
Importing an existing configuration file
General identification settings, such as chassis and management
module labels and location information
Date and time setup
Management module IP configuration
User ID and password updates
IO module characteristics
Chassis security policy level
Domain name services
Event recipient configuration - The allowed characters for
the recipient portion of the email are !#$%&'*+-/=?^_`{}|~ but
quoted string forms are not allowed. For example, !#$%&'*+-/=?^_`{}|~@example.org
is supported.
|
| Mgt Module Management |
Properties |
The Properties section contains options to configure
the primary and standby CMM.
The following tabs are available:
- General - Enter a unique CMM name
and set the serial port attributes.
- Date and Time - Set the time manually or with an NTP
server. For manual operation, the date and time value is explicitly
set and maintained by the system management software. For the NTP
server mode, the user specifies the NTP server IP address, update
frequency, and whether authentication is required. No matter which
mode is chosen, the timezone setting can also be configured. This
setting displays international time zones ordered by major region/minor
region. Some have comments to assist in making the selection.
Note: If you choose to set the date and time from an NTP server, the CMMNTP v3 Authentication key index and NTP v3 Authentication
key must match the key ID and password values set on the NTP server.
For example, if you are using an external Linux-based NTP server with
a key ID of 1234 and a password of my_password, you
would typically add 1234 M my_password to /etc/ntp.keys. In addition, you should also add trustedkey 1234 to /etc/ntp.conf. If you are using an optional management device, such as the Lenovo XClarity Administrator or
the Flex System Manager management node, as the NTP server, make
sure that you use the key ID and password that you specified for the
management device. See the documentation for your NTP server for information
about setting a key ID and password.
- Advanced Failover - When a standby CMM is
installed, the Advanced Failover tab enables the user to configure
the behavior and network properties of the standby CMM.
The following options are available.
Note: If you enable
IP address swapping during failover with both CMMs
set to the same static IP address, you must disable DHCP.
- Use Advanced Failover - Enable or disable the use of CMM failover.
- IP Address Policy - When a failover situation occurs, the following
options are available for the handling of IP addresses:
- Do not swap Management Module IP addresses - In a failover situation,
you must login to the CMM,
using the IP address that you have specified for the standby CMM.
- Swap Management Module IP addresses - In a failover situation,
the IP address that you use for the CMM remains
the same. The IP address of the failed CMM is
transferred to the standby CMM,
and back from the standby to the primary CMM.
- Host Name - Host name defined for the standby CMM interface.
- Domain Name - Domain name defined for the standby CMM interface.
- IPv4 Config - IPv4 configuration for the standby CMM interface.
If DHCP is enabled for the primary CMM interface,
it will also be defined for the standby. If DHCP is disabled, the
user can define the static IP address, mask, and gateway.
- IPv6 Config - IPv6 configuration of the standby CMM.
If IPv6 static address support is enabled on the primary CMM,
the user can define the standby CMM IPv6
static IP address.
|
| Mgt Module Management |
License Key Management |
The License Key Management page provides status
information related to I/O module and chassis licensed features that
are installed on chassis switches. The following option tabs are available:
- IOM License Keys Management - Status information related to I/O
module licensed features that are installed on chassis switches. Each
key generally provides the following information:
- Cert - Identifying number of a key in the table
- Index - Identifying number of a particular key on an I/O module
- Bay - Bay number of the I/O module
- Valid Through - Expiration date of the key
- Description - Text description of the key
- License ID - Unique identifier for the key
- Other Info - Other relevant text about the key
- Status - Status of the key
- Chassis License Keys Management - Status information related to
chassis licensed features that are installed on the chassis. Each
key generally provides the following information:
- Index - Identifying number of a particular key on the chassis
- Feature - Text name of the key
- Feature Type - Numeric identifier of the key
- Description - Text description of the key
- System - Text description of the related system of the key
- License ID - Unique identifier of the key
- Validation - Validation scheme used by the key
- Status - Status of the key
- Constraint - List of any constraints imposed on a key. If there
are none, a (-) minus sign is displayed in the cell.
|
| Restart |
This option enables the user to restart the
primary and standby CMM from
the web interface. The following selections are available:
- Normal Restart - This option does not change the current configuration,
but all existing network connections are temporarily lost. If the
local system is being restarted, you must open a new browser window
and log in to the web interface again.
- Restart and Switch to Standby Management Module - This option
restarts the primary CMM,
then switches over to the standby CMM.
All existing network connections are temporarily lost. You must open
a new browser and log in again to get back to the web interface.
- Restart Standby Only - Restarts the standby CMM.
|
| Reset to Defaults |
This option enables the user to set the CMM configuration
to its defaults. This operation might cause network connections to
the CMM to be lost. After the configuration has been initialized,
the CMM is automatically reset to activate the default configuration.
The user can optionally choose to keep the event log and not clear
the log information. Note: Resetting the CMM to
the default settings can be used to disable centralized user management
and return chassis management capability to the CMM.
|
| Mgt Module Management |
File Management |
The File Management page contains
options to view and delete files in the CMM local storage file system
and to monitor space usage. The File Management section allows the
user to view and delete files in the CMM local
storage file system and to monitor CMM space
usage. The following options are available:
- Click the directory name to view that directory level.
- Go Up One Level - Returns to the previous directory.
- Delete Selected - Removes files that have been selected. Supervisor
or Chassis Administrator access is required to delete a file.
- Download File - Select a file and click the download button to
download it.
- The total, used, and available space are shown at the top of page.
|