21 Cyber security
WCC Lite is based on OpenWRT operating system. OpenWrt is described as a Linux distribution for
embedded devices. WCC Lite has same functionality as Linux OS including user management.
Basic configuration on WCC Lite can be done using web based frontend.
More advanced
configuration is available over terminal interface. For secure web access, WCC Lite can be accessed
via HTTPS (TLS) instead of the unencrypted HTTP protocol. You can use
openssl
utility to generate
your own certificate authority and certificates to be used on web interface. Certificates can also be
named or placed in whatever directory you wish by editing
/etc/lighttpd/lighttpd.conf
.
Terminal is accessible over Telnet or SSH. For security reasons we strongly recommend to use SSH.
SSH, also known as
Secure Socket Shell
, is a network protocol that provides administrators with a
secure way to access a remote computer. SSH also refers to the suite of utilities that implement the
protocol. Secure shell provides strong authentication and secure encrypted data communications
between two computers connecting over an insecure network such as the Internet. SSH is widely
used by network administrators for managing systems and applications remotely, allowing them to
log in to another computer over a network, execute commands and move files from one computer
to another.
21.1 User rights
Depending on the user name, different rights are defined: admin is generally entitled to make
changes while user does not have any editing permissions, the relevant buttons are disabled. User
can be assigned to one of fifteen user groups that can access different amounts of device parameters.
Highest (fifteenth) permision level grants the same permission as root user has. User group rights
can be edited to give more rights or restrictions, except for highest (15th) level.
21.1.1 User management and rights authentication
WCC Lite provides different authentication mechanisms:
• Authentication via locally stored credentials.
In this scenario all users, passwords and
permissions are encrypted and stored in internal WCC Lite storage.
• Authentication via external RADIUS Server.
In this scenario all users, passwords and
permissions (profiles) are defined in remote RADIUS Server. Login into WCC Lite is available
only if RADIUS Server will grant authentication and will provide user profile with user rights on
that device (more detailed description below). This also means that a password for such user
cannot be changed remotely.
• Authentication via external RADIUS Server with fallback option. In this scenario users will be
authenticated via RADIUS server. If server fails to respond (configured timeout is passed) WCC
will use locally stored credentials. Fallback options are selected with PAM configuration.
By default only authentication via locally stored credentials is allowed. For authentication via external
RADIUS server a user should at first enable RADIUS process and configure at least one server.
21.1.2 Locally stored credentials management
Device has predefined default users like
root
and
user
.
148
