2016 Symantec Corporation This document may be freely reproduced & distributed whole & intact including this copyright
notice.
23
Role
Description
FIPS 140-2
role
Authentication
type
Manage
Policy
Access to management interface with ability to
manage/view policy, manage/view SSL logs and
view PKI information.
Manage
Policy
Username/
Password
Manage PKI
Access to management interface and physical
appliance, with ability to manage/view PKI
information, manage PKI role for a user, view
appliance settings, and view user details.
Crypto Officer Username/
Password
It is possible for a single operator to have multiple roles. For example, an
administrator might have Manage Appliance and Manage Policy roles, or a
Crypto Officer may have both Manage PKI and Manage Policy roles.
For the purposes of FIPS 140-2, any user with the Manage PKI role should be
viewed as a Crypto Officer, and any user with the Auditor role should be viewed
as a User.
When the system is initialized it enters a bootstrap process and remains in this
state until there is at least one user with the Manage Appliance role, and one user
with the Manage PKI role. One user could have both roles.
2.4.1 Management Interfaces
Before accessing the module for administrative services, administrators must
authenticate using the methods specified in Section
. The module offers the following management interfaces:
•
WebUI: A graphical user interface accessible remotely with a web browser
that supports TLS. Authentication is required before any functionality is
available.
•
CLI: A limited command line interface is accessible remotely using SSH,
locally via the serial console port, and through the VGA port using a
monitor and keyboard. Authentication is required before any
functionality is available.
The Web user interface is accessed over a separate management-only Ethernet
connection. Connection to this interface does not provide access to data being
processed by the module.
A limited set of management interfaces are provided through the LCD, keypad,
and LEDs on the front panel of the module. No authentication is required;
however, physical access is needed. See
for a full listing of these
services.
2.4.2 Authentication Mechanisms
Authentication to the management interfaces enumerated in Section
requires a username and password. Details of the
authentication mechanisms are given shown in
The valid character set that can be used in passwords is:
•
lowercase alpha (26 characters)
•
uppercase alpha (26 characters)
•
numeric (10 characters)
