Page 1
Dell Open Manage Server Administrator Security Configuration Guide December 2022 Rev. A02
Page 2
Notes, cautions, and warnings NOTE: A NOTE indicates important information that helps you make better use of your product. CAUTION: A CAUTION indicates either potential damage to hardware or loss of d...
Page 3
Contents Chapter 1: Overview...................................................................................................................... Legal disclaimer........................................
Page 4
Security updates and patching ................................................................................................................................ Code and product authenticity and integri...
Page 5
Overview Server Administrator provides a comprehensive one-to-one systems management solution in two ways: from an integrated web browser-based graphical user interface (GUI) and from a command line i...
Page 6
Audience This document is intended for individuals who are responsible for managing security on servers where Server Administrator is installed. Document references Server Administrator documents are ...
Page 7
To provide feedback on this documentation, email us at [email protected]. Overview
Page 8
Security quick references Topics: Deployment models Security profiles Deployment models Server Administrator does not explicitly have a deployment tool. Server Administrator can be installed securely ...
Page 9
Session time-out configuration is available to set the web interface idle timeout duration. The default timeout is 30 minutes. Role-based access Role-based access is given to all local and domain user...
Page 10
Product and subsystem security Topics: Security control maps Authentication Authorization Network security Data security Cryptography Auditing and logging Serviceability Code and product authenticity ...
Page 11
Figure 1. Server Administrator interfaces Authentication Server Administrator provides a login web interface for customers to provide user credentials. Server Administrator by default uses the operati...
Page 12
Table 1. Authentication interfaces of supported operating systems Supported operating Authentication interfaces system Windows On supported Microsoft Windows operating systems, Server Administrator us...
Page 13
Authorization The authorization details for users configured on the system and configuring roles to those users are described. General authorization settings By default, all users can login to Server ...
Page 14
1. In line 113, set the compression attribute to "off", and then save the server.xml file. The directory path for the server.xml file is <Install Path>\Sys Mgt\apache-tomcat\conf. 2. R...
Page 15
Encryption: SHA-256, SHA-512 Cryptographic configuration options The SSL protocols, cipher suites, and encryption can be configured through the webserver preferences. Certificate management For more i...
Page 16
Log protection There is no explicit handling of log message with encryption. Logging format OMSA internally uses xml format for logs. Sample log entries are: Feature Usage log: <OMSA_GUI><fea...
Page 17
Severity level of the event Event ID Date and time that the event is captured Category of the event Description of the event Serviceability There is no explicit serviceability feature in Server Admini...
Page 18
Miscellaneous configuration and management elements Topics: Customer modification and customization Installing client software Protecting authenticity and integrity Backups of application or data Cust...
Page 19
Internal security information Topics: Embedded component usage Internally discovered issues Embedded component usage Table 3. List of third-party components Third-party components Version Eclipse Temu...
Page 20
Appendix A For more information, see the following links: Topic Links NIST SP 800-53 https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final Do D Public SRG\STIG Downloads https://public.cyber...
Page 21
Appendix B Supported TLS cipher suites SSL provides a secure connection between the web server and the browser. During configuration, choose the ciphers that support the web server. The connection ser...
Page 22
Accessing support content from the Dell Technologies support site Access supporting content related to an array of systems management tools using direct links, going to the Dell Technologies support s...
Page 23
Contacting Dell Technologies Dell Technologies provides several online and telephone-based support and service options. Availability varies by country and product, and some services may not be availab...