Role strategy and role authorizations

One major part of the security strategy is the role strategy which incorporates the following features:

• The roles are graduated: Only the necessary interfaces and functions are available to each role.
  
  

• Each user account is permanently assigned to a role.
  
  

• No rights escalation is possible, i.e. no access (or transition) is possible to interfaces and functions other than those envisaged. In particular, no access is possible to the root account of the base operating system.
  
  

• Roles
  For users, the basic roles mentioned below are defined. In addition, user-defined roles can be configured by combining basic roles. With the exception of the Administrator and Service roles, the remaining roles have restricted rights tailored to their respective areas of responsibility. In addition to the SEM functionality described below, each basic role also has access to some further SEM windows like the main windows Dashboard and Certificates and may administrate its own password, download the CA certificate of the MU and access the event logging.

  • Administrator
    The Administrator role is higher ranking than the other roles (except the Service role). It entitles to all functions of the SE Manager as well as for shell access and execution of all functions of the recommended CLI. It cannot be combined with other roles in a user-defined role.

  • BS2000 administrator
    A BS2000 administrator has the authorization for functions of the SE Manager which are necessary to operate BS2000 systems. In addition, they also have some administrator authorizations: switching the units SU, MU and HNC on/off, performing a CSR backup, creating diagnostic data, accessing the shadow terminal, read access to the hardware inventory, and configuration of scheduled power on/off of the units SU, MU and HNC. Furthermore a BS2000 administrator may execute the commands bs2Console, bs2Dialog and svpConsole via PuTTY on a remote unit.

  • BS2000 operator
    A BS2000 operator has the authorization for functions of the SE Manager which are necessary to operate BS2000 systems. An administrator or security administrator can also configure specific authorizations individually for a BS2000 operator account. Furthermore a BS2000 operator may execute the commands bs2Console, bs2Dialog and svpConsole via PuTTY on a remote unit.

  • AU administrator
    An AU administrator has the authorization for functions of the SE Manager which are necessary to operate the systems on AUs. In addition, they also have some administrator authorizations: switching the AUs on/off, read access to the hardware inventory, and configuration of scheduled power on/off of the AUs.

  • Read-only administrator
    A Read-only administrator has the right to view all windows of the SE Manager, however modifying actions are not allowed.
  • Security administrator
    A Security administrator has full authorization for the windows and functions of the SE Manager under the categories Authorizations and Logging.
  • Hardware administrator
    A Hardware administrator has full authorization for the windows and functions of the SE Manager under the categories Hardware -> Units, Hardware -> HW inventory, Hardware -> Energy and Service -> Units.
  • Storage administrator
    A Storage administrator has full authorization for the windows and functions of the SE Manager under the categories Devices -> … -> IORSF files | Disks | Tape devices, Hardware -> Units -> … -> FC interfaces | Multipath disks | CRD disks and Hardware -> Storage (without STORMAN!).
  • Power operator
    A Power operator has authorization for the main window Units under the category Hardware and the functions for powering units on and off.
  • IP network administrator
    An IP network administrator has full authorization for the windows and functions of the SE Manager under the categories Hardware -> Units -> … -> IP interfaces, Hardware -> Management -> … -> IP configuration | Routing & DNS and Hardware -> IP networks.
  • FC network administrator
    An FC network administrator has full authorization for the windows and functions of the SE Manager under the categories Hardware -> FC networks and Devices -> BS2000 paths.
  • Shadow terminal operator
    A Shadow terminal operator has authorization for access to the main window Service -> Units -> <MU> -> Remote Service, wherefrom a shadow terminal can be opened.

  • Add-on-specific roles

    • OPENSM2

      • OPENSM2 administrator
        An OPENSM2 administrator has authorization for access to the add-on OPENSM2 and to its administration on all Management Units.
      • OPENSM2 information
        A user with role OPENSM2 information has authorization for access to the add-on OPENSM2. The administration of the add-on is not allowed.

    • OPENUTM

      • OPENUTM administrator
        An OPENUTM administrator has authorization for access to the add-on OPENUTM and to its administration on all Management Units (Master and Administration Write privileges).
      • OPENUTM operator
        An OPENUTM operator has authorization for access to the add-on OPENUTM including administration (Administration Write privilege).
      • OPENUTM information
        A user with role OPENUTM information has authorization for read access to the add-on OPENUTM (Administration Read privilege).

    • ROBAR

      • ROBAR administrator
        A ROBAR administrator has authorization for access to the add-on ROBAR and to its administration on all Management Units.
      • ROBAR operator
        A ROBAR operator has authorization for access to the add-on ROBAR. The administration of the add-on is not allowed.

    • STORMAN

      • STORMAN administrator
        A STORMAN administrator has authorization for access to the add-on STORMAN and to its administration on all Management Units.

      • STORMAN information
        A user with role STORMAN information has authorization for access  to the add-on STORMAN. The administration of the add-on is not allowed.
  • Service
    The Service role is reserved exclusively for Customer Support.
  
  Overviews of the role-specific tasks and functions are also provided in the “Operation and Administration” manual [2] and in the online help.
  
  When special basic roles are mentioned below, such as BS2000 administrator or Security administrator, this also refers to those user-defined roles which contain these basic roles.
  
  

• Individual rights for BS2000 operators

  An administrator or security administrator can grant and deny rights for certain functions of the SE Manager to a BS2000 operator account.

  • Console access to particular BS2000 systems

  • Dialog access to particular BS2000 systems

  • SVP  SU /390

  Security-relevant actions

  An administrator or security administrator can release or lock the following functions of the SE Manager for operating (see main menu Authorizations -> Users -> Operator rights):

  • Access to the SVP (SE Server with SU /390 only)

  • Access to a BS2000 console on a particular BS2000 system

  • Access to the BS2000 dialog on a particular BS2000 system