EMC® VNX® Series Security Configuration Guide for VNX

Security for management access

On any VNX storage system, the following management applications can be used to access the system:

• Unisphere - One of the two main applications you use to configure, monitor, and manage VNX systems. Unisphere is a web-based GUI that can be launched by pointing the browser to the IP address of either the Control Station or the Storage Processors (SPs).
• Command Line Interface (CLI) - The other main program you use to manage VNX systems. The CLI is separate for block and file services. Block CLI can be installed and run from any host that has network connectivity to the VNX. File CLI can be accessed by opening a remote session to the Control station using SSH.
• Unisphere Service Manager (USM) - This software allows you to update, install and maintain VNX system hardware and software as well as provide contact and system information to your service provider.
• Unisphere Host Agent or server utility - These optional software programs run on SAN-attached hosts. Their main function is to help communicate host attributes and LUN/volume mappings to the storage system.
• Unisphere Initialization Utility - This optional software allows you to initialize VNX for block systems and network settings from a workstation.
• VNX Installation Assistant (VIA) - This software allows you to initialize VNX unified (block and file) and VNX for file systems and network settings from a workstation.
• SNMP management software - This optional software allows you to monitor the state of VNX systems.
• Admsnap and admhost - These optional management utilities help you manage SnapView™ and SAN Copy™ replication objects.
• Remote support services - Remote EMC support is available for VNX systems. Many customers use this customer service software to allow EMC to help them configure and monitor their systems.
• Unisphere Server software - This software executes the storage management functions described in this guide. In this guide, this software is also called the storage management server. This software is pre-installed on VNX SPs and Control Station. This software can optionally be installed on Windows XP or Windows Server.

As shown in VNX Management components, the various components communicate with the VNX system by both in-band and out-of-band. In-band communication travels over the data connection to the VNX system, while out-of-band communication travels over the management connection to the VNX system.

It is imperative that management access to the VNX is controlled and limited to authorized users and applications. To secure management access, VNX implements the following main functions:

• Authentication - Identify who is making a request.
• Authorization - Determine if the requestor has the right to exercise the request.
• Privacy - Protect against snooping of data.
• Trust - Verify the identity of communicating parties.
• Audit - Keep a record of who did what, and when.