EMC® VNX® Series Security Configuration Guide for VNX

Authentication configuration

Security is initialized differently for VNX unified/file and VNX for block systems.

VNX unified/file systems will have the following management accounts factory installed:

• root - This is a VNX for file local account and provides root-level privileges on the control station.
• nasadmin - This is a VNX for file local account and provides administrator level privileges on the control station.
• sysadmin - This is a global system account and provides administrator level privileges for both VNX for file and VNX for block.

A system account is a special global account that is needed for internal communication between block and file services. VNX unified/file systems require at least one system account. You cannot delete this system account unless another global administrator account or global security administrator account is available.

VNX Installation Assistant (VIA) is the utility for initializing VNX unified/file systems. EMC recommends to change the default password for the three accounts when first initializing a VNX unified/file system using VIA.

VNX for block systems do not have any default management accounts. The Unisphere Initialization wizard is the utility used for initializing VNX for block systems. Security can be initialized on VNX for block systems in the following ways:

• User can choose to create a global account when initializing the system using Unisphere Initialization wizard.
• User can create a global account when first logging into Unisphere.

A system account is not created by default on VNX for block systems because it is not needed; however, adding another VNX unified/file system to the VNX for block system's local domain would require a system account and the user will be prompted accordingly to create a system account.

For all VNX systems (VNX unified/file and VNX for block), at least one global account is required. This account must have the "administrator" or "security administrator" role. An LDAP server(s) can be configured if LDAP authentication is desired, and other global or local accounts can also be created.

Security functions having to do with configuring authentication can be performed either from Unisphere or secure CLI.