Manualshelf

Users Guide

ManualsBrandsDell ManualsAccess PlatformsSmartFabric OS10 Documentation
1361136213631364136513661367136813691370
Table Of Contents
● Generating a CSR and installing a host certificate — see Request and install host certificates.
1. Install a trusted CA certificate.
OS10# copy tftp://CAadmin:secret@172.11.222.1/GeoTrust_Universal_CA.crt
home:// GeoTrust_Universal_CA.crt
OS10# crypto ca-cert install home://GeoTrust_Universal_CA.crt
Processing certificate ...
Installed Root CA certificate
CommonName = GeoTrust Universal CA
IssuerName = GeoTrust Universal CA
2. Generate a CSR, copy the CSR to a CA server, download the signed certificate, and install the host certificate.
OS10# crypto cert generate request cert-file home://s4048-001.csr key-file home://
tsr6.key cname "Top of Rack 6" altname "IP:10.0.0.6 DNS:tor6.dell.com" email
admin@dell.com organization "Dell EMC" orgunit Networking locality "Santa Clara" state
California country US length 1024
Processing certificate ...
Successfully created CSR file /home/admin/tor6.csr and key
OS10# copy home://tor6.csr scp://CAadmin:secret@172.11.222.1/s4048-001-csr.pem
OS10# copy scp://CAadmin:secret@172.11.222.1/s4048-001.crt usb://s4048-001.crt
OS10# crypto cert install crt-file usb://s4048-001.crt key-file usb://s4048-001.key
This will replace the already installed host certificate.
Do you want to proceed ? [yes/no(default)]:yes
Processing certificate ...
Host certificate installed successfully.
3. Configure an X.509v3 security profile.
OS10# show crypto cert
-------------------------------------
| Installed non-FIPS certificates |
-------------------------------------
s4048-001
-------------------------------------
| Installed FIPS certificates |
-------------------------------------
OS10# config terminal
OS10(config)# crypto security-profile secure-cluster
OS10(config-sec-profile)# certificate s4048-001
OS10(config-sec-profile)# exit
4. Configure the cluster security profile.
OS10(config)# cluster security-profile secure-cluster
OS10(config)# exit
SSH Smart Card Authentication
OS10 allows you to use Common Access Card (CAC) and Personal Identity Verification (PIV) smart cards for authenticating
users when connecting with Secure Shell (SSH). CAC and PIV smart cards contain Public Key Infrastructure (PKI) X.509v3
certificates that are issued by certificate authorities. This feature allows the OS10 software to verify user authentication and
email signing and encryption. To use smart card authentication, use an SSH client that supports X.509v3 authentication.
The OS10 SSH server supports X.509v3 smart card authentication in two forms - with or without a password. When you use
X.509v3 authentication with passwords, you can use X.509v3 authentication along with remote authentication using RADIUS or
TACACS+ authentication.
Security
1363