2.6
Table Of Contents
- ACE Management Server Administrator’s Manual
- Contents
- About This Book
- Introduction
- Planning an ACE Management Server Deployment
- Installing and Configuring ACE Management Server
- Configuration Options for ACE Management Server
- Prerequisites for Configuring the Server
- Starting ACE Management Server Configuration
- Viewing and Changing Licensing Information
- Using an External Database
- Creating Access Control
- Uploading Custom SSL Certificates
- Logging Events
- Applying Configuration Settings
- Load-Balancing Multiple ACE Management Server Instances
- Typical Setup Using Load-Balanced ACE Management Server Instances
- Install the Required Services for Load Balancing
- Use the Same SSL Certificate on All Servers
- Create New SSL Certificates and Keys for Each Server
- Installing and Configuring the Load Balancer
- Verify That ACE Instances Are Using the Load Balancer
- Managing ACE Instances
- Viewing ACE Instances That the Server Manages
- Search for an Instance
- Sort by Column Heading and Change Column Width
- Show, Hide, and Move Columns in the Instance View
- Create or Delete Custom Columns in the Instance View
- View Instance Details
- Reactivate, Deactivate, or Delete an ACE Instance
- Change a Copy Protection ID
- Reset the Authentication Password
- Add Information for Custom Columns
- Troubleshooting and Maintenance
- Appendix: Database Schema and Audit Event Log Data
- Glossary
- Index
ACE Management Server Administrator’s Manual
18 VMware, Inc.
Security Features and Considerations
Bydefault,ACEManagementServerusestheSecureSocketsLayer(SSL)protocoltoprovideencryptedand
securecommunications.
FollowingisanoverviewofsecurityfeaturesandrecommendationsonhowtoconfiguretheACE
ManagementServertoavoidsecurityproblems:
TraffictoandfromclientsisprotectedbyHTTPS–Bydefault,ACEManagementServercreatesa
self‐signedcertificatewhenyouinstallittouseforHTTPStraffic.Thesecertificatesaresecure,butyou
canalsoconfigureACEManagementServertouseyourowncertificateandkeypairs.
TrafficfromACEManagementServertoActiveDirectoryisencrypted–Iftheserverisintegratedwith
anActiveDirectoryservice,itcommunicateswiththeservicethroughanSSL‐protectedlink.LDAPtraffic
isencryptedattheapplicationlayer.CredentialsareprotectedbyusingtheKerberosprotocolto
authenticatecredentials.
Sensitiveconfigurationoptionsareencrypted–Passwordsstoredintheconfigurationfileareencrypted.
Databasesecurity–Thedatabasestorecontainssensitivedatasuchascryptographickeys.Configure
yourdatabasesecuritysothatitisprotectedfromintrusionandprotectedincaseofdataloss.Formore
informationaboutfeaturesthatareavailabletoprotectyourdata,seeyourdatabasedocumentation.
SSLencryptsdatathrough
theuseofapublic‐keyandprivate‐keypair.Thepublickeyisknowntoeveryone
andtheprivatekeyisknownonlytothemessagerecipient.URLs thatrequireanSSLconnectionstartwith
https.
DuringACEManagementServerinstallation,thefollowingtwofilesarecreated:
server.key–AnRSA1024‐bitkey,thisistheprivatekey.
server.crt–Aself‐signedcertificate.Itssignatureisverifiedbythepublickey,whichisembeddedin
thecertificate.Thispubliccertificateisvalidfor10yearsfromthedateandtimeatwhichtheserveris
installed.ThecertificatefileisencodedinPEMformat.
Bydefault,thesefiles
arestoredintheSSLdirectoryintheVMwareACEManagementServerprogram
directory.
VMwarePlayer,whichrunstheACEinstances,doesnottrustanycertificatesstoredonthehostmachineon
whichitisrunning.Instead,itreliesonacompletecertificationchainthatisincludedintheACE
package.
Usingself‐signedcertificatesisadequateformostsecurityneeds.
Youcan,however,useacertificateissuedbyacertificateauthority.IfyouhavemultipleACEManagement
Serverinstances,youcanuseonecertificateforalloryoucanuseadifferentcertificateoneachone.
Using SSL Certificates and Protocol
WhenanACE‐enabledvirtualmachineconnectstoanACEManagementServer,itdownloadsthepublic
certificateforthatserverandanychainofcertificatesrequiredtoverifytheserver’spubliccertificate.Aserver
certificatemighthaveachainofseveralcertificatesthatmustbeverifiedstepbystepuntilthe
verification
processreachestheroot,ortrusted,certificateinthecertificatestore.Thefirsttimeaconnectionismadetoa
serverbyanyACE‐enabledvirtualmachineonaWorkstationadministratormachine,thecertificateandits
verificationaredownloadedtotheWorkstationhostsystem.
Thestoreorcollectionofcertificates
thatisdownloadedwhenanACE‐enabledvirtualmachineconnectstoa
serverisincludedineachACEpackagethatyoucreatewiththatvirtualmachine.ItissavedintheACE
Resourcesdirectory.WhenyoudeployandrunanACEinstanceofthisACE‐enabledvirtualmachine,the
VMwarePlayer
applicationusesthecertificatesincludedinthepackagetoverifyconnectionsmadetotheACE
ManagementServer.ItverifiesthatthecertificatesthatareintheACEpackagematchthosethattheserver
provides.Iftheydonotmatchexactly,VMware Playerdisplaysanerrormessageanddoesnotrunthe
instance.