Creating Multiple Restrictions And Roles - HP Integrated Lights-Out User Manual

Creating multiple restrictions and roles

The most useful application of multiple roles includes restricting one or more roles so that rights do not
apply in all situations. Other roles provide different rights under different constraints. Using multiple
restrictions and roles enables the administrator to create arbitrary, complex rights relationships with a
minimum number of roles.
For example, an organization might have a security policy in which LOM administrators are allowed to
use the LOM device from within the corporate network but are only able to reset the server outside of
regular business hours.
Directory administrators might be tempted to create two roles to address this situation, but extra caution is
required. Creating a role that provides the required server reset rights and restricting it to an after-hours
application might allow administrators outside the corporate network to reset the server, which is contrary
to most security policies.
In the example, security policy dictates general use is restricted to clients within the corporate subnet, and
server reset capability is additionally restricted to after hours.
Alternatively, the directory administrator could create a role that grants the login right and restrict it to the
corporate network, then create another role that grants only the server reset right and restrict it to after-
hours operation. This configuration is easier to manage but more dangerous because on-going
administration might create another role that grants users from addresses outside the corporate network
the login right, which could unintentionally grant the LOM administrators in the server Reset role the ability
to reset the server from anywhere, provided they satisfy the time constraints of that role.
The previous configuration meets corporate security policy. However, adding another role that grants the
login right can inadvertently grant server reset privileges from outside the corporate subnet after hours. A
more manageable solution would be to restrict the Reset role, as well as the General Use role.
Directory-enabled remote management 139