IBM i Series Handbook page 28

that is directly attached to the system is a physical connection similar to a twinaxial console. The
serial cable you use for Operations Console using a direct connection can be physically secured
similar to a twinaxial connection to control access to the physical console device. Operations
Console local console on a network uses a version of Secure Sockets Layer (SSL) that supports
device and user authentication, but without using certificates.
Device authentication
The device authentication is based on a service tools device ID. By default, the system
administers service tools device IDs. The initial value for the number of automatically created
service tools device IDs is set to 10. With the default service tools device ID QCONSOLE, 11 PCs
can be connected to a system at the same time, each with a unique service tools device ID. If you
set this value to zero, you will have to administer the service tools device IDs manually. Service
tools device IDs are administered manually in dedicated service tools (DST) and system service
tools (SST). They consist of a service tools device ID and a service tools device ID password. The
default service tools device ID is QCONSOLE and the default password is QCONSOLE. An
Operations Console local console on a network encrypts and changes the password during each
successful connection. You must use the default password to initially set up your system if you
use a local console on a network (LAN).
The device authentication requires a unique service tools device ID for each PC that is configured
with a local console on a network (LAN) connection.
| When using a local console on a network (LAN), the configuration wizard determines if the
system is capable of automatically creating a service tools device ID. If it is, the system skips the
|
process for the user to create a service tools device ID. If you need to manually assign a
|
| user-created service tools device ID to a new configuration without turning off the autocreate
function, simply disconnect the PC from the network while you create the configuration so that
|
Operations Console cannot validate the function. You will then be prompted for the user-created
|
| service tools device ID. By default, the initial service tools device ID password is set to the name
of the service tools device ID in uppercase.
|
| Note: The access password protects the service tools device ID information (service tools device
ID and password) on the PC. By default, Operations Console manages the access password
|
for you. During the configuration process, you are not presented a window in which to
|
| assign an access password. However, should you elect to manually administer this
password, you can change it using the Properties and the Access Password tab.
|
When establishing a network connection, the Operations Console no longer prompts you for the
|
| access password to access the encrypted service tools device ID and password unless you have
| manually set it after the configuration was created. However, you are prompted for a valid
service tools user ID and password.
|
User authentication
This security provides assurance as to who is using the service device. All problems related to
user authentication are the same regardless of console type. For more information, see the Service
tools topic.
Data privacy
This security provides confidence that the console data can only be read by the intended
recipient. An Operations Console local console that is directly attached to the system uses a
physical connection similar to a twinaxial console or secure network connection for LAN
connectivity to protect console data. Operations Console using a direct connection has the same
data privacy as a twinaxial connection. If the physical connection is secure as discussed under
service device authentication, the console data remains protected. To protect the data, ensure that
only authorized people enter the computer room.
Operations Console local console on a network uses a secure network connection if the
appropriate cryptographic products are installed. The console session uses the strongest
16
System i: Connecting to System i Operations Console