Understanding Subsystem Setup; Cs Role Users And Authorization - Red Hat CERTIFICATE SYSTEM 7.1 - ADMINISTRATOR Administrator's Manual

Understanding Subsystem Setup

You will be instructed on how to disable these features in order to conform to the Common
Criteria Environment.
Understanding Subsystem Setup
This section describes at a high-level what to expect when you configure a subsystem
following the instructions in the document CS Common Criteria Setup Procedure. This
section contains links to the main guidance documents where detailed information is
provided for each feature, but you will need to follow the CS Common Criteria Setup
Procedure in order to set up a Red Hat CS Common Criteria evaluated environment.

CS Role Users and Authorization

In CS, you create role users and then assign them to groups (also roles) to give them the
privileges of the role represented by the group membership. You need to set up at least one
auditor role user, one agent role user, and one administrator role user for each subsystem.
You specify the first administrator role user when you install the subsystem. You will be
setting up the administrative interface (CS console) for SSL authentication; all agent role
users, auditor role users, and administrator role users you set up will need to obtain a
certificate, and the certificates for those role users will need to be stored with their role user
entries. It is recommended that you have the auditor role users, administrator role users, and
agent role users use their hardware tokens to submit requests to the end-entity interface of
the Certificate Manager or Registration Manager that will process the request.
You can also configure new groups and assign them privileges other than the default
privileges assigned to the default groups, thus creating new roles in the subsystem. You do
this by creating a group, setting up ACIs for this group in the ACLs pertinent to the
privileges you want to define for this group.
For complete information on creating users, assigning them to groups, creating groups, and
changing the ACLs, see Chapter 9, "Authorization."
Note that while you have the flexibility to add groups and change the ACLs under the
Common Criteria Environment, you have to be extra cautious about creating scenarios that
are not secure, for example allowing anyone access to the agent services interface. You also
need to be careful when making changes to the default roles, or when adding roles that you
do not create security holes or vulnerabilities.
Any custom plug-ins for the Access Control feature are not part of the Common Criteria
Environment. Also recall that any custom plug-ins for the Access Control feature are not
part of the Common Criteria Environment.
702 Red Hat Certificate System Administrator's Guide • September 2005