Novell ACCESS MANAGER 3.1 SP1 - ADMINISTRATION Manual page 12

Multiple Administrator Accounts: Only one admin user is created when you install Access
Manager. If something happens to the user who knows the name of this user and password or if
the user forgets the password, you cannot access the Administration Console. Novell
recommends that you create at least one back up user and to make that user security equivalent
to the admin user. In the Administration Console, select the Roles and Tasks icon in the
iManager header, then click Users > Create User. After creating the user, select to modify the
user and make the user security equal to the admin user. For other considerations when you
have multiple administrators, see
page 18.
Network Configuration: You need to protect the Administration Console from Internet attacks. It
should be installed behind your firewall.
If you install secondary consoles for redundancy, these secondary consoles should be on the same
network. For a secure system, they should not be required to cross routers to communicate with each
other.
Also, if you are installing the Administration Console on a separate machine, ensure that the DNS
names resolve between the Identity Server and the Administration Console. This ensures that SSL
security functions correctly between the Identity Server and the configuration store in the
Administration Console.
Delegated Administrators: If you create delegated administrators for policy containers (see
Section 1.6.2, "Managing Delegated Administrators," on page
sufficient rights to implement a cross-site scripting attack using the Deny Message in an Access
Gateway Authorization policy.
They are also granted rights to the LDAP server, which gives them sufficient rights to access the
configuration datastore with an LDAP browser. Modifications done with an LDAP browser are not
logged by Access Manager. To enable the auditing of these events, see
Auditing for LDAP Events" on page
Test Certificates: When you install the Administration Console, the following test certificates are
automatically generated:
test-signing
test-encryption
test-connector
test-provider
test-consumer
test-stunnel
For tight security, we recommend that you replace these certificates, except the test-stunnel
certificate, with certificates from a well-known certificate authority.
Two years after you install the Administration Console, new versions of these certificates are
automatically generated as the old certificates expire. If you are using any of the test certificates in
your configuration, the Administration Console cannot use the new version until you reboot the
machine.
12 Novell Access Manager 3.1 SP1 Administration Console Guide
Section 1.6, "Multiple Administrators, Multiple Sessions," on
22.
19), be aware that they have
"Activating eDirectory