Web-based System Manager Administration Guide

Running Web-based System Manager Security

Web-based System Manager runs in application mode when you use a machine as a client to manage another machine.

Application mode

To activate application mode, on the client, type the following command:

wsm -host hostname

where hostname is the name of the remote machine that you want to manage.

If the machine to be managed is configured to allow secure connections only (see Enabling Web-based System Manager Security), then the client must have the sysmgt.websm.security fileset installed, and must have a copy of the CA public key ring file in the /usr/websm/codebase directory. In this mode, the Web-based System Manager login dialog indicates that security is required.

If the machine to be managed is configured to allow secure or unsecure connections (see Enabling Web-based System Manager Security) and the client has a copy of the CA public key ring file in the /usr/websm/codebase directory, the Web-based System Manager login dialog allows the client user to specify a secure or unsecure connection.

When running in application mode, security is indicated by a secure connection message on the status line at the bottom of the window.

Applet Mode

Web-based System Manager runs in applet mode when you use a browser to connect to the machine you want to manage. Applet mode adds another security consideration for the secure transfer of the CA public key ring file and the applet's .class files. For complete security in applet mode, the client must use the SSL capabilities of its browser and contact the server only with the HTTPS protocol. This requires that the HTTP Server is configured for security or that SMGate is configured through one of the following options:

• One option is to use the SSL capability of the Web server on the managed machine. For this option, the Web server must be configured for security. Follow the instructions provided with your Web server. Then you can access Web-based System Manager on the managed machine with the following Web address: https://hostname/wsm.html, where hostname is the name of the remote machine you want to manage. In this option, the applet and the SM.pubkr public key ring are transferred securely from the Web server on the managed machine to the client.
• Another option is to use the SMGate daemon. SMGate runs on managed machines and serves as an SSL gateway between the client browser and the local Web server. SMGate responds to the HTTPS request of the client browser, and creates an SSL connection with it by using the private key and certificate of the Web-based System Manager server. Inside the managed machine, SMGate creates an unsecure connection to the local Web server.

  In this option, the applet and SM.pubkr public key ring are securely transferred from SMGate on the managed machine to the browser client. Communications between the managed machine and client are over SSL. When you are using SMGate, you can access Web-based System Manager on the managed machine with the following Web address: https://hostname:9092/wsm.html, where hostname is the name of the remote machine you want to manage.

  Note: 9092 is the default port number for SMGate. If you enabled SMGate with a different port number, then specify that number.

When you are running in applet mode, make sure the following security indicators are present:

• The browser's HTTPS indication
• The secure connection message on the status line at the bottom of the Web-based System Manager windows.

If either indicator is missing, the connection is not completely secure.