|
|
The Administrative Accounts tree stores accounts that are used to administer Cisco Secure Policy Manager. You can create, modify, and delete administrative accounts under the Administrative Accounts tree. An administrator must submit the username and password of an active administrative account for the GUI client when connecting to a Primary Policy Database from either a primary or secondary server. In a distributed system, the computer on which you install the Primary Policy Database feature set is called a primary server (as is the computer in a stand-alone system). The computers on which you install all other feature sets are called secondary servers.
This account is not the same as a Windows NT user account, although the username and password can overlap for both accounts. Every person who intends to administer Cisco Secure Policy Manager either from a primary or secondary server should have a separate administrative account.
Administrative accounts enable users to administer Cisco Secure Policy Manager from either a primary or secondary server. The GUI client supports three types of administrative accounts.
 |
Warning All administrative account information, especially passwords, should be guarded carefully, especially that for full access administrative accounts. |
An administrative account for the GUI client is not the same as a Windows NT user account. A person who has Windows NT administrator privileges with his or her user account does not necessarily have access to administer a Primary Policy Database unless that person also has an administrative account for the GUI client. When you install Cisco Secure Policy Manager, the setup program creates a default administrative account based upon the Windows NT user account that you used to log on to the workstation.
 |
Note Immediately after installation, you should delete or disable the default account. By doing so, you eliminate the possibility of someone obtaining your Windows NT account information and logging on to the GUI client and making changes to security policies and configuration settings, thus compromising network security. |
We recommend that you create a new account for each additional person who intends to administer your network security devices, because sharing accounts among users makes accountability more difficult. The GUI client has no limits for the number of administrative accounts that you can create.
|
Note You cannot delete the last remaining administrative account or the one currently in use. If you attempt to do so, the GUI client displays a message box informing you of this fact. |
You can perform the following tasks from the Administrative Accounts tree or from the General panel related to any administrative account. For step-by-step procedures on performing a specific task, refer to the corresponding task topic.
You should create an administrative account for each person who intends to administer Cisco Secure Policy Manager on either a primary or secondary server. Sharing an account is insecure because it provides no accountability of who made what change to the Primary Policy Database.
 |
Caution All administrators should guard their passwords carefully. Otherwise, the security of the Policy Database, and hence your networks, could be compromised. |
To create an administrative account, perform the following task:
Result: A new administrative account node appears under the Administrative Accounts tree in the Navigator pane, and the General panel for the new account appears in the View pane.
 |
Tips If the General panel for the new account does not appear in the View pane, right-click the new account node, and then click Properties on the shortcut menu. |
Step 2 To name the administrative account, type the name in the Username box in the General panel.
This name becomes the default username for the administrative account. The GUI client enables long usernames and the use of most alphanumeric or symbol characters. Also, you can use both uppercase and lowercase characters. However, you cannot use quotation marks (") or a semicolon (;).
Step 3 To designate the user's full name, type it in the Full Name box.
The GUI client enables long full names and the use of all alphanumeric or symbol characters. Also, you can use uppercase and lowercase characters. While this field does not affect operation of the Primary Policy Database, it provides all administrators with a means of keeping track of who uses which account.
Step 4 To specify a privilege level, select one from the Privileges list.
Three administrative privileges are available:
For more information about administrative privileges, see Learn More About Administrative Accounts.
Step 5 To specify a new password, select the Change Password check box.
Result: A check mark appears in the Change Password check box, and the New password and Confirm password boxes become available.
Step 6 To assign a password to the new account, type it in the New password box.
The GUI client enables long passwords and the use of all alphanumeric and symbol characters. Also, you can use both uppercase and lowercase characters.
Step 7 To confirm the password that you assigned, type it again in the Confirm password box.
If an error message appears after typing and confirming the password, retype the password in the Confirm password box. If an error message persists, check the CAPS LOCK key on your keyboard.
Step 8 To accept your changes and close the General panel, click OK.
Result: The name of the account node under the Administrative Accounts tree in the Navigator pane automatically updates to the new username.
Step 9 To save any changes that you have made, click Save on the File menu.
You should change the password for an administrative account if you suspect that the existing one has become insecure or has been compromised in any way.
|
Caution All administrators should guard their passwords carefully. Otherwise, the security of the Primary Policy Database, and hence your networks, could be compromised. |
To change an administrative account password, perform the following task:
Result: The General panel appears in the View pane.
Step 2 Select the Change Password check box under Password.
Result: A check mark appears in the Change Password check box and the New password and Confirm password boxes become available.
Step 3 To provide a new password, type it into the New password box.
The GUI client enables long passwords and the use of all alphanumeric and symbol characters. Also, you can use both uppercase and lowercase characters.
Step 4 To confirm the new password, retype it into the Confirm password box.
If you receive an error message, retype the password into the Confirm password box again. If an error message persists, check the CAPS LOCK key on your keyboard.
Step 5 To accept your changes and close the selected panel, click OK.
Step 6 To save any changes that you have made, click Save on the File menu.
Using a GUI client account with full access privileges, you can change the privilege values for other accounts defined within the Administrative Accounts tree. This feature enables you to customize access to the GUI client, which helps you meet your security requirements for access to your policy management system.
|
Caution Although administrative privileges can be changed, you should do it with caution. If read-only access and report viewing only accounts were used to view reports from a web browser, it is possible that the username and password were hijacked. In this event, upgrading these accounts to full access privileges can compromise the security of your system. |
|
Note At least one administrative account must have full access privileges. If you attempt to change privileges for the last remaining full access account, the GUI client displays a message box informing you that no administrative account has full access privileges. If you do change privileges for the last remaining full access account to read-only access or report viewing, the GUI client will not allow you to save and exit, even with Consistency Check disabled. |
To change privileges for an existing administrative account, perform the following task:
Result: The General panel appears in the View pane.
Step 2 To change privileges for an existing account, select one from the Privileges list.
Three administrative privileges are available:
For more information about administrative privileges, see Learn More About Administrative Accounts.
Step 3 To accept your changes and close the selected panel, click OK.
Step 4 To save any changes that you have made, click Save on the File menu.
Posted: Thu May 25 13:46:07 PDT 2000
Copyright 1989 - 2000©Cisco Systems Inc.