IBM DS8900F User Manual

You are responsible for downloading or obtaining from IBM, and installing designated machine code (such
as microcode, basic input/output system code [BIOS], utility programs, device drivers, and diagnostics
that are delivered with an IBM system) and other software updates in a timely manner from the ibm.com
website (www.ibm.com) or from other electronic media, and following the instructions that IBM provides.
You can request IBM to install machine code changes; however, you might be charged for that service.
Planning for user accounts and passwords
Planning for administrative user and service accounts and passwords ensures that you use the best
security practices.
Managing secure user accounts
Follow these recommended practices for managing secure user accounts.
Procedure
Complete the following steps to achieve the level of secure access for users that is required for your
storage system.
1. Assign two or more storage administrators and two or more security administrators to manage your
storage system. To preserve the dual control that is recommended for recovery key management, do
not assign both storage administrator and security administrator roles to the same user. Change the
password for both the default storage administrator and default security administrator user accounts,
or delete the default user account after user accounts for other administrators are created.
2. Create one user account for each user who is authorized to access your storage system. Do not share a
single user account between multiple users.
3. Assign appropriate user roles and scopes to user accounts in accordance with the storage
management responsibilities of the user.
4. Review congurable user ID policies, and set the policies in accordance with your security objectives.
The default settings are consistent with IBM recommended user ID and password policies and
practices.
5. For applications that require network access to the storage system, assign a unique user ID (an ID that
is not assigned to any other user). You can assign different user IDs for different software applications
or different servers so that actions can be distinguished by user ID in the audit logs.
Managing secure service accounts
Follow these recommended practices to manage access to your service account in the DS Service GUI
and remote access by IBM Hardware Support.
Procedure
Complete the following steps to achieve the level of secure access that is required for service accounts on
your storage system.
1. Assign one or more service administrators to manage service on your storage system.
2. Access the DS Service GUI from a web browser on a system that has network access to the Hardware
Management Console (HMC) at https://HMC_IP/service, where HMC_IP is the IP address or host
name of the HMC. You can also access the DS Service GUI from the link on the login page of the
DS8000 Storage Management GUI.
3. Log in to the DS Service GUI by using the service administrator account and change the password for
that account.
The service administrator account is pre-congured with user ID (customer) and password
(cust0mer).
4. Determine how you want IBM Hardware Support to access your storage system and set remote service
access controls accordingly.
Chapter 9. Planning for security
117

IBM DS8900F Specifications

General

Brand	IBM
Model	DS8900F
Category	Storage
Language	English