Security overview
There are various levels of security that can be configured:
- None: Agent Controller will accept connection requests
from any client (Workbench) on any host on the network. This setting is
not recommended unless the Agent Controller is operating in a very
controlled network environment.
- Local access only: Agent Controller will accept connection
requests only from a client (Workbench) on the same machine. This level
of security is sufficient when using Agent Controller on the local
machine.
- Specific hosts only: Agent Controller will accept
connection requests from any client on a specified list of hosts on the
network.
- Full security enablement: In addition to the security
selected above, users requesting access will be required to
authenticate first by providing their operating system user name and
password. You can specify that any user, once authenticated, can have
access, or that only a specified list of users can have access.
Note
Currently, only operating system authentication is supported. If you
use other authentication mechanisms such as Lightweight Directory
Access Protocol (LDAP), do not enable full security. To protect access
in such cases, use one of the other options, above.
During the configuration step of Agent Controller (via SetConfig.bat
or SetConfig.sh), you can choose to enable or
disable communications security. By enabling the security, you
ensure that communication to Agent Controller will be encrypted using Secure
Sockets Layer (SSL) technology, and that all connections will
be forced to authenticate.
If the security was enabled in the configuration, you will be prompted
as follows for authentication purposes when connecting using the
Workbench:
- If the server security certificate is unknown, you will be
prompted with a pop-up on whether
you want to accept the certificate.
For a trusted Agent Controller:
- Click View Certificate Details to see the values of the
certificate properties.
- Click OK to close the Certificate Properties dialog box.
- If the host is trusted, click Yes to accept the certificate.
The certificate is saved in the local keystore.
- You will not be prompted to accept the certificate again when
connecting to this host the next time.
For an untrusted Agent
Controller:
- Click View Certificate Details to see the values of the
certificate properties.
- Click OK to close the Certificate Properties dialog box.
- If the host is untrusted, click No. Do not accept the
certificate.
- You will be prompted to accept the certificate again when
connecting to this host the next time.
- To connect to this host now as an untrusted Agent Controller,
click Yes on the Certificate Properties dialog box.
- To connect, you will be prompted with a pop-up for user name and
password. Enter a valid user names as configured (as the username
must be a valid operating system username, the password would be the
operating system password applicable for that username).
Note
When referring to file and directory locations in this document,
<install-home> is the directory where the Agent Controller package was
unzipped.
- A sample keystore and certificate is installed under <install-home>/security.
It is recommended that you create your own keystores and certificates,
as appropriate.
- If security is configured, the keystore used by the Agent
Controller is specified in the <install-home>/config/serviceconfig.xml.
Related tasks
Changing Agent Controller
security settings after installation