PowerStore Security

In this module, you will login to the PowerStore interface called PowerStore Manager. You will review the security settings and features of the PowerStore system.

PowerStore Manager Security Settings

If you are starting the lab with this section, you will have to first login to the PowerStore Manager. Double-click **PowerStore** on the desktop. Login to PowerStore Manager with the following settings: - User: **admin** - Password: **Password123!** Click **"Log In"**

At the top right of the PowerStore Manager interface, click the **Gear** icon labeled **"Settings"** to open the Settings Menu.

Now we will look at the additional security features. Click **"Signed Cluster Certificate"**

From this page we can customize the signed certificate used for management. See that the user has the options to **Import** a new certificate and **Generate CSR**. As this is an offline demo, we cannot follow the process to change the certificate. We will proceed to review other security features.

Next, navigate to **"KMIP"** located in the left navigation bar.

External key management via Key Management Interoperability Protocol (KMIP) provides an additional layer of security to protect access to the system if the system is relocated to a different data center or has been stolen From the **KMIP** page, we can configure the certificate to establish the trust with a KMIP server, and enable and customize the KMIP server settings. As this is an offline demo, we cannot follow the process to enable a KMIP server. We will proceed to review other security features.

Navigate to **Compliance** next.

From the Compliance page you can view the enabled TLS Protocol and whether STIG and FIPS is enabled

Click **"HTTP Redirect"** from the left hand pane

In **HTTP Redirect** page the feature is enabled by default. With this enabled, the user can automatically redirect any HTTP requests to HTTPS. For instance, if the user tries to open the PowerStore Manager from http://<ClusterIP> it would redirect to https://ClusterIP>.

Multi-Factor Authentication

Multi-Factor Authentication (MFA) is supported with RSA SecurID. Enabling MFA provides an additional layer of security when authenticating to the system, as it requires the user to identify themselves with an RSA SecurID generated passcode, resulting in 2 Factor Authentication.

We will configure MFA by connecting the RSA SecurID Server in PowerStore Manager. Navigate to **Settings > Security** from the top right corner. Click "**Authentication"**

Click on the **"CAC/PIV"** tab. CAC/PIV is available for STIG enabled systems and can be configured on this tab once STIG is enabled. Since this is none STIG enabled demo, it would not be possible to show this.

Next click on the **"RSA SecurID"** tab Click **"Configure"**

The Configure Authentication window appears. Configure the following RSA SecurID Server Settings for the required fields below: - Server IP or FQDN (RSA SecurID Server): **192\.168.1.100** - Port (Default): **5555** - Client ID (PowerStore Cluster IP): **192\.168.1.10** - Access Key (Generated from RSA Server): **1234**

Click **"Next"**

When configuring MFA, a certificate is required from the RSA SecurID Server to successfully authenticate with PowerStore. Select the **Paste Certificate Text** radio button and insert the following Demo Certificate text below: **-----BEGIN CERTIFICATE-----** **Test Cert for RSASecurID** **-----END CERTIFICATE-----**

Once the text is inserted click **"Next"**

By default, there are no **Current Bypass Users** configured. By enabling MFA Bypass on a local user, it allows a user to access the system if there are issues communicating with the RSA SecurID MFA server. It is recommended to have at least one local administrator configured as a MFA bypass user. We can configure a bypass user on the system during the MFA configuration wizard. In the Bypass User window, select **admin2**

Click **"Next"**

Ensure the **Enable RSA SecurID** radio button is selected. By selecting this option, it will log the user out of the current PowerStore Manager session and force the user to log back in now using Multi Factor Authentication. Click **"Next"**

Review the **Summary** page, Provide the following username and passcode to validate the configuration: Username: **SecureAdmin** Passcode: **1234** and click **"Configure"**. Once the wizard completes, it will log the user out of the PowerStore Manager session.

Now that Multi-Factor Authentication is enabled, we will now login as a MFA enabled user. Use the securityadmin credentials to login: - Username: **securityadmin** - Password: **Password123!** Click **"Log In"**

The PowerStore system then will prompt the user for a RSA SecurID Passcode as it is not a bypass user. The user will then enter in their SecurID generated passcode. In this lab we will enter in the RSA SecurID Passcode referenced below: RSA SecurID Passcode: **1234** Click **"Log In"**.

Close the **Configuration Recommendations** page.

Once logged in, if not already on the **Authentication** page, navigate to **Settings > Security > Authentication** to view the RSA SecurID configuration details. Review the RSA SecurID configuration.

Once finished reviewing the RSA SecurID information, Navigate to **Settings > Security > Users**

In the Local tab, select the **admin** user

Click **"Change MFA Bypass"**

A popup window appears confirming the user **admin** will be able to bypass MFA. If MFA is enabled, all LDAP users are required to login with MFA. LDAP users cannot be configured as bypass users. Click **"OK"**

Verify that the local admin account was modified to be a **MFA Bypass** user by view the '**Bypass MFA**" column. The admin user should now reference '**Bypass MFA = Yes"**

We will now log out of the **securityadmin** account. Click the user icon on the top right of the web page and click **Log Out** Click **"Log Out"**

Now that the local **admin** user is configured as an MFA bypass user. Log into PowerStore Manager as the **admin** user with the credentials below. We will now be able to login without PowerStore Manager requiring a RSA SecurID passcode. - Username: **admin** - Password: **Password123!** Click **"Log In"**

Once we have logged in with the **admin** user successfully as a bypass user, navigate back to **Settings > Security > Authentication > RSA SecurID**.

Click "**Disable"** and proceed to disable RSA SecurID.

Click **"Disable".** This will log us out of PowerStore Manager.

Log back into PowerStore Manager with your admin credentials: - Username: **admin** - Password: **Password123!** Click **"Log In"**

Once logged back in with our local admin account, navigate to **Settings > Security > Authentication > RSA SecurID** if not already there. Review the RSA SecureID setting and verify that the status is now **Disabled**

Click "**Delete"**, to delete the RSA SecurID configuration.

Click **"Delete"**

Single Sign On (SSO)

Single Sign On (SSO) is supported with Microsoft EntraID. Enabling SSO provides an additional layer of security when authenticating to the system, as it requires the user to identify themselves through the Identity Provider, resulting in seamless user integration.

We will configure our Identity Provider in PowerStore Manager. If not already there, navigate to **Settings > Security > Authentication** in PowerStore Manager. Next click on the **"SSO Identity Provider"** tab Click **"Configure"**

Provide a Name for your IDP configuration Example Name **"My-SSO"** Click **"Next"**

Review the registration information. This information is what would be needed to provided to your SSO provider Check off **"I have copied and pasted the generated URLs of each selected host to my IdP to manually register my PowerStore as a relying party with my IdP."** Click **"Next"**

When configuring SSO, a certificate is required from the SSO Identity Provider to successfully authenticate with PowerStore. Select the **Paste Certificate Text** radio button and insert the following Demo Certificate text below: **-----BEGIN CERTIFICATE-----** **Test Cert for SSO** **-----END CERTIFICATE-----** Click **Next**

The IdP Setup window appears. Configure the following IdP Settings for the required fields below: - IdP Type: **Microsoft Entra ID** - Application (client) ID: **123abc-Test-Client-789xyz** - Client Secret: **1234567890** - OIDC Metadata URL: **https://login.microsoftonline.com/mytenant/v2.0/.well-known/openid-configuration** - Proof Key for Code Exchange (PKCE): **SHA-256** - Scopes: **Select all (openid, email, profile)**

Click **"Next"**

The Claims and Roles window appears. Configure the following Claims and Roles for the required fields below: Claims - IdP Claim: **email** Role Mapping - Claim Value: **CompanyAdmin@mycompany.local** - Claim Name: **User_Name (email)** - Account Role: **Administrator**

Click **"Next"** to bring up the Summary Page Review the summary of the SSO configuration and click **"Finish"** to submit the configuration

View the success report of the configuration and click **"Done"**

Next a popup box will appear informing that the IdP configuration is complete and provides the opportunity to test the configuration. Click **"Test Configuration"** to bring up the test IdP Configuration screen and review the details. Given this is a simulator the test link does not work, in a real environment this link can be copied and pasted into a browser to view the results Click **"Close"** Note: there is a **"Test Configuration"** button on the SSO Identity Provider page that can be used to test the configuration at anytime.

Next click **"Enable"** to enable or Activate the SSO configuration. A warning popup box will appear, read over the details and when ready click **"Enable"**

Review the SSO Identity Provider page to now see SSO is now enabled for use.

Temporary Credentials

Next click the **"Temporary Credentials"** tab

Click **"Generate Temporary ID and Secret"** to generate temporary credentials for use. Temporary credentials can be used as a way to integrate and connect external resources such as replication to another PowerStore, VMware VASA provider, and more.

Multiparty Authorization (MPA)

Multiparty Authorization enforces that a secondary privileged user is required to approve or reject critical actions, such as modification or deletion, in order for them to be executed. This added the additional security as well as checks and balances for these actions. Both Administrator and Storage Administrator roles are considered privileged user roles in which can approve or reject requests.

We will configure Multiparty Authorization (MPA) in PowerStore Manager. If not already there, navigate to **Settings > Security > Multiparty Authorization** in PowerStore Manager Once on the page review the details and click on the slider to enable MPA.

Review the warning and behavior of MPA before enabling it. Once you have read over the warning and its implications Click **"Enable"**

MPA is now enabled, review all of the actions in which MPA applies to.

When ready navigate to **Storage > Volumes**

Locate the volume named **"View-Topology1"** and click **More Actions > Delete**

Click **"Delete"**

Review that the delete action has been requested but not carried out. PowerStore manager generate a informational Bar in which states the request needs to be approved. Click on **"Track request Status"**

Track request status takes you to a new tab under **Monitoring** in PowerStore manager called **MPA Requests**. Here an approved user can Approve or reject others modification or in our case deletion requests.

Select the job in question and notice since your user is who requested the job, the only option provided is Reject against your own job. At this time you can either log out of the PowerStore Manager simulator and log back in to approve the request or reject your own request.

It is recommended to close the simulator after completing the MPA section and relaunching the simulator if you plan on continuing with other modules. By not closing out and relaunching, MPA will remain enabled and require any Modification or deletion action in other modules to require approval from secondary user.

Congratulations! You have reached the end of this particular module. Click **Close** in the top left corner of this script to return to the demo guide.

PowerStore Security

In this module, you will login to the PowerStore interface called PowerStore Manager. You will review the security settings and features of the PowerStore system.

PowerStore Manager Security Settings

At the top right of the PowerStore Manager interface, click the **Gear** icon labeled **"Settings"** to open the Settings Menu.

Now we will look at the additional security features. Click **"Signed Cluster Certificate"**

Next, navigate to **"KMIP"** located in the left navigation bar.

Navigate to **Compliance** next.

From the Compliance page you can view the enabled TLS Protocol and whether STIG and FIPS is enabled

Click **"HTTP Redirect"** from the left hand pane

Multi-Factor Authentication

We will configure MFA by connecting the RSA SecurID Server in PowerStore Manager. Navigate to **Settings > Security** from the top right corner. Click "**Authentication"**

Next click on the **"RSA SecurID"** tab Click **"Configure"**

Click **"Next"**

Once the text is inserted click **"Next"**

Click **"Next"**

Close the **Configuration Recommendations** page.

Once finished reviewing the RSA SecurID information, Navigate to **Settings > Security > Users**

In the Local tab, select the **admin** user

Click **"Change MFA Bypass"**

Verify that the local admin account was modified to be a **MFA Bypass** user by view the '**Bypass MFA**" column. The admin user should now reference '**Bypass MFA = Yes"**

We will now log out of the **securityadmin** account. Click the user icon on the top right of the web page and click **Log Out** Click **"Log Out"**

Once we have logged in with the **admin** user successfully as a bypass user, navigate back to **Settings > Security > Authentication > RSA SecurID**.

Click "**Disable"** and proceed to disable RSA SecurID.

Click **"Disable".** This will log us out of PowerStore Manager.

Log back into PowerStore Manager with your admin credentials: - Username: **admin** - Password: **Password123!** Click **"Log In"**

Click "**Delete"**, to delete the RSA SecurID configuration.

Click **"Delete"**

Single Sign On (SSO)

Provide a Name for your IDP configuration Example Name **"My-SSO"** Click **"Next"**

Click **"Next"**

Click **"Next"** to bring up the Summary Page Review the summary of the SSO configuration and click **"Finish"** to submit the configuration

View the success report of the configuration and click **"Done"**

Next click **"Enable"** to enable or Activate the SSO configuration. A warning popup box will appear, read over the details and when ready click **"Enable"**

Review the SSO Identity Provider page to now see SSO is now enabled for use.

Temporary Credentials

Next click the **"Temporary Credentials"** tab

Multiparty Authorization (MPA)

Review the warning and behavior of MPA before enabling it. Once you have read over the warning and its implications Click **"Enable"**

MPA is now enabled, review all of the actions in which MPA applies to.

When ready navigate to **Storage > Volumes**

Locate the volume named **"View-Topology1"** and click **More Actions > Delete**

Click **"Delete"**

Congratulations! You have reached the end of this particular module. Click **Close** in the top left corner of this script to return to the demo guide.