Deployment Checklist

This security checklist includes guidelines that help secure your database.

• Set strong passwords for root and any other accounts that have any SAM-QFS roles assigned to them. This guideline includes:

  • Any accounts that are given administrative roles by the SAM-QFS Manager.

  • acsss, acsdb, and acssa User IDs (if being used).

  • Any disk array administrative accounts.

• If using the default user samadmin with the SAM-QFS Manager, change the password right away from the default installed password to a strong password. Do not use root with the SAM-QFS Manager, but rather assign roles as needed to other user accounts. Protect those accounts also with strong passwords.

• Install port filtering on WAN edge routers to prevent traffic on ports listed in General Security Principles from coming in to the MDS or clients, except as needed for Sun SAM-Remote.

• Segregate FC disks and tapes either physically or through FC zoning so that disks are accessible only from the MDS and clients, and tapes are accessible only from the MDS and potential MDS. This security practice helps prevent loss-of-data accidents as a result of accidental overwriting of tape or disk.

• Check /dev to ensure that tape and disk device files are not accessible to users other than root. This practice prevents SAM-QFS data from being accessed inappropriately or destroyed.

• SAM-QFS is a POSIX file system, and provides a rich set of file/directory permissions including Access Control Lists (ACLs). Use them as needed to protect user data on the file system. For more information, see the SAM-QFS documentation.

• Set up an appropriate set of backup dumps based on local policy. Backups are part of security and provide a way of restoring data lost either accidentally, or through some breach. Your backup should include some policy while being transported to an offsite location. Backups need to be protected to the same degree as SAM-QFS tapes and disk.