EditDiscussionPage history

Difference between revisions of "Maintenance"

 
(56 intermediate revisions by the same user not shown)
Line 1: Line 1:
−
유지관리 메뉴는 imRAD 관리인터페이스에 접근 할 수 있는 계정 및 관리자/운영자의 이력을 포함합니다.
+
__FORCETOC__
−
==== 운영계정 ====
+
=== Maintenance ===
−
운영계정은 관리자와 운영자로 구분되며 운영자는 읽기 권한만 있습니다.<br>
+
In this menu, You can manage accounts that can access the imRAD management interface. It also has audit logs that are a sequence of activities.
−
새로운 운영 계정을 생성하려면 유지관리> 운영계정을 클릭 후 화면 우측 상단의 "새로운 계정 생성" 버튼을 클릭하면 됩니다.
+
 
−
[[File:new_account.png|350px|thumb|새로운 계정 생성]]
+
==== Accounts ====
−
[[File:new_account_radius.png|350px|thumb|새로운 계정 생성 - RADIUS 인증]]
+
The Maintenance Accounts are divided into two types.
−
[[File:edit_account_tmppwd.png|350px|thumb|계정 임시 비밀번호 발급]]
+
The first type is "Administrator" which is a privileged user. The second type is "Operator" which is a non-privileged user which means only having READ privilege.
 +
 
 +
You can create an account by clicking the "Create New Account" button at the top right of the list.
  
−
인증 유형은 다음과 같이 세 가지가 존재합니다.
 
 
{| class="wikitable"
 
{| class="wikitable"
−
! 인증 유형 !! 설명
+
! style='width:200px' | Item !! Required !! Description
 +
|-
 +
| Accounts Type || Yes || Choose one type.
 +
|-
 +
| Login ID || Yes || The multibyte or Non-ASCII characters(e.g, Korean, Japanese) are not allowed and the maximum length is 64 characters.
 
|-
 
|-
−
| Local || imRAD 데이터베이스에 계정이 저장되며 이를 통해 로그인 인증을 처리합니다.비밀번호는 임시 비밀번호 형태로 저장되며 생성된 아이디와 임시 비밀번호로 최초 로그인 후 비밀번호를 할 수 있게 유도됩니다.
+
| Login authentication Type || Yes || The imRAD supports three login authentication methods that are
 +
* Local: The credentials are validated from the local imRAD Database.
 +
* RADIUS: The credentials are validated via a remote RADIUS server.
 +
* LDAP: The credentials are validated via an LDAP server.
  
 +
{{note|Note that you must define an Authentication Entity before creating an account that is validating via either the RADIUS or LDAP.}}
 
|-
 
|-
−
| RADIUS || 3rd party RADIUS 장비에서 인증이 확인되어야 관리인터페이스에 로그인 할 수 있습니다. 따라서 계정 생성시 RADIUS 장비를 선택해야 하며 저장된 RADIUS 장비가 없다면 유지관리> 설정> 인증 객체에서 생성 할 수 있습니다.<br>
+
| Temporary Password || Yes|| Temporary Password means that the password of an account is short random text. If a user logs in with an account whose password is Temporary, The user must change its password before login. If not, he can't log in.<br>
−
비밀번호는 입력 할 필요 없습니다.
+
You may create an account for a new user to enable to change its password before login.
−
 
+
|-
 +
| Email || No || Email address of a user.
 +
|-
 +
| Description || No || Description of a user.
 
|-
 
|-
−
| LDAP || 3rd party LDAP 서버로부터 인증이 확인되어야 관리인터페이스에 로그인 할 수 있습니다. 따라서 계정 생성시 LDAP 서버 선택해야 하며 저장된 LDAP 서버가 없다면 유지관리> 설정> 인증 객체에서 생성 할 수 있습니다.<br>
 
−
비밀번호는 입력 할 필요 없습니다.
 
 
|}
 
|}
  
−
'''임시 비밀번호'''<br>
+
===== Temporary Password =====
−
저장된 Local 계정의 비밀번호는 복호화 할 수 없는 암호화 형태이므로 계정의 비밀번호를 잊어버린 경우 임시 비밀번호를 발급해  비밀번호를 다시 설정하게 할 수 있습니다.<br>
+
As described in the above table, Temporary Password makes it possible to change its password before login. When a user tries to log in with an account that was set a Temporary Password, the system moves a page in which a user can change its password.
−
그림(계정 임시 비밀번호 발급)과 같이 "임시 비밀번호" 버튼을 클릭하면 좌측 하단에 붉은 색으로 임시 비밀번호가 표시됩니다.
+
 
−
임시 비밀번호는 3일 이내에 로그인해야 새로운 비밀번호를 생성 할 수 있습니다.
+
All saved passwords in the local imRAD Database are not decrypted as plaintext because all passwords are encrypted by secured cryptographic hash functions (CHF).<ref>Cryptographic hash function</ref> Although a user wants to know his/her password because a user forgot it, you can't provide the password as plaintext. Instead, you can generate the Temporary Password for an account.
 +
 
 +
The Temporary Password is only available for accounts whose authentication type is "LOCAL".
 +
If you set The Temporary Password to an account, a user MUST change the password within 3 days. If not, the account will be locked.
 +
 
 +
===== Lock/Unlock =====
 +
The account may change to a locked state and a user can't log in with the account. There are three types of "LOCK" states.
 +
*  '''auto-lock'': If a login failure exceeds the specified number of login failures, we automatically lock the account for specified minutes. In this case, we change the locked state to "auto-lock". The "auto-lock" will be unlocked after elapsing the specified minutes. The specified number of login failures and minutes are defined in the "Managemnet> Settings > Security".
 +
* '''dormant-lock''': It indicates that the account was not logged in for the specified number of days that are defined in the "Managemnet> Settings >  Accounts".
 +
* '''lock''': it indicates that an administrator locks the account.
 +
 
 +
{{note|Note that an administrator can unlock all locked accounts from the details of an account by clicking the icon([[File:popup.png|23x]]) in front of each row on the list.}}
 +
 
 +
==== Audit Log ====
 +
An audit log(also called audit trail) is a record of events and changes, typically regarding a sequence of activities or a specific activity<ref>https://en.wikipedia.org/wiki/Audit_trail</ref>.
 +
 
 +
Activities of all the managers(administrator and operator) users and internal events of the system are recorded as audit logs. All users can search and see all audit logs but not change or delete them.<br>
 +
You can see the details of each log by clicking the icon([[File:popup.png|23x]]) in front of each row on the list.
 +
 
 +
==== Settings ====
 +
===== Accounts =====
 +
This setting contains the values to lock the account that were not logged in for a long time. If a manager does not log in while the specified days, the status of the account is changed to "dormant-lock".
 +
 
 +
The locked accounts are not allowed to log in before unlocking them.
 +
 
 +
===== Security =====
 +
This setting defines the authentication and session policies to have you securely access the management interface.
 +
====== Password Policy ======
 +
* Minimum Length: The minimum length of a password.
 +
* Mix of Characters: If you want a strong password, select all items.
 +
* Password Aging: It makes possible to have users forcibly change his/her password periodically.
 +
 
 +
 
 +
====== Maintenance account Session ======
 +
If you want to allow multiple sessions of the same account from different hosts or browsers, switch on the "Allow Multiple Sessions".  
 +
{{note|Even if multiple sessions are not allowed, duplicate logins through multiple browsers on a single computer are permitted.}}
 +
You can also configure the '''session timeout''' and the '''Lockout''' is used to prevent a brute-force attack<ref>https://en.wikipedia.org/wiki/Brute-force_attack</ref> by locking an account for a while when a user failed its login several times.
 +
 
 +
{{note|Note that the '''dashboard''' page is not affected by the Session Termination.
 +
In other words, Even if the dashboard page is open for a long time without any interaction, the session never expires.}}
 +
 
 +
 
 +
=== References ===

Latest revision as of 18:15, 9 August 2023

Maintenance

In this menu, You can manage accounts that can access the imRAD management interface. It also has audit logs that are a sequence of activities.

Accounts

The Maintenance Accounts are divided into two types. The first type is "Administrator" which is a privileged user. The second type is "Operator" which is a non-privileged user which means only having READ privilege.

You can create an account by clicking the "Create New Account" button at the top right of the list.

Item Required Description
Accounts Type Yes Choose one type.
Login ID Yes The multibyte or Non-ASCII characters(e.g, Korean, Japanese) are not allowed and the maximum length is 64 characters.
Login authentication Type Yes The imRAD supports three login authentication methods that are
  • Local: The credentials are validated from the local imRAD Database.
  • RADIUS: The credentials are validated via a remote RADIUS server.
  • LDAP: The credentials are validated via an LDAP server.

Note that you must define an Authentication Entity before creating an account that is validating via either the RADIUS or LDAP.

Temporary Password Yes Temporary Password means that the password of an account is short random text. If a user logs in with an account whose password is Temporary, The user must change its password before login. If not, he can't log in.

You may create an account for a new user to enable to change its password before login.

Email No Email address of a user.
Description No Description of a user.
Temporary Password

As described in the above table, Temporary Password makes it possible to change its password before login. When a user tries to log in with an account that was set a Temporary Password, the system moves a page in which a user can change its password.

All saved passwords in the local imRAD Database are not decrypted as plaintext because all passwords are encrypted by secured cryptographic hash functions (CHF).[1] Although a user wants to know his/her password because a user forgot it, you can't provide the password as plaintext. Instead, you can generate the Temporary Password for an account.

The Temporary Password is only available for accounts whose authentication type is "LOCAL". If you set The Temporary Password to an account, a user MUST change the password within 3 days. If not, the account will be locked.

Lock/Unlock

The account may change to a locked state and a user can't log in with the account. There are three types of "LOCK" states.

  • 'auto-lock: If a login failure exceeds the specified number of login failures, we automatically lock the account for specified minutes. In this case, we change the locked state to "auto-lock". The "auto-lock" will be unlocked after elapsing the specified minutes. The specified number of login failures and minutes are defined in the "Managemnet> Settings > Security".
  • dormant-lock: It indicates that the account was not logged in for the specified number of days that are defined in the "Managemnet> Settings > Accounts".
  • lock: it indicates that an administrator locks the account.

Note that an administrator can unlock all locked accounts from the details of an account by clicking the icon(23x) in front of each row on the list.

Audit Log

An audit log(also called audit trail) is a record of events and changes, typically regarding a sequence of activities or a specific activity[2].

Activities of all the managers(administrator and operator) users and internal events of the system are recorded as audit logs. All users can search and see all audit logs but not change or delete them.
You can see the details of each log by clicking the icon(23x) in front of each row on the list.

Settings

Accounts

This setting contains the values to lock the account that were not logged in for a long time. If a manager does not log in while the specified days, the status of the account is changed to "dormant-lock".

The locked accounts are not allowed to log in before unlocking them.

Security

This setting defines the authentication and session policies to have you securely access the management interface.

Password Policy
  • Minimum Length: The minimum length of a password.
  • Mix of Characters: If you want a strong password, select all items.
  • Password Aging: It makes possible to have users forcibly change his/her password periodically.


Maintenance account Session

If you want to allow multiple sessions of the same account from different hosts or browsers, switch on the "Allow Multiple Sessions".

Even if multiple sessions are not allowed, duplicate logins through multiple browsers on a single computer are permitted.

You can also configure the session timeout and the Lockout is used to prevent a brute-force attack[3] by locking an account for a while when a user failed its login several times.

Note that the dashboard page is not affected by the Session Termination. In other words, Even if the dashboard page is open for a long time without any interaction, the session never expires.


References

  1. ↑ Cryptographic hash function
  2. ↑ https://en.wikipedia.org/wiki/Audit_trail
  3. ↑ https://en.wikipedia.org/wiki/Brute-force_attack