Secure the System

NOTE: This is not a complete security guide. Feel free to expand the regulations according to the company's security policies and ever-changing security best practices. Please also review this document with the IT security services provider prior to implementing the appliance.

Network security

• Make sure the IP addresses of IPMI, Cluster, and individual appliances are not accessible from the Internet (i.e., outside of the company's network). Additionally:

  • No public IP addresses are used for IPMI, TUI, Cluster, and Appliances.

  • Not every user needs to have Administrator privileges.

  • Secure KVM or Console access.

• IPMI access should be disabled (e.g., unplugging the cable from the Appliance's port) or network-restricted.

• Make sure to set up Multi-Factor Authentication.

  • Make sure to store Multi-Factor recovery codes in a secure location.

  • Consider regenerating recovery codes regularly.

  • Review who has access to the two-factor authentication app.

• Disable SSH access to the Appliances. SSH access is disabled by default.

• Use a strong password for the Object First appliance.

• Change the factory-generated IPMI password.

Physical security

• Restrict physical access to the servers.

  • Make sure to keep Appliances in the well-ventilated, locked server room.

  • Supervise the maintenance activities.

• Make sure the security settings cannot be altered by users

  • Review user access levels.

  • Make sure to change the cluster passwords regularly.