HP Integrated Lights-Out 2 User Guide

Using DNS-based restrictions can create some security complications. Name service protocols areinsecure. Any individual with malicious intent and access to the network can place a rogue DNS serviceon the network creating fake address restriction criteria. Organizational security policies should be takeninto consideration when implementing DNS-based address restrictions.How user time restrictions are enforcedAdministrators can place a time restriction on directory user accounts. Time restrictions limit the ability ofthe user to log in (authenticate) to the directory. Typically, time restrictions are enforced using the time atthe directory server, but if the directory server is located in a different time zone or a replica in a differenttime zone is accessed, then time zone information from the managed object can be used to adjust forrelative time.The directory server evaluates user time restrictions, but the determination can be complicated by timezone changes or authentication mechanism.Creating multiple restrictions and rolesThe most useful application of multiple roles includes restricting one or more roles so that rights do notapply in all situations. Other roles provide different rights under different constraints. Using multiplerestrictions and roles enables the administrator to create arbitrary, complex rights relationships with aminimum number of roles.For example, an organization might have a security policy in which LOM administrators are allowed touse the LOM device from within the corporate network but are only able to reset the server outside ofregular business hours.Directory administrators might be tempted to create two roles to address this situation, but extra caution isrequired. Creating a role that provides the required server reset rights and restricting it to an after-hoursapplication might allow administrators outside the corporate network to reset the server, which is contraryto most security policies.Directory-enabled remote management 133