Configuring security

In addition to assigning security roles to users and groups, you can configure security in these ways.

For details about user roles and groups, see Managing roles.

Authentication
PowerVC supports two different types of backend for authentication.
Managing roles
Roles are used to specify what actions a user can perform. Roles are assigned to a user (or group, in which case they are inherited by all users in that group). A user or group can have more than one role, in which case they are able to perform any action that at least one of their roles allows.
Managing projects
A project, sometimes referred to as a tenant, is a unit of ownership. Most resources, such as virtual machines, volumes, and images, belong to a specific project. Only users with a role assignment for a given project can work with the resources belonging to that project. The ibm-default project is created during installation, but PowerVC supports the creation of additional projects for resource segregation.
Replacing the certificate for PowerVC access
By default, PowerVC uses a self-signed X.509 certificate to secure its web interface and REST APIs. Self-signed certificates are not signed by an independent certificate authority (CA). Because anyone can create self-signed certificates, they cannot be trusted automatically by clients such as web browsers. For better security, an administrator should replace the default self-signed certificate with a new CA-signed certificate that clients will trust automatically. Certificates might also need to be replaced if they are expiring or have been revoked, if their private key has been compromised, and so on.
Replacing messaging certificates
Follow these steps to replace the certificates that are used to secure AMQP messaging. You should replace the certificates if you believe that a certificate was compromised or if you need to change a property, such as the expiration date.
Enabling SELinux enforcing mode after PowerVC is installed
If SELinux was in permissive or disabled mode while installing PowerVC and you later choose to enable SELinux enforcing mode, you must restart the PowerVC services by using the following command:

Parent topic: Configuring PowerVC