User manual SYMANTEC ALTIRIS OUT OF BAND MANAGEMENT COMPONENT 7.0 SP3 IMPLEMENTATION GUIDE V1.0

[. . . ] AltirisTM Out of Band Management Component from Symantec Implementation Guide Version 7. 0 SP3 MR1 AltirisTM Out of Band Management Component from Symantec Implementation Guide The software described in this book is furnished under a license agreement and may be used only in accordance with the terms of the agreement. Documentation version 7. 0 SP3 MR1 Legal Notice Copyright © 2010 Symantec Corporation. Symantec, the Symantec Logo, Altiris, and any Altiris or Symantec trademarks used in the product are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U. S. Other names may be trademarks of their respective owners. [. . . ] Click Local Interface: TLS Server Authentication. Click Network Interface: TLS Server Authentication. Select the Server Certificate from the drop-down list. If the list is empty, do the following in order: Click the Browse for Certificate Generation Properties symbol. In the Select Certificate Generation Properties dialog box, click the Add symbol to add a new certification authority (CA) to the list. Specify the CA settings in the Add Certificate Generation Properties dialog box. The default template for TLS is WebServer. On the Select Certificate Generation Properties page, click the CA that you just added, and then click OK. 7 Click OK to close the profile. To reconfigure Intel AMT computers 1 2 3 4 In the Symantec Management Console, on the Settings menu, click All Settings. In the left pane, click Remote Management > Out of Band Management > Intel AMT Systems > Intel AMT Systems. (Optional) Click the computers that you want to reconfigure. On the toolbar, click the Re-configure symbol. The reconfiguration process is initiated. After reconfiguration, the communications with Intel AMT computers are secure. 100 Configuring TLS Configuring TLS with mutual authentication Configuring TLS with mutual authentication TLS with mutual authentication adds more security to communications with Intel AMT devices. Mutual authentication, also known as two-way authentication, is a process whereby two parties, typically a client and a server, authenticate each other in such a way that both parties are assured of the identity of the other. In mutual authentication, the server requests a certificate from the client, and the client requests a certificate from the server. Table 7-2 Step Step 1 Process for configuring TLS with mutual authentication Action Meet the requirements for TLS with mutual authentication. Description To use this feature, you must first complete all of the steps that are required for TLS. See "Configuring TLS" on page 96. Step 2 Install a client certificate. You must issue and install an Intel AMT client certificate that will be used to authenticate to the client Intel AMT computers. See "Creating and installing a client certificate using an Enterprise CA" on page 100. Step 3 Configure Intel AMT computers to use TLS with mutual authentication. You must modify the Intel AMT configuration profile and reconfigure Intel AMT computers. See "Configuring Intel AMT computers to use TLS mutual authentication" on page 108. Creating and installing a client certificate using an Enterprise CA You must create an Intel AMT client certificate for TLS with mutual authentication and install the certificate in the certificate store of the Intel SCS user. See "Configuring TLS with mutual authentication" on page 100. Configuring TLS Configuring TLS with mutual authentication 101 Table 7-3 Process for creating and installing a client certificate using an Enterprise CA Action Create a new template. Step Step 1 Description Certificate template defines the format and content of a certificate. See "Creating a new template for mutual authentication" on page 101. Step 2 Issue the new template. You must publich the certificate template so that a certification authority (CA) can issue certificates based on it. See "Issuing the new template for mutual authentication" on page 103. Step 3 Request and install a new Certificate request lets you get a certificate based on the template. [. . . ] A managed computer on which a service plug-in is installed. Notification Server can reduce its workload and minimize network traffic by distributing specific processes to site servers. A feature of Intel AMT that redirects console output to a remote terminal. It lets IT administrators remotely change BIOS settings, repair a computer that cannot start, and so on. [. . . ]