Security procedure

  1. Update the following passwords:

    • Keystore

    • Truststore

    • Jarsigning

    • Admin Token

    • Service Token

    • Authentication Manager

  2. Log into http://<cont_IP>:/8443/sdu/ui as the SDN user.

  3. Select Configurations.

  4. Select the component com.hp.sdn.ctl.of.impl.AuthenticationManager.

  5. Select Modify.

  6. Set the AdminToken to the newly chosen Keystore (authentication) admin token.

  7. Set the ServiceToken to the newly chosen internal communication secret.

  8. Set the KeystorePass to the value that you will be using to secure the SSL Keystore.

  9. Set the TruststorePass to the value that you will be using to secure the SSL Truststore.

  10. Update the Keystore Admin Token in the file etc/keystore/keystore.conf.

    Change the Admin Token from admin_token=ADMIN to admin_token=<AdminTokenSetInControllerConf>.

  11. Update the Keystore password to match the password changed in Step 1 using the following:

    keytool-storepasswd-storepassskyline-

    new<KeystorePassFromControllerConfig>-keystore/opt/sdn/admin/keystore.

  12. Update the Keystore’s internal serverkey to match the keystore’s password using the following:

    keytool-keypasswd-alias serverkey-storepass <KeystorePassFromControllerConfig>-keystore skyline-new <KeystorePassFromControllerConfig>-keystore/opt/sdn/admin/keystore.

  13. Update the Truststore password to match the Truststore password in Step 1 using the following:

    keytool-storepasswd-storepass skyline-new foobar-keystore/opt/sdn/admin/truststore.

  14. Update the jar signing keystore password (named sdnjar_trust.jks) using the following:

    keytool-storepasswd-storepass skyline-new <newpass4sign>-keystore/opt/sdn/admin/sdnjar_trust.jks.

    This password does not have to match the others.

  15. Update opt/sdn/virgo/bin/dmk.sh to insert environment variables that set the sdnjar_trust.jks values in the controller.

    1. Under the line containing “XX-HeadDumpPath...” add —DSDN.trustpas=<NEWPASS4SIGN>.

    2. Restart the Keystone service (sudo service keystore restart).

  16. Restart the controller.