Best practices for configuring PKI authentication for FMS

You can configure public key infrastructure (PKI) authentication for FMS to authorize fscadmin commands. This authentication prevents offsite administrators (such as administrators at supplier sites) from performing unauthorized FSC administrative commands. Use PKI authentication to specify which fscadmin commands require additional signing, allowing you to control the functionality available for specified servers and installations. Use the following best practices for optimal security. Password conventions Use strong passwords. Do not use passwords vulnerable to dictionary attacks. Do not use password patterns that can be easily guessed if one password is compromised. Use different passwords for each keystore and key. Use only encrypted passwords in property files. Use only characters that can be reliably and repeatedly typed (or cut/pasted) into command shells; avoid characters that make this difficult. Keystore conventions The keystore type must be JCEKS; the keystore file extension must be .jceks. Use meaningful names, such as trusted.jceks and supplier.jceks and fsc.fscid.signing.jceks. In each keystore, for each keystorealias element defined in the fmsmaster configuration file, place either the private key or the public certificate. Each private key requires that a password entry in the properties file is deployed along with the keystore. Place only private keys in keystores you plan to deploy to trusted sites. Consider the keystore and its associated properties file as a pair and name them accordingly, for example, fsc.fscid.signing.jceks and fsc.fscid.properties. Siemens Digital Industries Software recommends using scripts to manage keystores, generate key pairs, export public certificates, and import the public certificates to other keystores. Keep scripts in a secure location. Naming conventions Use no spaces, commas, equal signs, or colons in the names of keystore aliases. Use no spaces or commas in the names of policy IDs. Siemens Digital Industries Software recommends adding a system identifier to aliases, such as the system ID or site ID. Doing so ensures that over time, as signatures are passed between sites, the aliases continue to be unique and traceable to the owning site.