Restricting selected fscadmin commands for PKI authentication

Before selecting fscadmin commands for additional authentication, you must first: Determine which fscadmin commands you want to restrict. This example requires additional authentication for the filestoredetail and cachedetail commands. Determine the policy names associated with the restricted commands. This example defines a single policy (trustedadmin) for both commands. Policy names are arbitrary, but should be meaningful, such as siteadmins or supplieradmins. Determine the key/certificate aliases used to assert a policy. This example uses ent123.trustedadmin. You can use different keys/certificates for each installation, though this requires significant keystore management. The keytool used in this example is from Java JDK 1.5. Procedure Create the trusted keystore to hold the private keys. In this example, this is the keystore deployed to trusted servers and installations. Determine the keystore name. In this example, the keystore name is trusted.jceks Determine the password used for the keystores. In this example, the password is trusted.jceks.lp7qZF.password. Determine the password used for individual keys. In this example, the password is trustedadmin.5oDHfVV.password. Use the keytool to create the keystore and key. For example: Copy > keytool -storetype jceks -keystore trusted.jceks -storepass trusted.jceks.lp7qZF.password -genkey -v -keyalg RSA -alias "ent123.trustedadmin" -keypass trustedadmin.5oDHfVV.password -validity 9999 -dname "CN=FMS trusted admin policy site ent123, OU=org unit, O=org, L=c, ST=st, C=cc" Generating 1,024 bit RSA key pair and self-signed certificate (MD5WithRSA) for: CN=FMS trusted admin policy site ent123, OU=org unit, O=org, L=c, ST=st, C=cc [Storing trusted.jceks] Use the keytool to export the public certificate. For example: Copy > keytool -storetype jceks -keystore trusted.jceks -storepass trusted.jceks.lp7qZF.password -export -v -alias "ent123.trustedadmin" -keypass trustedadmin.5oDHfVV.password -file ent123.trustedadmin.cer Certificate stored in file <ent123.trustedadmin.cer> Use the keytool to list the contents of the keystore. For example: Copy > keytool -storetype jceks -keystore trusted.jceks -storepass trusted.jceks.lp7qZF.password -list -v Keystore type: jceks Keystore provider: SunJCE Your keystore contains 1 entry Alias name: ent123.trustedadmin Creation date: Jul 10, 2022 Entry type: keyEntry Certificate chain length: 1 Certificate[1]: Owner: CN=FMS trusted admin policy site ent123, OU=org unit, O=org, L=c, ST=st, C=cc Issuer: CN=FMS trusted admin policy site ent123, OU=org unit, O=org, L=c, ST=st, C=cc Serial number: 4a578037 Valid from: Fri Jul 10 13:53:59 EDT 2022 until: Mon Nov 24 12:53:59 EST 2036 Certificate fingerprints: MD5: 66:6F:67:55:09:CA:04:69:52:76:C8:49:30:30:75:F0 SHA1: E4:74:66:DD:54:C2:0D:4B:D2:AD:74:EA:65:69:89:C7:0F:16:71:49 ******************************************* ******************************************* Create the untrusted keystore to contain only public certificates. In this example, this is the keystore deployed to untrusted servers and installations (such as supplier sites). Determine the keystore name. In this example, the keystore name is untrusted.jceks Determine the passwords used for the keystores. In this example, the password is untrusted.jceks.2TLiFD.password. Use the keytool to create and import the public certificate. For example: Copy > keytool -storetype jceks -keystore untrusted.jceks -storepass untrusted.jceks.2TLiFD.password -import -v -noprompt -trustcacerts -alias "ent123.trustedadmin" -file ent123.trustedadmin.cer Certificate was added to keystore [Storing untrusted.jceks] Use the keytool to list the contents of the keystore. For example: Copy > keytool -storetype jceks -keystore untrusted.jceks -storepass untrusted.jceks.2TLiFD.password -list -v Keystore type: jceks Keystore provider: SunJCE Your keystore contains 1 entry Alias name: ent123.trustedadmin Creation date: Jul 10, 2022 Entry type: trustedCertEntry Owner: CN=FMS trusted admin policy site ent123, OU=org unit, O=org, L=c, ST=st, C=cc Issuer: CN=FMS trusted admin policy site ent123, OU=org unit, O=org, L=c, ST=st, C=cc Serial number: 4a578037 Valid from: Fri Jul 10 13:53:59 EDT 2022 until: Mon Nov 24 12:53:59 EST 2036 Certificate fingerprints: MD5: 66:6F:67:55:09:CA:04:69:52:76:C8:49:30:30:75:F0 SHA1: E4:74:66:DD:54:C2:0D:4B:D2:AD:74:EA:65:69:89:C7:0F:16:71:49 ******************************************* ******************************************* Create and/or modify the FSC property files. Encrypt the keystore and key/alias password values using the passwordtool script. For example: Copy > passwordtool -encrypt trusted.jceks.lp7qZF.password fcLxB/oeZ+IeNnP/vofAqFpDqmJdSyaU0y+EHU0ffRc= > passwordtool -encrypt trustedadmin.5oDHfVV.password Bpg2TLiFDni3bT4xS4kyIaLvz5TWGLQ/GPTJN2r5T3s= > passwordtool -encrypt untrusted.jceks.2TLiFD.password J168VL0QG4bTbJpcls57lqwc3P42GhTnXWfogeoVWs0= Add the following properties to the fsc.fscid.properties file for trusted installations: Copy # signing keystore file and password com.teamcenter.fms.signing.keystore.file=trusted.jceks com.teamcenter.fms.signing.keystore.epassword=fcLxB/oeZ+IeNnP/vofAqFpDqmJdSyaU0y+EHU0ffRc= # key password(s) property name form: com.teamcenter.fms.signing..epassword com.teamcenter.fms.signing.ent123.trustedadmin.epassword=Bpg2TLiFDni3bT4xS4kyIaLvz5TWGLQ/GPTJN2r5T3s= Add the following properties to the fsc.fscid.properties file for untrusted installations: Copy # signing keystore file and password com.teamcenter.fms.signing.keystore.file=untrusted.jceks com.teamcenter.fms.signing.keystore.epassword=J168VL0QG4bTbJpcls57lqwc3P42GhTnXWfogeoVWs0= # key password(s) property name form: com.teamcenter.fms.signing..epassword # none... Create and/or modify the fscadmin property files by adding the following properties to the fscadmin.properties file for trusted installations. (No properties need be added for untrusted installations.) Copy # signing keystore file and password com.teamcenter.fms.signing.keystore.file=trusted.jceks com.teamcenter.fms.signing.keystore.epassword=fcLxB/oeZ+IeNnP/vofAqFpDqmJdSyaU0y+EHU0ffRc= # default admin ticket signing alias com.teamcenter.fms.signing.fscadmin.default.alias=ent123.trustedadmin # key password(s) property name form: com.teamcenter.fms.signing..epassword com.teamcenter.fms.signing.ent123.trustedadmin.epassword=Bpg2TLiFDni3bT4xS4kyIaLvz5TWGLQ/GPTJN2r5T3s= Modify the fmsmaster configuration file. Add the following elements under the last fmsenterprise element in the file (or after the final multisiteexport element, if any exist). In this example, the fscadminpolicies element maps fscadmin commands to policies. The policy element maps policies to the keystore aliases (in this case, to the keys/certificates). Copy ... ... ... Reload the fmsmaster configuration file by stopping and starting the FSC service or by issuing an fscadmin config reload command. For example: Copy > fscadmin -s http://cii6w223:7168 ./config/reload Initial configuration hash: 9a727fb3215fc5f9bf289cb4db0b164f Configuration reload successful. Final configuration hash: efed77c0315fc5f9bf289cb4db0b164f The fmsmaster configuration file, FSC properties, and signing keystores are read each time the configuration file is reloaded. Verify the available keys/certificates. Trusted installations should have access to private keys and public certificates. Untrusted installations should only have access to public certificates. Use the fscadmin command to perform the verification. For example: Copy > fscadmin -s http://cii6w223:7168 ./keystoreinfo Keystore info: # of private keys: 1, aliases: [ent123.trustedadmin] # of secret keys: 0, aliases: [] # of certificates: 1, aliases: [ent123.trustedadmin] Check in the FSC log files. For example: Copy ... INFO - 2022/07/10-18:38:55,500 UTC - cii6w223 - Keystore info: # of private keys: 1, aliases: [ent123.trustedadmin] # of secret keys: 0, aliases: [] # of certificates: 1, aliases: [ent123.trustedadmin] ... Test to confirm the selected FSC commands are restricted. The FSC allows an fscadmin command when a required signature for any certificate for any policy associated with the fscadmin command is present. If a required signature is not present, or cannot be validated, the fscadmin command is denied. Use a trusted fscadmin command in a trusted installation. For example: Copy > fscadmin -s http://cii6w223:7168 ./filestoredetail *** volume filestores: *** transient volume filestores: *** accesson filestores: Filestore Details: testvolarh---sy2a----bHA, root: e:\workdir\FMSShare\FMSTestExplodedWar \cr.txt, Len: 771999, Last modified: Mar 18 17:07 EST 2019, Last access: Jul 09 17:17 EDT 2021 \crlf.txt, Len: 776010, Last modified: Mar 18 17:06 EST 2019, Last access: Jul 09 17:17 EDT 2021 \FMS_User_Doc_Java.doc, Len: 403456, Last modified: Mar 12 09:23 EDT 2020, Last access: Mar 19 14:25 EDT 2021 \index.html, Len: 18372, Last modified: Dec 10 15:35:22 EST 2020, Last access: Jul 09 09:09:55 EDT 2021 ... \testfiles - empty \testvol - empty Dirs: 270, Files: 9009, Bytes: 19719498212 Use a trusted fscadmin command in an untrusted installation. For example: Copy > fscadmin -s http://cii6w223:7168 ./filestoredetail Error, server returned status code: 400, status message: ERROR_SIGNATURE_MISSING_1{filestoredetail} Results After confirming the selected fscadmin commands are restricted, manage PKI authorization by: Storing a backup of your keystores and passwords in a safe location. Creating new keys/certificates and deploying the new keys if you suspect a private key is compromised. Creating new keystores, creating new keys/certificates, using new passwords, and deploying the new keystores and property values if you suspect a password is compromised. This causes all previous keys and passwords to cease working.