Home
Security
Configure different security features to adequately protect business assets and resources in the data model when using BigFix Inventory.
Configuring VM Manager Tool to accept trusted VM manager certificates
By default, the VM Manager Tool accepts all VM manager certificates regardless of whether they are trusted or not. You can change the default behavior to ensure that only trusted certificates are accepted by the VM Manager Tool.

Security
Configure different security features to adequately protect business assets and resources in the data model when using BigFix Inventory.
- Flow of data
  There are several different interactions that occur between the components of the BigFix Inventory infrastructure and between the user and tool.
- Security configuration scenarios
  Check what security options need to be enabled on the BigFix server and the BigFix Inventory server to achieve each of the supported security scenarios.
- Configuring secure communication
  To ensure secure communication, BigFix Inventory uses public key cryptography, which is based on algorithms that use two separate keys, a private key and a public key. This key pair is used to encrypt and decrypt communication.
- Assuring compliance with federal encryption standards
  You can configure BigFix Inventory to be compliant with the Federal Information Processing Standard requirements that are related to encryption.
- Authenticating users with LDAP
  BigFix Inventory supports authentication through a Lightweight Directory Access Protocol server. To use this feature, you must configure the BigFix Inventory server.
- Configuring and enabling single sign-on
  Available from 9.2.1. You can now use the two-factor authentication and use single sign-on to log on to BigFix Inventory and maintain login consistency with other applications in the enterprise. You can configure BigFix Inventory to use two-factor authentication with single sign-on based either on the exchange of Security Assertion Markup Language (SAML 2.0) token and Microsoft™ Active Directory Federation Services as Identity Provider or you can use the IBM Lightweight Third-Party Authentication (LTPA) technology and IBM Security Access Manager for Web as the authentication service.
- Configuring passwords and encryption mechanisms
  To improve the application security, define a security policy for user passwords. You can also configure passwords and encryption mechanisms for the keystore in which the passwords are stored, and the BigFix Inventory database.
- Configuring user account lockout
  Available from 9.2.8. By default, user account is locked for 5 minutes after the user attempts to log in to BigFix Inventory more than 10 times within 5 minutes. You can change the default settings or disable the user account lockout.
- Configuring VM Manager Tool to accept trusted VM manager certificates
  By default, the VM Manager Tool accepts all VM manager certificates regardless of whether they are trusted or not. You can change the default behavior to ensure that only trusted certificates are accepted by the VM Manager Tool.
- Relays
  Relays lighten both upstream and downstream burdens on the server. Rather than communicating directly with a server, clients can instead be instructed to communicate with designated relays, considerably reducing both server load and client and server network traffic.

Configuring VM Manager Tool to accept trusted VM manager certificates

By default, the VM Manager Tool accepts all VM manager certificates regardless of whether they are trusted or not. You can change the default behavior to ensure that only trusted certificates are accepted by the VM Manager Tool.

Procedure

Extract the VM manager certificate to a file.
The following steps are provided as an example and show how to extract a VMware certificate in Firefox. The steps that you need to perform might differ depending on the virtualization type and the web browser that you are using. If you encounter problems with extracting VM manager certificates, refer to the documentation of the virtualization that you are using.
1. Type the VM manager address in the web browser.
2. Click the lock sign and click More Information.
3. Open the Security tab and click View Certificate.
4. Open the Details tab and click Export.
5. Save the file in the DER format.
Log in to the computer where the VM Manager Tool is installed and copy the VM manager certificate to that computer.
To define the certificate as trusted, open the command-line interface and run the following command.
```
vmman.bat -addcertificate -alias unique_alias -file vm_manager_certificate
```
Where:

-alias

Unique alias that will be associated with the VM manager certificate.

-file

Path to the VM manager certificate that you extracted.

Important: Both switches are required.
Change the VM Manager Tool settings to accept only trusted certificates.
- If you are using basic VM management, log in to BigFix Inventory and go to Management > Advanced Server Settings. Then, set the value of the vmmman_trust_all_vm_managers_certificates parameter to false.
- If you are using advanced VM management, open the <BES Client>\LMT\VMMAN\config\vmmmainconf.properties file on the computer where the VM Manager Tool is installed. Then, change the value of the vmm_trust_all_vm_managers_certificates parameter to false.

Results

The VM Manager Tool accepts only trusted VM manager certificates. If a certificate of a VM manager that is defined in BigFix Inventory is not trusted, the status of the VM manager changes to Connection failed.