BIOS hardening for RSA Authentication Manager 8.x

[#1]

Article Number

000030712

Applies To

RSA Product Set: SecurID
RSA Product/Service Type: Authentication Manager
RSA Version/Condition:  8.x

Issue

Chapter 2 (page 36) of the RSA Authentication Manager 8.1 Security Configuration Guide (Revision 2) covers BIOS hardening; however, it does not offer the steps to change the BIOS password.

Resolution

To protect access to the BIOS, RSA recommends that administrators change the preconfigured BIOS password to a strong password of their choice.
 

Changing the BIOS password requires a reboot of the RSA SecurID Appliance so plan accordingly for an outage.

Steps

1. Log in to the RSA SecurID Appliance with the rsaadmin account at the local console and enter the password for rsaadmin when prompted.  The password for this account was set up during the deployment of the SecurID Appliance and is unknown to RSA.
2. To reboot the RSA SecurID Appliance at the command line, use the command sudo reboot.
3. On startup, the SecurID Appliance local console initially shows the RAID Controller BIOS version and RAID configuration information, as shown here:

Image description

4. On the next screen, the administrator is given the option to press F2 to enter the setup.

Image description

5. Press F2 to enter the setup.
6. You are prompted to enter a password.  For example:

Image description

7. After the BIOS password is entered, the BIOS menu is shown:

Image description 

8. ​Use the arrow keys on the keyboard to navigate the BIOS menu and select Security.  For example:

Image description

9. Select Set Administrator Password.
10. Enter the current password for the BIOS.

Image description

11. Create a new BIOS password:

Image description

12. Confirm the new BIOS password:

Image description
 

You may get the following warning if the password is not considered to be strong enough; however, the weak password is still accepted.
 

Image description

Use a strong password to ensure security.  Store the new BIOS password in a secure place.

13. After the BIOS password change, navigate the BIOS menu and select Exit.  For example:

Image description

14. Select Save Changes and Exit.
15. When prompted select Yes to save the configuration and exit.

Image description

16. The SecurID Appliance will then go through a reboot sequence.

Notes

• Article 000030712 - RSA Authentication Manager 8.1 BIOS hardening provides information that is related to the hardware RSA SecurID Appliance.