HP 3PAR InForm OS Common Criteria Administrator's Reference (QL226-96586, October 2012)

Operating in Common Criteria Mode 26
1. The system administrator should set the 3parsvc account password on the desired HP
3PAR Storage System to the manufacturing default value.
This password is provided by the HP 3PAR Technical Support team. To change the
password, use the setpassword 3parsvc CLI command.
2. The authorized service provider can boot the SP and log in as local user spvar or
spdood using a password assigned by the administrator (authorized maintainers will
use spvar and HP employees will use spdood).
3. The authorized service provider uses the SPOCC or spmaint interface to associate the
HP 3PAR Storage System to the SP (spmaint menu option 3.2 [add new inserv]),
and supplies the IP address of the HP 3PAR Storage System.
This causes the SP to exchange a public key with the HP 3PAR Storage System,
change the password of 3parsvc to a random value, and create accounts
3parservice, 3parbrowse and 3paredit (all with random passwords).
4. The maintenance activity is then performed as required.
5. On completion, the authorized service provider removes the SP – HP 3PAR Storage
System association using SPOCC or spmaint interface (spmaint menu option 3.4
[remove an inserv]).
6. The system administrator can take the following steps to lock out the SP again should it
be booted:
a. On the SP, change the spvar and spdood passwords.
b. Use the CLI to change the password of the 3parsvc account.
c. Use the CLI to remove the 3paredit, 3parbrowse, and 3parservice accounts.
7. The SP can then be powered off, if desired.
8. The authorized service provider will need to use the node console to perform the
following steps:
a. Run onallnodes update_pwfile.
b. Run onallnodes rm /root/.ssh/authorized_keys2.