Attachment_0011_-_ENDR_Users_Guide.pdf

Enterprise Network Data Repository

User’s Guide

Version 1.0

28 Aug 2014

96CG/SCOIE

101 Griffin Way • Bldg. 1425 • Room 166 i

Table of Contents Table of Contents i List of Tables and Figures iii 1 Introduction 1

1.1 What is ENDR? 1

1.2 Navigation Options 3

1.3 Obtaining Help Online 6

2 Basic Operations 7

2.1 What ENDR Manages 7

2.2 Obtaining a New IP Address 7

2.3 Duties of a Certifying Official 8

User Name Resolution 8

2.4 Lifecycle of a Request 8

2.5 Viewing Your Information 8

Search ENDR 8 Custom Search 10 Organizational Policy Report 12

2.6 Changing Host Information 12

2.7 Viewing the List of IAMs 12

2.8 Viewing the List of IAOs 12

2.9 Viewing the Certifying Official Groups 12

2.10 Viewing User Roles 12

2.11 Email Notification 12

2.12 Data Safety 14

3 Advanced Operations 15

3.1 Time Savers 15

Batch Entry 15 Global Changes 15 Batch DAA Accreditation 15

3.2 Advanced Searching 15

3.3 Entering Complex Hosts 16

3.4 Portable and Multi-Classified Machines 17

3.5 Expiring Hosts 18

3.6 Deleting Hosts 18

3.7 Deleting Deleted Hosts 19

3.8 Reserving Test Addresses and Host Names 19

3.9 DNS Updates 19

3.10 Port Security 19

3.11 My Hosts Report 19

4 IAMs and IAOs 19

4.1 IAM/IAO Duties in ENDR 19

4.2 Approving Pending Requests 20

4.3 Handling Problem Requests 20

4.4 Deleting Requests 21

4.5 Renewing DAA Accreditation 21

4.6 Options for IAOs and IAMs 21

Read Only 21 No DAA Authority 22 No Email 22

4.7 Certifying Official Groups 22

Adding a Certifying Official Group 22 Changing a Certifying Official Group 22 Deleting a Certifying Official Group 22

4.8 Managing Organizational Policies 23

Disabling an Organizational Policy 23

Enabling an Organizational Policy 23 5 Network Role 24

5.1 Network Role Duties in ENDR 24

5.2 Altered Views 24

Pending Requests Page 24 Custom Search Page 24 Statistics 24 Search ENDR 25 Change Computer Page 25 Deleting Deleted Hosts 25

5.3 Assigning Network Information 25

IP Addresses 25 Assigning Host Names 26 Assigning CNAME Records 26 Assigning MX Records 26

5.4 Batch Entry 26

5.5 Managing the Buildings 27

Adding a New Building 27 Changing a Building 27 Deleting a Building 27

5.6 Managing Address Ranges 27

Adding an Address Range 27 Viewing Address Ranges 28 Changing Address Ranges 28 Deleting Address Ranges 28

5.7 Managing IP Address Reservations 28

Viewing Existing IP Reservations 28 Releasing IP Reservations 29

5.8 Restoring Deleted Hosts 29

5.9 Managing the Network Role Membership 29

Adding Network Role 29 Deleting Network Role 29

5.10 Marking Problem Requests 29

5.11 Resetting DNS and Port Security Information 29

6 Information Assurance 30

6.1 IA Duties in ENDR 30

6.2 Special Views 30

Custom Search Page 30

6.3 Managing the IAMs and IAOs 30

Adding IAMs 30 Deleting IAMs 30 Replacing IAMs 30 Adding an Alternate 31 Deleting an Alternate 31 Setting Options 31

6.4 Managing the Information Assurance Role

Membership 31

Adding Information Assurance Role 31 Deleting Information Assurance Role 31

6.5 Managing Organizational Policies 31

Uploading Organizational Policies 31 Deleting Organizational Policies 32 Changing Organizational Policies 32 Disabling an Organizational Policy 32 ii

Enabling an Organizational Policy 32 7 User Management 33

7.1 Account Status 33

7.2 User Manager Responsibilities 33

Adding a User 33 Changing a User 33 Deleting a User 33

7.3 Managing the User Manager Role 33

Adding User Manager Role 33 Deleting User Manager Role 34

8 Application Manager 35

8.1 Duties of the Application Manager 35

8.2 Adding New Operating Systems 35

8.3 Deleting Operating Systems 35

8.4 Managing the Application Manager Role 35

Adding Application Manager Role 35 Deleting Application Manager Role 35

8.5 Adding New Roles 35

8.6 Deleting Roles 35

8.7 Managing References 35

Adding References 36 Changing References 36 Deleting References 36

8.8 Managing Locations 36

Adding New Locations 36 Changing Locations 36 Deleting Locations 37 Viewing Locations 37

8.9 Managing Applications 37

Adding Applications 37 Changing Applications 37

8.10 Deleting Applications 37

9 Trouble Shooting 38

9.1 Request is not in DNS 38

9.2 IP/MAC/Hostname conflict 38

9.3 Search shows nothing 38

9.4 Batch file not text/plain 38

9.5 Can’t find an action 38

Appendix A – Field Definitions 39 Index 45 iii

List of Tables and Figures Table 1 Roles in ENDR 1 Table 2 Navigation Options 3 Table 3 Email Message Events and Recipients 13 Table 4 Common Regular Expressions 16 Table 5 Pending Request Symbols 24 Table 6 Application Types 39 Table 7 DAA Modes 41

Figure 1 IP Request Life Cycle 2 Figure 2 Alert Process FlowError! Bookmark not defined.

Figure 3 New Request Screen 7 Figure 4 Search ENDR Matching Multiple Hosts 9 Figure 5 Search ENDR Results 10 Figure 6 Custom Search Screen 11 Figure 7 Alert Compliance ReportError! Bookmark not defined.

Figure 8 Alert Compliance Detail ReportError! Bookmark not defined.

Figure 9 Compliance MatrixError! Bookmark not defined.

Figure 10 Accreditation Page 21 Figure 11 Alert Overview ReportError! Bookmark not defined.

Figure 12 NOSC Report Error! Bookmark not defined.

1 Introduction

1.1 What is ENDR?

The Enterprise Network Data Repository1 (ENDR) unites the Designated Approval Authority (DAA) accreditation process, Internet Protocol (IP) address assignment and Port Security into one web interface.

It eliminates redundant data entry, and automates as much of the above processes as possible. ENDR enables:

• Machines can be tracked to their location and Certifying Official.

• IP addresses expire unless they have current DAA accreditation.

• Hostnames, Media Access Controller (MAC) addresses, Canonical Names (CNAMEs, and Mail Exchanger (MX) records are guaranteed to be unique.

• Entry of hosts into the Eglin Port Security Database.

ENDR users can take on multiple roles summarized below. Different roles have different powers and views into the ENDR data that will be discussed in later sections.

Table 1 Roles in ENDR Role Definition

Certifying Official The Certifying Official (CO) is the person responsible for making a technical judgment of the system’s compliance with the system security policy. They also request IP addresses and DAA Accreditation.

Recommendation: If a person can modify the configuration of a system (i.e. install software or modify system files) then that individual should be the Certifying Official for that system. ENDR supports CO Groups if more than one person shares administrative duties on a host.

IAM The Designated Approval Authority Organizational Representative (IAM) is the person who formally accepts the responsibility for the security of the machine on behalf of the DAA. DAA accreditation is required for the machine to operate. The DAA appoints the IAM for your organization.

IAO The Information System Security Officer (IAO) assists the IAM in the certification and accreditation process. IAOs are appointed in writing by the IAM.

Information Assurance

Also called Security Administrators, these people work in the Information Assurance (IA) Office. They manage the list of IAMs and IAOs, organizational policies, and post Alerts.

Network Also called the IP Administrator, these people assign IP addresses and hostnames.

They also manage the address ranges and the list of valid buildings.

User Manager The User Manager role is only used when ENDR manages the user information.

The User Manager is allowed to create, delete, and change users. Eglin does not use this role.

1 https://ENDR.eglin.af.mil https://esdi.eglin.af.mil/

Role Definition Network Admin They manage the membership of the Network and Network Admin roles.

IA Admin They manage the membership of the Information Assurance and IA Admin roles.

User Manager Admin

They manage the membership of the User Manager and User Manager Admin roles. Eglin does not use this role.

Application Manager They manage the list of Operating Systems, change the Announcement, and perform other configuration duties that are needed at installation time.

Figure 1 illustrates the flow of a request from origination, through DAA accreditation, to IP assignment.

Figure 1 IP Request Life Cycle

1.2 Navigation Options

ENDR uses a left navigation scheme to make all of the actions possible in a role available for use. If a user has more than one role, they can switch between the roles by selecting a different role at the top right of the screen. The page will refresh and display the navigation options available for the new role.

Table 2 Navigation Options

V ie w

Action Description See Also ENDR Logo Show main ENDR page Search ENDR View information about a single host 2.5.1

Custom Search Search the hosts viewable by your current role 2.5.2, 3.2 Reserved View the reserved IPs 5.7.1

Address Ranges View the address ranges 5.6.2

Locations View the locations 8.8.4

IAMs View the list of available IAMs 2.7

IAOs View the list of available IAOs 2.8

CO Groups View the membership of all CO Groups 2.9

E di t/ A ct io ns

Add OS Add a new Operating System 8.2

Delete OS Delete an Operating System 8.3

Add Role Add a new Role 8.5

Delete Role Delete a role 8.6

IA

M

Add Add a new IAM 6.3.1

Change Change/replace an existing IAM 6.3.3,6.3.6 Delete Delete a IAM 6.3.2

IA

O

Add Add a new IAO 6.3.1

Change Delete an IAO 6.3.3,6.3.6 Delete Change/replace an existing IAO 6.3.2

Change CO Group Change a CO group 4.7.2

C om pu te r New Request a new host 2.2

Pending View/change/approve requests for new hosts 4.2

Change Change an existing host 2.6

Delete Delete an existing host 3.6

Accredit Update the DAA Accreditation of one or more hosts 4.5

Global Change Make the same change to many hosts at once 3.1.2

Batch Create Load new requests from a batch spreadsheet 3.1.1, 5.4 Restore Deleted Reverse the deletion of a host 5.8

Delete Deleted Completely remove a deleted host from the database 3.7

Po lic y

Add Add a new IAM Policy 6.5.1

Change Change an existing IAM Policy 6.5.3

Delete Delete a IAM Policy 6.5.2

Disable Make a IAM Policy unavailable for use 4.8.1,6.5.4 Enable Allow a disabled IAM Policy to be used 4.8.2,6.5.5

IP

Reserve Reserve an IP Address 5.7

Release Release a reserved IP Address 5.7.2

Reset DNS Refresh the DNS and DHCP database entries for a host 5.11

A dd re ss

R an ge View See the address ranges 5.6.2

New Add a new address range 5.6.1

Change Change an existing address range 5.6.3

Delete Delete an address range 5.6.4

Bu ild in g New Add a new building 5.5.1

Change Change an existing building 5.5.2

Delete Delete a building 5.5.3

U se r

Add Add a new user 7.2.1

Change Change an existing user 7.2.2

Delete Delete a user 7.2.3

Add CO Group Add a new Certifying Official Group 4.7.1

Change CO Group Change an existing CO Group 4.7.2

Delete CO Group Delete a CO Group 4.7.3

Re fe re nc e

New Add a new reference 8.7.1

Change Change an existing reference 8.7.2

Delete Delete a reference 8.7.3

Lo c at io New Add a new location 8.8.1

Change Change an existing location 8.8.2

Delete Delete a location 8.8.3

A pp lic at io n New Add a new application 8.9.1

Change Change an existing application 8.9.2

Delete Delete an application 8.10

Re po rts

M isc

Organizational Policy See an organizational policy report 2.5.3

My Hosts See a summary report for all of your hosts 3.11

User Roles See your roles and the roles of other users 2.14

St at ist ic s

Summary See a summary report for all of ENDR 5.2.3

IPs per Building See the count of IP Addresses assigned to each building 5.2.3

IPs per OS See the count of IPs using each Operating System 5.2.3

Accreditation Count See a breakdown of the different accreditation types 5.2.3

Host Report (Excel) See a tabular report of all of your host information 5.2.3

A dd to R ol e

Network Add user(s) to the Network role 5.9.1

Network Admin Add user(s) to the Network Admin role 5.9.1

A dm in

IA Add user(s) to the Information Assurance role 6.4.1

IA Admin Add user(s) to the IA Admin role 6.4.1

User Manager Add user(s) to the User Manager role 7.3.1

User Manager Admin Add user(s) to the User Manager Admin role 7.3.1

Application Manager Add user(s) to the Application Manager role 8.5.1

D el et e fr om

R ol e

Network Delete user(s) from the Network role 5.9.2

Network Admin Delete user(s) from the Network Admin role 5.9.2

IA Delete user(s) from the Information Assurance role 6.4.2

IA Admin Delete user(s) from the IA Admin role 6.4.2

User Manager Delete user(s) from the User Manager role 7.3.2

User Manager Admin Delete user(s) from the User Manager Admin role 7.3.2

Application Manager Delete user(s) from the Application Manager role 8.5.2

Re fe re nc es

FAQ The list of Frequently Asked Questions Network SSAA View the Network SSAA User’s Guide This document

Templates The batch spreadsheet, sample IAM policy, etc.

1.3 Obtaining Help Online

If you want to know the definition of one of the data fields, you can click on the field name. A help window will appear. These fields are also described in Appendix A.

If you have a general question about ENDR, the first place to look is the Frequently Asked Questions List.

If you can’t find your answer there, then email your question to 96 CS ENDR Team.

https://esdi.eglin.af.mil/faq.cgi mailto:96cg.esditeam@eglin.af.mil

2 Basic Operations

2.1 What ENDR Manages

The short description is “everything that needs DAA accreditation”. This includes classified and unclassified desktop hosts, servers, printers, network routers, laptops, etc – especially those that require an IP address. It even includes hosts that don’t connect to any network. It is important that every host be entered into ENDR for your IAM to track and report on it, so that its IP address appears in the Domain Name System, and to track its compliance with alerts.

2.2 Obtaining a New IP Address

Click on the “New” action under the “Computer” heading. You will see a form with three columns (See Figure 3 New Request Screen).

Figure 2 New Request Screen

Fill in the mandatory sections (indicated by *). When you select your IAM, the list of available IAM Policies that can apply to your host will appear. Continue filling in the mandatory sections. Make sure the security on your host is up-to-date (consult your IAM policy for references and checklists). When you are satisfied with the accuracy of the information you supplied, and the status of the host’s security, click on the wide bar that begins with “I certify…”

ENDR will hold the request until it has DAA accreditation, after which the IP Administrator will assign the IP address. You will receive an email message containing the new IP address along with the information you originally submitted. (See section 2.4 for the lifecycle of a request).

2.3 Duties of a Certifying Official

The Certifying Official should be the person most involved with the configuration of the host. It defaults to the person entering the data into ENDR, but it can be a Certifying Official Group if several people manage the host. You can enter a different user name as Certifying Official if someone else manages the machine. (See 2.3.1 for a note on CO names)

When any of the host information stored in ENDR changes (new network card, different serial number, location, operating system change, etc.), the Certifying Official is responsible for updating the data. If the changes were significant, like a change of operating system, the Certifying Official should go through the process of attaining DAA accreditation.

User Name Resolution Whenever ENDR asks for the name of a user, enter as many letters of the last name as you are sure of, followed by a space and as many letters of the first name as you are sure of. You can omit the first name if you believe there will only be a few matches.

When you submit the form, ENDR will show you a list of display names (First Last Middle Rank Office) that match the information you provided. Click on the user you want.

2.4 Lifecycle of a Request

Section 2.2 explains how to submit a new request, but that’s not all that is necessary before the IP address is granted. New requests enter the pending state, where they await DAA accreditation from either the IAM or the IAO (who receive mail when the request is originated). Once the request has DAA accreditation, the IP Administrator assigns an IP address based on the host’s physical location. Only when the IP Administrator submits the request, does the request leave the pending state and become active (See Figure 1 IP Request Life Cycle).

2.5 Viewing Your Information

There are several ways to obtain information about your hosts. The best choice depends on your needs.

Search ENDR If you only want to see the data associated with a single host and you know something about it (IP Address, Hostname, Standalone ID, MAC Address, Serial Number, etc.), “Search ENDR” under the “View” heading is your best choice. Enter the information you know into the text field and hit return or press the “go” button. Unlike the more powerful “Custom Search”, this view has no access controls on the data.

Any person can see any host. This makes “Search ENDR” very useful for trouble-shooting and security investigations. The goal of this page is to be the one-stop source for all information about a single host.

ENDR will search all of the hosts in its primary database, and all of the hosts in the archive database trying to match the data you provided. ENDR tries to be smart about what you entered. If your search string looks like an IP Address, then it searches for matching IPs. If it looks like a MAC Address, then it searches for matching MACs. If it isn’t sure, then it searches hostnames, serial numbers, comments, etc.

Remember, this is a single host view, so ENDR will not perform pattern matching, or search fields that will likely belong to many hosts (like building).

If more than one host matches the search criteria, (for instance an active host and an archived host that have the same IP Address), ENDR will show a one-line summary of the matching hosts and where they came from. Click on the host you wish to view.

Figure 3 Search ENDR Matching Multiple Hosts If the search only matched one host, or if you click on a host from the one-line summary, you will see the familiar three-column display, but you won’t be able to change anything. If you have permission to change the host, you will see a button below the host information “Change <yourhost>” that is linked to the change page for your host.

Figure 4 Search ENDR Results If the host is in an inactive state (deleted, pending, unclaimed, etc.), a message to that effect will appear in red beneath the page title. Below the three-column display will be the compliance status (if applicable) of the host for all open alerts. Again, if you have permission to change the host, you will a see a button “Change Compliance” that is linked to the “Change Compliance by Host” page. Finally, you will see the entire log history of the host, sorted most-recent to least recent.

Custom Search The “Custom Search” page under the “View” heading is the most versatile tool for displaying your data. By default, it shows you the IP address, hostname, Certifying Official, IAO, IAM, DAA accreditation date, and MAC address of the hosts you can view with your current role.

Figure 5 Custom Search Screen

You can customize the fields that appear through the “Show fields” select box. The “Search fields” select boxes allow you to restrict the output to those hosts that match certain search criteria.

2.5.2.1 Searching

Use the search boxes to reduce your output and speed the retrieval of your information. All searches are case independent.

For example, suppose you wanted to see all of your Dell machines. Select Model in the first select list and type “Dell” in the “String” box next to it. Press “Show”.

Each additional search you specify is logically ANDed with the others, so your results have to match all of the search criteria before they appear.

For example, suppose you wanted a list of all of the UNIX boxes in room 315 of building 380. You would select Operating System in the first “Search fields” select box and type “Unix” in the box next to it. You would select Floor/Room in the second select box and type “315” in the box next to it. Then you would select Building in the third select box and type “380” in the box next to it. Then press “Show”.

Sometimes, like when you are trying to resolve a conflicting MAC address, you may wish to search hosts in all states (Pending, Deleted, etc.), rather than just the active hosts. Check the box entitled “Search hosts in all states” for this to happen.

2.5.2.2 Excel Output

Should you wish to manipulate your data in a manner that the web page doesn’t support, such as multi-column sorting, counting, etc., you can obtain the results in a Microsoft Excel spreadsheet. Just check the “Format data for input to Excel” box near “Reset” before hitting “Show”. If you are using a PC with Excel, it will automatically load the file. For all others, you will be presented with a file to download.

Organizational Policy Report The “Org Policy” page under the “Report” heading allows you to view Organizational Policies and the hosts that use them. First, select the IAM who owns the policy you wish to view. Press “Continue”. The screen will redraw to show you a list of policies. Select the policy you wish to view. Press “Continue”.

Once again, the screen will redraw and show you a link to the policy and a list of hosts that use it. From this screen the policy can be viewed and printed from a separate window that pops up when you click on the link. The next step is to select the hosts you wish to view and then press “Finish”. You will see a (perhaps lengthy) report that shows the details of all hosts that you selected. This page can also be printed and attached to the policy printout to form a complete written DAA package for those hosts.

2.6 Changing Host Information

When it is time to change information about one of your hosts, use the “Change” page under the “Computer” heading. You will see a list of IP addresses and hostnames that you can change. Select the one you want to change and you will see a screen similar to the “New Computer” screen, except with all of the information for your host filled in. Make the changes you want and press “Save Changes”. See section

2.3.1 to learn how to change the Certifying Official.

If you want to change the network-related information in the third column, you can use the “Message to the IP Administrator” box. Type in your request and press “Message to IP Admin”. An email message will be sent to them and they will make the changes.

2.7 Viewing the List of IAMs

The “IAMs” page under the “View” heading will show you the wing, display name, list of alternates, phone number, and location of every appointed IAM.

2.8 Viewing the List of IAOs

The “IAOs” page under the “View” heading will show you the wing, display name, list of alternates, phone number, and location of every appointed IAO.

2.9 Viewing the Certifying Official Groups

The “CO Groups” page under the “View” heading will allow you to choose a Certifying Official Group and see the IAM Sponsor, owner, and complete membership of the group.

2.10 Viewing User Roles

The “User Roles” page under the “Reports” heading will show you all of your role and group memberships.

It will also let you see the role and group memberships of any other ENDR user.

2.11 Email Notification

ENDR will send an email message (from 96cg.esditeam@us.af.mil) when certain events occur. The following table outlines the trigger event, the recipient(s), and the action the recipient should take.

mailto:96cg.esditeam@us.af.mil

Table 3 Email Message Events and Recipients Event Recipient(s) Action

New Request Certifying Official, IAO, alternate IAO, IAM, alternate

IAM

The IAO or DOR should visit the pending page to DAA accredit the request.

IP address is Granted by IP Administrator

Certifying Official The Certifying Official should configure the host with the new IP address or configure the host to use

DHCP.

DAA Accreditation is about to expire

Certifying Official, IAO, alternate IAO, IAM, alternate

IAM

The DOR or IAO should use the accredit page to update the DAA accreditation date.

The Certifying Official, IAO, alternate IAO, IAM, or alternate IAM has become invalid (account disabled or removed)

IAO, alternate IAO, IAM, alternate IAM (unless they are an invalid user)

For an invalid IAM, IAO, or alternate, amend the appointment letter on file with the IA OFFICE.

Invalid Certifying Officials should be replaced by the IAM or IAO using the change computer page.

A primary IAM or IAO is replaced The new IAM or IAO The recipient should review the organizational policy and use the search page to examine the hosts for which they are responsible.

A deleted IP Address still responds to “ping” shortly before it is to be released for reuse

IP Admin, Certifying Official, IAO, alternate IAO, IAM, alternate IAM

Either request that the host be undeleted, or remove the IP Address from the host.

A Organizational Policy is about to expire or has expired

The IAM who owns the policy, alternate IAMs, and the IA Office

Update your IAM policy and submit it to the IA Office.

Invalid Certifying Official Group owner

The IAM who owns the group and alternate IAMs

Visit the “Change CO Group” page to appoint a new group owner.

Invalid Certifying Official Group member

The IAM who owns the group, alternate IAMs, group owner

Visit the “Change CO Group” page to remove the inactive user from the group.

Empty Certifying Official Group The IAM who owns the group, alternate IAMs, group owner

Review the need for this group and either assign someone to it or delete it.

Unused Certifying Official Group The IAM who owns the group, alternate IAMs, group owner

Review the purpose of this group and either assign it to one or more hosts or delete it.

2.12 Data Safety

One of the benefits of centralized data is its ability to prevent conflicts. ENDR takes great pains to avoid duplicate MAC addresses, host names, IP addresses, CNAMEs, and MX records. Clean data makes trouble shooting and security investigation much easier.

Users are permitted to change data according to their role. Certifying Officials can change the information in the left column of the new and update displays for hosts for which they are the Certifying Official. IAOs and IAMs can change information in both the first and second columns for hosts for which they are IAO, IAM, or one of the alternates. The IP Administrators can change the third column.

Aside from the “Search ENDR” capability, non-privileged users can only see hosts for which they are one of the three roles (CO, IAO, or IAM.) or an alternate.

3 Advanced Operations

3.1 Time Savers

If you find yourself doing the same thing over and over, and it seems like there should be a better way, there probably is.

Batch Entry When you need to add a large number of hosts (10 or more), consider using the batch entry facility.

Enter your data in the Excel template and mail it to netadmin@eglin.af.mil. They will load the data and inform you of any errors. You will only need to resubmit the information that had a problem the first time.

Global Changes Sometimes you need to make the same change to a lot of your hosts. The “Global Change” page under the “Computer” heading can make such changes quick and easy.

Follow the steps from the top down. First select the hosts you wish to change. It can be any number of regular and standalone hosts. If there is a search condition that must apply to all of the hosts chosen in step 1 before they will be changed, specify it in step 2. Third, indicate the changes you want made. You can select different choices in step 3, or change a text field. See section 2.3.1 when changing a Certifying Official.

There are two checkboxes in step 4 that modify the way the updates are performed. By default, the search string you supply must match the value in the selected field exactly. Also, the new value you type in the fourth column completely replaces the old value.

The first checkbox tells ENDR to only replace the part of the old value that matches your search string. The second checkbox treats your search string as a regular expression (see section 3.2) rather than as an exact match.

Use caution when performing global updates, especially when using regular expression searches. If you are in doubt, contact 96cg.esditeam@us.af.mil and someone will help you.

Batch DAA Accreditation For IAMs and IAOs who have a sudden influx of hosts to approve, we have the Batch DAA Accreditation mechanism. In the “Pending” display, it appears automatically when you have DAA accreditation privilege and there are six or more requests awaiting your approval. Just select the ones you want to approve and hit the “DAA Accredit Selected Requests” button. Make sure the requests have been reviewed for accuracy before you approve them.

3.2 Advanced Searching

The search boxes in the global change and search pages permit the use of regular expressions to match parts of fields. A full treatment of regular expressions is beyond the scope of this document, but here are some of the more useful ones:

https://esdi.eglin.af.mil/supportfiles/batch.xls mailto:netadmin@eglin.af.mil

Table 4 Common Regular Expressions Regular

Expression Function

^ Matches the beginning of a line.

$ Matches the end of a line.

. Matches any character.

* Matches zero or more characters.

+ Matches one or more characters.

\d Matches any number.

\ Escapes any special character.

\s Matches any white space character.

Suppose you wish to see all of your hosts on Eglin’s subnet 3. You would use ^129\.61\.3\. as the search string on the IP address field. Note the need to escape the periods in the IP address since they are considered special characters. The trailing period is used to keep from matching the hosts in subnets 30, 31, 32, etc.

Suppose you want to see all of your hosts in building 1, but not those in building 13. If you just searched on “1”, you would see every host that had a 1 in its building number. To restrict the search, you need to use ^1$ as the search string on the Building field. The leading carat and trailing dollar sign mean that it will only match fields that both begin and end with a single number 1.

Suppose that among all of your hosts, you have several Suns with a model of “Sun 630”, “Sun 650”, and “Sun 690” and you wish to match only these. You would use ^sun 6\d0 or ^sun 6\d+ as your search string on the Model field.

Dates inside the ENDR database are in a format different from what appears in the reports. The only time this is important is when you want to use a regular expression to search on a date field.

Inside the database, dates are of the YYYY-MM-DD format instead of the DD-MMM-YYYY format used in the ENDR displays. Therefore, if you want to see all hosts that had their DAA accreditation in April of 1999, you would select “DAA Date” from one of the search select lists, and type “1999\-04” in the input box. If you wish to search on a complete date, either date format will work.

3.3 Entering Complex Hosts

Most hosts have a single network interface, a single IP address, and a single host name. For those that break the mold, data entry becomes trickier. When a host has multiple interfaces, the MAC addresses must be separated with commas. The same is true for host names.

For IP addresses, CNAMEs, and MX records, it is more complex still, since they are associated with a host name, and there can be multiple host names. This is where you must use the vertical bar (|) as a secondary separator. Vertical bars separate the IP addresses, CNAMEs, and MX records for the same host name. Commas separate groups of these associated with different host names. It is time for an example or two.

Suppose you have a host with two network cards with a different host name and IP address for each. Fill in the MAC address, host name, and IP address fields like this:

MAC Address 00-11-22-33-44-55,99-88-77-66-55-44 Host Name host1.eglin.af.mil,host2.eglin.af.mil IP Address 129.61.5.5,129.61.6.6

Now suppose that you have a host with one network card, one host name, but three IP addresses.

Here is how you would fill in the MAC address, host name, and IP address fields:

MAC Address 00-11-22-33-44-55 Host Name host1.eglin.af.mil IP Address 129.61.5.5|129.61.6.6|129.61.7.7

CNAMEs and MX records are another source of complexity. Here is how you would fill in the MAC address, host name, IP address, CNAME, and MX record fields for a host with two CNAMEs and an MX record.

MAC Address 00-11-22-33-44-55 Host Name host1.eglin.af.mil IP Address 129.61.5.5 CNAME cname1|cname2 MX record otherhost:10

Our grand finale complex host will have two network interface cards and two host names (host1, host2). The name host1 will have one IP (129.61.1.1) and two CNAMEs (cname1a, cname1b).

The name host2 will have two IP addresses (129.61.2.2, 129.61.3.3), two CNAMEs (cname2a, cname2b) and two MX records (mx2a:10, mx2b:20). Here is how the fields would look:

MAC Address 00-11-22-33-44-55,aa-bb-cc-dd-ee-ff Host Name host1.eglin.af.mil,host2.eglin.af.mil IP Address 129.61.1.1,129.61.2.2|129.61.3.3 CNAME cname1a|cname1b,cname2a|cname2b MX record ,mx2a:10|mx2b:20

Note the use of commas to separate the information for the different host names, particularly the comma at the beginning of the MX record field since there are no MX records for the first host name.

3.4 Portable and Multi-Classified Machines

Some machines change their classification, or even their physical location from time to time. If the host transitions between classification levels, it must be entered into ENDR at the highest classification level it uses.

If the machine is a laptop that is used in multiple buildings with an IP address in each building, select the building in which it spends the most time. Put any additional buildings for which the laptop needs IPs in the “Comments to the IP Administrator” box. The IP Administrator must select the “Disable Building/IP check” checkbox when activating the pending request or the consistency checker will complain about IP addresses that are not valid for the selected building.

3.5 Expiring Hosts

Every host in the database expires unless its IAO/DOR takes periodic action. A host’s DAA accreditation2 is good for three years. Every night, ENDR examines every host to see if it is about to expire. If a host is fourteen (14) days or less from expiration, an email message is sent to the Certifying Official (if interim accreditation), IAO, and IAM. The IAM or IAO should use the “Accredit” page under the “Computer” heading to renew DAA accreditation.

An email message will be sent daily until the host is recertified or expired. When a host expires, it will be automatically deleted (see section 3.6 for what this means).

3.6 Deleting Hosts

The “Delete” page under the “Computer” heading allows the Certifying Official, IAO, IAM, and their alternates to delete hosts. You will see a list of IP addresses and standalone hosts that you can delete. IP Administrators see an input box that allows them to type an IP address or host name.

Once a host is selected for deletion, ENDR displays information about the host and then prompts for confirmation. When you confirm the deletion, the host goes into the deleted state. Its name and IP address will not be released for ninety (90) days in case the host needs to be un-deleted (contact 96cg.esditeam@us.af.mil if you need a host un-deleted; see section 5.8). Deleted hosts no longer appear in the Domain Name Server (DNS) or Dynamic Host Control Protocol (DHCP) server even though their host names, IP addresses, and MAC addresses are reserved.

After ninety days, the host information will be archived, and its host name, IP address, and MAC address become free for re-issue.

Sometimes you want to delete a host and use its name, IP address, or MAC address immediately.

Check the box below the confirmation button before confirming. The host will be immediately obliterated.

In rare circumstances, you may have a host with multiple IP addresses and want to delete the entire host rather than just the one IP address. By default, the selected IP address will be removed from the host. It cannot be un-deleted! For hosts with multiple IP addresses, a second checkbox will appear below the confirmation button. Use the second checkbox if you want to delete the entire host rather than the one selected IP address. In that case, the host will be subject to the same grace period and un-deletion privileges as a regular host.

2 Interim DAA Accreditation is only good for 30 days.

3.7 Deleting Deleted Hosts

Sometimes a need arises to re-use a host that is sitting in deleted state. Rather than waiting for the remainder of the 90 day reservation period to expire, the user wants to accelerate the removal of the host from the database. The “delete deleted” page under the “Computer” heading shows you a list of deleted hosts that you own. Selecting one will archive it and makes its IP, hostname, and MAC available for re-use.

3.8 Reserving Test Addresses and Host Names

If you need an IP address or range of IP addresses for testing or short term use, contact netadmin@eglin.af.mil or 96cg.esditeam@us.af.mil. Depending upon your needs, several solutions are possible.

3.9 DNS Updates

ENDR automatically updates the DNS (Eglin local BIND DNS, does not affect AFNET DNS) information when ENDR data changes. By the time you receive mail informing you that your IP address has been granted, you should be able to use it. All hosts with Type other than Standalone appear in the internal name server.

3.10 Port Security

ENDR automatically updates the Port Security Databases used by the Eglin Enclave Network to ensure only properly accredited hosts have access to the NIPRNet.

3.11 My Hosts Report

This report gives you a summary of the hosts you manage in your current role. It shows different things depending on your role, including the number of hosts in each state, a breakdown by type, a breakdown by OS, a breakdown by building of all hosts, and a breakdown by building of non-network-infrastructure hosts.

4 IAMs and IAOs

4.1 IAM/IAO Duties in ENDR

IAMs and IAOs are appointed by the DAA via a letter sent to the IA Office. IAMs are responsible for establishing the policy that the organization follows before granting accreditation to a host. The policy covers physical and information security issues and can be different for each organization.

The IAM Policy includes the circumstances under which an IAO may grant DAA accreditation to a host via the ENDR interface. The policy might also mandate that members of the organization use the comment fields to record information important to the organization. There is an IAM Policy template available (under the “External Templates” link). All IAM Policies must be submitted to the IA Office for review before they can have any hosts assigned to them.

In ENDR, IAMs and IAOs have the same privileges by default. An organization’s IAM policy may restrict IAOs from exercising these privileges, and restrictions may be enforced by setting ENDR options (see section 4.6).

mailto:netadmin@eglin.af.mil mailto:96cg.esditeam@us.af.mil https://esdi.eglin.af.mil/supportfiles/DAASecurityPolicy.doc https://esdi.eglin.af.mil/supportfiles/DAASecurityPolicy.doc

If you are a IAM, IAO, or an alternate for either, the ENDR main page (accessible via the ENDR logo) will show your roles below the announcement. For example, you will see something like, “You are a primary IAM with alternates person1, person2”.

The main job of IAOs and IAMs in ENDR is to grant accreditation to new and expiring hosts. A DAA Type of “Final” is good for three years and is the default. A DAA Type of “Interim” means that the IAM is awaiting some action or information before granting final accreditation, but that the system is allowed to operate on the network in the meantime. Interim DAA accreditation is good for thirty days, after which it must be re-accredited, or changed to type “Final”.

4.2 Approving Pending Requests

The pending requests for a DOR or IAO can be viewed from the “Pending” page under the “Computer” heading. You will see a select list of hosts awaiting accreditation. If there are six (6) or more requests, the batch accreditation form may be visible (see section 3.1.3). Requests that already have accreditation will have an asterisk (*) after their name.

When you select a request, its information appears in the familiar three-column display. If you need an IP address assigned, but the DAA process is incomplete, you can use the Interim DAA accreditation type. Keep in mind that accreditation will expire in 30 days unless you change the type to Final.

You grant accreditation by clicking the “Grant DAA Accreditation” button below the middle column. Hosts of type Standalone are an exception. Once they receive DAA accreditation, they are immediately activated in the database and assigned a Standalone ID number; there is no need for the IP Administrators to become involved.

If you make any changes, there are two ways to save them. By clicking the “Save Pending Request” button, you record any changes without granting DAA accreditation. The “Grant DAA Accreditation” button saves any changes and grants DAA accreditation.

4.3 Handling Problem Requests

It is important that you examine the request for errors. Sometimes users mistakenly assign the wrong IAO or IAM. By clicking on the name of the requester at the top, you can send him or her a message notifying them of the mix-up.

Check the fields in the first column for accuracy and completeness. ENDR tries to validate as much as possible, but some fields such as room number, model, and serial number, are impossible to verify automatically. See section 4.2 about saving changes.

In the second column, make sure the choices of the requester are in accordance with your wishes.

Pay special attention to the DAA Type. If Interim is chosen by mistake, the DAA accreditation will expire in 30 days rather than 3 years. Also, make sure the requester chose the correct IAM Policy for the host.

Use the link at the top to clear up problems with the requester, and don’t be afraid to ask for help from 96cg.esditeam@us.af.mil on anything about which you are uncertain.

4.4 Deleting Requests

If you discover that a request was made in error, you can delete it with the “Delete Request” button. Unlike an active host, once a pending request is deleted, it cannot be recovered.

4.5 Renewing DAA Accreditation

This is done via the accredit page.

Figure 6 Accreditation Page First, select the host(s) that you wish to accredit. If you want to accredit all of your hosts that run a particular operating system, use the right-hand box and select the operating system you want. The two boxes are almost always mutually exclusive; you do not need to select a host in the left box and then select its operating system in the right box.

Once you have your host(s) selected, press the “Grant DAA Accreditation” button.

4.6 Options for IAOs and IAMs

By default, all IAMs, IAOs, and their alternates have the same privileges within ENDR. Some IAMs wish for their IAOs or alternates to have reduced privileges. There are three areas in which privileges can be restricted: changing data, granting DAA accreditation, and receiving mail. All of these are described in greater detail below. Any changes from the default must be requested of the IA Office via a paper letter from the IAM.

Read Only By default, all IAMs, IAOs, and alternates can change information in the first two columns of a request. Users with Read Only enabled can see everything the IAM and IAO can, but are unable to change the information. Note that Read Only does not remove the ability to grant DAA accreditation.

No DAA Authority By default, all IAMs, IAOs, and alternates can grant DAA accreditation. For users with No DAA enabled, the “Grant DAA Accreditation” button will not appear for pending requests, nor will the user be able to grant accreditation via the “Accredit” page.

No Email By default, all IAMs, IAOs, and alternates receive the same email. For users with No Email enabled, no email will be sent to them in their IAM/IAO role. It is very important that at least one IAM, IAO, or alternate receive mail for an organization. Failure to do so will not only slow the IP address assignment process, it will deny the organization reports on the consistency of their data, and information on impending expirations.

4.7 Certifying Official Groups

IAMs and IAOs are able to create named groups of Certifying Officials that permit multiple users to serve in the Certifying Official role for a single host. Each CO Group has a IAM sponsor, an owner, and one or more members. The IAM sponsor and the owner control the membership of the group. The name of each CO Group is unique across all of ENDR.

Adding a Certifying Official Group Use the “Add CO Group” page under the “User” heading to add a new Certifying Official Group.

You must select a unique name for the group, choose the IAM specify the owner (see section 2.3.1 for what to expect). If you leave the owner field blank, it will default to you. Press “Continue” to go on to specify the membership of the group.

Enter the name of a prospective member (see section 2.3.1) into the box above “Check Names” and then press “Check Names”. Click on the display name of the user you want. The member screen will reappear with the user you chose in the “Members” box at the right. Keep entering members like this until you are finished. Press “Create Certifying Official Group” to create the group. Note: there must be at least one member of the group.

Changing a Certifying Official Group Use the “Change CO Group” page under the “User” heading to change an existing Certifying Official Group. Select the CO Group you wish to change from the dropdown list and you will see a screen showing the name, sponsor, and owner of the CO Group. Make any changes you want and press “Continue”. You will then see a screen similar to the “Add CO Group” member screen except with the values filled in. Press “Change Certifying Official Group” when you are finished.

Deleting a Certifying Official Group Use the “Delete CO Group” page under the “User” heading to delete an existing Certifying Official Group. The CO Group must not be tied to any hosts. When you select the group it will be deleted.

4.8 Managing Organizational Policies

IAMs have the power to disable organizational policies of theirs that they don’t want hosts to use.

Disabling a policy prevents new hosts from choosing it and prevents current hosts that use it from being changed until they stop using it.

Note that the Information Assurance role can disable an organizational policy as well. It is not possible for an IAM to enable a policy disabled by the IA Office.

Disabling an Organizational Policy Use the “Disable” page under the “Policy” heading to see a list of your policies. Choose the policy you want to disable and press “Disable Policy”.

Enabling an Organizational Policy Use the “Enable” page under the “Policy” heading to see a list of currently disabled policies.

Choose the policy you want to enable and press “Enable Policy”.

5 Network Role

5.1 Network Role Duties in ENDR

The Network Role users (a.k.a IP Administrators) are few in number, but great in responsibility. Their many duties include managing the relationship between buildings and address ranges, managing the list of buildings, and granting IP addresses.

5.2 Altered Views

Many of the pages available to Certifying Officials behave differently for those with the Network role.

Pending Requests Page IP Administrators are able to see all pending requests. They may change information in the third column, as well as delete requests. For IP Administrators, the pending requests are sorted differently and sometimes have special symbols next to them. See Table 5, for the details.

Table 5 Pending Request Symbols Symbol Meaning Sort Order

* The request has DAA accreditation First + This is a new request (has an empty IP address field) Second

(None) The request has an IP address, but is awaiting DAA accreditation

Third

? This request has been designated as a problem request by the IP Administrator.

See section 5.10

Last

Custom Search Page On the custom search page, IP Administrators have an additional checkbox at the top, which allows them to include all hosts in the database in their searches. It is not checked by default.

Statistics Near the bottom of the left navigation column, IP Administrators see a list of statistics views, three of which are appropriate to them. The first is the high-level summary, which shows the number of IP addresses, standalone hosts, IAMs, IAOs, and Certifying Officials in the database. It also shows the number of outstanding pending requests.

The second report shows the number of IP addresses granted for each building (not counting hosts of type Net Infrastructure).

The third report provides a Microsoft Excel spreadsheet that shows all hosts along with the organization of the IAM and IAO. Note that this last report shows only the first IP Address, hostname, and MAC address for each host.

Search ENDR In addition to the regular log information, IP Administrators can see the comments they made about hosts when their IP addresses were assigned (see section 5.3.1).

Change Computer Page Because they can change the third column information of all hosts, IP Administrators don’t want to see every host in the database when using the “Update” screen under “Existing Computer Data”. Instead, they get a list of active subnets that they can open to see a list of all hosts contained therein.

Deleting Deleted Hosts Sometimes a host is deleted and dutifully preserved by ENDR for the 90-day waiting period, but someone needs to use that host’s IP address, host name, or MAC address. On the “Delete” screen, the IP Administrator has the additional capability to completely remove any deleted host.

5.3 Assigning Network Information

IP Administrators have responsibility for the information in the third column. The following sub-sections will describe the formats required and the ways ENDR can help the IP Administrator do their job.

When a host is activated, the Certifying Official receives an email detailing the new IP address and host name, as well as the fields in the first two columns to help them identify the host to which the IP address applies.