Siemens RUGGEDCOM RSG2200 User's Guide download pdf (Page 14)

Chapter 1

Introduction

RUGGEDCOM ROS

User Guide

2 Security Recommendations and Considerations

Section 1.2

Security Recommendations and Considerations

The following describes important security-related recommendations and suggestions that should be considered

before implementing the RMC30 on any network:

• Section 1.2.1, “Security Recommendations”

• Section 1.2.2, “Key Files”

Section 1.2.1

Security Recommendations

To prevent unauthorized access to the device, note the following security recommendations:

• Do not connect the device to the Internet. Deploy the device only within a secure network perimeter.

• Replace the default passwords for all user accounts and processes (where applicable) before the device is

deployed.

• Use strong passwords. Avoid weak passwords such as password1, 123456789, abcdefgh, etc. For more

information about creating strong passwords, refer to the password requirements in Section 4.3, “Configuring

Passwords”.

• Make sure passwords are protected and not shared with unauthorized personnel.

• Passwords should not be re-used across different usernames and systems, or after they expire.

• When RADIUS authentication is done remotely, make sure all communications are within the security perimeter

or on a secure channel.

• SSL and SSH keys are accessible to users who connect to the device via the serial console. Make sure to take

appropriate precautions when shipping the device beyond the boundaries of the trusted environment:

▪ Replace the SSH and SSL keys with throwaway keys prior to shipping.

▪ Take the existing SSH and SSL keys out of service. When the device returns, create and program new keys

for the device.

• Restrict physical access to the device to only trusted personnel. A person with malicious intent could extract

critical information, such as certificates, keys, etc. (user passwords are protected by hash codes), or reprogram

the device.

• Control access to the serial console to the same degree as any physical access to the device. Access to the

serial console allows for potential access to the ROS boot loader, which includes tools that may be used to gain

complete access to the device.

• Only enable services that will be used on the device, including physical ports. Unused physical ports could

potentially be used to gain access to the network behind the device.

• If SNMP is enabled, limit the number of IP addresses that can connect to the device and change the

community names. Also configure SNMP to raise a trap upon authentication failures. For more information,

refer to Section 5.2, “Managing SNMP”.

• Avoid using insecure services such as Telnet and TFTP, or disable them completely if possible. These services

are available for historical reasons and are disabled by default.

• Limit the number of simultaneous Web Server, Telnet and SSH sessions allowed.

• Configure remote system logging to forward all logs to a central location. For more information, refer to

Section 3.6, “Managing Logs”.

1 2 ... 9 10 11 12 13 14 15 16 17 18 19 ... 169 170

Comments to this Manuals

No comments

Siemens RUGGEDCOM RSG2200 User's Guide Page 14

Comments to this Manuals

Related products and manuals for Networking Siemens RUGGEDCOM RSG2200