1
Planning and Overview
12
■
File security
EFW data includes both policy information and audit records that contain raw
contents of packets. These packets may include login names and passwords that
could be transmitted over your network. As long as the disk partition on which you
install the Policy Server is formatted with NTFS (NT File System), files used by the Policy
Server can be accessed only by a user with Windows administrative privileges. If you
use the FAT or FAT32 file system, any authorized user of the computer for the Policy
Server could access EFW data. Further, if these files are shared over the network,
many users could potentially access these files.
■
Database security
EFW uses an underlying SQL database, called
MySQL
. Access to execute SQL
commands for this database is protected by passwords generated at installation time.
In addition, access using a remote SQL client is prohibited. Direct user access to the
EFW database via SQL is not necessary for EFW operations.
■
Secure communication
Communication is encrypted between EFW devices and the Policy Server, between the
Management Console and the Policy Server, and between Policy Servers. Policy Servers
identify themselves to each other, to the Management Console, and to their EFW devices
using two public-private key pairs generated upon creation of a new EFW domain.
The installation procedure in Chapter 2 of this guide includes a step to save these key
pairs to a diskette. The key pair data supports a method to recover control of EFW
NICs in the event of a catastrophic loss of all Policy Servers and data in a domain. (For
example, disk crashes on all Policy Server machines in a domain.) For a description of
the recovery procedure, see “Using the Recovery Diskette” on page 44. Possession of
an EFW key pair diskette could assist a knowledgeable but unauthorized user in
turning off the EFW capability on an EFW NIC.
The first time you connect a remote Management Console running on a particular
computer to any Policy Server in a domain, you will be asked to accept a digital
certificate generated to secure this communication. The system displays a fingerprint for
this certificate. Subsequent attempts to connect will verify the fingerprint presented by
the server with the previously accepted certificate. Thus, the fingerprint would normally
be displayed only the first time you connect from a machine. If you see a different
fingerprint, this difference could indicate an attempt by an attacker to masquerade
another program as a Policy Server (for example, to gain login-password information).
For communication between NICs and the Policy Server, the system automatically
determines the level of encryption used, based upon the encryption capability of
the EFW NICs. If EFW NICs are installed using the network installation method, they
generate their own initial encryption keys and report them to the Policy Server. If
installed with the diskette-keyed method, the initial key is generated by the Policy
Server and distributed to the EFW NICs via a diskette. For a comparison of these two
methods, see “Determine How You Want to Distribute EFW Firmware” on page 16.
CAUTION:
To protect EFW data from unauthorized users, install the Policy Server
on a disk partition formatted with NTFS.
CAUTION:
Create and keep an EFW key pair diskette in a secure location, as long
as any EFW NIC remains in the domain for this Policy Server.