Asentria SiteBoss 530 User Manual
55
Securing a SiteBoss 530
This section discusses all facets of security that must be considered when installing a SiteBoss 530. For adequate
security, you must consider the following:
•
•
•
•
•
•
•
•
Security mode
The security mode
(
sec.mode
) tells the unit how to control users' access to it. You can configure either User Profiles
mode or RADIUS mode. (See
). For either mode, you can restrict by what methods a user can
connect, as well as whether the user receives "Username:" and/or "Password:" when prompted for those items. Be
careful to always preserve a way to access the unit as a MASTER user (that is, a user with rights=MASTER). This is
the user with full access to configure all settings and invoke all commands. If you are using User Profiles, ensure,
before you log out, that you have a MASTER user configured and that you don't forget its password. If you are using
RADIUS then you can configure a MASTER user any time as long as you can configure users on the RADIUS server.
Before logging out of the unit when configuring RADIUS, ensure the unit can ping the RADIUS server, and that you
verify that a user can access the unit via RADIUS. If the user cannot log in to the unit via RADIUS then you will need
your existing login in order to gather data to help troubleshoot why the RADIUS user cannot log in.
If you are logged into the unit, you can put traffic on any network to which the unit is connected. For example, pinging
a host on the network, FTP-ing to it, SSH-ing to it, Telnet-ing to it. Therefore good security comes from making it so no
unauthorized persons have access to the unit. This is something you must ensure with the User Profiles or RADIUS
security mode configurations.
SNMP
By default anyone can access the unit via SNMP, and the SiteBoss's MIB is fully featured with configuration objects.
Therefore if you don't take care to secure SNMP, you leave the unit open to unauthorized users. There are 3 ways to
secure SNMP.
1.
turn it off (
net.snmp.enable
=OFF
)
2. leave it enabled for all SNMP versions (
net.snmp.enable
=ALL VERSIONS
) but ensure that the community
name is a strong password and that all user profiles have strong passwords. Be aware however then for
snmpv1 and v2c, the community names are transmitted in the clear, as with Telnet, so anyone eavesdropping
on the network may get unauthorized access to the unit.
3. set it to V3 only (
net.snmp.enable
=V3 ONLY
) and either use RADIUS or use a User Profiles configuration
that has strong passwords.
Telnet/FTP
Keep in mind that like SNMP, login credentials (and all application content) are transmitted in the clear for Telnet and
FTP, so anyone eavesdropping on the network could gain unauthorized access to the unit. Therefore, to tighten
security on Telnet, either do not use it, forbid it (with
sec.connectvia
), or use it with RADIUS/CHAP or User
Profiles with one-time password or challenge response.
Summary of Contents for SiteBoss 530
Page 6: ......
