ELSA LANCOM Business 6000, Manual

Page: 54 / 174

Operating modes and functions
|
|
ELSA LANCOM Business 6000
|
54
EN
6.1.1 Password protection
The simplest option for the protection of the configuration is the
establishment of a password. As long as a password hasn't been set, anyone
can change the configuration of the device.
The password input field can be found in the ELSA LANconfig in the
'Management' configuration section on the 'Security' tab. The password
prompt can be activated in a terminal or Telnet session in the
/Setup/Config-module/passw.required
menu. In this case, the
password it-self is set with the command
passwd
.
6.1.2 Login barring
The configuration in the ELSA LANCOM Business is protected against “brute
force attacks” by barring logins. A brute-force attack is the attempt by an
unauthorized person to crack a password to gain access to a network, a
computer or another device. To achieve this, a computer can, for example, go
through all the possible combinations of letters and numbers until the right
password is found.
As a measure of protection against such attacks, the maximum allowed
number of unsuccessful attempts to Login can be set. If this limit is reached,
access will be barred for a certain length of time.
If barring is activated on one port all other ports are automatically barred too.
The following entries are provided in the ELSA LANconfig for configuring
login barring in the 'Management' configuration area on the 'Security' tab or
under
/Setup/Config-module
in the menu:
'Lock configuration after' (
Login-errors
)
'Lock configuration for' (
Lock-minutes
)
6.1.3 Access control via TCP/IP
Access to the internal functions of the devices through TCP/IP can be
restricted using a special filter list. Internal functions in this case are
configuration sessions via
ELSA LANconfig , ELSA WEBconfig , SNMP or
Telnet.
This table is empty by default and so access to the router can therefore be
obtained by TCP/IP from computers with any IP address. The filter is activated
when the first IP address with its associated network mask is entered and
from that point on only those IP addresses contained in this initial entry will