EndRun Tempus LX GPS, User Manual

Page: 69 / 116

T e m p u s L X G P S U s e r M a n u a l 57
"Smarter Timing Solutions"
Appendix
A
Security
Your Tempus LX incorporates several important security features to prevent unauthorized tampering
with its operation. Many of these are standard multiple-user access control features of the underlying
Linux operating system which controls the Tempus LX. Others are provided by the additional proto-
col servers selected for inclusion in your Tempus LX, and the way that they are configured.
Secure user authentication and session privacy while performing routine monitoring and mainte-
nance tasks are provided by the OpenSSH implementations of the “secure shell” daemon,
sshd
and
its companion “secure copy” utility,
scp
. The NET-SNMP implementation of the Simple Network
Management Protocol (SNMP) daemon,
snmpd
. conforms to the latest Internet standard, known
as SNMPv3, which also supports secure user authentication and session privacy. In addition, the
Network Time Protocol daemon,
ntpd
supports client-server authentication security measures to
deter spoofing of NTP clients by rogue NTP servers. This appendix describes these security measures
and gives the advanced network administrator information that will allow custom configuration to fit
specific security needs.
Linux Operating System
The embedded Linux operating system running in the Tempus LX is based on kernel version 2.4.26
and version 10 of the Slackware Linux distribution. As such it supports a complete set of security
provisions:
• System passwords are kept in an encrypted file,
/etc/shadow
which is not accessible by users other
than root .
• Direct
root
logins are only permitted on the local RS-232 console or via SSH.
• The secure copy utility,
scp
, eliminates the need to use the insecure
ftp
protocol for transferring
program updates to the Tempus LX.
• Access via SNMP is configurable to provide the security of the latest version 3 Internet standard
which supports both view-based access control and user-based security using modern encryption
techniques. Previous versions v1 and v2c supported access control essentially via passwords trans-
mitted over the network in plain text. Refer to
Appendix C – Simple Network Management Protocol
which is dedicated to configuration of SNMP for details.
• Individual host access to protocol server daemons such as
in.telnetd, snmpd
or
sshd
may be
controlled by the
tcpd
daemon and /etc/hosts.allow and /etc/hosts.deny.
• Risky protocols like TIME, DAYTIME and TELNET may be completely disabled by configura-
tion of the
inetd
super-server daemon.