Chapter 1
Introduction
RUGGEDCOM RSG2488
User Guide
2
Security Recommendations and Considerations
Section 1.2
Security Recommendations and Considerations
The following describes important security-related recommendations and suggestions that should be considered
before implementing the RSG2488 on any network:
•
Section 1.2.1, “Security Recommendations”
•
Section 1.2.1
Security Recommendations
To prevent unauthorized access to the device, note the following security recommendations:
• Replace the default passwords for the standard
admin
,
operator
and
guest
profiles before the device is
deployed.
• Replace the default passwords for accessing boot mode, service mode and maintenance mode before the
device is deployed.
• Use strong passwords. For more information about creating strong passwords, refer to the password
Section 4.3, “Configuring Passwords”
• Passwords should not be re-used across different usernames and systems, or after they expire.
• SSL and SSH keys are accessible to users who connect to the device via the serial console. Make sure to take
appropriate precautions when shipping the device beyond the boundaries of the trusted environment:
○ Replace the SSH and SSL keys with
throwaway
keys prior to shipping.
○ Take the existing SSH and SSL keys out of service. When the device returns, create and program new keys
for the device.
• Restrict physical access to the device to only trusted personnel. A person with malicious intent in possession
of the flash card could extract critical information, such as certificates, keys, etc. (user passwords are protected
by hash codes), or reprogram the card.
• Control access to the serial console to the same degree as any physical access to the device. Access to the
serial console allows for potential access to the ROS boot loader, which includes tools that may be used to gain
complete access to the device.
• Only enable the services that will be used on the device, including physical ports. Unused physical ports could
potentially be used to gain access to the network behind the device.
• If SNMP is enabled, limit the number of IP addresses that can connect to the device and change the
community names. Also configure SNMP to raise a trap upon authentication failures. For more information,
refer to
.
• Avoid using insecure services such as Telnet and TFTP, or disable them completely if possible. These services
are available for historical reasons and are disabled by default.
• Limit the number of simultaneous Web Server, Telnet and SSH sessions allowed.
• Configure remote system logging to forward all logs to a central location. For more information, refer to
• Periodically audit the device to make sure it complies with these recommendations and/or any internal security
policies.
