4
i).
Xerox recommends the following when utilizing Secure Sockets Layer (SSL):
•
Any self-signed digital certificate or digital certificate signed by a Trusted Certificate Authority should have a maximum
validity of 180 days.
•
If a self-signed certificate is to be used the generic Xerox root CA certificate should be downloaded from the device and
installed in the certificate store of the user's browser.
j).
Xerox recommends that HTTPS be enabled in the evaluated configuration. To enable HTTPS (SSL):
•
At the Web UI
4
, select the
Properties
tab.
•
Follow the “Digital Certificates” instructions starting on page 62 of the SAG to install on the device either a self-signed
digital certificate or a digital certificate signed by a Certificate Authority (CA).
•
Select the following entries from the
Properties
'
Content
menu’:
Connectivity
Æ
Protocols
Æ
HTTP
.
•
Select the Secure HTTP (SSL)
Enabled
checkbox in the
Configuration
group box and enter the desired HTTPS port
number in the Port Number text box.
•
Select the [
Apply
] button. This will save the indicated settings. After saving the changes the Web UI will become
disabled; the System Administrator will have to access the Web UI again.
k).
Xerox recommends the following when utilizing Secure Sockets Layer (SSL) for secure scanning:
•
SSL should be enabled and used for secure transmission of scan jobs.
•
When storing scanned images to a remote repository using an https: connection, a Trusted Certificate Authority
certificate should be uploaded to the device so the device can verify the certificate provided by the remote repository.
•
When an SSL certificate for a remote SSL repository fails its validation checks the associated scan job will be deleted
and not transferred to the remote SSL repository. The System Administrator should be aware that in this case the job
status reported in the Completed Job Log for this job will read: “Job could not be sent as a connection to the server
could not be established”.
l).
To be consistent with the evaluated configuration, protocol choices for remote authentication should be limited to
[
Kerberos (Solaris)
], [
Kerberos (Windows 2000/2003)
] or [
LDAP
].
The device supports other protocol options.
Choose the
protocol option that best suits your needs.
In the case of LDAP/LDAPS the System Administrator should ensure that SSL is enabled as discussed in Step 19 on page 7-9
in the SAG.
m).
To be consistent with the evaluated configuration, the device should be set for local authorization. Remote authorization
was not evaluated since that function is performed external to the system.
Choose the authorization option that best suits
your needs.
n).
In viewing the Audit Log the System Administrator should note the following:
•
Deletion of a file from Reprint Saved Job folders or deletion of a Reprint Saved Job folder itself is recorded in theAudit
Log.
•
Deletion of a print or scan job or deletion of a scan-to-mailbox job from its scan-to-mailbox folder may not be recorded
in the Audit Log.
•
Extraneous process termination events (Event 50) may be recorded in the Audit Log when the device is rebooted or
upon a Power Down / Power Up.
o).
In downloading the Audit Log the System Administrator should ensure that Audit Log records are protected after they have
been exported to an external trusted IT product and that the exported records are only accessible by authorized individuals.
p).
Be careful not to create an IP Filtering rule that rejects incoming TCP traffic from all addresses with source port set to 80;
this will disable the Web UI.
IP Filtering is not available for either the AppleTalk protocol or the Novell protocol with the ‘IPX’ filing transport. Also, IP
Filtering will not work if IPv6 is used instead of IPv4.
4
From here on the directions assume that the Web UI has been accessed already by following the “Accessing CentreWare IS” instructions on page
17 of the SAG.
