NETGEAR GSM7212 - ProSafe Switch Istruzioni per l'installazione e il funzionamento

Publication Version 1.0, February 2006

Application Note: Configuring and

Enabling Management Security

Publication Version 1.0, February 2006

Trademarks

NETGEAR and Auto Uplink are trademarks or registered trademarks of NETGEAR, Inc..

Microsoft, Windows, and Windows NT are registered trademarks of Microsoft Corporation.

Other brand and product names are registered trademarks or trademarks of their respective holders. Portions of this

document are copyright Intoto, Inc.

Disclaimers

February 2006 Information in this document is subject to change at any time without notice and is provided "as is" with

no warranty. NETGEAR, Inc. makes no warranty of any kind with regard to this material including, but not limited to,

the implied warranties of merchantability and fitness for a particular purpose. NETGEAR, Inc. shall not be liable for

errors contained herein or for any direct, indirect, special, incidental, or consequential damages in connection with the

use of this material. NETGEAR, Inc. assumes no responsibility for customer product design or the use or application of

customers' products or for any infringements of patents or rights of others which may result from NETGEAR, Inc.

assistance. The content of this application notes does not imply that NETGEAR, Inc. intends to make it available in any

NETGEAR managed switch product. NETGEAR, Inc. may have patents or pending patent applications covering

subject matter in this document. The furnishing of this document does not give any license to these patents.

Product and Publication Details

Model Number:

Publication Date: February 2006

Product Family: NETGEAR managed switch

Product Name: 7xxx Series Managed Switch

Home or Business Product: Business

Language: English

Publication Part Number: Beta Draft 1

Publication Version Number 1.0

iii

Publication Version 1.0, February 2006

Contents

Application Note: Configuring and Enabling Management Security

Chapter 1

Introduction

Chapter 2

Enabling Management Security

Certificate Generation .....................................................................................................2-1

Configuring Secure Shell ................................................................................................2-2

Disabling Insecure Access .......................................................................................2-3

Configuring Secure Socket Layer ...................................................................................2-3

Preventing Insecure Web Sessions .........................................................................2-4

Appendix A

Certificate Generation Scripts

SSH ............................................................................................................................... A-1

SSL ................................................................................................................................ A-1

SSL Helper Files ............................................................................................................ A-3

Publication Version 1.0, February 2006

Application Note: Configuring and Enabling Management Security

Introduction 1-1

v1.0, February 2006

Chapter 1

Introduction

In the past, network communications were simply a matter of packaging frames of

information and shipping them over the wire to their destination. Protocols gave

little thought to who might be viewing the frames as they crossed the wire, or

what illegitimate parties might do with the information so gleaned. More and

more, security has become an ever-present concern amongst the members of the

networking community. Networking infrastructure is far too important to risk

abuse by hackers, whether they are malevolent or simply mischievous. As a

whole, the community has turned to encryption as a means of ensuring the

security of network transactions.

Interactive login is a mainstay for providing a means to control and/or configure

an entity across the network. For decades the telnet protocol has provided this

capability for devices wishing to provide interactive login over a network.

However, these protocols are chief culprits with regard to the transmission of

sensitive information (e.g. passwords) over the network unprotected. The current

de facto standard for providing interactive login in a secure fashion is the Secure

Shell (SSH). SSH provides a number of services in a secure manner. These

include port forwarding, file transfer, X11 forwarding, and interactive login. Of

these, currently only interactive login is of interest for the NETGEAR managed

switch software.

Managing devices with a web browser has been standard practice for several

years. Unfortunately, standard HTTP transactions are no more secure than telnet.

This was one of the original barriers to the success of "e-commerce". The solution

(then and now) is the use of the Secure Sockets Layer (SSL) protocol. SSL

provides a means of abstracting an encrypted connection between two stations.

Once established, such a connection is virtually no different to use than an

unsecured connection. This allows an established protocol (e.g. HTTP) to operate

in a secure manner on an open network.

A third component of management on a modern networking appliance is SNMP.

The SNMP protocol has it own security mechanisms outside of SSH and SSL.

Consequently discussion of security for SNMP transactions is outside the scope of

this document.

Application Note: Configuring and Enabling Management Security

1-2 Introduction

v1.0, February 2006

Application Note: Configuring and Enabling Management Security

Enabling Management Security 2-1

v1.0, February 2006

Chapter 2

Enabling Management Security

Enabling management security is a two-step process. The first step involves

generating and loading appropriate authentication keys (SSH) and security

certificates (SSL). Optionally a reputable third party such as RSA Security, Inc. or

Entrust, Inc. can validate these certificates and keys but for evaluation purposes

validation is unnecessary.

The second step involves enabling either SSL or SSH and optionally disabling the

insecure versions of telnet and web management. Once enabled, subsequent

management connections may be made in a secure manner.

Certificate Generation

To generate self-signed credentials, the open source applications ssh-keygen and

openssl can be used to create the seven files used to form the security certificates

and authentication keys. Both of these applications are well documented by the

open source community. Detailed descriptions will not be repeated here as the

user can check the man pages for detailed help. Two scripts are included in the

appendix at the end of this application note along with some helper files. This set

of files can be freely modified and used to generate the appropriate self-signed

credentials. Generation of these credentials has been verified using both cygwin

and Linux.

Once the component files are created, the credentials must be loaded onto the

switch running the NETGEAR managed switch. This is accomplished using the

copy command from a tftp server.

1. From privileged EXEC mode, issue the following command:

where the IP address of the tftp server should be substituted as appropriate.

#copy tftp://192.168.77.122/rsa1.key nvram:sshkey-rsa1

Application Note: Configuring and Enabling Management Security

2-2 Enabling Management Security

v1.0, February 2006

2. Repeat the copy command for all the other authentication components:

The SSL and SSH credentials may be uploaded separately as needed. However, it

is likely that if security is required for one access method it will be required for all

access methods. Therefore, best practice is to create the certificates and

authentication key simultaneously.

Configuring Secure Shell

Once the authentication credentials are loaded and the certificates and

authentication keys are formed, management security may be configured on the

NETGEAR managed switch device.

1. From privileged EXEC mode, issue the command

as described in the Command Line Interface Reference manual. This will allow

secure shell sessions to be instantiated on the NETGEAR managed switch.

2. Check the message log to determine the success or failure of the command.

Messages indicating successful start of the ssh service look like this:

• rsa2.key nvram:sshkey-rsa2

• dsa.key nvram:sshkey-dsa

• dh512.pem nvram:sslpem-dhweak

• dh1024.pem nvram:sslpem-dhstrong

• server.pem nvram:sslpem-server

• rootcert.pem nvram:sslpem-root

# ip ssh

0 days 00:17:07 Unit: 1 : File: sshd_main.c : Line: 349 :

SSHD: Done generating server key

0 days 00:17:06 Unit: 1 : File: sshd_main.c : Line: 639 :

SSHD: successfully loaded RSA2 key

0 days 00:17:06 Unit: 1 : File: sshd_main.c : Line: 627 :

SSHD: successfully opened file ssh_host_rsa_key

0 days 00:17:06 Unit: 1 : File: sshd_main.c : Line: 605 :

SSHD: successfully loaded DSA key

Application Note: Configuring and Enabling Management Security

Enabling Management Security 2-3

v1.0, February 2006

If a secure connection cannot be established, entries such as the following indicate

the nature of the problem.

In this case, the authentication credentials were invalid and should be regenerated.

Disabling Insecure Access

To disable insecure access to the NETGEAR managed switch, issue the following

command:

Configuring Secure Socket Layer

Optionally or in concert with SSH, SSL may be enabled. Once again the message

log is the best source of feedback for problem determination.

1. To enable SSL, issue the privileged EXEC mode command:

2. Attempt a secure web access using https. Consult the message log for to

determine the success or failure status.

0 days 00:17:06 Unit: 1 : File: sshd_main.c : Line: 592 :

SSHD: successfully opened file ssh_host_dsa_key

0 days 00:17:06 Unit: 1 : File: sshd_control.c : Line: 400 :

SSHD: sshdListenTask started

0 days 02:30:30 File: ssh_sys_fastpath.c : Line: 584 : tid

40052584, context 0x0x157dba0, deleting 40052584, retval = 1

0 days 02:30:30 File: ssh_sys_fastpath.c : Line: 401 : SSHD:

exiting global context 0x0x157dba0

0 days 02:30:30 File: sshd_main.c : Line: 550 : SSHD: host key

is corrupt (did not decode).

# no telnet

Note: Caution should be exercised before issuing this command as once

the active telnet sessions are terminated, no new telnet sessions

will be allowed. Please consult the appropriate Command

Reference for more information on configuring remote sessions.

# ip http secure-server

Application Note: Configuring and Enabling Management Security

2-4 Enabling Management Security

v1.0, February 2006

Valid certificates are indicated by a message log entry that looks like the

following:

Certificate information may be accessed using browser-specific methods. With

Internet Explorer, the lock icon along the bottom message line can be checked for

certificate details. Additionally, when connecting to a NETGEAR managed

switch that uses self-generated credentials, Explorer will warn the user about the

authenticity of the certificate. When secure certificates are acquired from a third

party this warning will no longer occur.

Preventing Insecure Web Sessions

Insecure web sessions may be prevented by disabling the http server using the

privileged EXEC mode command:

As with secure shell, the best guide for information on NETGEAR managed

switch commands that control HTTP and HTTPS access is the Command Line

Interface Reference manual.

0 days 01:25:29 Unit: 1 : File: sslt_util.c : Line: 303 :

SSLT: Successfully loaded all required SSL PEM files

# no ip http server

Altri manuali per GSM7212 - ProSafe Switch

Questo manuale è adatto per i seguenti modelli

Indice

Altri manuali NETGEAR Interruttore

NETGEAR

NETGEAR GS724TS - ProSafe 24 Port Gigabit Stackable Smart... Manuale utente

NETGEAR

NETGEAR SB104 Network Starter Kit SB104 SB104 Manuale utente

NETGEAR

NETGEAR GS108LP Guida all'installazione

NETGEAR

NETGEAR GSM7328Sv1 - ProSafe 24+4 Gigabit Ethernet L3 Managed Stackable... Manuale utente

NETGEAR

NETGEAR GS724AT - ProSafe Gigabit Smart Switch Manuale utente

NETGEAR

NETGEAR ProSAFE M4300 series Manuale utente

NETGEAR

NETGEAR ProSafe GSM7252PS Manuale di istruzioni

NETGEAR

NETGEAR GS724TS - ProSafe 24 Port Gigabit Stackable Smart... Manuale utente

NETGEAR

NETGEAR GS748Tv4 Manuale

NETGEAR

NETGEAR M4350 Series Manuale utente

NETGEAR

NETGEAR M4100 Series ProSAFE Manuale

NETGEAR

NETGEAR FS728TS - ProSafe Smart Switch Manuale

NETGEAR

NETGEAR GS724TP - ProSafe Smart PoE Switch Manuale utente

NETGEAR

NETGEAR 7300 Series Manuale utente

NETGEAR

NETGEAR MS510TX Manuale utente

NETGEAR

NETGEAR MS510TX Manuale

NETGEAR

NETGEAR ProSafe GSM7228PS Manuale utente

NETGEAR

NETGEAR ProSafe FS752TP Manuale

NETGEAR

NETGEAR GS724TPv2 Manuale utente

NETGEAR

NETGEAR ProSafe GS108v3 Manuale utente

NETGEAR

NETGEAR GS728TS Smart Switch Manuale

NETGEAR

NETGEAR FSM7328S - ProSafe Switch Manuale utente

NETGEAR

NETGEAR ProSafe GS700TP Manuale di istruzioni

NETGEAR

NETGEAR MVBR1210C Manuale utente

Manuali Interruttore popolari di altre marche

URC

URC Total Control MFS-8 Manuale utente

Azbil

Azbil HPQ-D11 Manuale utente

Sony

Sony DFS-900M Manuale utente

SICK

SICK i17S Manuale utente

F&F

F&F SZR-277 Manuale utente

Shure

Shure UAMS/BK Manuale utente

Dräger

Dräger X-zone Switch Off Manuale utente

Asco

Asco Joucomatic 349 Series Manuale utente

BT Mini Hub Manuale utente

D-Link

D-Link DES-1226G Manuale utente

Johnson Controls

Johnson Controls FS80-C Manuale utente

Alcatel-Lucent

Alcatel-Lucent 7450 ESS-12 Manuale utente

MicroNet

MicroNet SP1200A Manuale utente

Ruijie

Ruijie RG-PF2920 Series Manuale di installazione e funzionamento

Altinex

Altinex DA1914SX Manuale utente

MiLAN

MiLAN MIL-SM2401M Manuale utente

RJM

RJM MASTERMIND PBC/6X Manuale utente

Atlas

Atlas MMK-KVM8 Manuale utente