NETGEAR GSM7212 - ProSafe Switch Instructions d'installation et d'utilisation

Publication Version 1.0, February 2006

Application Note: Configuring and

Enabling Management Security

Publication Version 1.0, February 2006

Trademarks

NETGEAR and Auto Uplink are trademarks or registered trademarks of NETGEAR, Inc..

Microsoft, Windows, and Windows NT are registered trademarks of Microsoft Corporation.

Other brand and product names are registered trademarks or trademarks of their respective holders. Portions of this

document are copyright Intoto, Inc.

Disclaimers

February 2006 Information in this document is subject to change at any time without notice and is provided "as is" with

no warranty. NETGEAR, Inc. makes no warranty of any kind with regard to this material including, but not limited to,

the implied warranties of merchantability and fitness for a particular purpose. NETGEAR, Inc. shall not be liable for

errors contained herein or for any direct, indirect, special, incidental, or consequential damages in connection with the

use of this material. NETGEAR, Inc. assumes no responsibility for customer product design or the use or application of

customers' products or for any infringements of patents or rights of others which may result from NETGEAR, Inc.

assistance. The content of this application notes does not imply that NETGEAR, Inc. intends to make it available in any

NETGEAR managed switch product. NETGEAR, Inc. may have patents or pending patent applications covering

subject matter in this document. The furnishing of this document does not give any license to these patents.

Product and Publication Details

Model Number:

Publication Date: February 2006

Product Family: NETGEAR managed switch

Product Name: 7xxx Series Managed Switch

Home or Business Product: Business

Language: English

Publication Part Number: Beta Draft 1

Publication Version Number 1.0

iii

Publication Version 1.0, February 2006

Contents

Application Note: Configuring and Enabling Management Security

Chapter 1

Introduction

Chapter 2

Enabling Management Security

Certificate Generation .....................................................................................................2-1

Configuring Secure Shell ................................................................................................2-2

Disabling Insecure Access .......................................................................................2-3

Configuring Secure Socket Layer ...................................................................................2-3

Preventing Insecure Web Sessions .........................................................................2-4

Appendix A

Certificate Generation Scripts

SSH ............................................................................................................................... A-1

SSL ................................................................................................................................ A-1

SSL Helper Files ............................................................................................................ A-3

Publication Version 1.0, February 2006

Application Note: Configuring and Enabling Management Security

Introduction 1-1

v1.0, February 2006

Chapter 1

Introduction

In the past, network communications were simply a matter of packaging frames of

information and shipping them over the wire to their destination. Protocols gave

little thought to who might be viewing the frames as they crossed the wire, or

what illegitimate parties might do with the information so gleaned. More and

more, security has become an ever-present concern amongst the members of the

networking community. Networking infrastructure is far too important to risk

abuse by hackers, whether they are malevolent or simply mischievous. As a

whole, the community has turned to encryption as a means of ensuring the

security of network transactions.

Interactive login is a mainstay for providing a means to control and/or configure

an entity across the network. For decades the telnet protocol has provided this

capability for devices wishing to provide interactive login over a network.

However, these protocols are chief culprits with regard to the transmission of

sensitive information (e.g. passwords) over the network unprotected. The current

de facto standard for providing interactive login in a secure fashion is the Secure

Shell (SSH). SSH provides a number of services in a secure manner. These

include port forwarding, file transfer, X11 forwarding, and interactive login. Of

these, currently only interactive login is of interest for the NETGEAR managed

switch software.

Managing devices with a web browser has been standard practice for several

years. Unfortunately, standard HTTP transactions are no more secure than telnet.

This was one of the original barriers to the success of "e-commerce". The solution

(then and now) is the use of the Secure Sockets Layer (SSL) protocol. SSL

provides a means of abstracting an encrypted connection between two stations.

Once established, such a connection is virtually no different to use than an

unsecured connection. This allows an established protocol (e.g. HTTP) to operate

in a secure manner on an open network.

A third component of management on a modern networking appliance is SNMP.

The SNMP protocol has it own security mechanisms outside of SSH and SSL.

Consequently discussion of security for SNMP transactions is outside the scope of

this document.

Application Note: Configuring and Enabling Management Security

1-2 Introduction

v1.0, February 2006

Application Note: Configuring and Enabling Management Security

Enabling Management Security 2-1

v1.0, February 2006

Chapter 2

Enabling Management Security

Enabling management security is a two-step process. The first step involves

generating and loading appropriate authentication keys (SSH) and security

certificates (SSL). Optionally a reputable third party such as RSA Security, Inc. or

Entrust, Inc. can validate these certificates and keys but for evaluation purposes

validation is unnecessary.

The second step involves enabling either SSL or SSH and optionally disabling the

insecure versions of telnet and web management. Once enabled, subsequent

management connections may be made in a secure manner.

Certificate Generation

To generate self-signed credentials, the open source applications ssh-keygen and

openssl can be used to create the seven files used to form the security certificates

and authentication keys. Both of these applications are well documented by the

open source community. Detailed descriptions will not be repeated here as the

user can check the man pages for detailed help. Two scripts are included in the

appendix at the end of this application note along with some helper files. This set

of files can be freely modified and used to generate the appropriate self-signed

credentials. Generation of these credentials has been verified using both cygwin

and Linux.

Once the component files are created, the credentials must be loaded onto the

switch running the NETGEAR managed switch. This is accomplished using the

copy command from a tftp server.

1. From privileged EXEC mode, issue the following command:

where the IP address of the tftp server should be substituted as appropriate.

#copy tftp://192.168.77.122/rsa1.key nvram:sshkey-rsa1

Application Note: Configuring and Enabling Management Security

2-2 Enabling Management Security

v1.0, February 2006

2. Repeat the copy command for all the other authentication components:

The SSL and SSH credentials may be uploaded separately as needed. However, it

is likely that if security is required for one access method it will be required for all

access methods. Therefore, best practice is to create the certificates and

authentication key simultaneously.

Configuring Secure Shell

Once the authentication credentials are loaded and the certificates and

authentication keys are formed, management security may be configured on the

NETGEAR managed switch device.

1. From privileged EXEC mode, issue the command

as described in the Command Line Interface Reference manual. This will allow

secure shell sessions to be instantiated on the NETGEAR managed switch.

2. Check the message log to determine the success or failure of the command.

Messages indicating successful start of the ssh service look like this:

• rsa2.key nvram:sshkey-rsa2

• dsa.key nvram:sshkey-dsa

• dh512.pem nvram:sslpem-dhweak

• dh1024.pem nvram:sslpem-dhstrong

• server.pem nvram:sslpem-server

• rootcert.pem nvram:sslpem-root

# ip ssh

0 days 00:17:07 Unit: 1 : File: sshd_main.c : Line: 349 :

SSHD: Done generating server key

0 days 00:17:06 Unit: 1 : File: sshd_main.c : Line: 639 :

SSHD: successfully loaded RSA2 key

0 days 00:17:06 Unit: 1 : File: sshd_main.c : Line: 627 :

SSHD: successfully opened file ssh_host_rsa_key

0 days 00:17:06 Unit: 1 : File: sshd_main.c : Line: 605 :

SSHD: successfully loaded DSA key

Application Note: Configuring and Enabling Management Security

Enabling Management Security 2-3

v1.0, February 2006

If a secure connection cannot be established, entries such as the following indicate

the nature of the problem.

In this case, the authentication credentials were invalid and should be regenerated.

Disabling Insecure Access

To disable insecure access to the NETGEAR managed switch, issue the following

command:

Configuring Secure Socket Layer

Optionally or in concert with SSH, SSL may be enabled. Once again the message

log is the best source of feedback for problem determination.

1. To enable SSL, issue the privileged EXEC mode command:

2. Attempt a secure web access using https. Consult the message log for to

determine the success or failure status.

0 days 00:17:06 Unit: 1 : File: sshd_main.c : Line: 592 :

SSHD: successfully opened file ssh_host_dsa_key

0 days 00:17:06 Unit: 1 : File: sshd_control.c : Line: 400 :

SSHD: sshdListenTask started

0 days 02:30:30 File: ssh_sys_fastpath.c : Line: 584 : tid

40052584, context 0x0x157dba0, deleting 40052584, retval = 1

0 days 02:30:30 File: ssh_sys_fastpath.c : Line: 401 : SSHD:

exiting global context 0x0x157dba0

0 days 02:30:30 File: sshd_main.c : Line: 550 : SSHD: host key

is corrupt (did not decode).

# no telnet

Note: Caution should be exercised before issuing this command as once

the active telnet sessions are terminated, no new telnet sessions

will be allowed. Please consult the appropriate Command

Reference for more information on configuring remote sessions.

# ip http secure-server

Application Note: Configuring and Enabling Management Security

2-4 Enabling Management Security

v1.0, February 2006

Valid certificates are indicated by a message log entry that looks like the

following:

Certificate information may be accessed using browser-specific methods. With

Internet Explorer, the lock icon along the bottom message line can be checked for

certificate details. Additionally, when connecting to a NETGEAR managed

switch that uses self-generated credentials, Explorer will warn the user about the

authenticity of the certificate. When secure certificates are acquired from a third

party this warning will no longer occur.

Preventing Insecure Web Sessions

Insecure web sessions may be prevented by disabling the http server using the

privileged EXEC mode command:

As with secure shell, the best guide for information on NETGEAR managed

switch commands that control HTTP and HTTPS access is the Command Line

Interface Reference manual.

0 days 01:25:29 Unit: 1 : File: sslt_util.c : Line: 303 :

SSLT: Successfully loaded all required SSL PEM files

# no ip http server

Autres manuels pour GSM7212 - ProSafe Switch

Ce manuel convient aux modèles suivants

Table des matières

Autres manuels NETGEAR Changer

NETGEAR

NETGEAR GS724AT - ProSafe Gigabit Smart Switch Manuel utilisateur

NETGEAR

NETGEAR ProSafe JGSM7224 Manuel utilisateur

NETGEAR

NETGEAR ProSafe GS700TS Manuel utilisateur

NETGEAR

NETGEAR ProSAFE M6100 XCM8944 Manuel utilisateur

NETGEAR

NETGEAR M6100 Series Manuel

NETGEAR

NETGEAR Pro GS108PP Manuel utilisateur

NETGEAR

NETGEAR GS316P Manuel utilisateur

NETGEAR

NETGEAR ProSafe GS728TP Manuel utilisateur

NETGEAR

NETGEAR GSS108E Manuel utilisateur

NETGEAR

NETGEAR GS105v5 Manuel utilisateur

NETGEAR

NETGEAR FS726T - ProSafe Smart Switch Manuel utilisateur

NETGEAR

NETGEAR FS108 - ProSafe 10/100 Desktop Switch Manuel utilisateur

NETGEAR

NETGEAR ProSAFE Plus GS108PEv3 Manuel utilisateur

NETGEAR

NETGEAR ProSafe GSM7324 Manuel utilisateur

NETGEAR

NETGEAR S350 Series Manuel utilisateur

NETGEAR

NETGEAR FSM726S Manuel utilisateur

NETGEAR

NETGEAR M4300-96X Manuel

NETGEAR

NETGEAR GSM7224 - Switch Manuel utilisateur

NETGEAR

NETGEAR GS724TP - ProSafe Smart PoE Switch Manuel utilisateur

NETGEAR

NETGEAR SB104 Network Starter Kit SB104 SB104 Manuel utilisateur

NETGEAR

NETGEAR GS724TP - ProSafe Smart PoE Switch Manuel utilisateur

NETGEAR

NETGEAR M4200 Series Manuel

NETGEAR

NETGEAR FS728TS - ProSafe Smart Switch Manuel utilisateur

NETGEAR

NETGEAR ProSAFE GS105Ev2 Manuel utilisateur

Manuels Changer populaires d'autres marques

URC

URC Total Control MFS-8 Manuel utilisateur

Azbil

Azbil HPQ-D11 Manuel utilisateur

Sony

Sony DFS-900M Manuel utilisateur

SICK

SICK i17S Manuel utilisateur

F&F

F&F SZR-277 Manuel utilisateur

Shure

Shure UAMS/BK Manuel utilisateur

Dräger

Dräger X-zone Switch Off Manuel utilisateur

Asco

Asco Joucomatic 349 Series Manuel utilisateur

BT Mini Hub Manuel utilisateur

D-Link

D-Link DES-1226G Manuel utilisateur

Johnson Controls

Johnson Controls FS80-C Manuel utilisateur

Alcatel-Lucent

Alcatel-Lucent 7450 ESS-12 Manuel utilisateur

MicroNet

MicroNet SP1200A Manuel utilisateur

Ruijie

Ruijie RG-PF2920 Series Manuel d'installation et d'exploitation

Altinex

Altinex DA1914SX Manuel utilisateur

MiLAN

MiLAN MIL-SM2401M Manuel utilisateur

RJM

RJM MASTERMIND PBC/6X Manuel utilisateur

Atlas

Atlas MMK-KVM8 Manuel utilisateur