HP JETADVANTAGE SECURITY MANAGER. Credential Management

Transcription

1 HP JETADVANTAGE SECURITY MANAGER Credential Management CONTENTS Overview... 2 Credential Types... 2 Admin (EWS) Password... 3 SNMPv1/v SNMPv File System Password... 6 PJL Password... 6 Remote Configuration Password... 7 Bootloader Password... 7 Service Access Code... 8 Group One PIN / Group Two PIN... 9 Fax PIN Presence... 9 Credential Store Credentials Failed Examples Troubleshooting Credential Failures SNMP Admin (EWS) Password Log Files Ports Proxies Example Device Interrogation Configuring SNMP Timeouts

2 OVERVIEW Passwords and credentials are used to prevent unauthorized access to device configuration interfaces. HP JetAdvantage Security Manager can assess these passwords and c redentials to determine if they are present on devices then remediate to place the passwords and credentials into compliance with how they are set in the policy. This document discusses the different types of passwords and credentials that can be remediated on devices and the manner in which Security Manager manages them. CREDENTIAL TYPES HP JetAdvantage Security Manager offers a wide variety of device credential types that can be added to a policy and remediated to keep devices in compliance: 2

3 Admin (EWS) Password The Admin (EWS) Password (also called the Device Password or EWS Password) helps protect devices from unauthorized access and configuration through remote applications such as Embedded Web Server (EWS) or HP Web Jetadmin. With the Admin (EWS) Password configured, the device will not allow changes to configuration settings through those mechanisms unless the correct password is provided. However, for tools such as Web Jetadmin, it depends upon the technique the tool is using to make the configuration changes. While the Admin (EWS) Password will protect against changes that use protocols such as Web Services, HTTP or LEDM, it will not protect against changes made through SNMP. The Admin (EWS) Password can be synchronized with the SNMP Set Community Name so it can protect against unwanted changes via SNMP as well. Account Lockout can be enabled to define how many incorrect attempts occur before lockout (3-30), reset attempts after ( seconds), how long for lockout duration ( seconds), and minimum password length (0-16). Password Complexity can be enabled to ensure the password is complex enough to mimimize the chances of the password being compromised. 3

4 SNMPv1/v2 These settings provide support for specific tools that rely on SNMPv1/v2 for read amd write operastions such as device discovery, status, configurations, etc. The device can be configured to accept SNMPv1/v2 for Read Only, Read/Write, or Disabled. SNMP operations can be protected by a password of sorts called a Community Name. If you select Read Only Enabled, enter the Read Community Name and then re-enter it to confirm. If you select Read and Write Enabled, enter the Read/Write Community Name and then re-enter it to confirm. Note: If you synchronize passwords using the HP Embedded Web Server (EWS), the Admin (EWS) Password can also be used as the SNMPv1/v2 Set Community Name meaning it will be enforced for all write operations using SNMPv1/v2. Security Manager treats Community Names slightly differently from tools such as EWS or Web Jetadmin as it adheres more closely to the RFC for Community Names. While EWS and Web Jetadmin offer a Get Community Name and a Set Community Name, Security Manager offers a Read Community Name and a Read/Write Community Name. A Read/Write Community Name is used for performing SNMP Set Requests and SNMP Get Requests, while the Read Community Name is only used for SNMP Get Requests. Thus, Security Manager will attempt to use the Read/Write Community Name for Gets and Sets if one is provided. For example, if you enabled SNMPv1/v2 Read/Write under EWS and protected Gets with a Get Community Name and Sets with a different Set Community Name, as long as Security Manager knows the Set Community Name, it could perform Gets and Sets. So technically you would only need to enter the Read/Write Community name into Security Manager which matches the Set Community Name, but there is certainly no harm in also entering the Read Community Name to match the Get Community Name, Security Manager just wouldn t need to use it. Click Enable Default SNMPv1/v2 Credential Access if it is desired to allow Public to be used for SNMP Get Requests. 4

5 SNMPv3 SNMPv3 employs a user-based security model (RFC 2574), and features user authentication and data privacy through encryption. To fully assess SNMPv3, you must typically create an SNMPv3 account on the device and implement the account information on the SNMPv3 management application. To create the account, provide a user name, an authentication key, a privacy key, and an encryption algorithm. Note: If FIPS 140 is enabled, the SNMPv3 Encryption Algorithms must be set to SHA-1/AES. MD5/DES is not allowed. Best Possible can be chosen to instruct Security Manager to choose the best Encryption Algorithm in accordance to other security settings being enabled such as FIPS 140. Many organizations opt to protect just Set operations with SNMPv3 to encrypt the data because Set operations may contain sensitive data such as passwords, but they will leave Get operations open to use SNMPv1/v2 since little to no sensitive data will be passed on Get operations. It then just becomes a matter of whether Get operations should be left open to public or protected with a Read Community Name (aka Get Community Name). Certainly it is much less work to not have to manage a Read Community Name on the fleet for data that is not seen as sensitive, but it still may be desired to control who can read any information from devices. 5

6 File System Password The File System Password prevents unauthorized users from making changes to the file system configuration options and from performing a secure storage erase. File System Passwords are no longer used in Futuresmart devices and newer. The File System Password feature helps protect the MFP data storage system options from unauthorized access. With the File System password configured, the MFP requires the password before it will allow configurations to features that affect the data storage system. Some of these features are the File Erase mode, the Secure Storage Erase feature, and the File System Access options. To configure the Files System Password, type 8 or fewer characters into the Enter Password and Confirm password fields. PJL Password Printer Job Language (PJL) commands provide two way communication with the printer and can be used to change control panel settings. Note: In order for Security Manager to assess the PJL Password item, the PJL Access Commands item must be set to Enable. Otherwise, assessment of the PJL Password cannot occur and the password will always be remediated, even if it matches. The PJL password feature helps protect the MFP from unauthorized configurations through Print Job Language (PJL) commands. It does not affect ordinary print jobs. Once the PJL password is configured, the MFP requires it before it will process any of these commands. The PJL password is different from the option to disable PJL Disk Access (another setting in the EWS Security page). Configure both settings for better security. Set the PJL password by typing any number between 1 and into the Enter Password and Confirm password fields. 6

7 Remote Configuration Password By default, HP Digital Sending Software (DSS) uses the HP Embedded Web Server (EWS) Administrator Password to connect to the device. However, if the Remote Configuration Password is set on the device, HP DSS and other remote configuration tools use this password to connect. This allows administrators to use separate HP EWS and HP DSS administrator passwords. To enable (remediate), select the check box and then enter/confirm the Remote Configuration Password to use. To disable, clear the password fields and deselect the check box. Bootloader Password The Bootloader Password prevents unauthorized access to the device's bootloader settings from the control panel. These settings control system-wide options such as cold resets, NVRAM and disk initialization, and clearing RFU errors. If improperly set, these options can severely impact the device's operation. On most devices, the bootloader password is not set by default. Note: Once set, the Bootloader Password cannot be recovered if lost. Losing the password permanently prevents access to the bootloader settings. Knowledge of an existing bootloader is required before a new Bootloader Password can be set. Therefore, the credential store allows for adding an existing Bootloader Password so it can be used to set the Bootloader Password to a new value. If Security Manager can change the password on the device, it will store the new password in the credential store to be used for future Bootloader Password transactions. If the Bootloader Password is blank on the device, during remediation Security Manager will set whatever is entered in the policy as the Bootloader Password on the device and will store the new password in the credential store to be used for future Bootloader Password transactions. 7

8 For cases where there is an existing Bootloader Password set, the assessment behavior of Security Manager will differ between older devices and newer Futuresmart devices. Older devices use SNMP to manage the Bootloader Password, and Security Manager can use SNMP to test an existing password on a device against one in a policy to know when to remediate. However, newer Futuresmart devices use web services to manage the Bootloader Password, and there is not a technique whereby Security Manager could test a password on a device against one in a policy. Therefore, Security Manager has no way of knowing whether to remediate or not. A checkbox is provided to Always Remediate if it is desired for Security Manager to always set the value in the policy on the device regardless of whether it matches or not. As this could cause remediation reports to always indicate the password is being changed without knowing it of really is out of compliance, another checkbox is present to Suppress reporting for the Bootloader Password. Service Access Code The Service Access Code is used to prevent unauthorized access to the device's Service menu from the control panel. It must be 8 digit long. Note: Leave the Service Access Code fields blank to reset the Service Access Code to the factory default value. 8

9 Group One PIN / Group Two PIN The device personal identification number (PIN) controls access to specific features from the control panel on devices prior to Futuresmart devices. You can assign specific features such as print or copy to a group (Group One or Group Two), and then assign the group to a specific PIN. When the PIN is entered correctly, the features in the group are accessible. Both Group One PIN and Group Two PIN can be assessed and remediated. Fax PIN Presence When the FAX Personal Identification Number (PIN) is set, the device holds all received FAX messages for printing until the PIN is correctly entered on the control panel. This password can only be assessed for presence only, it cannot be remediated as there is no technique over the network to read/test the value against one in a policy. 9

10 CREDENTIAL STORE When credentials are present on a device, Security Manager needs to know those credentials before it can communicate with the device to read or write information. The term Credential Store refers to an area of the Security Manager database where credentials are stored for each device so Security Manager knows how to communicate with it using read and write operations. All data in the Credential Store is securely encrypted in the database for protection. If no credentials are present on a device when it is discovered, Security Manager will use public or blank credentials in order to performread and write operations on the device. Once a remediation is performed to set credentials on the device, those credentials are stored in the Credential Store for future attempts to communicate with the device for raed and write operations. If credentials are already present on a device when it is discovered, credentials can be manually added to the Credential Store by selecting the device and choosing the icon for Set Credentials, Configure or by right-clicking the device and choosing Set Credentials, User Configured. This operation can be performed on a single device, multi-selected devices, or a group. 10

11 A Configure Credentials screen appears where various types of credentials can be entered to be stored into the database. Once credentials are entered, choose Save to save the credentials into the Credential Store. The device goes back into a No Information state requiring a Verify task with the new credentials to ensure they now working. If success is not achieved, the device is placed in a Credentials Failed state and the bad credential is removed from the database/credential store. Global Credentials are values entered into Security Manager to be used in cases credentials are needed but are not available in the Credential Store. If the Global Credential value is used by Security Manager and results in success, that value is now stored for that device within the Credential Store. Global Credentials are added by clicking the File symbol in upper right hand corner of screen, Settings, Global Credentials. 11

12 CREDENTIALS FAILED When Security Manager verifies a device and encounters a device with a credential such as SNMP Set Community Name, it follows a specific sequence. The following is a simplified example of how Security Manager attempts to resolve a credential that it knows is present on a device: 1. Use credential stored in Credential Store (database) 2. If no match, try blank or public (in case credentials were erased on device) 3. If no match, check Global Credential Store for credential 4. If match, add Global Credential to Credential Store (database) to be used for subsequent communications with device 5. If no match, post a Credentials Failed status A Verify task performs the credential validation check described above. A Verify is performed automatically before scheduled tasks such as Assess and Assess/Remediation. A Verify is not performed automatically during a manual or automatic discovery, a device will remain in a No Informaton state after discovery and requires either a manual Verify task to check credentials or wait for a scheduled task to perform the Verify task. An Instant On discovery will perform a Verify task automatically if Instant On is setup to perform automatic remediations. EXAMPLES The following example describe different credential related scenarios and how Securuty Manager manages the credentials in each scenario. Scenario 1 is a very tradional model where the device may have just been added to the network from a staging area and is completely clean of credentials until Security Manager discovers and applies the credentials. Security Manager tucks away the credentials in the Credential Store for future use. 12

13 Scenario 2 is more indicative of the first time Security Manager is introduced into an environment of existing devices. Most if not all will have existing credentials, and Securuity Manager needs to be informed of those credentials before it can manage the devices. Scenario 3 depicts what can happen when two different management tools are attempting to manage credentials on devices. One will always break the other until they can be brought into sync. In the above example, Web Jetadmin changes the Device Password. This could have just as easily been EWS as well. In either case, Security Manager needs to be manually populated with the new password in order to manage the device. This scenario could also happen in reverse where Security Manager changes the password and Web Jetadmin needs to be manually informed of the new password. Web Jetadmin fortunately contains a credential store similar in behavior to Security Manager. TROUBLESHOOTING CREDENTIAL FAILURES It is common for both Web Jetadmin and Security Manager to be managing a fleet, and when one tool changes device credentials, the other tool indicates a credential failure until it too knows the credentials. The best way to troubleshooting credential failures is to hone in on a single device, highlight one device and check the Properties by clicking on the device IP Address link. Normally for devices with no credential failure, the credentials will all be in a Valid state as seen to the right. However, when the status indicates Credentials Failed, Security Manager does not know that credential in order to read and/or write settings that require that credential. 13

14 SNMP SNMP v1/v2 credentials are broken into two types: Read and Read/Write. These equate to the Get Community Name and Set Community Name under EWS. If there are no credentials entered for the Get Community Name under EWS, and if the Disable SNMP v1/v2 default Get Community Name of public box is not checked, the device is wide open to read information using SNMP with just public used as the Community Name for an SNMP GET REQ packet. Thuis isn t uncommon as very little sensitive data is passed thru just Read attempts and many types of software require the ability to read information from the devuce over SNMP. If the Set Community Name is set as seen above, a Verify task in Security Manager will first pass without credential failure testing the ability to read information over SNMP using public as the Get Community Name. However, the verify task will fail when an SNMP SET REQ packet is sent to test the ability to write to the device, and the device returns no response because an incorrect Set Community Name is provided. The status of the device indicates Credentials Failed. The properties will indicate that the SNMP v1/v2 Read/write Community Name is Invalid. A network trace easily proves why as the SNMP SET REQ packet shows no response coming back from the device, typical device behavior when there is a mismatch of the Community Name. To resolve this situation, either clear the credentials on the device under EWS, oradd the SNMP v1/v2 Read/write Community Name to the database (credential store) for the device by selecting it and choosing the Set Credentials icon and clicking Configure. Admin (EWS) Password If the Admin (EWS) Password is claiming Credentials Failed, this means that the test Security Manger performs to determine if an Admin (EWS) password is present is failing. For Futuresmart devices, Security Manager will attempt to use web services to retrieve a system configuration page. Proper EWS credentials are required to retrieve such a page. If the page is not returned, it is assumed the Admin (EWS) Password that Security Manager has stored for the device in the database or in the global store is incorrect. For older non-futuresmart devices, an attempt is made over an HTTP request to retrieve the Security Status page under EWS. Again, if the page is not 14

15 returned, it is assumed the Admin (EWS) Password that Security Manager has stored for the device in the database or in the global store is incorrect. One technique to resolve this issue is to add the Admin (EWS) Password to the database (credential store) for the device by selecting it and choosing the Set Credentials icon and clicking Configure. Another technique is to clear out the Admin (EWS) Password under EWS, then right-click the device in HPSM and clear the credentials that are stored in the database under Set Credentials, Reset. Basically you are just trying to make sure Security Manager and EWS match. Now perform a Verify task and see if credentials failures are cleared. If it still claims credentials failed, try deleting the device and rediscovering. Log Files If failures still cannot be resolved for SNMP Community Names or Admin (EWS) Password, log files can be viewed for clues. Log files are stored under C:\Program Files (x86)\hp Jetadvantage Security Manager\logs. The three log files containing the most valuable troubleshooting data include: HPSM_Service.log contains data regarding HPSM service and actions it performs EapNetworkLib.log contains data regarding network traffic to devices EapDeviceLib.log contains data specific to device settings The EapNetworkLib.log file contains statements such as below that either the SystemConfiguration endpoint cannot be retrieved or the Security Status page cannot be returned for Admin (EWS) Password issues. It also contains statements that SNMP GET REQ or SNMP SET REQ attempts were not returned for SNMP credential issues. Example Admin (EWS) password failure for Futuresmart device: Exception message=xmlrest.get( , /systemconfiguration, 0) failed. HTTP status code: Forbidden, inner exception message=the remote server returned an error: (403) Forbidden. Example Admin (EWS) password failure for non-futuresmart device: :52:04,451 WARN EapNetworkLib [4] - Exception message=web.get( , ml,0) failed. HTTP status code: Unauthorized, inner exception message=the remote server returned an error: (401) Unauthorized. Example SNMP Set Community Name failure for non-futuresmart device: Ports Exception message=snmp.set( ,1 varbind(s)) timed out., inner exception message=no response was received from the agent. Timeout is set to milliseconds. Security Manager primarily uses the following ports to communicate to devices: 80 used for non-encrypted HTTP traffic to device 161 SNMP traffic to device 443 encrypted traffic to device 7627 web services traffic to device Therefore, these ports need to be open in order for Security Manager to effectively manage devices. Security Manager and Web Jetadmin are very similar in how they communicate to devices. If Web Jetadmin is managing devices fine without credential failures and you are certain Security Manager 15

16 has matching credentials in its Credential Store, as a test you might install Security Manager on the same machine as Web Jetadmin to determine if port issues exist oin the Security Manager server. PortQry, a free Microsofty utility, can also be used to determine if ports are open between the Security Manager server and the device. The Port Query user interface tool makes it easy to quickly enter an IP Address for a printer and the port to be queried. Results will be displayed whether the port is Listening or Not Listening. Proxies Security Manager runs under the Network Service accout be default. It is possible that Network Service has been configured to use a proxy. If Security Manager reports credential failures on the fleet when no passwords are actually present on the fleet, it is quite possible a proxy is blocking the ability for Security Manager to query the pages it requires from the device to determine if an Admin (EWS) Password is present. A utility named bitsadmin can be used to determine if a proxy is present on local service accounts and can clear these settings. Try the following command to determine if network Service is using a proxy: Bitsadmin /util /getieproxy networkservice Possible values include: NO_PROXY Do not use a proxy server. AUTODETECT Automatically detect the proxy settings. MANUAL_PROXY Use an explicit proxy list and bypass list. Specify the proxy list and bypass list immediately following the usage tag. For example, MANUAL_PROXY proxy1,proxy2 NULL. If the command retyurns MANUAL_PROXY or AUTODETECT, try setting Network Service to run without a proxy by tyoing the following command: 16

17 Bitsadmin /util /setieproxy networkservice NO_PROXY EXAMPLE DEVICE INTERROGATION Here is an example of a typical device interrogation of a Futuresmart device to check credentials: During the Verify task, Security Manager starts by pinging the device. If there is no response to pings, a Network Communication Error status is posted. If pings are successful, there are several SNMP GET REQ packets sent with various OIDs to retrieve basic device information. If the OIDs receive no response, Security Manager makes an educated guess that the SNMP credentials are wrong since that would be the exact behavior if the Community Names don t match and the device still responds to pings. Therefore, a Credentials Failed status is posted blaming the SNMP Read Community Name. The remaining transactions are secure ones over port 443 and port 7627 attempting to retrieve an endpoint called SystemConfiguration over web services. If that fails, there will be several indications in log files that it failed, and the status will indicate Credentials Failed as seen below blaming the Admin (EWS) Password because you must know the correct Admin (EWS) Password to retrieve such information over web services: The EapNetworkLib.log file contains statements as such indicating the request was forbidden: :32:47,213 ERROR EapNetworkLib [28] - EapNetworkLib.EapUnauthorizedAccessException: XmlRest.Get(NPI851843, /systemconfiguration, 0) failed. HTTP status code: Forbidden ---> System.Net.WebException: The remote server returned an error: (403) Forbidden. If you try to access the device EWS, it should only show the Information tab unless you login and provide the correct Admin (EWS) Password if an Admin (EWS) Password is set. If one is set and you can successfully login to EWS by entering it, that same Admin (EWS) Password can be manually entered into the Security Manager database. Now a verify task should succeed because the password matches the device. CONFIGURING SNMP TIMEOUTS The timeouts used for performing SNMP queries can be edited in a configuration file. To change these parameters, open the following file in a test editor: C:\Program Files (x86)\hp JetAdvantage Security Manager\HPSM_config.exe.config Edit the following entries, save changes, and restart the Security Manager service. <add key="snmprequesttimeout" value="30000" /> Value is in milliseconds (30s) amount of time to wait for responses to SNMP packets <add key="verificationsnmprequesttimeout" value="2000" /> Value is in milliseconds (2s) amount of time to wait for SNMP responses during a Verify task <add key="timebetweeneapretry" value="5000" /> Value is in milliseconds (5s) time to wait between retries on SNMP packets Copyright 2017 HP Development Company, L.P. The information contained herein is subject to change without notice. The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein. Microsoft and Windows are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. c enw, Rev.4, December

18 18