HP 6125G HP Networking guide to hardening Comware-based devices - Page 2

Introduction This document contains information to help you secure your HP Comware OS-based devices, which will help increase the overall security of your network. This document, which is structured around the three planes into which network device functions can be categorized, provides an overview of each feature and references related documentation. The three functional planes of a network-the management plane, control plane, and data plane-each provide different functionality that must be protected. Management plane The management plane consists of functions that achieve the management goals of the network. It includes interactive management sessions using secure shell (SSH), as well as statistics gathering with SNMP, NetStream, or sFlow. When you consider the security of a network device, it is critical that the management plane be protected. If a security incident is able to undermine the functions of the management plane, it can be impossible for you to recover or stabilize your network. The sections of this document detail the security features and configurations available in Comware-based HP software that help fortify the management plane. General management plane hardening The management plane is used to access, configure, and manage a device, as well as monitor its operations and the network on which it is deployed. The management plane is the plane that receives and sends traffic for operations of these functions. You must secure both the management plane and control plane of a device, as operations of the control plane directly affect operations of the management plane. The following protocols are used by the management plane: • SNMP • Telnet • Secure shell (SSH) • FTP • TFTP • Secure FTP • HWTACACS • RADIUS • NetStream • sFlow • NTP • Syslog Steps must be taken to help ensure the survival of the management and control planes during security incidents. If one of these planes is successfully exploited, all network planes can be compromised. Password control Password control refers to a set of functions provided by the local authentication server to control user login passwords, super passwords, and user login status based on predefined policies. If passwords are cracked by attackers, the whole network is compromised. Generally, an administrator sets a password for each network user. A password is displayed in either plain text or cipher text. A plain-text password is visible to all users logged in through the console port. In addition, a user can log in to a device and obtain its configuration file, from which the user can view user names and plain-text passwords. Cipher-text passwords are therefore recommended, especially when password control is no enabled. Cipher text prevents logged-in users from viewing passwords, but the passwords can still be cracked by some software. If a user obtains the configuration file, the user can then easily use crack software to obtain the passwords. 2