HP StorageWorks MSA 2/8 HP StorageWorks Secure Fabric OS V1.0 User Guide (AA-R - Page 14

Security of Management Channels, Secure Shell

Get HP StorageWorks MSA 2/8 - SAN Switch PDF manuals and user guides View all HP StorageWorks MSA 2/8 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 14 highlights

Introducing Secure Fabric OS Security of Management Channels You can use Secure Fabric OS to increase the security of the local and remote management channels, including Fabric Manager, Web Tools, standard SNMP applications, Management Server, and a supported command line interface (CLI) client such as sectelnet. You can specify the access allowed through a channel by customizing the Secure Fabric OS policy for that channel. Secure Fabric OS policies are available for telnet (includes sectelnet and Secure Shell), SNMP, Management Server, HTTP, and Application Programing Interface (API). Fabric Manager and Web Tools both use HTTP and API to access the switch. Once a digital certificate is installed on the switch, Fabric OS v2.6.1, v3.1.x, and v4.1.x all encrypt sectelnet, API, and HTTP passwords automatically, regardless of whether Secure Fabric OS is enabled. Note: The "Telnet" button in Web Tools can be used to launch telnet only (not sectelnet or Secure Shell), and is disabled when Secure Mode is enabled. Secure Shell Fabric OS v4.1.x supports Secure Shell (SSH), which is a fully encrypted protocol for CLI. Use of SSH requires installation of a SSH client on the host computer. It does not require a digital certificate on the switch. SSH access is configurable by the Telnet policy that is available through Secure Fabric OS. However, Fabric OS v4.1.x supports SSH whether or not Secure Fabric OS is licensed. If you want to restrict CLI access over the network to SSH, disable telnet as described under "Telnet" on page 15. SSH clients are available in the public domain, and can be located by searching on the Internet. Any client that supports Version 2 of the protocol is supported, such as PuTTy or F-Secure. Fabric OS v4.1.x also supports the following ciphers for session encryption and Hash Message Authentication Codes (HMACs)-a hash function based message authentication code: ■ Ciphers: AES128-CBC, 3DES-CBC, Blowfish-CBC, Cast128-CBC, and RC4 ■ HMACs: HMAC-MD5, HMAC-SHA1, HMAC-SHA1-96, HMACMD5-96. 14 Secure Fabric OS Version 1.0 User Guide

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
Introducing Secure Fabric OS
14
Secure Fabric OS Version 1.0 User Guide
Security of Management Channels
You can use Secure Fabric OS to increase the security of the local and remote
management channels, including Fabric Manager, Web Tools, standard SNMP
applications, Management Server, and a supported command line interface (CLI)
client such as sectelnet.
You can specify the access allowed through a channel by customizing the Secure
Fabric OS policy for that channel. Secure Fabric OS policies are available for
telnet (includes sectelnet and Secure Shell), SNMP, Management Server, HTTP,
and Application Programing Interface (API). Fabric Manager and Web Tools both
use HTTP and API to access the switch.
Once a digital certificate is installed on the switch, Fabric OS v2.6.1, v3.1.x, and
v4.1.x all encrypt sectelnet, API, and HTTP passwords automatically, regardless
of whether Secure Fabric OS is enabled.
Note:
The “Telnet” button in Web Tools can be used to launch telnet only (not sectelnet
or Secure Shell), and is disabled when Secure Mode is enabled.
Secure Shell
Fabric OS v4.1.x supports Secure Shell (SSH), which is a fully encrypted protocol
for CLI. Use of SSH requires installation of a SSH client on the host computer. It
does not require a digital certificate on the switch.
SSH access is configurable by the Telnet policy that is available through Secure
Fabric OS. However, Fabric OS v4.1.x supports SSH whether or not Secure Fabric
OS is licensed.
If you want to restrict CLI access over the network to SSH, disable telnet as
described under “
Telnet
” on page 15.
SSH clients are available in the public domain, and can be located by searching on
the Internet. Any client that supports Version 2 of the protocol is supported, such
as PuTTy or F-Secure.
Fabric OS v4.1.x also supports the following ciphers for session encryption and
Hash Message Authentication Codes (HMACs)—a hash function based message
authentication code:
■
Ciphers: AES128-CBC, 3DES-CBC, Blowfish-CBC, Cast128-CBC, and RC4
■
HMACs: HMAC-MD5, HMAC-SHA1, HMAC-SHA1-96, HMACMD5-96.