Security Considerations - ProCurve 2910al-24g Management And Configuration Manual

File Transfers
Using USB Autorun
A-40
d. determine if the file will be 'run once' (moved to a 'processed' direc­
tory on execution) or 'run many' (kept in the root directory of the flash
drive from where it can be executed again).
2. Deploy the AutoRun file to a USB flash drive.
3. (If required) Enable the autorun feature on the switch (autorun is enabled
by default unless an operator or manager password has been set—see
"Autorun and Configuring Passwords" on page A-43).
4. (If the AutoRun file has been signed or encrypted) Enable secure-mode
on the switch firstly by configuring an encryption key and a valid trusted
certificate, and then by enabling secure-mode via the CLI. See "Enabling
Secure Mode" on page A-42.
5. Insert the USB flash drive into the switch's USB auxiliary port.
The switch processes the AutoRun file automatically and writes a result
(.txt) file and report (.xml) file back to the USB flash drive, reporting on
the command operations that were executed.
6. Remove the USB device from the USB port.
The switch executes any post-commands, such as rebooting the switch to
apply any configuration updates.
7. (Optional) Transfer the 'result file' and 'report file' to a PCM+-enabled
computer for report checking. See "Troubleshooting Autorun Operations"
on page A-41.

Security Considerations

By default, the switch is unsecured when shipped (that is, USB autorun is
enabled by default). However, as soon as an operator or manager password is
configured, autorun is disabled and must be re-enabled at the configuration
level of the CLI before it can be used. The requirement to use PCM+ to create
a valid AutoRun file helps prevent a non-authorized command file from being
created and processed by the switch.
In terms of physical security, access to the switch's console port and USB port
are equivalent. Keeping the switch in a locked wiring closet or other secure
space helps to prevent unauthorized physical access. As additional precau­
tions, you have the following configuration options via the CLI (see page A-42):
■ Disable autorun by setting an operator or manager password.
■ Disable or re-enable the USB autorun function via the CLI.
Enable autorun in secure mode to verify signatures in autorun command
■
files and to decrypt encrypted command files.