Lexmark C54x Administrator's Manual

Lexmark C54x Administrator's Manual

Embedded web server — security
Hide thumbs Also See for C54x:
Table of Contents

Advertisement

Embedded Web Server — Security
Administrator's Guide
September 2014
www.lexmark.com
Model(s):
C54x, C73x, C746, C748, C792, C925, C950, E260, E360, E46x, T65x, W850, X264, X36x, X46x, X543, X544, X546, X548, X65x, X73x, X74x, X792, X796, X86x, X925, X95x

Advertisement

Table of Contents
loading

Summary of Contents for Lexmark C54x

  • Page 1 Embedded Web Server — Security Administrator's Guide September 2014 www.lexmark.com Model(s): C54x, C73x, C746, C748, C792, C925, C950, E260, E360, E46x, T65x, W850, X264, X36x, X46x, X543, X544, X546, X548, X65x, X73x, X74x, X792, X796, X86x, X925, X95x...
  • Page 2: Table Of Contents

    Contents Contents Devices covered in this guide...............4 Simple‑security devices..........................4 Advanced‑security devices........................4 Managing authentication and authorization methods........5 Understanding the basics..........................5 Simple-security device access controls.....................8 Limiting access using basic security setup....................10 Advanced-security building blocks......................10 Using a security template to control function access................20 Managing certificates and other settings............24 Installing a Certificate Authority certificate on the device..............24 Configuring the device for certificate information..................24...
  • Page 3: Contents

    Contents Securing data.....................42 Physical lock............................42 Disk encryption............................43 Checking disk encryption status......................44 Erasing settings (non‑volatile memory)....................44 Disk file wiping............................46 Erasing hard disk data..........................48 Out‑of‑service wiping..........................49 Statement of volatility..........................50 Security solutions..................52 Print Release............................52 Secure Held Print Jobs..........................52 Card Authentication..........................52 Smart Card authentication........................52 Security scenarios..................54 Scenario: Printer in a public place......................54 Scenario: Standalone or small office.......................55...
  • Page 4: Devices Covered In This Guide

    Devices covered in this guide Devices covered in this guide There are two levels of security supported based on the product definition. For a complete list of available functionality, “Authentication and authorization” on page Simple‑security devices C540, C543, C544, C546, C746, E260d, E260dn, E360d, E360dn, X264dn, X363dn, X364dn, X364dw, X543, X544, X546dtn Advanced‑security devices C73x, C748, C792, C925, C950, E460dn, E460dw, E462dtn, T650, T652, T654, T656, W850, X464de, X466, X548de, X548dte, X65x, X73x, X74x, X792, X796, X86x, X925, X950, X952, X954...
  • Page 5: Managing Authentication And Authorization Methods

    Managing authentication and authorization methods Managing authentication and authorization methods Understanding the basics Securing a printer through the Embedded Web Server involves combining one or more components to define who is allowed to use the printer, and which functions those users are allowed to access. Available components include Authentication, Authorization, and Groups.
  • Page 6 Managing authentication and authorization methods Function Simple‑security devices Advanced‑security devices Panel PIN Protect PIN Protection Web Page Password Protect Password Protection Internal Accounts (Username and Username/Password) Groups (internal) LDAP LDAP+GSSAPI Kerberos 5 Active Directory Limited access controls Access controls (complete) Security Templates Basic Security Setup = Supported...
  • Page 7: Access Controls

    Managing authentication and authorization methods Groups Administrators can designate up to 32 groups to be used in association with either the Internal accounts or LDAP/LDAP +GSSAPI building blocks. To ensure device security, groups are used to identify sets of users needing access to similar functions.
  • Page 8: Simple-Security Device Access Controls

    Managing authentication and authorization methods To obtain the printer IP address, print a network setup page, and then locate the TCP/IP section. For more information on printing a network setup page, see the printer User’s Guide. We recommend using HTTPS when connecting to the Embedded Web Server to prevent network viewing of the data being entered.
  • Page 9 Managing authentication and authorization methods Creating a PIN and applying access control restriction For simple‑security devices, control panel access control is limited to creating a PIN and applying access restrictions through the Panel PIN Protect security control. Typically, personal identification numbers (PINs) are used to control access to a device or specific device menus. PINs can also be required when retrieving a held print, copy, or fax job.
  • Page 10: Limiting Access Using Basic Security Setup

    Managing authentication and authorization methods Limiting access using basic security setup Use Basic Security Setup to limit access to the Embedded Web Server settings and the configuration menus on the printer control panel. This selection allows the definition of simple internal device security authentication methods. Notes: •...
  • Page 11 Managing authentication and authorization methods When configuring from the control panel, the steps may vary depending on your printer model. For example, for devices with a large touch screen, you can access the security setup by doing the following: Navigate to the menu screen. Touch Security >...
  • Page 12: Setting Up Internal Accounts

    Managing authentication and authorization methods Changing the PIN length Click Settings > Security > Miscellaneous Security Settings. Enter a number in the Minimum PIN Length field. Click Submit. Setting up internal accounts Note: This feature is available only in advanced‑security devices. Administrators can configure one internal account building block per supported device.
  • Page 13 Managing authentication and authorization methods Using the Embedded Web Server Click Settings > Security > Security Setup. Under Advanced Security Setup, click Internal Accounts > Add an Internal Account. Provide the information needed for each account: • Account Name—Type the account name of the user. For example, “Jack Smith.” You can use up to 164 UTF‑8 characters.
  • Page 14 Managing authentication and authorization methods Connecting your printer to an Active Directory domain Using Active Directory simplifies network authentication and authorization setup, automatically creating and configuring LDAP+GSSAPI and Kerberos authentication building blocks. Notes: • This feature is available only in some printer models. •...
  • Page 15: Using Ldap

    Managing authentication and authorization methods • Use Kerberos Service Ticket—This advanced setup, otherwise known as SPNEGO, is the session ticket that a user uses to log in to a computer. We recommend leaving this setting unchanged. • Use Active Directory Device Credentials—This option lets you use the service account that is created in Active Directory.
  • Page 16 Managing authentication and authorization methods • Userid Attribute—Type either cn (common name), uid, userid, or user‑defined. • Mail Attribute—Type a maximum of 48 characters to identify e‑mail addresses. The default value is “mail.” • Full Name Attribute—Type a maximum of 48 characters. The default value is “cn.” •...
  • Page 17 Managing authentication and authorization methods Select a setup from the list. Click Delete Entry to remove the profile, or Cancel to return to previous values. Notes: • Click Delete List to delete all LDAP setups in the list. • An LDAP building block cannot be deleted if it is being used as part of a security template. Validating an LDAP setup From the Embedded Web Server, click Settings >...
  • Page 18 Managing authentication and authorization methods • Userid Attribute—Type either cn (common name), uid, userid, or user‑defined. • Mail Attribute—Type a maximum of 48 characters to identify e‑mail addresses. The default value is “mail.” • Full Name Attribute—Type a maximum of 48 characters. •...
  • Page 19 Managing authentication and authorization methods Notes: • Click Delete List to delete all LDAP+GSSAPI setups in the list. • An LDAP+GSSAPI building block cannot be deleted if it is being used as part of a security template. Configuring Kerberos 5 for use with LDAP+GSSAPI Note: This feature is available only in advanced‑security devices.
  • Page 20: Using A Security Template To Control Function Access

    Managing authentication and authorization methods • To verify that the Kerberos configuration file for the selected device is functional, click Test Setup. Setting date and time Kerberos servers require key requests to have a recent time stamp (usually within 300 seconds). Therefore, the printer clock must be in sync or closely aligned with the KDC system clock.
  • Page 21 Managing authentication and authorization methods Step 1: Create a building block A building block is required to specify authentication and authorization for device menus and functions. Use the building blocks to define security templates, and then select a template for each access control. From the Embedded Web Server, click Settings >...
  • Page 22 Managing authentication and authorization methods On the Authentication Setup screen, select the appropriate building block, and then touch Done. On the Authorization Setup screen, select the appropriate building block, and then touch Done. Select one or more groups to be included in the template, and then touch Done. Step 3: Assign security templates to access controls After assigning a security template, users are required to provide the appropriate credentials to access any functions assigned with a security template.
  • Page 23 Managing authentication and authorization methods • You can delete a security template only if it is not in use, but you can edit a security template that is in use. Editing or deleting a security template from the control panel Note: These instructions apply only in printer models with a touch‑screen display.
  • Page 24: Managing Certificates And Other Settings

    Managing certificates and other settings Managing certificates and other settings Note: This feature is available only in some printer models. The Certificate Management menu is used for configuring printers to utilize certificates for establishing SSL, IPSec, and 802.1x connections. Additionally, devices utilize certificates for LDAP over SSL authentication and address book look- ups.
  • Page 25 Managing certificates and other settings The printer has a self‑generated certificate. For some operations (such as 802.1X and IPsec), the printer certificate needs to be upgraded to a certificate that has been signed by a certificate authority. The printer includes a process of generating a certificate signing request that can be viewed or downloaded, which facilitates the process of obtaining the signed certificate for the printer.
  • Page 26 Managing certificates and other settings Follow the CA certificate request process as defined for the CA. A sample request is shown in “Appendix B: CA‑Signed Device Certificate creation” on page Note: The result is a CA‑signed device certificate file (in .pem format). Save this file on your computer for use in the next steps.
  • Page 27: Setting Certificate Defaults

    Managing certificates and other settings Click any of the following: • Delete—Remove a previously stored certificate. • Download To File—Download or save the certificate as a .pem file. • Download Signing Request—Download or save the signing request as a .csr file. •...
  • Page 28: Managing Devices Remotely

    Managing devices remotely Managing devices remotely Using HTTPS for device management Turn off the HTTP port, leaving the HTTPS port (443) active, to restrict the access of the device Embedded Web Server to HTTPS only. This action ensures that all communication with the device using Embedded Web Server is encrypted. From the Embedded Web Server, click Settings >...
  • Page 29: Setting Up Snmp

    Managing devices remotely Setting up SNMP Simple Network Management Protocol (SNMP) is used in network management systems to monitor network-connected devices for conditions that warrant administrative attention. The Embedded Web Server allows administrators to configure settings for SNMP versions 1 through 3. Note: We recommend selecting only SNMPv3, setting Minimum Authentication Level to Authentication, Privacy, and setting the strongest privacy algorithm.
  • Page 30: Configuring Security Audit Log Settings

    Managing devices remotely Configuring security audit log settings Note: This setting is available only in advanced‑security devices and in simple‑security devices with color LCD control panels. The security audit log lets administrators monitor security‑related events on a device, including failed user authorization, successful administrator authentication, and Kerberos file uploads to a device.
  • Page 31: Updating Firmware

    Managing devices remotely Note: To use e-mail alerts, click Submit to save the changes, and then click Setup E-mail Server to configure SMTP settings. Click Submit to save the changes, or Reset Form to restore the default settings. E-mail server setup To use the e‑mail notification of logged events, set up the e‑mail server.
  • Page 32 The firmware must be packaged in a proprietary format and encrypted with a symmetric encryption algorithm through an embedded key that is known only to Lexmark. However, the strongest security measure comes from requiring all firmware packages to include multiple digital 2048-bit RSA signatures from Lexmark. If these signatures are not valid, or if the message logs indicate a change in firmware after the signatures were applied, then the firmware is discarded.
  • Page 33: Managing Other Access Functions

    Managing other access functions Managing other access functions Configuring confidential printing Note: This feature is available only in printer models that allow PIN selection from the control panel. Users printing confidential or sensitive information may use the confidential print option. This option allows print jobs to e remain in the print queue until the user enters a PIN on the printer control panel.
  • Page 34: Setting Login Restrictions

    Managing other access functions Reserve Job Expiration Set a limit on how long the printer stores print jobs for printing at a later time. Note: This setting is available only in some printer models. 1 hour 4 hours 24 hours 1 week Note: Off is the factory default setting.
  • Page 35: Enabling The Security Reset Jumper

    Managing other access functions To set the schedule that restricts access at a specified time, do the following: From the Embedded Web Server, click Settings > Security > Schedule USB Devices. From the Disable Devices menu, select to disable printing from any USB device or from flash drives only. Note: All scheduled Disable actions are affected by this setting.
  • Page 36: Enabling Holding Faxes

    Managing other access functions The secure reset feature requires specifying in the Embedded Web Server the effect of using the security reset jumper, which is located on the controller board. From the Embedded Web Server, click Settings > Security > Miscellaneous Security Settings. From the Security Reset Jumper list, select one of the following: •...
  • Page 37 Managing other access functions Notes: • This feature requires a hard disk. • When the device is locked, incoming print and fax jobs are stored in the printer hard disk. If the hard disk is encrypted, then the jobs stored are encrypted. •...
  • Page 38: Securing Network Connections

    Securing network connections Securing network connections Configuring 802.1X authentication Note: This feature is available only in advanced‑security devices. Though normally associated with wireless devices and connectivity, 802.1X authentication supports both wired and wireless environments. The following network authentication mechanisms can be included in the 802.1X protocol negotiation: •...
  • Page 39: Configuring Ip Security Settings

    Securing network connections Notes: • If using digital certificates to establish a secure connection to the authentication server, configure the certificates on the printer before changing 802.1X authentication settings. For more information, see “Managing certificates and other settings” on page •...
  • Page 40 Securing network connections Setting Description Connections Configures the authenticated connections of the printer. Pre‑Shared Key Authenticated Connections • The following pre‑shared key settings can be configured: Host 1–5 – Address—You can type a maximum of 45 bytes of characters. Certificate Authenticated Connections –...
  • Page 41: Configuring The Tcp/Ip Port Access Setting

    Securing network connections Configuring the TCP/IP port access setting Note: This setting is available only in some printer models. You can control your network device activities by configuring your device to filter out traffic on specific network ports. Protocols (such as FTP, HTTP, and Telnet) can be disabled. Port filtering on devices disables network ports individually.
  • Page 42: Securing Data

    Securing data Physical lock Most Lexmark printers support cabled computer locks used to secure the critical and sensitive components of the device, such as the controller board and hard disk. These locks let you identify whether the physical components containing sensitive data on the devices have been tampered with.
  • Page 43: Disk Encryption

    Securing data Disk encryption Enable hard disk encryption to prevent loss of sensitive data if the printer or its hard disk is stolen. When hard disk encryption is activated, the encryption key to be used (256-bit AES symmetric encryption) is pseudo-randomly generated.
  • Page 44: Checking Disk Encryption Status

    Securing data Notes: • Encryption takes approximately two minutes. A status bar appears on the control panel indicating the progress of the disk encryption task. • After the disk has been encrypted, the printer returns to the Enable/Disable screen. Warning—Potential Damage: Do not turn off the printer during the encryption process. Doing so may result in loss of data.
  • Page 45 Securing data Clearing selected settings Using the Embedded Web Server Click Settings > Security > Restore Factory Defaults > Restore Settings. Note: Some settings are available only in the latest printer firmware versions. Select one of the following settings: • Printer Settings—Restore all non‑critical base device settings to the factory default.
  • Page 46: Disk File Wiping

    Securing data Using the control panel Turn off the printer. While the printer is turning on, press and hold 2 and 6 on the keypad simultaneously until a progress bar appears. Note: Some printer models require you to press and hold the check mark and the right arrow buttons. The printer performs a power‑on sequence, and then the Configuration menu appears.
  • Page 47 Securing data • Automatic—Immediately overwrite areas of the disk that were used for job processing. Automatic wiping marks all disk space used by a previous job and prevents the file system from reusing this space until it is sanitized. Automatic wiping is the only wiping process that operates without having to take the device offline during the wiping process.
  • Page 48: Erasing Hard Disk Data

    Securing data Modifying scheduled disk wiping from the Embedded Web Server If you have enabled the Manual Wiping mode to set a schedule for disk wiping, then click Scheduled Disk Wiping and do the following: Use the Time and Day(s) lists to schedule the disk wiping, and then click Add. If necessary, repeat the step to schedule additional times for disk wiping.
  • Page 49: Out-Of-Service Wiping

    Securing data Using the control panel Turn off the printer. While turning on the printer, press and hold 2 and 6 on the keypad simultaneously until a progress bar appears. It takes approximately a minute before the Configuration menu appears. Note: Some printer models require you to press and hold the check mark and the right arrow buttons.
  • Page 50: Statement Of Volatility

    Securing data Using the control panel This menu is available only in some firmware versions. Turn off the printer. While turning on the printer, press and hold 2 and 6 on the keypad simultaneously until a progress bar appears. Note: Some printer models require you to press and hold the check mark and the right arrow buttons. The printer performs a power-on reset, and then the Configuration menu appears.
  • Page 51 Securing data Disposing of a hard disk Note: Some printer models may not have a hard disk installed. High‑security environments may require additional steps to ensure that confidential data on the printer or hard disk cannot be accessed when either is removed from premises. •...
  • Page 52: Security Solutions

    To release your documents, enter your credentials at the device, and then select the documents you want to print. For more information on how to configure and use the application, see the documentation that came with the Lexmark Print Management application.
  • Page 53 Security solutions For more information on how to configure and use this application, see Smart Card Authentication Administrator’s Guide.
  • Page 54: Security Scenarios

    Security scenarios Security scenarios Scenario: Printer in a public place To provide simple protection for a printer located in a public space, such as a lobby, use a password and PIN. Administrators can assign a single password or PIN for all authorized users of the device, or separate codes to protect individual functions.
  • Page 55: Scenario: Standalone Or Small Office

    Security scenarios From the drop‑down menu next to the name of each function you want to protect, select the security template created in step Click Submit. Note: To gain access to any function controlled by this security template, users are required to enter the appropriate PIN or password.
  • Page 56: Scenario: Network Running Active Directory

    Security scenarios Step 3: Assign security templates to access controls From the Embedded Web Server, click Settings > Security > Security Setup > Access Controls. If necessary, click Expand All or click a specific folder to view a list of available functions. Select a security template for each function you want to protect.
  • Page 57: Scenario: More Security-Aware Environment (802.1X) And Snmpv3

    Security scenarios Scenario: More security‑aware environment (802.1X) and SNMPv3 In this scenario, the network uses 802.1X communication to restrict network access, and secure LDAP to enforce authentication and authorization for access of device functions. Also, device access is logged and the device is remotely managed using SNMPv3.
  • Page 58 Security scenarios To secure a network, restrict all network ports that are not used. For more information, see “Configuring the TCP/ IP port access setting” on page To allow remote management of SNMPv3, enable SNMPv3, and then disable SNMPv1,2. For more information, see “Setting up SNMP”...
  • Page 59: Troubleshooting

    AKE SURE THAT A SUPPORTED SMART CARD READER IS ATTACHED Remove the unsupported reader and attach a valid reader. For information on the supported readers, contact your Lexmark representative. Printer home screen fails to return to a locked state when not in use...
  • Page 60 Troubleshooting KDC and MFP clocks are out of sync This error indicates that the printer clock is more than five minutes out of sync with the domain controller clock. AKE SURE THAT THE DATE AND TIME SETTINGS ON THE PRINTER ARE CORRECT From the Embedded Web Server, click Settings >...
  • Page 61 Troubleshooting KDC does not respond within the required time Try one or more of the following: AKE SURE THAT THE ADDRESS OR HOST NAME OF THE IS CORRECT From the Embedded Web Server, click Settings > Device Solutions > Solutions (eSF) > PKI Authentication > Configure.
  • Page 62: Ldap Troubleshooting

    Troubleshooting Client is unknown This error indicates that the KDC being used to authenticate the user does not recognize the User Principal Name specified in the error message. AKE SURE THAT THE DOMAIN CONTROLLER INFORMATION IS CORRECT From the Embedded Web Server, click Settings > Device Solutions > Solutions (eSF) > PKI Authentication > Configure.
  • Page 63: Held Jobs/Print Release Lite Troubleshooting

    Troubleshooting LDAP lookups fail almost immediately Try one or more of the following: LDAP AKE SURE THAT THE DDRESS ETUP CONTAINS THE HOST NAME FOR THE SERVER From the Embedded Web Server, click Settings > Network/Ports > Address Book Setup. Make sure that the host name (not the IP address) of the LDAP server specified in the Server Address field is correct.
  • Page 64 Troubleshooting Cannot determine Windows user ID PKI A AKE SURE THAT UTHENTICATION SETS THE USER FOR THE SESSION From the Embedded Web Server, click Settings > Device Solutions > Solutions (eSF) > PKI Authentication > Configure. From the User Session and Access Control section, in the Session Userid setting, specify how to obtain the Windows user ID when logging in: •...
  • Page 65 Troubleshooting AKE SURE THAT ALL JOBS ARE REQUIRED TO BE HELD From the Embedded Web Server, click Settings > Device Solutions > Solutions (eSF) > PKI Held Jobs > Configure. From the Advanced Settings section, enable Require All Jobs to be Held and Clear Print Data . Apply the changes.
  • Page 66: Appendix

    Appendix Appendix Appendix A: CA file creation Note: This example of generation of a CA file for the Certificate Authority assumes usage of a Windows Certificate Authority server. Point the browser window to the CA. Make sure to use the URL, http//<CA’s address>/CertSrv, where CA’s address is the IP address or host name of the CA server.
  • Page 67 Appendix Function access control What it does Configuration Menu This protects access to the Configuration Menu. Manage Shortcuts at the Device This protects access to the Manage Shortcuts section of the Settings menu from the printer control panel. Manage Shortcuts Remotely This protects access to the Manage Shortcuts section of the Settings menu from the Embedded Web Server.
  • Page 68 Appendix Function access control What it does Firmware Updates This controls the ability to update firmware from any source other than a flash drive. Firmware files that are received through FTP, the Embedded Web Server, etc., will be ignored (flushed) when this function is protected. Operator Panel Lock This protects access to the locking function of the printer control panel.
  • Page 69 Appendix Function access control What it does FTP Function This controls access to the Scan to FTP function. Held Jobs Access This protects access to the Held Jobs function. PictBridge Printing This controls the ability to print from an attached PictBridge‑enabled digital camera. Note: Selected devices only.
  • Page 70 Appendix Using the on‑screen keyboard Some device settings require one or more alphanumeric entries, such as server addresses, user names, and passwords. When an alphanumeric entry is needed, a keyboard appears: Password & “ Caps Clear < > Shift Backspace .com .org Space...
  • Page 71: Edition Notice

    All rights reserved. Trademarks Lexmark and Lexmark with diamond design are trademarks of Lexmark International, Inc., registered in the United States and/or other countries. Mac and the Mac logo are trademarks of Apple Inc., registered in the U.S. and other countries.
  • Page 72 Notices as applicable, the Commercial Computer Software and Commercial Software Documentation are licensed to the U.S. Government end users (a) only as Commercial Items and (b) with only those rights as are granted to all other end users pursuant to the terms and conditions herein. GifEncoder GifEncoder - writes out an image as a GIF.
  • Page 73 Notices "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity.
  • Page 74 Notices (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a "NOTICE"...
  • Page 75 Notices Copyright [yyyy] [name of copyright owner] Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS"...
  • Page 76: Glossary Of Security Terms

    Glossary of Security Terms Glossary of Security Terms Access Controls Settings that control whether individual device menus, functions, and settings are available, and to whom. Also referred to as Function Access Controls on some devices. Authentication A method for securely ientifying a user. Authorization A method for specifying which functions are available to a user, i.e.
  • Page 77: Index

    Index Index basic security configuring advanced building Numerics applying basic security setup 10 blocks 802.1X authentication 38, 57 authentication type 10 control panel 10 limiting access 10 configuring device modifying or removing access 10 certificate information 24 access controls building blocks Configuring Out of Service Erase 49 list of 66 adding to security templates 20...
  • Page 78 Index erasing hard disk 48 Kerberos file not uploaded 60 erasing non‑volatile memory 44, 51 keyboard advanced security setup 11 erasing volatile memory 51 using the 69 creating or editing 9, 11 Panel PIN Protect 9 Print Release 52 printer firmware LDAP connecting to Active Directory 14...
  • Page 79 Index reset jumper on controller Kerberos file not uploaded 60 board 35 LDAP lookup failure 62, 63 security audit log 30 LDAP lookups take too long 62 security templates 20 login does not respond while simple 4 getting user info 62 SNMP 29 login screen does not appear USB host ports 34...

Table of Contents