Key Files - Siemens RUGGEDCOM ROS User Manual

RUGGEDCOM ROS
User Guide
• Limit the number of simultaneous Web Server, Telnet and SSH sessions allowed.
• Configure remote system logging to forward all logs to a central location. For more information, refer to
Section 3.5, "Managing
• Configuration files are provided in the CSV (comma separated values) format for ease of use. Make sure
configuration files are properly protected when they exist outside of the device. For instance, encrypt the files,
store them in a secure place, and do not transfer them via insecure communication channels.
• Management of the configuration file, certificates and keys is the responsibility of the device owner. Before
returning the device to Siemens for repair, make sure encryption is disabled (to create a cleartext version of the
configuration file) and replace the current certificates and keys with temporary throwaway certificates and keys
that can be destroyed upon the device's return.
• Be aware of any non-secure protocols enabled on the device. While some protocols, such as HTTPS and
SSH, are secure, others, such as Telnet and RSH, were not designed for this purpose. Appropriate safeguards
against non-secure protocols should be taken to prevent unauthorized access to the device/network.
• Configure port security features on access ports to prevent a third-party from launching various attacks that can
harm the network or device. For more information, refer to
• Periodically audit the device to make sure it complies with these recommendations and/or any internal security
policies.
Section 1.2.2

Key Files

ROS uses security keys to establish secure remote logins (SSH) and Web access (SSL).
It is strongly recommended that a unique SSL certificate and SSH keys be created and provisioned. New ROS -
based units from Siemens will be shipped with a unique certificate and keys preconfigured in the ssl.crt and
ssh.keys flash files.
The default and auto-generated SSL certificates are self-signed. It is recommended to use an SSL certificate that
is either signed by a trusted third-party Certificate Authority (CA) or by an organization's own CA. This technique
is described in the Siemens application note: Creating/Uploading SSH Keys and SSL Certificates to ROS Using
Windows, available from www.siemens.com/ruggedcom.
The sequence of events related to Key Management during an upgrade to ROS v4.1 or later is as follows:
NOTE
The auto-generation of SSH keys is not available for Non-Controlled (NC) versions of ROS.
• On first boot, ROS will start the SSH and SSL services using the default keys.
• Immediately after boot, ROS will start to generate a unique SSL certificate and SSH key pair, and save each
one to its corresponding flash file. This process may take several minutes to complete. As each one is created,
the corresponding service is immediately restarted with the new keys.
• At any time during the key generation process, custom keys can be uploaded. The custom keys will take
precedence over both the default and auto-generated keys.
• On subsequent boot, if there is a valid ssl.crt file, the default certificate will not be used for SSL. If there is a
valid ssh.keys file, the default SSH key will not be used.
• At any time, new keys may be uploaded or generated by ROS using the sslkeygen or sshkeygen CLI
commands.
The following sections describe SSL certificates and SSH key pairs in more detail:
Key Files
Logs".
Section 5.10, "Managing Port
Chapter 1
Introduction
Security".
3