New Features; Ensuring A Secure Operating System; Secure Shell (Ssh) - HP StorageWorks MSA 2/8 - SAN Switch User Manual

New Features

Ensuring a Secure Operating System

Fabric OS v4.1 uses Linux as the operating system in the switch. Therefore,
securing the switch includes securing the underlying operating system as well.
Fabric OS uses the Berkeley r-commands facility to transfer data between control
processors in the Core Switch 2/64 platform. The primary security concern is the
use of the .rhosts file. All hosts listed in the.rhosts file are trusted, meaning they
can log in to the switch without any authentication such as a password. The .rhosts
file on the switch contains the IP address 10.0.0.5 and 10.0.0.6, which are the IP
address of each CP in a Core Switch 2/64 chassis. To prevent the use of these
facilities except from the internal network, an iptables firewall has been
implemented. This firewall isolates the external network from internal network
and does not allow execution of r-commands on the switch from external hosts.
However, if you logged in to a switch of CP as root, you can issue r-commands to
the other CP.
In addition, various proprietary protocols are also used over the internal CP-to-CP
Ethernet. The internal Ethernet interface is considered a "trusted" interface over
which arbitrary communications may occur. To address these security concerns,
the internal Ethernet interfaces were disconnected from the public Ethernet
interfaces.
A packet filter is used to isolate the internal Ethernet interface. The packet filter:

Secure Shell (SSH)

An SSH (Secure Shell) is used to support encrypted telnet sessions to the switch
(DES encryption is not supported). The default out-of-band Telnet mechanism for
managing switches was deemed insecure because the passwords are sent over the
wire in clear text. It is relatively easy for any network-connected system to sniff
and reap these passwords for use in subsequent intrusions. In a complex enterprise
network that aggregates device management into a backbone, it is difficult to
Fabric OS Procedures Version 3.1.x/4.1.x User Guide
Prevents routing of packets to and from internal network.
Protects against spoofing of internal network addresses.
The packet filter blocks all incoming packets from 10.0.0.0 to 10.0.0.255.
Closes network services intended only for the internal network without
changing the source code.
Basic Security in FOS
93