Network Security White Paper V1.7 ⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯
Total Page:16
File Type:pdf, Size:1020Kb
Network Security White Paper v1.7 ⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯ Network Security White Paper for Digital Multifunction and Printing Devices NOTICE THIS DOCUMENT SHALL NOT BE REPRODUCED IN WHOLE OR IN PART, FOR ANY PURPOSE OR IN ANY FASHION AND DISTRIBUTED WITHOUT THE PRIOR WRITTEN CONSENT OF RICOH CORPORATION. WHICH CONSENT RICOH CORPORATION MAY GRANT OR DENY IN ITS SOLE DISCRETION. All product names, domain names or product illustrations, including desktop images, used in this document are trademarks, registered trademarks or the property of their respective companies. They are used throughout this book in an informational or editorial fashion only and for the benefit of such companies. Ricoh does not grant or intend to grant hereby any right to such trademarks or property to any third parties. No such use, or the use of any trade name, or web site is intended to convey endorsement or other affiliation with Ricoh products. Although best efforts were made to prepare this document, Ricoh Corporation makes no representation or warranties of any kind with regards to the completeness or accuracy of the contents and accepts no liability of any kind including but not limited to performances, merchantability, fitness for any particular purpose, or any losses or damages of any kind caused or alleged to be caused directly or indirectly from this document. Technology Solutions Center Ricoh Corporation Version: 1.7 June 2007 Version History 1.1 – January 2004 1.2 – July 2004 1.3 – June 2005 1.4 – November 2005 1.5 – December 2005 1.6 – August 2006 1.6.1 – January 2007 1.6.2 – March 2007 ⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯ Page 1 of 66 Visit our knowledgebase at: HTTP://www.ricoh-usa.com/support/knowledgebase.asp Copyright © 2007 Ricoh Corporation Network Security White Paper v1.7 ⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯ Table of Contents 1 Introduction ............................................................................................................ 4 1.1 Terms ............................................................................................................................4 1.2 Target Audience............................................................................................................4 1.3 Model Cross Reference.................................................................................................5 2 Embedded Services and Potential Security Issues ............................................ 7 2.1 Telnet ............................................................................................................................8 2.2 FTP................................................................................................................................9 2.3 HTTP...........................................................................................................................11 2.4 SNMP v1/v2 ................................................................................................................13 2.5 SHELL (RSH/RCP) .....................................................................................................15 2.6 LPD .............................................................................................................................16 2.7 IPP...............................................................................................................................17 2.8 DIPRINT (RAW print) ..................................................................................................19 2.9 NBT .............................................................................................................................20 2.10 Authentication Service.................................................................................................21 2.11 Others..........................................................................................................................21 3 Services provided with open TCP/UDP ports ..................................................... 22 3.1 Related Protocols........................................................................................................23 4 Purpose of Access Control ................................................................................. 25 4.1 Web Image Monitor Access Control............................................................................25 4.2 TELNET/Maintenance Shell (MSHELL) ......................................................................29 5 Service Settings ................................................................................................... 31 5.1 Disabling Services thru Web Image Monitor ...............................................................33 5.2 Disabling Services thru MSHELL ................................................................................34 6 Summary and References ................................................................................... 34 Appendix A .................................................................................................................. 35 A.1 FTP Potential Threats .................................................................................................36 A.2 HTTPS Potential Threats ............................................................................................36 Appendix B .................................................................................................................. 37 B.1 MDNS..........................................................................................................................38 B.2 HTTPS.........................................................................................................................38 Appendix C .................................................................................................................. 40 C.1 SNMP v3 .....................................................................................................................41 C.2 SMB.............................................................................................................................42 C.3 Other Embedded Services ..........................................................................................43 C.4 Additional Services Provided with open TCP/UDP Ports ............................................43 ⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯ Page 2 of 66 Visit our knowledgebase at: HTTP://www.ricoh-usa.com/support/knowledgebase.asp Copyright © 2007 Ricoh Corporation Network Security White Paper v1.7 ⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯ C.5 HTTP/HTTPS settings.................................................................................................44 C.6 SNMP v1/v2 Settings ..................................................................................................45 C.7 SNMP v3 Settings .......................................................................................................46 Appendix D .................................................................................................................. 50 D.1 H.323/SIP....................................................................................................................51 D.2 Additional Services Provided with open TCP/UDP Ports ............................................51 D.3 Network Security Level settings ..................................................................................52 Appendix E .................................................................................................................. 54 E.1 SSDP...........................................................................................................................55 E.2 SFTP (SSH) ................................................................................................................56 E.3 Wireless LAN...............................................................................................................57 E.4 SSH/SFTP Network Security Settings.........................................................................59 E.5 Additional Services Provided with open TCP/UDP Ports ............................................59 E.6 Services that can be Disabled.....................................................................................59 E.7 Wireless LAN settings .................................................................................................60 ⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯ Page 3 of 66 Visit our knowledgebase at: HTTP://www.ricoh-usa.com/support/knowledgebase.asp Copyright © 2007 Ricoh Corporation Network Security White Paper v1.7 ⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯ 1 Introduction This document describes potential internal and external network threats and the recommended precautions for preventing them. The products have built-in network services that provide a variety of features for network clients (e.g. network scanning, printing or faxing), and client services for accessing network servers running outside the products (e.g. LDAP server, NetWare servers, or Mail servers). The products are designed for use inside an Intranet where network clients and servers are protected by firewalls, and they rely on the Intranet’s security policy. However, some customers require stricter security for network devices, due to increasing threats from inside the firewalls. Some configurations even use a secure connection to the Internet as a part of the Intranet. To satisfy these demands, the products are all evaluated by security scanning applications during development, and also are checked