S 4.80 Secure access mechanisms for remote administration

Initiation responsibility: Head of IT, IT Security Officer

Implementation responsibility: Administrator

Some active network components can be administered or monitored remotely by accessing the network. Access is attained using either connectionless or connection-oriented protocols. These protocols include:

• protocols intended exclusively for transmitting data, for example to transmit new firmware versions or configuration files, such as FTP, TFTP (use of the latter is generally not recommended), or RCP (see also S 6.52 Regular backup of configuration data of active network components),
• protocols for interactive communications, e.g. Telnet,
• protocols for network management, e.g. SNMP or CMIP

For all types of access, it must be ensured that unauthorised access cannot be gained.

For this, the default passwords and/or community names of the network components must be replaced by secure passwords and/or community names (see S 4.82 Secure configuration of active network components). In many active network components, the coupling of community names and passwords affects the FTP, Telnet, SNMP and CMIP protocols. Some components also allow access to be restricted based on MAC or IP addresses. This option should be used wherever possible so that access is only granted through dedicated management stations.

Only the network component itself should be able to enable data transmission protocols (TFTP, FTP, RCP). This applies in particular to non-authenticating protocols such as TFTP. For interactive communication protocols (Telnet), the auto-logout option of the network component should be enabled.

It must be noted that in most protocols, passwords and community names are transmitted in clear text, i.e. they can generally be read when someone listens in (refer to S 5.61 Suitable physical segmentation and S 5.62 Suitable logical segmentation)

Example: The "public" and "private" default community names in SNMP should be replaced by other names.

Review questions:

• Is any access by unauthorised persons ruled out for all types of access for remote administration?
• When using components that can be used to restrict the access to MAC or IP addresses: Is access allowed by dedicated management stations only?
• Are only the network components themselves allowed to initiate data transmission protocols?