NETGEAR and Auto Uplink are trademarks or registered trademarks of NETGEAR, Inc..
Microsoft, Windows, and Wi ndow s NT are registered trademar ks of Microsoft Corporation.
Other brand and product names are registered trademarks or trademarks of their respective holders. Portions of this
document are copyright Intoto, Inc.
Disclaimers
February 2006 Information in this document is subject to change at any time without notice and is provided "as is" with
no warranty. NETGEAR, Inc. makes no warranty of any kind with regard to this material including, but not limited to,
the implied warranties of merchantability and fitness for a particular purpose. NETGEAR, Inc. shall not be liable for
errors contained herein or for any direct, indirect, special, incidental, or consequential damages in connection with the
use of this material. NETGEAR, Inc. assumes no responsibility for customer product design or the use or application of
customers' products or for any infringements of patents or rights of others which may result from NETGEAR, Inc.
assistance. The content of this application notes does not imply that NETGEAR, Inc. intends to make it availab le in any
NETGEAR managed switch product. NETGEAR, Inc. may have patents or pending patent applications covering
subject matter in this document. The furnishing of this document does not give any license to these patents.
Product and Publication Details
Model Number:
Publication Date:February 2006
Product Family:NETGEAR managed switch
Product Name:7xxx Series Managed Switch
Home or Business Product:Business
Language:English
Publication Part Number:Beta Draft 1
Publication Version Number1.0
ii
Publication Version 1.0, February 2006
Contents
Application Note: Configuring and Enabling Management Security
Application Note: Configuring and Enabling Management Security
Chapter 1
Introduction
In the past, network communications were simply a matter of packaging frames of
information and shipping them over the wire to their destination. Protocols gave
little thought to who might be viewing the frames as they crossed the wire, or
what illegitimate parties might do with the information so gleaned. More and
more, security has become an ever-present concern amongst the members of the
networking community. Networking infrastructure is far too important to risk
abuse by hackers, whether they are malevolent or simply mischievous. As a
whole, the community has turned to encryption as a means of ensuring the
security of network transactions.
Interactive login is a mainstay for providing a means to control and/or configure
an entity across the network. For decades the telnet protocol has provided this
capability for devices wishing to provide interactive login over a network.
However, these protocols are chief culprits with regard to the transmission of
sensitive information (e.g. passwords) over the network unprotected. The current
de facto standard for providing interactive login in a secure fashion is the Secure
Shell (SSH). SSH provides a number of services in a secure manner. These
include port forwarding, file transfer, X11 forwarding, and interactive login. Of
these, currently only interactive login is of interest for the NETGEAR managed
switch software.
Managing devices with a web browser has been standard practice for several
years. Unfortunately, standard HTTP transactions are no more secure than telnet.
This was one of the original barriers to the success of "e-commerce". The solution
(then and now) is the use of the Secure Sockets Layer (SSL) protocol. SSL
provides a means of abstracting an encrypted connection between two stations.
Once established, such a connection is virtually no different to use than an
unsecured connection. This allows an established protocol (e.g. HTTP) to operate
in a secure manner on an open network.
A third component of management on a modern networking appliance is SNMP.
The SNMP protocol has it own security mechanisms outside of SSH and SSL.
Consequently discussion of security for SNMP transactions is outside the scope of
this document.
Introduction1-1
v1.0, February 2006
Application Note: Configuring and Enabling Management Security
1-2Introduction
v1.0, February 2006
Application Note: Configuring and Enabling Management Security
Enabling management security is a two-step process. The first step involves
generating and loading appropriate authentication keys (SSH) and security
certificates (SSL). Optionally a reputable third party such as RSA Security, Inc. or
Entrust, Inc. can validate these certificates and keys but for evaluation purposes
validation is unnecessary.
The second step involves enabling either SSL or SSH and optionally disabling the
insecure versions of telnet and web management. Once enabled, subsequent
management connections may be made in a secure manner.
Certificate Generation
Chapter 2
Enabling Management Security
To generate self-signed credentials, the open source applications ssh-keygen and
openssl can be used to create the seven files used to form the security certificates
and authentication keys. Both of these applications are well documented by the
open source community. Detailed descriptions will not be repeated here as the
user can check the man pages for detailed help. Two scripts are included in the
appendix at the end of this application note along with some helper files. This set
of files can be freely modified and used to generate the appropriate self-signed
credentials. Generation of these credentials has been verified using both cygwin
and Linux.
Once the component files are created, the credentials must be loaded onto the
switch running the NETGEAR managed switch. This is accomplished using the
copy command from a tftp server.
1. From privileged EXEC mode, issue the following command:
where the IP address of the tftp server should be substituted as appropriate.
v1.0, February 2006
Application Note: Configuring and Enabling Management Security
2. Repeat the copy command for all the other authentication components:
•rsa2.keynvram:sshkey-rsa2
•dsa.keynvram:sshkey-dsa
•dh512.pemnvram:sslpem-dhweak
•dh1024.pemnvram:sslpem-dhstrong
•server.pemnvram:sslpem-server
•rootcert.pemnvram:sslpem-root
The SSL and SSH credentials may be uploaded separately as needed. However, it
is likely that if security is required for one access method it will be required for all
access methods. Therefore, best practice is to create the certificates and
authentication key simultaneously.
Configuring Secure Shell
Once the authentication credentials are loaded and the certificates and
authentication keys are formed, management security may be configured on the
NETGEAR managed switch device.
1. From privileged EXEC mode, issue the command
# ip ssh
as described in the Command Line Interface Reference manual. This will allow
secure shell sessions to be instantiated on the NETGEAR managed switch.
2. Check the message log to determine the success or failure of the command.
Messages indicating successful start of the ssh service look like this:
0 days 00:17:07 Unit: 1 : File: sshd_main.c : Line: 349 :
SSHD: Done generating server key
Application Note: Configuring and Enabling Management Security
0 days 00:17:06 Unit: 1 : File: sshd_main.c : Line: 592 :
SSHD: successfully opened file ssh_host_dsa_key
0 days 00:17:06 Unit: 1 : File: sshd_control.c : Line: 400 :
SSHD: sshdListenTask started
If a secure connection cannot be established, entries such as the following indicate
the nature of the problem.
0 days 02:30:30 File: ssh_sys_fastpath.c : Line: 584 : tid
40052584, context 0x0x157dba0, deleting 40052584, retval = 1
0 days 02:30:30 File: ssh_sys_fastpath.c : Line: 401 : SSHD:
exiting global context 0x0x157dba0
0 days 02:30:30 File: sshd_main.c : Line: 550 : SSHD: host key
is corrupt (did not decode).
In this case, the authentication credentials were invalid and should be regenerated.
Disabling Insecure Access
T o disable insecure access to the NETGEAR managed switch, issue the following
command:
# no telnet
Note: Caution should be exercised before issuing this command as once
the active telnet sessions are terminated, no new telnet sessions
will be allowed. Please consult the appropriate Command
Reference for more information on configuring remote sessions.
Configuring Secure Socket Layer
Optionally or in concert with SSH, SSL may be enabled. Once again the message
log is the best source of feedback for problem determination.
1. To enable SSL, issue the privileged EXEC mode command:
2. Attempt a secure web access using https. Consult the message log for to
Enabling Management Security2-3
# ip http secure-server
determine the success or failure status.
v1.0, February 2006
Application Note: Configuring and Enabling Management Security
Valid certificates are indicated by a message log entry that looks like the
following:
0 days 01:25:29 Unit: 1 : File: sslt_util.c : Line: 303 :
SSLT: Successfully loaded all required SSL PEM files
Certificate information may be accessed using browser-specific methods. With
Internet Explorer, the lock icon along the bottom message line can be checked for
certificate details. Additionally, when connecting to a NETGEAR managed
switch that uses self-generated credentials, Explorer will warn the user about the
authenticity of the certificate. When secure certificates are acquired from a third
party this warning will no longer occur.
Preventing Insecure Web Sessions
Insecure web sessions may be prevented by disabling the http server using the
privileged EXEC mode command:
# no ip http server
As with secure shell, the best guide for information on NETGEAR managed
switch commands that control HTTP and HTTPS access is the Command Line
Interface Reference manual.
2-4Enabling Management Security
v1.0, February 2006
SSH
Application Note: Configuring and Enabling Management Security
Appendix A
Certificate Generation Scripts
The following two scripts and two helper files can be used to generate self-signed
certificates and authentication keys.
sshKeygen.sh
#!/bin/sh
##################################################################
#
# Generate key files for rsa and dsa
#
##################################################################
Application Note: Configuring and Enabling Management Security
[ req_distinguished_name ]
countryName = US
stateOrProvinceName = California
localityName = Santa Clara
organizationName = NETGEAR, Inc.
organizationalUnitName = Support
commonName = localhost
emailAddress = support@netgear.com