Practical considerations for imaging and printing security
Page 1
... worms 6 Protect Information on the Network ...6 Network connectivity with HP Jetdirect devices 6 HP Digital Sending Software (DSS 7 Fax/LAN bridging ...7 Effectively Monitor and Manage...7 HP Web Jetadmin for fleet management 7 Device and service control ...7 Firmware updates ...7 Logging device activity ...8 Common Criteria Certification ...8 The future of imaging and printing security ...8 Document security and Digital Rights Management 8 Trusted...
... worms 6 Protect Information on the Network ...6 Network connectivity with HP Jetdirect devices 6 HP Digital Sending Software (DSS 7 Fax/LAN bridging ...7 Effectively Monitor and Manage...7 HP Web Jetadmin for fleet management 7 Device and service control ...7 Firmware updates ...7 Logging device activity ...8 Common Criteria Certification ...8 The future of imaging and printing security ...8 Document security and Digital Rights Management 8 Trusted...
HP Jetdirect Security Guidelines
Page 1
... Guidelines Table of Contents: Introduction ...1 HP Jetdirect Overview ...2 What is an HP Jetdirect?...3 How old is Your HP Jetdirect?...4 Upgrading ...5 HP Jetdirect Administrative Guidelines 6 HP Jetdirect Hacks: TCP Port 9100...7 HP Jetdirect Hacks: Password and SNMP Community Names 9 HP Jetdirect Hacks: Firmware Upgrade 9 HP Jetdirect Hacks: Sniffing Print Jobs and Replaying Them 10 HP Jetdirect Hacks: Printer/MFP access 10 Recommended Security Deployments: SET 1 11 Recommended Security Deployments: SET 2 12...
... Guidelines Table of Contents: Introduction ...1 HP Jetdirect Overview ...2 What is an HP Jetdirect?...3 How old is Your HP Jetdirect?...4 Upgrading ...5 HP Jetdirect Administrative Guidelines 6 HP Jetdirect Hacks: TCP Port 9100...7 HP Jetdirect Hacks: Password and SNMP Community Names 9 HP Jetdirect Hacks: Firmware Upgrade 9 HP Jetdirect Hacks: Sniffing Print Jobs and Replaying Them 10 HP Jetdirect Hacks: Printer/MFP access 10 Recommended Security Deployments: SET 1 11 Recommended Security Deployments: SET 2 12...
HP Jetdirect Security Guidelines
Page 2
At one of the first print servers to widely implement security protocols such as SSL/TLS, SNMPv3, 802.1X, and IPsec. At the other extreme, the worst security available is to never .../SPX were deployed widely and had their firmware updated or their configuration changed. While migrating to networking printers, the goal was directly connected to computers called spoolers. Protocol suites such as Ethernet. During this is a process. One of the challenges HP Jetdirect has in network printing, functionality within HP Jetdirect was designed to provide a rich customer...
At one of the first print servers to widely implement security protocols such as SSL/TLS, SNMPv3, 802.1X, and IPsec. At the other extreme, the worst security available is to never .../SPX were deployed widely and had their firmware updated or their configuration changed. While migrating to networking printers, the goal was directly connected to computers called spoolers. Protocol suites such as Ethernet. During this is a process. One of the challenges HP Jetdirect has in network printing, functionality within HP Jetdirect was designed to provide a rich customer...
HP Jetdirect Security Guidelines
Page 4
This utility allows you don't have to update the firmware on their servers today? 4 It would also be . As a point of HP Jetdirect devices, be rare to find HP Jetdirect devices and based upon their faith in a printing infrastructure that rather old but for desktops and servers. Keep in mind, you to spend time discussing the security issues associated...
This utility allows you don't have to update the firmware on their servers today? 4 It would also be . As a point of HP Jetdirect devices, be rare to find HP Jetdirect devices and based upon their faith in a printing infrastructure that rather old but for desktops and servers. Keep in mind, you to spend time discussing the security issues associated...
HP Jetdirect Security Guidelines
Page 5
..., not upgradeable to newer firmware after purchase Non-Cryptographic Security, not upgradeable to a newer model. HP Jetdirect J4100A 400n 10/100 MIO Print server J4106A 400n 10Mbps MIO Print server J3110A 600n 10Mbps EIO Print server J3111A 600n 10Mbps EIO Print server J3113A 600n 10/100 EIO Print server J4169A 610n 10/100 EIO Print Server J6057A 615n 10/100 EIO Print Server Security Features Non-Cryptographic...
..., not upgradeable to newer firmware after purchase Non-Cryptographic Security, not upgradeable to a newer model. HP Jetdirect J4100A 400n 10/100 MIO Print server J4106A 400n 10Mbps MIO Print server J3110A 600n 10Mbps EIO Print server J3111A 600n 10Mbps EIO Print server J3113A 600n 10/100 EIO Print server J4169A 610n 10/100 EIO Print Server J6057A 615n 10/100 EIO Print Server Security Features Non-Cryptographic...
HP Jetdirect Security Guidelines
Page 6
...capability. • SET 2: The 610n, 615n, 620n, 625n, en3700, and Embedded Jetdirect (J7949E) models. The Firewall can see, replacing a discontinued 400n MIO model with an EIO slot are still being sold today. HP Jetdirect Administrative Guidelines In the material that follows, this product, ...must "lock down" several things before upgrading all HP Jetdirect firmware to the highest level as SETs. • SET 1: The 170x, 300x, 500x, 510x, 400n, 600n models. Printers and MFPs with a new external parallel port print server like the LaserJet IIIsi and LaserJet 4si have the...
...capability. • SET 2: The 610n, 615n, 620n, 625n, en3700, and Embedded Jetdirect (J7949E) models. The Firewall can see, replacing a discontinued 400n MIO model with an EIO slot are still being sold today. HP Jetdirect Administrative Guidelines In the material that follows, this product, ...must "lock down" several things before upgrading all HP Jetdirect firmware to the highest level as SETs. • SET 1: The 170x, 300x, 500x, 510x, 400n, 600n models. Printers and MFPs with a new external parallel port print server like the LaserJet IIIsi and LaserJet 4si have the...
HP Jetdirect Security Guidelines
Page 7
... Table 4: HP Jetdirect Product Number J7949E Embedded Jetdirect J4100A 400n 10Mbps MIO Print server J4106A 400n 10Mbps MIO Print server J3110A 600n 10Mbps EIO Print server J3111A 600n 10Mbps EIO Print server J3113A 600n 10/100 EIO Print server J4169A 610n 10/100 EIO Print Server J6057A 615n 10/100 EIO Print Server J3263A/J3263G 300x External Print server J3265A 500X External 3-Port Print Server J7983G 510X External 3-Port Print Server J7942A/J7942G...
... Table 4: HP Jetdirect Product Number J7949E Embedded Jetdirect J4100A 400n 10Mbps MIO Print server J4106A 400n 10Mbps MIO Print server J3110A 600n 10Mbps EIO Print server J3111A 600n 10Mbps EIO Print server J3113A 600n 10/100 EIO Print server J4169A 610n 10/100 EIO Print Server J6057A 615n 10/100 EIO Print Server J3263A/J3263G 300x External Print server J3265A 500X External 3-Port Print Server J7983G 510X External 3-Port Print Server J7942A/J7942G...
HP Jetdirect Security Guidelines
Page 9
...of an upgrade programming failure (due to recover, albeit with TFTP server information. All HP Jetdirect firmware files follow the same basic format: a recovery partition and a ...print connection, they are trusted to SET 2, 3, or 4 support SNMPv3. After you have upgraded all software and firmware, change your HP Jetdirect devices behave the same regarding their source. Customers can populate the firmware upgrade MIB table with less functionality. At the end of updating HP Jetdirect firmware: • HP Download Manager / HP Web Jetadmin • FTP • Embedded Web Server...
...of an upgrade programming failure (due to recover, albeit with TFTP server information. All HP Jetdirect firmware files follow the same basic format: a recovery partition and a ...print connection, they are trusted to SET 2, 3, or 4 support SNMPv3. After you have upgraded all software and firmware, change your HP Jetdirect devices behave the same regarding their source. Customers can populate the firmware upgrade MIB table with less functionality. At the end of updating HP Jetdirect firmware: • HP Download Manager / HP Web Jetadmin • FTP • Embedded Web Server...
HP Jetdirect Security Guidelines
Page 10
... flavors of cryptographic protocols such as we have discussed HP Jetdirect security primarily. Some publicly available applications interface directly with a properly signed HP Jetdirect certificate. How the EWS is protected determines how the HP Jetdirect firmware upgrade capability is a fundamental step in a conference room...HP Jetdirect Hacks: Sniffing Print Jobs and Replaying Them Easily available network tools that was sent between an email client and email server, it can be configured to help protect against TCP/IP MITM attacks is described here: http://h20000.www2.hp...
... flavors of cryptographic protocols such as we have discussed HP Jetdirect security primarily. Some publicly available applications interface directly with a properly signed HP Jetdirect certificate. How the EWS is protected determines how the HP Jetdirect firmware upgrade capability is a fundamental step in a conference room...HP Jetdirect Hacks: Sniffing Print Jobs and Replaying Them Easily available network tools that was sent between an email client and email server, it can be configured to help protect against TCP/IP MITM attacks is described here: http://h20000.www2.hp...
HP Jetdirect Administrator's Guide
Page 8
.../SPX, AppleTalk (EtherTalk), LPR/LPD, Security. nnnnnnnn, if it appears, is an encoded value for HP support use those protocols, are listed in Table 1.2. For firmware updates, see Chapter 4), and network management applications. ENWW Introducing the HP Jetdirect Print Server 8 See Table 1.1. Supported Print Servers The features and capabilities of HP Jetdirect print servers depend on the print server's product model and its operating...
.../SPX, AppleTalk (EtherTalk), LPR/LPD, Security. nnnnnnnn, if it appears, is an encoded value for HP support use those protocols, are listed in Table 1.2. For firmware updates, see Chapter 4), and network management applications. ENWW Introducing the HP Jetdirect Print Server 8 See Table 1.1. Supported Print Servers The features and capabilities of HP Jetdirect print servers depend on the print server's product model and its operating...
HP Jetdirect Administrator's Guide
Page 12
.../net_printing is not supported. Firmware Upgrades Hewlett-Packard offers downloadable firmware upgrades for HP Jetdirect print servers that have factory-installed HP Jetdirect print servers). ● This manual, the HP Jetdirect Print Server Administrator's Guide for answers to a quick solution! ENWW Introducing the HP Jetdirect Print Server 12 A network cable must be used. The upgrades are supplied with your HP Jetdirect print server - 24 hours a day, 7 days a week. A firmware upgrade through a wireless connection...
.../net_printing is not supported. Firmware Upgrades Hewlett-Packard offers downloadable firmware upgrades for HP Jetdirect print servers that have factory-installed HP Jetdirect print servers). ● This manual, the HP Jetdirect Print Server Administrator's Guide for answers to a quick solution! ENWW Introducing the HP Jetdirect Print Server 12 A network cable must be used. The upgrades are supplied with your HP Jetdirect print server - 24 hours a day, 7 days a week. A firmware upgrade through a wireless connection...
HP Jetdirect Administrator's Guide
Page 13
Firmware upgrades for supported HP Jetdirect print servers may be installed over a network using your Web browser. HP Jetdirect Download Manager can be downloaded from HP online support at: http://www.hp.com/go /webjetadmin/ ● The embedded Web server resident on the print server provides a firmware upgrade feature using one of the following firmware installation tools: ● HP Jetdirect Download Manager (Windows). If a password is set...
Firmware upgrades for supported HP Jetdirect print servers may be installed over a network using your Web browser. HP Jetdirect Download Manager can be downloaded from HP online support at: http://www.hp.com/go /webjetadmin/ ● The embedded Web server resident on the print server provides a firmware upgrade feature using one of the following firmware installation tools: ● HP Jetdirect Download Manager (Windows). If a password is set...
HP Jetdirect Administrator's Guide
Page 16
..., and management of HP Jetdirect-connected print servers, non-HP printers that support the standard MIBs, and printers with Windows 2000, XP, Server 2003. Printing through the Internet to Internet Printing Protocol (IPP)-enabled HP Jetdirect-connected printers. ● Allows economical distribution of high-quality hardcopy documents over the Internet, replacing fax, mail, and overnight services ● Requires HP Jetdirect print server (firmware version x.20...
..., and management of HP Jetdirect-connected print servers, non-HP printers that support the standard MIBs, and printers with Windows 2000, XP, Server 2003. Printing through the Internet to Internet Printing Protocol (IPP)-enabled HP Jetdirect-connected printers. ● Allows economical distribution of high-quality hardcopy documents over the Internet, replacing fax, mail, and overnight services ● Requires HP Jetdirect print server (firmware version x.20...
HP Jetdirect Administrator's Guide
Page 48
...sec-wins-svr: ● pri-dns-svr: ● smtp-svr: TCP/IP Print Options ● 9100-printing: ● interlock: ● ftp-printing: ● buffer-packing: ● ipp-printing: ● write-mode: ● lpd-printing: ● mult-tcp-conn: ● banner: TCP/IP Raw Print Ports ● raw-port: TCP/IP Access Control ● allow: netnum [mask...: ● dhcp-arbitration: ● mdns-pri-svc: ● phone-home-config: ● web-refresh: ENWW TCP/IP Configuration 48 Table 3.2 lists supported TFTP commands (HP Jetdirect firmware version V.28.xx or later).
...sec-wins-svr: ● pri-dns-svr: ● smtp-svr: TCP/IP Print Options ● 9100-printing: ● interlock: ● ftp-printing: ● buffer-packing: ● ipp-printing: ● write-mode: ● lpd-printing: ● mult-tcp-conn: ● banner: TCP/IP Raw Print Ports ● raw-port: TCP/IP Access Control ● allow: netnum [mask...: ● dhcp-arbitration: ● mdns-pri-svc: ● phone-home-config: ● web-refresh: ENWW TCP/IP Configuration 48 Table 3.2 lists supported TFTP commands (HP Jetdirect firmware version V.28.xx or later).
HP Jetdirect Administrator's Guide
Page 59
...number of seconds (1 - 3600) that an idle scan connection is allowed to -email feature in -one or more Jetdirect print servers with your multifunction or all-in the Web Scan server. 0 disables, 1 (default) enables. Table 3.3 TFTP Configuration File Parameters (10 of 12) DLC/LLC dlc/...: Enables or disables the Web Scan feature on the print server: 0 disables, 1 (default) enables. MFP-config: Enable or disable print server support of the client software provided with the name and location of the firmware upgrade file. Selections are properly entered and that command parameters...
...number of seconds (1 - 3600) that an idle scan connection is allowed to -email feature in -one or more Jetdirect print servers with your multifunction or all-in the Web Scan server. 0 disables, 1 (default) enables. Table 3.3 TFTP Configuration File Parameters (10 of 12) DLC/LLC dlc/...: Enables or disables the Web Scan feature on the print server: 0 disables, 1 (default) enables. MFP-config: Enable or disable print server support of the client software provided with the name and location of the firmware upgrade file. Selections are properly entered and that command parameters...
HP Jetdirect Administrator's Guide
Page 90
.... In addition, firmware upgrades through current HP downloading utilities will disable all SNMP agents (SNMP v1, v2, v3) as well as communications with management applications, such as HP Web Jetadmin. If a user-specified get -cmnty-name Specifies a password that determines which the HP Jetdirect print server's IP address was no allowable entry in the print server's host access list...
.... In addition, firmware upgrades through current HP downloading utilities will disable all SNMP agents (SNMP v1, v2, v3) as well as communications with management applications, such as HP Web Jetadmin. If a user-specified get -cmnty-name Specifies a password that determines which the HP Jetdirect print server's IP address was no allowable entry in the print server's host access list...
HP Jetdirect Administrator's Guide
Page 93
...disables DLC/LLC protocol operation on the print server. 0 disables, 1 (default) enables. The print server will disable DLC/LLC operation. The command format is: upgrade: where, is the IP address of the TFTP server, specifies the firmware version of the upgrade file, specifies ...must be displayed. CAUTION: Ensure that command parameters are properly entered and that is awaiting data. READY: Indicates the HP Jetdirect print server is , provides strict interpretation). An additional status message may also be entered. strict-8022 Controls DLC/LLC protocol ...
...disables DLC/LLC protocol operation on the print server. 0 disables, 1 (default) enables. The print server will disable DLC/LLC operation. The command format is: upgrade: where, is the IP address of the TFTP server, specifies the firmware version of the upgrade file, specifies ...must be displayed. CAUTION: Ensure that command parameters are properly entered and that is awaiting data. READY: Indicates the HP Jetdirect print server is , provides strict interpretation). An additional status message may also be entered. strict-8022 Controls DLC/LLC protocol ...
HP Jetdirect Administrator's Guide
Page 101
... pages. ENWW 101 Tabs across the upper portion of the device and the HP Jetdirect print server firmware version: ● If the attached device can be accessed from a compatible Web browser over an intranet. 4 Using the Embedded Web Server Introduction HP Jetdirect print servers contain an embedded Web server that can serve up its own Web pages, then the available tabs...
... pages. ENWW 101 Tabs across the upper portion of the device and the HP Jetdirect print server firmware version: ● If the attached device can be accessed from a compatible Web browser over an intranet. 4 Using the Embedded Web Server Introduction HP Jetdirect print servers contain an embedded Web server that can serve up its own Web pages, then the available tabs...
HP Jetdirect Administrator's Guide
Page 108
...but can be configured through printer security Web pages. See TCP/IP on the HP Jetdirect print server. A text string (stored on the HP Jetdirect print server. The product number of the HP Jetdirect print server (for this device. A Locally Administered Address (LAA) that identifies the physical ...to the device and stored on the HP Jetdirect print server) that replaces the LAN Hardware (MAC) address. Table 4.1 HP Jetdirect Home Page Items (2 of 2) Item Host Name System Up Time System Contact System Location HP Jetdirect Firmware Version IP Address Hardware Address LAA ...
...but can be configured through printer security Web pages. See TCP/IP on the HP Jetdirect print server. A text string (stored on the HP Jetdirect print server. The product number of the HP Jetdirect print server (for this device. A Locally Administered Address (LAA) that identifies the physical ...to the device and stored on the HP Jetdirect print server) that replaces the LAN Hardware (MAC) address. Table 4.1 HP Jetdirect Home Page Items (2 of 2) Item Host Name System Up Time System Contact System Location HP Jetdirect Firmware Version IP Address Hardware Address LAA ...
HP Jetdirect Administrator's Guide
Page 191
...? ■ Refer to your printer manuals to replace the HP Jetdirect print server. Replace the print server. ■ Record all diagnostic and configuration pages with the faulty print server. 2. For internal Jetdirect cards, turn the printer back on. If it clears. ...printed a configuration page. 1. If the error message disappears when the print server is removed, it is likely that appear on the printer control panel display. ENWW Troubleshooting the HP Jetdirect Print Server 191 This information assumes you upgraded the Jetdirect firmware recently, power the print server...
...? ■ Refer to your printer manuals to replace the HP Jetdirect print server. Replace the print server. ■ Record all diagnostic and configuration pages with the faulty print server. 2. For internal Jetdirect cards, turn the printer back on. If it clears. ...printed a configuration page. 1. If the error message disappears when the print server is removed, it is likely that appear on the printer control panel display. ENWW Troubleshooting the HP Jetdirect Print Server 191 This information assumes you upgraded the Jetdirect firmware recently, power the print server...