Practical considerations for imaging and printing security
Page 1
... worms 6 Protect Information on the Network ...6 Network connectivity with HP Jetdirect devices 6 HP Digital Sending Software (DSS 7 Fax/LAN bridging ...7 Effectively Monitor and Manage...7 HP Web Jetadmin for fleet management 7 Device and service control ...7 Firmware updates ...7 Logging device activity ...8 Common Criteria Certification ...8 The future of imaging and printing security ...8 Document security and Digital Rights Management 8 Trusted...
... worms 6 Protect Information on the Network ...6 Network connectivity with HP Jetdirect devices 6 HP Digital Sending Software (DSS 7 Fax/LAN bridging ...7 Effectively Monitor and Manage...7 HP Web Jetadmin for fleet management 7 Device and service control ...7 Firmware updates ...7 Logging device activity ...8 Common Criteria Certification ...8 The future of imaging and printing security ...8 Document security and Digital Rights Management 8 Trusted...
Practical considerations for imaging and printing security
Page 7
... that circumvent job accounting controls. HP releases firmware updates based on enterprise networks. HP Digital Sending Software (DSS) HP Digital Sending Software 4.0 can encrypt scanned documents between the DSS Server and the remote server using IPsec. The DSS Server may be bridged to the digital... network. 7 Effectively Monitor and Manage Effectively Monitor and Manage allows for both HP and its final destination via email. Device and service control Imaging and printing devices support many network protocols and services. Effectively managing network resources is the...
... that circumvent job accounting controls. HP releases firmware updates based on enterprise networks. HP Digital Sending Software (DSS) HP Digital Sending Software 4.0 can encrypt scanned documents between the DSS Server and the remote server using IPsec. The DSS Server may be bridged to the digital... network. 7 Effectively Monitor and Manage Effectively Monitor and Manage allows for both HP and its final destination via email. Device and service control Imaging and printing devices support many network protocols and services. Effectively managing network resources is the...
Practical considerations for imaging and printing security
Page 9
HP provides automated firmware update notification services, and HP Web Jetadmin aids in audit and regulatory compliance. 3. In some cases, these capabilities may be used as a starting point for enabling that face imaging and printing devices. IPsec secures existing printing and... maintaining a secure environment. Fleet/batch manage using HP Web Jetadmin HP Web Jetadmin provides consistent management of policy enforcement and assists in deploying updates across enterprise environments. 4. Update firmware images Firmware updates protect against actual needs. 2. Assess Common ...
HP provides automated firmware update notification services, and HP Web Jetadmin aids in audit and regulatory compliance. 3. In some cases, these capabilities may be used as a starting point for enabling that face imaging and printing devices. IPsec secures existing printing and... maintaining a secure environment. Fleet/batch manage using HP Web Jetadmin HP Web Jetadmin provides consistent management of policy enforcement and assists in deploying updates across enterprise environments. 4. Update firmware images Firmware updates protect against actual needs. 2. Assess Common ...
HP Jetdirect Security Guidelines
Page 1
... of this information can be addressed. whitepaper HP Jetdirect Security Guidelines Table of Contents: Introduction ...1 HP Jetdirect Overview ...2 What is an HP Jetdirect?...3 How old is Your HP Jetdirect?...4 Upgrading ...5 HP Jetdirect Administrative Guidelines 6 HP Jetdirect Hacks: TCP Port 9100...7 HP Jetdirect Hacks: Password and SNMP Community Names 9 HP Jetdirect Hacks: Firmware Upgrade 9 HP Jetdirect Hacks: Sniffing Print Jobs and Replaying Them 10 HP Jetdirect Hacks: Printer/MFP access 10 Recommended Security...
... of this information can be addressed. whitepaper HP Jetdirect Security Guidelines Table of Contents: Introduction ...1 HP Jetdirect Overview ...2 What is an HP Jetdirect?...3 How old is Your HP Jetdirect?...4 Upgrading ...5 HP Jetdirect Administrative Guidelines 6 HP Jetdirect Hacks: TCP Port 9100...7 HP Jetdirect Hacks: Password and SNMP Community Names 9 HP Jetdirect Hacks: Firmware Upgrade 9 HP Jetdirect Hacks: Sniffing Print Jobs and Replaying Them 10 HP Jetdirect Hacks: Printer/MFP access 10 Recommended Security...
HP Jetdirect Security Guidelines
Page 2
...plug-n-play" on the network. Popular HP tools, such as well-known default security settings. During this is not a sound practice for maintaining the proper operation of an infrastructure, regardless of the type of the first print servers to widely implement security protocols such as ...of transporting frames had as much as a directly connected printer. In short, HP Jetdirect was to have never had their firmware updated or their configuration changed. The incredible print quality of the HP LaserJet printers compared to other ways of use as Ethernet. Protocol suites such as...
...plug-n-play" on the network. Popular HP tools, such as well-known default security settings. During this is not a sound practice for maintaining the proper operation of an infrastructure, regardless of the type of the first print servers to widely implement security protocols such as ...of transporting frames had as much as a directly connected printer. In short, HP Jetdirect was to have never had their firmware updated or their configuration changed. The incredible print quality of the HP LaserJet printers compared to other ways of use as Ethernet. Protocol suites such as...
HP Jetdirect Security Guidelines
Page 4
... 3.11 HP Jetdirect J2550A, J2552A MIO Print Servers Microsoft Windows 95 HP Jetdirect J2550B, J2552B MIO Print Servers HP Jetdirect J3110A, J3111A EIO Print Servers HP Jetdirect J3263A 300X External Print Server HP Jetdirect J3113A 600n EIO Print Server Microsoft Windows 98 HP Jetdirect J3258A 170x External Print Server Microsoft Windows 2000 Professional HP Jetdirect J4169A 610n EIO Print Server Microsoft Windows XP HP Jetdirect J6057A 615n EIO Print Server Microsoft Windows 2003 Server HP Jetdirect J7934A 620n EIO Print Server HP Jetdirect J7961A 635n EIO Print Server Date Released...
... 3.11 HP Jetdirect J2550A, J2552A MIO Print Servers Microsoft Windows 95 HP Jetdirect J2550B, J2552B MIO Print Servers HP Jetdirect J3110A, J3111A EIO Print Servers HP Jetdirect J3263A 300X External Print Server HP Jetdirect J3113A 600n EIO Print Server Microsoft Windows 98 HP Jetdirect J3258A 170x External Print Server Microsoft Windows 2000 Professional HP Jetdirect J4169A 610n EIO Print Server Microsoft Windows XP HP Jetdirect J6057A 615n EIO Print Server Microsoft Windows 2003 Server HP Jetdirect J7934A 620n EIO Print Server HP Jetdirect J7961A 635n EIO Print Server Date Released...
HP Jetdirect Security Guidelines
Page 5
... to newer firmware after purchase Non-Cryptographic Security, upgradeable after purchase Non-Cryptographic Security, upgradeable after purchase SSL/TLS for Management, SNMPv3 SSL/TLS for Management, SNMPv3, 802.1X PEAP, 802.1X EAP-TLS. Firewall, SSL/TLS for Management, SNMPv3 Table 3 - HP Jetdirect J4100A 400n 10/100 MIO Print server J4106A 400n 10Mbps MIO Print server J3110A...
... to newer firmware after purchase Non-Cryptographic Security, upgradeable after purchase Non-Cryptographic Security, upgradeable after purchase SSL/TLS for Management, SNMPv3 SSL/TLS for Management, SNMPv3, 802.1X PEAP, 802.1X EAP-TLS. Firewall, SSL/TLS for Management, SNMPv3 Table 3 - HP Jetdirect J4100A 400n 10/100 MIO Print server J4106A 400n 10Mbps MIO Print server J3110A...
HP Jetdirect Security Guidelines
Page 6
... for HP Jetdirect, four different administrative guidelines will need to install a J7961G 635n IPv6/IPsec print server. Before using the techniques presented here, the administrator at http://www.hp.com/go/dlm_sw. This flexibility will come from the four main HP Jetdirect product ... 610n, 615n, 620n, 625n, en3700, and Embedded Jetdirect (J7949E) models. With security configurations, one must "lock down" several things before upgrading all HP Jetdirect firmware to counteract those devices on your windows open. One of those attacks. HP recommends always upgrading only a...
... for HP Jetdirect, four different administrative guidelines will need to install a J7961G 635n IPv6/IPsec print server. Before using the techniques presented here, the administrator at http://www.hp.com/go/dlm_sw. This flexibility will come from the four main HP Jetdirect product ... 610n, 615n, 620n, 625n, en3700, and Embedded Jetdirect (J7949E) models. With security configurations, one must "lock down" several things before upgrading all HP Jetdirect firmware to counteract those devices on your windows open. One of those attacks. HP recommends always upgrading only a...
HP Jetdirect Security Guidelines
Page 7
... Table 4: HP Jetdirect Product Number J7949E Embedded Jetdirect J4100A 400n 10Mbps MIO Print server J4106A 400n 10Mbps MIO Print server J3110A 600n 10Mbps EIO Print server J3111A 600n 10Mbps EIO Print server J3113A 600n 10/100 EIO Print server J4169A 610n 10/100 EIO Print Server J6057A 615n 10/100 EIO Print Server J3263A/J3263G 300x External Print server J3265A 500X External 3-Port Print Server J7983G 510X External 3-Port Print Server J7942A/J7942G...
... Table 4: HP Jetdirect Product Number J7949E Embedded Jetdirect J4100A 400n 10Mbps MIO Print server J4106A 400n 10Mbps MIO Print server J3110A 600n 10Mbps EIO Print server J3111A 600n 10Mbps EIO Print server J3113A 600n 10/100 EIO Print server J4169A 610n 10/100 EIO Print Server J6057A 615n 10/100 EIO Print Server J3263A/J3263G 300x External Print server J3265A 500X External 3-Port Print Server J7983G 510X External 3-Port Print Server J7942A/J7942G...
HP Jetdirect Security Guidelines
Page 9
... upgraded all software and firmware, change your HP Jetdirect devices behave the same regarding their password handling. There are trusted to print. they are trusted to establish a print connection, they are three common ways of updating HP Jetdirect firmware: • HP Download Manager / HP Web Jetadmin • FTP • Embedded Web Server When using HP Download Manager or HP Web Jetadmin, the application...
... upgraded all software and firmware, change your HP Jetdirect devices behave the same regarding their password handling. There are trusted to print. they are trusted to establish a print connection, they are three common ways of updating HP Jetdirect firmware: • HP Download Manager / HP Web Jetadmin • FTP • Embedded Web Server When using HP Download Manager or HP Web Jetadmin, the application...
HP Jetdirect Security Guidelines
Page 10
... of cryptographic protocols such as with PostScript or simple text, a print job can use the EWS to help protect against the TCP/IP protocol suite does. However, as we have discussed HP Jetdirect security primarily. Let's review what a MITM attack against unauthorized connections...an FTP client and an FTP server, it can "open it can be configured to upgrade HP Jetdirect devices is protected. How the EWS is protected determines how the HP Jetdirect firmware upgrade capability is described here: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=...
... of cryptographic protocols such as with PostScript or simple text, a print job can use the EWS to help protect against the TCP/IP protocol suite does. However, as we have discussed HP Jetdirect security primarily. Let's review what a MITM attack against unauthorized connections...an FTP client and an FTP server, it can "open it can be configured to upgrade HP Jetdirect devices is protected. How the EWS is protected determines how the HP Jetdirect firmware upgrade capability is described here: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=...
HP Jetdirect Security Guidelines
Page 14
Change the Encryption Strength to be used for all web communication. Uncheck "Enable Telnet and FTP Firmware Update" and "Enable RCFG". 14 This checkbox forces HTTPS to "Medium" and check the "Encrypt All Web Communication " checkbox.
Change the Encryption Strength to be used for all web communication. Uncheck "Enable Telnet and FTP Firmware Update" and "Enable RCFG". 14 This checkbox forces HTTPS to "Medium" and check the "Encrypt All Web Communication " checkbox.
HP Jetdirect Administrator's Guide
Page 8
... connection to your network has been established. Supported Print Servers The features and capabilities of HP Jetdirect print servers depend on the print server's product model and its operating firmware version. The installed firmware version can be identified using various methods, including the HP Jetdirect configuration page (see Chapter 9), Telnet (see Chapter 3), embedded Web server (see "Firmware Upgrades". Table 1.1 Supported Products Model Product Printer...
... connection to your network has been established. Supported Print Servers The features and capabilities of HP Jetdirect print servers depend on the print server's product model and its operating firmware version. The installed firmware version can be identified using various methods, including the HP Jetdirect configuration page (see Chapter 9), Telnet (see Chapter 3), embedded Web server (see "Firmware Upgrades". Table 1.1 Supported Products Model Product Printer...
HP Jetdirect Administrator's Guide
Page 12
...-Packard offers downloadable firmware upgrades for HP Jetdirect print servers that have factory-installed HP Jetdirect print servers). ● This manual, the HP Jetdirect Print Server Administrator's Guide for answers to a quick solution! The HP Web site: http://www.hp.com/support/net_printing is not supported. A firmware upgrade through a wireless connection is a great place to start for the applicable Jetdirect product models. ● HP Jetdirect Setup guides, supplied on...
...-Packard offers downloadable firmware upgrades for HP Jetdirect print servers that have factory-installed HP Jetdirect print servers). ● This manual, the HP Jetdirect Print Server Administrator's Guide for answers to a quick solution! The HP Web site: http://www.hp.com/support/net_printing is not supported. A firmware upgrade through a wireless connection is a great place to start for the applicable Jetdirect product models. ● HP Jetdirect Setup guides, supplied on...
HP Jetdirect Administrator's Guide
Page 13
...systems. For more information on the print server provides a firmware upgrade feature using one of the following firmware installation tools: ● HP Jetdirect Download Manager (Windows). If a ...HP Jetdirect Print Server 13 HP Jetdirect Download Manager can be downloaded from HP online support at: http://www.hp.com/go /webjetadmin/ ● The embedded Web server resident on HP Web Jetadmin, visit: http://www.hp.com/go /dlm_sw ● HP Web Jetadmin may be used to transfer a firmware upgrade image file to the print server. Firmware upgrades for supported HP Jetdirect print servers...
...systems. For more information on the print server provides a firmware upgrade feature using one of the following firmware installation tools: ● HP Jetdirect Download Manager (Windows). If a ...HP Jetdirect Print Server 13 HP Jetdirect Download Manager can be downloaded from HP online support at: http://www.hp.com/go /webjetadmin/ ● The embedded Web server resident on HP Web Jetadmin, visit: http://www.hp.com/go /dlm_sw ● HP Web Jetadmin may be used to transfer a firmware upgrade image file to the print server. Firmware upgrades for supported HP Jetdirect print servers...
HP Jetdirect Administrator's Guide
Page 16
...-quality hardcopy documents over the Internet, replacing fax, mail, and overnight services ● Requires HP Jetdirect print server (firmware version x.20.00 or later) ● IPP is also integrated with embedded Web servers. Printing through the Internet to Internet Printing Protocol (IPP)-enabled HP Jetdirect-connected printers. ● Allows economical distribution of multiple printers anywhere on value-based products, such...
...-quality hardcopy documents over the Internet, replacing fax, mail, and overnight services ● Requires HP Jetdirect print server (firmware version x.20.00 or later) ● IPP is also integrated with embedded Web servers. Printing through the Internet to Internet Printing Protocol (IPP)-enabled HP Jetdirect-connected printers. ● Allows economical distribution of multiple printers anywhere on value-based products, such...
HP Jetdirect Administrator's Guide
Page 48
...-wins-svr: ● pri-dns-svr: ● smtp-svr: TCP/IP Print Options ● 9100-printing: ● interlock: ● ftp-printing: ● buffer-packing: ● ipp-printing: ● write-mode: ● lpd-printing: ● mult-tcp-conn: ● banner: TCP/IP Raw Print Ports ● raw-port: TCP/IP Access Control ● allow: netnum [mask...mdns-pri-svc: ● phone-home-config: ● web-refresh: ENWW TCP/IP Configuration 48 Table 3.3 describes the TFTP parameters. Table 3.2 lists supported TFTP commands (HP Jetdirect firmware version V.28.xx or later).
...-wins-svr: ● pri-dns-svr: ● smtp-svr: TCP/IP Print Options ● 9100-printing: ● interlock: ● ftp-printing: ● buffer-packing: ● ipp-printing: ● write-mode: ● lpd-printing: ● mult-tcp-conn: ● banner: TCP/IP Raw Print Ports ● raw-port: TCP/IP Access Control ● allow: netnum [mask...mdns-pri-svc: ● phone-home-config: ● web-refresh: ENWW TCP/IP Configuration 48 Table 3.3 describes the TFTP parameters. Table 3.2 lists supported TFTP commands (HP Jetdirect firmware version V.28.xx or later).
HP Jetdirect Administrator's Guide
Page 56
... IP address 192.0.0.192. dhcp-arbitration: Specifies the amount of time, in seconds, that the print server will be disabled. phone-home-config: Specifies privacy settings on the print server during a forced TCP/IP reconfiguration (for example, when powered off/on or manually configured to 10... may be sent to the Networking tab of data to HP without prompting the user. For HP to collect data, Internet access is disabled. In addition, firmware upgrades through current HP...
... IP address 192.0.0.192. dhcp-arbitration: Specifies the amount of time, in seconds, that the print server will be disabled. phone-home-config: Specifies privacy settings on the print server during a forced TCP/IP reconfiguration (for example, when powered off/on or manually configured to 10... may be sent to the Networking tab of data to HP without prompting the user. For HP to collect data, Internet access is disabled. In addition, firmware upgrades through current HP...
HP Jetdirect Administrator's Guide
Page 59
... and filename of the firmware upgrade file. webscan-config: Enables or disables the Web Scan feature on the print server: 0 disables, 1 (default) enables. Other Settings link-type: (10/100 Fast Ethernet) Sets the print server's link speed (10 or 100 Mbps) and communication mode (Full- upgrade: To configure one or more Jetdirect print servers with your multifunction or...
... and filename of the firmware upgrade file. webscan-config: Enables or disables the Web Scan feature on the print server: 0 disables, 1 (default) enables. Other Settings link-type: (10/100 Fast Ethernet) Sets the print server's link speed (10 or 100 Mbps) and communication mode (Full- upgrade: To configure one or more Jetdirect print servers with your multifunction or...
HP Jetdirect Administrator's Guide
Page 90
...data on product use may be re-selected. 1: Allows the sending of the system from which SNMP GetRequests the HP Jetdirect print server will respond to HP without prompting the user. 0: Disables sending data to either a user-specified community name or the factory-default. DHCP... disables SNMP operation on the print server during embedded Web server access. The community name must be disabled. Once changed, this value cannot be sent to the Networking tab of the embedded Web server. In addition, firmware upgrades through current HP downloading utilities will disable all...
...data on product use may be re-selected. 1: Allows the sending of the system from which SNMP GetRequests the HP Jetdirect print server will respond to HP without prompting the user. 0: Disables sending data to either a user-specified community name or the factory-default. DHCP... disables SNMP operation on the print server during embedded Web server access. The community name must be disabled. Once changed, this value cannot be sent to the Networking tab of the embedded Web server. In addition, firmware upgrades through current HP downloading utilities will disable all...