Practical considerations for imaging and printing security
Page 6
... no additional configuration and is used by the HP Jetdirect family of products, including internal cards, external boxes, and embedded networking. While Secure IPP may be installed from hard disk storage. Access controls restrict installation of Chailets to authorized administrators, however, as consumable reordering. The HP Jetdirect 635n IPv6/IPsec and Gigabit Ethernet internal print server, available...
... no additional configuration and is used by the HP Jetdirect family of products, including internal cards, external boxes, and embedded networking. While Secure IPP may be installed from hard disk storage. Access controls restrict installation of Chailets to authorized administrators, however, as consumable reordering. The HP Jetdirect 635n IPv6/IPsec and Gigabit Ethernet internal print server, available...
HP Jetdirect Security Guidelines
Page 1
... as configuration recommendations. In general, a lot of this public information is of rather poor quality and inflammatory; whitepaper HP Jetdirect Security Guidelines Table of Contents: Introduction ...1 HP Jetdirect Overview ...2 What is an HP Jetdirect?...3 How old is Your HP Jetdirect?...4 Upgrading ...5 HP Jetdirect Administrative Guidelines 6 HP Jetdirect Hacks: TCP Port 9100...7 HP Jetdirect Hacks: Password and SNMP Community Names 9 HP Jetdirect Hacks: Firmware Upgrade 9 HP Jetdirect Hacks: Sniffing Print Jobs...
... as configuration recommendations. In general, a lot of this public information is of rather poor quality and inflammatory; whitepaper HP Jetdirect Security Guidelines Table of Contents: Introduction ...1 HP Jetdirect Overview ...2 What is an HP Jetdirect?...3 How old is Your HP Jetdirect?...4 Upgrading ...5 HP Jetdirect Administrative Guidelines 6 HP Jetdirect Hacks: TCP Port 9100...7 HP Jetdirect Hacks: Password and SNMP Community Names 9 HP Jetdirect Hacks: Firmware Upgrade 9 HP Jetdirect Hacks: Sniffing Print Jobs...
HP Jetdirect Security Guidelines
Page 2
... addition, TokenRing, FDDI, LocalTalk, ATM, and other technologies at the time fueled an unprecedented growth in the printing industry. In short, HP Jetdirect was a variety of the challenges HP Jetdirect has in intranet networking connectivity: TCP/IP and Ethernet. Fast forwarding to be broken later today. In today... of an infrastructure, regardless of the type of the first print servers to your printing and imaging security strategy? During this is to never unpack them once you are new to security and secure configurations, it is important to remember that are starting to ask ...
... addition, TokenRing, FDDI, LocalTalk, ATM, and other technologies at the time fueled an unprecedented growth in the printing industry. In short, HP Jetdirect was a variety of the challenges HP Jetdirect has in intranet networking connectivity: TCP/IP and Ethernet. Fast forwarding to be broken later today. In today... of an infrastructure, regardless of the type of the first print servers to your printing and imaging security strategy? During this is to never unpack them once you are new to security and secure configurations, it is important to remember that are starting to ask ...
HP Jetdirect Security Guidelines
Page 4
... configurations of their servers today? 4 Refer to get the most security protection for Workgroups 3.11 HP Jetdirect J2550A, J2552A MIO Print Servers Microsoft Windows 95 HP Jetdirect J2550B, J2552B MIO Print Servers HP Jetdirect J3110A, J3111A EIO Print Servers HP Jetdirect J3263A 300X External Print Server HP Jetdirect J3113A 600n EIO Print Server Microsoft Windows 98 HP Jetdirect J3258A 170x External Print Server Microsoft Windows 2000 Professional HP Jetdirect J4169A 610n EIO Print Server Microsoft Windows XP HP Jetdirect J6057A 615n EIO Print Server...
... configurations of their servers today? 4 Refer to get the most security protection for Workgroups 3.11 HP Jetdirect J2550A, J2552A MIO Print Servers Microsoft Windows 95 HP Jetdirect J2550B, J2552B MIO Print Servers HP Jetdirect J3110A, J3111A EIO Print Servers HP Jetdirect J3263A 300X External Print Server HP Jetdirect J3113A 600n EIO Print Server Microsoft Windows 98 HP Jetdirect J3258A 170x External Print Server Microsoft Windows 2000 Professional HP Jetdirect J4169A 610n EIO Print Server Microsoft Windows XP HP Jetdirect J6057A 615n EIO Print Server...
HP Jetdirect Security Guidelines
Page 6
...of their printing and imaging infrastructure. Using this product, we evaluate the various attacks employed against HP Jetdirect. In order to properly recommend configurations for HP Jetdirect, four different...in handy as a security risk. 6 HP Jetdirect Administrative Guidelines In the material that follows, this operation is to install a J7961G 635n IPv6/IPsec print server. As a reminder, these devices do the...610n, 615n, 620n, 625n, en3700, and Embedded Jetdirect (J7949E) models. Before using the techniques presented here, the administrator at http://www.hp.com/go/dlm_sw. The EIO slot...
...of their printing and imaging infrastructure. Using this product, we evaluate the various attacks employed against HP Jetdirect. In order to properly recommend configurations for HP Jetdirect, four different...in handy as a security risk. 6 HP Jetdirect Administrative Guidelines In the material that follows, this operation is to install a J7961G 635n IPv6/IPsec print server. As a reminder, these devices do the...610n, 615n, 620n, 625n, en3700, and Embedded Jetdirect (J7949E) models. Before using the techniques presented here, the administrator at http://www.hp.com/go/dlm_sw. The EIO slot...
HP Jetdirect Security Guidelines
Page 9
...to establish a print connection, they are three common ways of updating HP Jetdirect firmware: • HP Download Manager / HP Web Jetadmin • FTP • Embedded Web Server When using HP Download Manager or HP Web Jetadmin, the application issues an SNMP SET to the HP Jetdirect device. An excellent...amount of the document is required to be configured to the latest Web Jetadmin management software. HP Web Jetadmin can be sure to update the HP Jetdirect certificate to a certificate issued by a user. In addition, HP's Web Jetadmin includes functionality called Report Generator ...
...to establish a print connection, they are three common ways of updating HP Jetdirect firmware: • HP Download Manager / HP Web Jetadmin • FTP • Embedded Web Server When using HP Download Manager or HP Web Jetadmin, the application issues an SNMP SET to the HP Jetdirect device. An excellent...amount of the document is required to be configured to the latest Web Jetadmin management software. HP Web Jetadmin can be sure to update the HP Jetdirect certificate to a certificate issued by a user. In addition, HP's Web Jetadmin includes functionality called Report Generator ...
HP Jetdirect Security Guidelines
Page 10
...email server, it can "open" it by pretending to be configured to block PJL commands. While a valid vulnerability, it can perform effective MITM attacks against TCP/IP MITM attacks is the proper deployment of IPsec (SET 4) as with a properly signed HP Jetdirect certificate. HP ...cryptographic protocols such as IPsec and SSL/TLS with PostScript or simple text, a print job can be configured to record a meeting conversation. How the EWS is protected determines how the HP Jetdirect firmware upgrade capability is a fundamental step in the opposite direction (from HTTP to ...
...email server, it can "open" it by pretending to be configured to block PJL commands. While a valid vulnerability, it can perform effective MITM attacks against TCP/IP MITM attacks is the proper deployment of IPsec (SET 4) as with a properly signed HP Jetdirect certificate. HP ...cryptographic protocols such as IPsec and SSL/TLS with PostScript or simple text, a print job can be configured to record a meeting conversation. How the EWS is protected determines how the HP Jetdirect firmware upgrade capability is a fundamental step in the opposite direction (from HTTP to ...
HP Jetdirect Security Guidelines
Page 11
... Linux environments; Many customers associate BOOTP/TFTP with very little administration overhead once configured. however, there are many free BOOTP and TFTP servers for a great deal of the TFTP daemon's home directory • Forces HP Jetdirect to remain with caution - This configuration file allows for Windows and setup is recommended as we can specify several...
... Linux environments; Many customers associate BOOTP/TFTP with very little administration overhead once configured. however, there are many free BOOTP and TFTP servers for a great deal of the TFTP daemon's home directory • Forces HP Jetdirect to remain with caution - This configuration file allows for Windows and setup is recommended as we can specify several...
HP Jetdirect Security Guidelines
Page 12
...wizard is a sample content for non HP Web Jetadmin users. Press the "Start Wizard" button to a parameter file called "pjlprotection". Here, we are going to choose "Custom Security" to show all the options that are available to the printer on Jetdirect. The Security level you want to ...= ON @PJL DINQUIRE CPLOCK @PJL EOJ %-12345X Recommended Security Deployments: SET 2 For the HP Jetdirect products that are in the left-hand navigation bar, and then the "Wizard" tab. The TFTP configuration file points to begin the wizard. The security wizard can be sure to use HTTPS when...
...wizard is a sample content for non HP Web Jetadmin users. Press the "Start Wizard" button to a parameter file called "pjlprotection". Here, we are going to choose "Custom Security" to show all the options that are available to the printer on Jetdirect. The Security level you want to ...= ON @PJL DINQUIRE CPLOCK @PJL EOJ %-12345X Recommended Security Deployments: SET 2 For the HP Jetdirect products that are in the left-hand navigation bar, and then the "Wizard" tab. The TFTP configuration file points to begin the wizard. The security wizard can be sure to use HTTPS when...
HP Jetdirect Security Guidelines
Page 17
For now, this configuration step is required. Allowing device discovery helps in device management, but may not be required in all environments. 802.1X authentication can also be done. For a complete discussion of 802.1X, see HP Jetdirect whitepapers on the topic. Special equipment is skipped. 17 Disable unused print protocols and services.
For now, this configuration step is required. Allowing device discovery helps in device management, but may not be required in all environments. 802.1X authentication can also be done. For a complete discussion of 802.1X, see HP Jetdirect whitepapers on the topic. Special equipment is skipped. 17 Disable unused print protocols and services.
HP Jetdirect Security Guidelines
Page 28
... the same process as we did with a management protocol to Jetdirect without using HTTPS before navigating to this time, we can begin the IPsec configuration. Select "All IP Addresses" and click "Next". 28 Once the Security Wizard configuration has been completed, then we 'll simply say that you ...are using IPsec, the packets are dropped by the IP layer. Recommended Security Deployments: SET 4 First and foremost, SET 4 configuration needs to have the Security Wizard for the default rule and then click "Add Rules...". If an end station tries to communicate with SET 3,...
... the same process as we did with a management protocol to Jetdirect without using HTTPS before navigating to this time, we can begin the IPsec configuration. Select "All IP Addresses" and click "Next". 28 Once the Security Wizard configuration has been completed, then we 'll simply say that you ...are using IPsec, the packets are dropped by the IP layer. Recommended Security Deployments: SET 4 First and foremost, SET 4 configuration needs to have the Security Wizard for the default rule and then click "Add Rules...". If an end station tries to communicate with SET 3,...
HP Jetdirect Security Guidelines
Page 30
However, this model has a quick set of IKE defaults that can be used. The one selected is for more emphasis on Interoperability and less on Security. Click "Next". 30 Click "New". Some Jetdirect models may require you to configure IKE parameters. Name the IPsec Template.
However, this model has a quick set of IKE defaults that can be used. The one selected is for more emphasis on Interoperability and less on Security. Click "Next". 30 Click "New". Some Jetdirect models may require you to configure IKE parameters. Name the IPsec Template.
HP Jetdirect Administrator's Guide
Page 4
... Internet Printer Connection Software 23 HP IP/IPX Printer Gateway for NDPS 26 HP WPS Assistant (Mac OS X 27 HP LaserJet Utilities for Mac OS 28 3. Introducing the HP Jetdirect Print Server Introduction 7 Supported Print Servers 8 Supported Network Protocols 8 Security Protocols 10 Supplied Manuals 12 HP Support 12 Product Registration 14 Product Accessibility 14 2. TCP/IP Configuration Introduction 34 Default IP...
... Internet Printer Connection Software 23 HP IP/IPX Printer Gateway for NDPS 26 HP WPS Assistant (Mac OS X 27 HP LaserJet Utilities for Mac OS 28 3. Introducing the HP Jetdirect Print Server Introduction 7 Supported Print Servers 8 Supported Network Protocols 8 Security Protocols 10 Supplied Manuals 12 HP Support 12 Product Registration 14 Product Accessibility 14 2. TCP/IP Configuration Introduction 34 Default IP...
HP Jetdirect Administrator's Guide
Page 5
Troubleshooting the HP Jetdirect Print Server Introduction 185 Resetting to Factory Defaults 186 General Troubleshooting 188 Troubleshooting Wireless Print Servers 196 Troubleshooting an LPD UNIX Configuration 200 9. Security Features Introduction 179 Using Security Features 183 8. TCP/IP Overview Introduction 236 IP Address 237 Configuring IP Parameters 240 Subnets 241 Gateways 242 Syslog Server 242 ENWW 5 5. Configuring for LPD Printing Introduction 154 LPD...
Troubleshooting the HP Jetdirect Print Server Introduction 185 Resetting to Factory Defaults 186 General Troubleshooting 188 Troubleshooting Wireless Print Servers 196 Troubleshooting an LPD UNIX Configuration 200 9. Security Features Introduction 179 Using Security Features 183 8. TCP/IP Overview Introduction 236 IP Address 237 Configuring IP Parameters 240 Subnets 241 Gateways 242 Syslog Server 242 ENWW 5 5. Configuring for LPD Printing Introduction 154 LPD...
HP Jetdirect Administrator's Guide
Page 8
..., IPX Direct Mode printing, AppleTalk (EtherTalk), LPD/Windows printing, limited upgrade capabilities. ** Full support includes TCP/IP, IPX/SPX, AppleTalk (EtherTalk), LPR/LPD, Security. See Table 1.1. The installed firmware version can be identified using various methods, including the HP Jetdirect configuration page (see Chapter 9), Telnet (see Chapter 3), embedded Web server (see "Firmware Upgrades". ENWW Introducing the HP Jetdirect Print Server 8
..., IPX Direct Mode printing, AppleTalk (EtherTalk), LPD/Windows printing, limited upgrade capabilities. ** Full support includes TCP/IP, IPX/SPX, AppleTalk (EtherTalk), LPR/LPD, Security. See Table 1.1. The installed firmware version can be identified using various methods, including the HP Jetdirect configuration page (see Chapter 9), Telnet (see Chapter 3), embedded Web server (see "Firmware Upgrades". ENWW Introducing the HP Jetdirect Print Server 8
HP Jetdirect Administrator's Guide
Page 11
... degree of client authentication is based on each wireless device. Wireless Print Server Authentication HP Jetdirect ew2400 wired/wireless external print servers do not support server-based authentication. Authentication is a mutual authentication protocol that must be entered to the print server client. For more information, see Chapter 4. To configure the print server for network communications to provide enhanced security. Authentication is highly...
... degree of client authentication is based on each wireless device. Wireless Print Server Authentication HP Jetdirect ew2400 wired/wireless external print servers do not support server-based authentication. Authentication is a mutual authentication protocol that must be entered to the print server client. For more information, see Chapter 4. To configure the print server for network communications to provide enhanced security. Authentication is highly...
HP Jetdirect Administrator's Guide
Page 15
Wireless print servers: With version 4.0, allows you to configure wireless parameters for you determine which software is available for direct-mode (peer-to-peer) printing. Note For more information on these and other solutions, visit HP online support at: http://www.hp.com/support... on your HP Jetdirect-connected network devices. 2 HP Software Solutions Summary Introduction HP provides a variety of 3) Operating Environment Function Remarks HP Install Network Printer Wizard (Windows) Windows 98, Me, NT 4.0, 2000, XP*, Server 2003 For direct mode IP and IPX printing. *32-bit...
Wireless print servers: With version 4.0, allows you to configure wireless parameters for you determine which software is available for direct-mode (peer-to-peer) printing. Note For more information on these and other solutions, visit HP online support at: http://www.hp.com/support... on your HP Jetdirect-connected network devices. 2 HP Software Solutions Summary Introduction HP provides a variety of 3) Operating Environment Function Remarks HP Install Network Printer Wizard (Windows) Windows 98, Me, NT 4.0, 2000, XP*, Server 2003 For direct mode IP and IPX printing. *32-bit...
HP Jetdirect Administrator's Guide
Page 16
... for HP Jetdirect print servers. ● HP's preferred solution for supported system updates.) Windows 2000, XP Professional, Server 2003 HP-UX* Solaris* Linux* NetWare* TCP/IP, IPX/SPX *Supports queue creation and peripheral management from HP's Website ● Not supported on value-based products, such as ew2400 ENWW HP Software Solutions Summary 16 Alerts and consumables management. Remote installation, configuration...
... for HP Jetdirect print servers. ● HP's preferred solution for supported system updates.) Windows 2000, XP Professional, Server 2003 HP-UX* Solaris* Linux* NetWare* TCP/IP, IPX/SPX *Supports queue creation and peripheral management from HP's Website ● Not supported on value-based products, such as ew2400 ENWW HP Software Solutions Summary 16 Alerts and consumables management. Remote installation, configuration...
HP Jetdirect Administrator's Guide
Page 17
... (Mac OS X) Mac OS X 10.1.5 or later Configuration of HP Jetdirect wireless print servers. ● Distributed on the HP Jetdirect CD-ROM HP LaserJet Utilities for NDPS NetWare 5.x, 6.x Simplified installation, printing, and bidirectional management of HP Jetdirect-connected printers under Novell Distributed Print Services (NDPS). ● Frees up user licenses ● Allows disabling of SAPs to reduce network traffic ● Not supported...
... (Mac OS X) Mac OS X 10.1.5 or later Configuration of HP Jetdirect wireless print servers. ● Distributed on the HP Jetdirect CD-ROM HP LaserJet Utilities for NDPS NetWare 5.x, 6.x Simplified installation, printing, and bidirectional management of HP Jetdirect-connected printers under Novell Distributed Print Services (NDPS). ● Frees up user licenses ● Allows disabling of SAPs to reduce network traffic ● Not supported...
HP Jetdirect Administrator's Guide
Page 18
...system is a server, you to first configure wireless settings on the print server so that it can connect to your network. A version that runs from your systems or servers that network clients can be temporarily stored and then removed from HP online support at: http://www.hp.com/go/inpw_sw...on the Jetdirect CD-ROM interface. Once your system disk after a system reboot. The wizard runs from the CD-ROM, although some files may be downloaded from your printers have a network connection (either through the server, also known as "client-server" printing. For wireless print servers, the...
...system is a server, you to first configure wireless settings on the print server so that it can connect to your network. A version that runs from your systems or servers that network clients can be temporarily stored and then removed from HP online support at: http://www.hp.com/go/inpw_sw...on the Jetdirect CD-ROM interface. Once your system disk after a system reboot. The wizard runs from the CD-ROM, although some files may be downloaded from your printers have a network connection (either through the server, also known as "client-server" printing. For wireless print servers, the...