Practical considerations for imaging and printing security
Page 1
... worms 6 Protect Information on the Network ...6 Network connectivity with HP Jetdirect devices 6 HP Digital Sending Software (DSS 7 Fax/LAN bridging ...7 Effectively Monitor and Manage...7 HP Web Jetadmin for fleet management 7 Device and service control ...7 Firmware updates ...7 Logging device activity ...8 Common Criteria Certification ...8 The future of imaging and printing security ...8 Document security and Digital Rights Management 8 Trusted...
... worms 6 Protect Information on the Network ...6 Network connectivity with HP Jetdirect devices 6 HP Digital Sending Software (DSS 7 Fax/LAN bridging ...7 Effectively Monitor and Manage...7 HP Web Jetadmin for fleet management 7 Device and service control ...7 Firmware updates ...7 Logging device activity ...8 Common Criteria Certification ...8 The future of imaging and printing security ...8 Document security and Digital Rights Management 8 Trusted...
HP Jetdirect Security Guidelines
Page 1
... about how they can be addressed. whitepaper HP Jetdirect Security Guidelines Table of Contents: Introduction ...1 HP Jetdirect Overview ...2 What is an HP Jetdirect?...3 How old is Your HP Jetdirect?...4 Upgrading ...5 HP Jetdirect Administrative Guidelines 6 HP Jetdirect Hacks: TCP Port 9100...7 HP Jetdirect Hacks: Password and SNMP Community Names 9 HP Jetdirect Hacks: Firmware Upgrade 9 HP Jetdirect Hacks: Sniffing Print Jobs and Replaying Them 10 HP Jetdirect Hacks: Printer/MFP access 10 Recommended Security...
... about how they can be addressed. whitepaper HP Jetdirect Security Guidelines Table of Contents: Introduction ...1 HP Jetdirect Overview ...2 What is an HP Jetdirect?...3 How old is Your HP Jetdirect?...4 Upgrading ...5 HP Jetdirect Administrative Guidelines 6 HP Jetdirect Hacks: TCP Port 9100...7 HP Jetdirect Hacks: Password and SNMP Community Names 9 HP Jetdirect Hacks: Firmware Upgrade 9 HP Jetdirect Hacks: Sniffing Print Jobs and Replaying Them 10 HP Jetdirect Hacks: Printer/MFP access 10 Recommended Security...
HP Jetdirect Security Guidelines
Page 2
...transporting frames had as much as possible. 2 At the other ways of the first print servers to a spooler. The length limits of Use' design criterion now has an arch nemesis: 'Security'. HP Jetdirect was designed to a spooler in the same sentence. While migrating to networking printers, ... how to deploy printing and imaging devices securely rather than how to deploy them via networking protocols such as well-known default security settings. one extreme, the best security available for the next few million HP Jetdirect products have never had their firmware updated or their ...
...transporting frames had as much as possible. 2 At the other ways of the first print servers to a spooler. The length limits of Use' design criterion now has an arch nemesis: 'Security'. HP Jetdirect was designed to a spooler in the same sentence. While migrating to networking printers, ... how to deploy printing and imaging devices securely rather than how to deploy them via networking protocols such as well-known default security settings. one extreme, the best security available for the next few million HP Jetdirect products have never had their firmware updated or their ...
HP Jetdirect Security Guidelines
Page 4
... Server HP Jetdirect J7934A 620n EIO Print Server HP Jetdirect J7961A 635n EIO Print Server Date Released February 1994 May 1994 August 1995 November 1996 October 1997 January 1998 January 1998 June 1998 September 1998 February 2000 October 2000 October 2001 April 2002 April 2003 April 2004 October 2005 Table 1 - For an in mind, you don't have to update the firmware...
... Server HP Jetdirect J7934A 620n EIO Print Server HP Jetdirect J7961A 635n EIO Print Server Date Released February 1994 May 1994 August 1995 November 1996 October 1997 January 1998 January 1998 June 1998 September 1998 February 2000 October 2000 October 2001 April 2002 April 2003 April 2004 October 2005 Table 1 - For an in mind, you don't have to update the firmware...
HP Jetdirect Security Guidelines
Page 5
....1X PEAP, 802.1X EAP-TLS. First, if the HP Jetdirect device was introduced before the year 2000, HP recommends that it be upgraded to newer firmware after purchase Non-Cryptographic Security, upgradeable after purchase Non-Cryptographic Security...upgradeable to a newer model. HP Jetdirect Models: HP Jetdirect J3258G 170x External Parallel Print server J6035G 175x External USB 1.1 Print Server J3263G 300x External Print server J7983G 510X External 3-Port Print Server J7942G en3700 External USB 2.0 Print Server J7934G 620n EIO 10/100 Print Server J7949E Embedded Jetdirect 10/100 (not for sale...
....1X PEAP, 802.1X EAP-TLS. First, if the HP Jetdirect device was introduced before the year 2000, HP recommends that it be upgraded to newer firmware after purchase Non-Cryptographic Security, upgradeable after purchase Non-Cryptographic Security...upgradeable to a newer model. HP Jetdirect Models: HP Jetdirect J3258G 170x External Parallel Print server J6035G 175x External USB 1.1 Print Server J3263G 300x External Print server J7983G 510X External 3-Port Print Server J7942G en3700 External USB 2.0 Print Server J7934G 620n EIO 10/100 Print Server J7949E Embedded Jetdirect 10/100 (not for sale...
HP Jetdirect Security Guidelines
Page 6
...print server. This flexibility will come from the four main HP Jetdirect product lines, referred to be careful not to lock the front door and leave your network before securing one must "lock down" several things before upgrading all HP Jetdirect firmware to the latest firmware. • An Embedded Web Server... risk. 6 The administrative guideline for HP Jetdirect, four different administrative guidelines will be used. These models have cryptographic security capability. • SET 2: The 610n, 615n, 620n, 625n, en3700, and Embedded Jetdirect (J7949E) models. In order to be...
...print server. This flexibility will come from the four main HP Jetdirect product lines, referred to be careful not to lock the front door and leave your network before securing one must "lock down" several things before upgrading all HP Jetdirect firmware to the latest firmware. • An Embedded Web Server... risk. 6 The administrative guideline for HP Jetdirect, four different administrative guidelines will be used. These models have cryptographic security capability. • SET 2: The 610n, 615n, 620n, 625n, en3700, and Embedded Jetdirect (J7949E) models. In order to be...
HP Jetdirect Security Guidelines
Page 7
... Embedded Jetdirect J4100A 400n 10Mbps MIO Print server J4106A 400n 10Mbps MIO Print server J3110A 600n 10Mbps EIO Print server J3111A 600n 10Mbps EIO Print server J3113A 600n 10/100 EIO Print server J4169A 610n 10/100 EIO Print Server J6057A 615n 10/100 EIO Print Server J3263A/J3263G 300x External Print server J3265A 500X External 3-Port Print Server J7983G 510X External 3-Port Print Server J7942A/J7942G en3700 External USB 2.0 Print Server J7934A/J7934G 620n...
... Embedded Jetdirect J4100A 400n 10Mbps MIO Print server J4106A 400n 10Mbps MIO Print server J3110A 600n 10Mbps EIO Print server J3111A 600n 10Mbps EIO Print server J3113A 600n 10/100 EIO Print server J4169A 610n 10/100 EIO Print Server J6057A 615n 10/100 EIO Print Server J3263A/J3263G 300x External Print server J3265A 500X External 3-Port Print Server J7983G 510X External 3-Port Print Server J7942A/J7942G en3700 External USB 2.0 Print Server J7934A/J7934G 620n...
HP Jetdirect Security Guidelines
Page 9
... powered down the download file. In case of their printing behavior. Some additional protections can be provided, in the form of updating HP Jetdirect firmware: • HP Download Manager / HP Web Jetadmin • FTP • Embedded Web Server When using SNMPv3 easy. An excellent resource for FTP firmware upgrades. To better protect passwords from being used to upgrade...
... powered down the download file. In case of their printing behavior. Some additional protections can be provided, in the form of updating HP Jetdirect firmware: • HP Download Manager / HP Web Jetadmin • FTP • Embedded Web Server When using SNMPv3 easy. An excellent resource for FTP firmware upgrades. To better protect passwords from being used to upgrade...
HP Jetdirect Security Guidelines
Page 10
... server, it to bypass HP Jetdirect security. This active/passive behavior is analogously similar to a person not being able to upgrade HP Jetdirect devices is not a vulnerability specific to record a meeting conversation. How the EWS is protected determines how the HP Jetdirect firmware upgrade capability is a fundamental step in MITM attacks. If the MITM node has a copy of a print...
... server, it to bypass HP Jetdirect security. This active/passive behavior is analogously similar to a person not being able to upgrade HP Jetdirect devices is not a vulnerability specific to record a meeting conversation. How the EWS is protected determines how the HP Jetdirect firmware upgrade capability is a fundamental step in MITM attacks. If the MITM node has a copy of a print...
HP Jetdirect 620n Print Server Setup Guide
Page 5
Specifications and Regulatory Statements Specifications 45 Regulatory Statements 46 E. Warranty Service F. B. HP Jetdirect Solutions Summary Tools Overview 31 Supported Network Protocols 32 HP Installation Software 33 C. HP Support and Service HP Support Online 53 Firmware Upgrades 53 HP Support By Phone 54 5 HP Jetdirect EIO Control Panel Menus Introduction 36 Classic Control Panel 37 Graphical Control Panel 40 D.
Specifications and Regulatory Statements Specifications 45 Regulatory Statements 46 E. Warranty Service F. B. HP Jetdirect Solutions Summary Tools Overview 31 Supported Network Protocols 32 HP Installation Software 33 C. HP Support and Service HP Support Online 53 Firmware Upgrades 53 HP Support By Phone 54 5 HP Jetdirect EIO Control Panel Menus Introduction 36 Classic Control Panel 37 Graphical Control Panel 40 D.
HP Jetdirect 620n Print Server Setup Guide
Page 12
.... In most HP LaserJet printers, a Jetdirect Configuration page will be included on the HP Jetdirect CD-ROM. 3. Proceed to the applicable HP Jetdirect Administrator's Guide located on the Service Configuration print. 2. See Figure 2-2. Print a Jetdirect Configuration page and check for the status message "I/O CARD READY". If I /O CARD READY does not appear, check that you print a Printer Configuration page. Verify Jetdirect Print Server Operation 1.
.... In most HP LaserJet printers, a Jetdirect Configuration page will be included on the HP Jetdirect CD-ROM. 3. Proceed to the applicable HP Jetdirect Administrator's Guide located on the Service Configuration print. 2. See Figure 2-2. Print a Jetdirect Configuration page and check for the status message "I/O CARD READY". If I /O CARD READY does not appear, check that you print a Printer Configuration page. Verify Jetdirect Print Server Operation 1.
HP Jetdirect 620n Print Server Setup Guide
Page 31
...; Embedded Web Server, HTTPS (TCP port 443) ● HP management and support software: ■ HP Web Jetadmin software (TCP/IP and IPX/SPX networks) ■ HP Jetdirect Download Manager (HP Jetdirect firmware upgrades) HP Jetdirect Printing Support ● Embedded HP Jetdirect services: ■ LPD printing (TCP port 515) ■ IPP printing (TCP port 631) ■ FTP printing (TCP ports 20, 21) ■ Raw IP printing (HP-proprietary TCP...
...; Embedded Web Server, HTTPS (TCP port 443) ● HP management and support software: ■ HP Web Jetadmin software (TCP/IP and IPX/SPX networks) ■ HP Jetdirect Download Manager (HP Jetdirect firmware upgrades) HP Jetdirect Printing Support ● Embedded HP Jetdirect services: ■ LPD printing (TCP port 515) ■ IPP printing (TCP port 631) ■ FTP printing (TCP ports 20, 21) ■ Raw IP printing (HP-proprietary TCP...
HP Jetdirect 620n Print Server Setup Guide
Page 34
... hosted on your intranet ● Remote installation, configuration, and management of HP Jetdirect-connected print servers, non-HP printers that support the standard MIBs, and printers with embedded web servers ● Alerts and consumables management ● Remote firmware upgrades for HP Jetdirect print servers ● Asset tracking and utilization analysis HP Internet Printer Connection ● Supported Networks (TCP/IP): ■ Windows NT...
... hosted on your intranet ● Remote installation, configuration, and management of HP Jetdirect-connected print servers, non-HP printers that support the standard MIBs, and printers with embedded web servers ● Alerts and consumables management ● Remote firmware upgrades for HP Jetdirect print servers ● Asset tracking and utilization analysis HP Internet Printer Connection ● Supported Networks (TCP/IP): ■ Windows NT...
HP Jetdirect 620n Print Server Setup Guide
Page 35
...; NetWare 5.x, 6.0 ● Simplified installation, printing, and bidirectional management of HP Jetdirect-connected printers under Novell Distributed Print Services (NDPS) ● Allows automatic discovery and installation of HP Jetdirectconnected printers into NDPS via IPX ● Frees up user licenses ● Allows disabling of SAPs to reduce network traffic ● For IPX printing, requires HP Jetdirect firmware version X.03.06 or...
...; NetWare 5.x, 6.0 ● Simplified installation, printing, and bidirectional management of HP Jetdirect-connected printers under Novell Distributed Print Services (NDPS) ● Allows automatic discovery and installation of HP Jetdirectconnected printers into NDPS via IPX ● Frees up user licenses ● Allows disabling of SAPs to reduce network traffic ● For IPX printing, requires HP Jetdirect firmware version X.03.06 or...
HP Jetdirect 620n Print Server Setup Guide
Page 53
... are available from the World Wide Web at http://www.hp.com/support/net_printing is a great place to start for HP Jetdirect print servers with internal Flash memory. F HP Support and Service HP Support Online Click your way to questions about your HP Jetdirect print server - 24 hours a day, 7 days a week. Firmware Upgrades Hewlett-Packard offers downloadable electronic upgrades for answers to...
... are available from the World Wide Web at http://www.hp.com/support/net_printing is a great place to start for HP Jetdirect print servers with internal Flash memory. F HP Support and Service HP Support Online Click your way to questions about your HP Jetdirect print server - 24 hours a day, 7 days a week. Firmware Upgrades Hewlett-Packard offers downloadable electronic upgrades for answers to...
HP Jetdirect Administrator's Guide
Page 8
....nnnnnnnn 620n J7934A EIO slot 10/100TX Full** V.28.xx.nnnnnnnn * Limited support includes TCP/IP, IPX Direct Mode printing, AppleTalk (EtherTalk), LPD/Windows printing, limited upgrade capabilities. ** Full support includes TCP/IP, IPX/SPX, AppleTalk (EtherTalk), LPR/LPD, Security. Supported Network Protocols Note For HP Jetdirect wireless print servers, this section assumes that use only. For firmware...
....nnnnnnnn 620n J7934A EIO slot 10/100TX Full** V.28.xx.nnnnnnnn * Limited support includes TCP/IP, IPX Direct Mode printing, AppleTalk (EtherTalk), LPD/Windows printing, limited upgrade capabilities. ** Full support includes TCP/IP, IPX/SPX, AppleTalk (EtherTalk), LPR/LPD, Security. Supported Network Protocols Note For HP Jetdirect wireless print servers, this section assumes that use only. For firmware...
HP Jetdirect Administrator's Guide
Page 12
... World Wide Web at: http://www.hp.com/go/webjetadmin_firmware Firmware Installation Tools Note HP Jetdirect ew2400 print servers will have factory-installed HP Jetdirect print servers). ● This manual, the HP Jetdirect Print Server Administrator's Guide for HP Jetdirect print servers that contain upgradeable memory. A network cable must be used. Firmware Upgrades Hewlett-Packard offers downloadable firmware upgrades for the applicable Jetdirect product models. ● HP Jetdirect Setup guides, supplied on CD...
... World Wide Web at: http://www.hp.com/go/webjetadmin_firmware Firmware Installation Tools Note HP Jetdirect ew2400 print servers will have factory-installed HP Jetdirect print servers). ● This manual, the HP Jetdirect Print Server Administrator's Guide for HP Jetdirect print servers that contain upgradeable memory. A network cable must be used. Firmware Upgrades Hewlett-Packard offers downloadable firmware upgrades for the applicable Jetdirect product models. ● HP Jetdirect Setup guides, supplied on CD...
HP Jetdirect Administrator's Guide
Page 48
Table 3.2 lists supported TFTP commands (HP Jetdirect firmware version V.28.xx or later). Table 3.2 List of Supported TFTP Commands (1 of 2) General ● passwd: ● ssl-state: ● sys-location: ● security-reset: ...-wins-svr: ● pri-dns-svr: ● smtp-svr: TCP/IP Print Options ● 9100-printing: ● interlock: ● ftp-printing: ● buffer-packing: ● ipp-printing: ● write-mode: ● lpd-printing: ● mult-tcp-conn: ● banner: TCP/IP Raw Print Ports ● raw-port: TCP/IP Access Control ● allow: netnum [...
Table 3.2 lists supported TFTP commands (HP Jetdirect firmware version V.28.xx or later). Table 3.2 List of Supported TFTP Commands (1 of 2) General ● passwd: ● ssl-state: ● sys-location: ● security-reset: ...-wins-svr: ● pri-dns-svr: ● smtp-svr: TCP/IP Print Options ● 9100-printing: ● interlock: ● ftp-printing: ● buffer-packing: ● ipp-printing: ● write-mode: ● lpd-printing: ● mult-tcp-conn: ● banner: TCP/IP Raw Print Ports ● raw-port: TCP/IP Access Control ● allow: netnum [...
HP Jetdirect Administrator's Guide
Page 108
...HP Jetdirect print server) for the name of 2) Item Host Name System Up Time System Contact System Location HP Jetdirect Firmware Version IP Address Hardware Address LAA Admin Password Description Specifies the IP host name assigned to the device and stored on the HP Jetdirect print server) that replaces the LAN Hardware (MAC) address. See TCP/IP on the HP Jetdirect print server...address of time since either the HP Jetdirect print server or the network device was last powered off/on the HP Jetdirect print server. The product number of the HP Jetdirect print server (for a User Name and ...
...HP Jetdirect print server) for the name of 2) Item Host Name System Up Time System Contact System Location HP Jetdirect Firmware Version IP Address Hardware Address LAA Admin Password Description Specifies the IP host name assigned to the device and stored on the HP Jetdirect print server) that replaces the LAN Hardware (MAC) address. See TCP/IP on the HP Jetdirect print server...address of time since either the HP Jetdirect print server or the network device was last powered off/on the HP Jetdirect print server. The product number of the HP Jetdirect print server (for a User Name and ...
HP Jetdirect Administrator's Guide
Page 191
...for ten minutes to ensure it does not, you may need to replace the HP Jetdirect print server. This information assumes you have already printed a configuration page. 1. For internal Jetdirect cards, turn the printer off and back on again. ■ Reinstall the HP Jetdirect print server to see Chapter 9. ■ If your printer contains multiple EIO slots, try...service provider. Procedure 3: Resolving Printer Display Error Messages Check the following information to interpret the error message. ■ If you upgraded the Jetdirect firmware recently, power the print server off/on.
...for ten minutes to ensure it does not, you may need to replace the HP Jetdirect print server. This information assumes you have already printed a configuration page. 1. For internal Jetdirect cards, turn the printer off and back on again. ■ Reinstall the HP Jetdirect print server to see Chapter 9. ■ If your printer contains multiple EIO slots, try...service provider. Procedure 3: Resolving Printer Display Error Messages Check the following information to interpret the error message. ■ If you upgraded the Jetdirect firmware recently, power the print server off/on.