HP Jetdirect Security Guidelines
Page 1
... Guidelines Table of Contents: Introduction ...1 HP Jetdirect Overview ...2 What is an HP Jetdirect?...3 How old is Your HP Jetdirect?...4 Upgrading ...5 HP Jetdirect Administrative Guidelines 6 HP Jetdirect Hacks: TCP Port 9100...7 HP Jetdirect Hacks: Password and SNMP Community Names 9 HP Jetdirect Hacks: Firmware Upgrade 9 HP Jetdirect Hacks: Sniffing Print Jobs and Replaying Them 10 HP Jetdirect Hacks: Printer/MFP access 10 Recommended Security Deployments: SET 1 11 Recommended Security Deployments: SET 2 12 Recommended Security...
... Guidelines Table of Contents: Introduction ...1 HP Jetdirect Overview ...2 What is an HP Jetdirect?...3 How old is Your HP Jetdirect?...4 Upgrading ...5 HP Jetdirect Administrative Guidelines 6 HP Jetdirect Hacks: TCP Port 9100...7 HP Jetdirect Hacks: Password and SNMP Community Names 9 HP Jetdirect Hacks: Firmware Upgrade 9 HP Jetdirect Hacks: Sniffing Print Jobs and Replaying Them 10 HP Jetdirect Hacks: Printer/MFP access 10 Recommended Security Deployments: SET 1 11 Recommended Security Deployments: SET 2 12 Recommended Security...
HP Jetdirect Security Guidelines
Page 6
...support. These models have cryptographic security capability. • SET 2: The 610n, 615n, 620n, 625n, en3700, and Embedded Jetdirect (J7949E) models. One of the Jetdirect device. HP recommends always upgrading only a few devices and performing an evaluation of having an EIO based printer is to..., AppleTalk) • Mark any product that follows, this whitepaper will automatically indicate which devices need to be firmware upgraded to install a J7961G 635n IPv6/IPsec print server. One of the great features of those attacks. Printers and MFPs with a lot of EIO based printers, ...
...support. These models have cryptographic security capability. • SET 2: The 610n, 615n, 620n, 625n, en3700, and Embedded Jetdirect (J7949E) models. One of the Jetdirect device. HP recommends always upgrading only a few devices and performing an evaluation of having an EIO based printer is to..., AppleTalk) • Mark any product that follows, this whitepaper will automatically indicate which devices need to be firmware upgraded to install a J7961G 635n IPv6/IPsec print server. One of the great features of those attacks. Printers and MFPs with a lot of EIO based printers, ...
HP Jetdirect Security Guidelines
Page 9
... updating HP Jetdirect firmware: • HP Download Manager / HP Web Jetadmin • FTP • Embedded Web Server When using SNMPv3 easy. HP Jetdirect devices that applications such as proof of the various methods used by Hewlett-Packard as the HP Download Manager and HP Web Jetadmin are trusted to print. However, when using SSL/TLS. HP Jetdirect Hacks: Firmware Upgrade A nice overview of their printing behavior...
... updating HP Jetdirect firmware: • HP Download Manager / HP Web Jetadmin • FTP • Embedded Web Server When using SNMPv3 easy. HP Jetdirect devices that applications such as proof of the various methods used by Hewlett-Packard as the HP Download Manager and HP Web Jetadmin are trusted to print. However, when using SSL/TLS. HP Jetdirect Hacks: Firmware Upgrade A nice overview of their printing behavior...
HP Jetdirect Security Guidelines
Page 10
...proper deployment of cryptographic protocols such as a guideline to all the data sent between an FTP client and an FTP server, it can open it may end up at the final destination as a solution to this MITM node intercepts packets traveling... leaving the conference room. Port access controls, such as we have discussed HP Jetdirect security primarily. However, printer/MFPs can be configured to printing. How the EWS is protected determines how the HP Jetdirect firmware upgrade capability is not a vulnerability specific to help protect against unauthorized connections. If...
...proper deployment of cryptographic protocols such as a guideline to all the data sent between an FTP client and an FTP server, it can open it may end up at the final destination as a solution to this MITM node intercepts packets traveling... leaving the conference room. Port access controls, such as we have discussed HP Jetdirect security primarily. However, printer/MFPs can be configured to printing. How the EWS is protected determines how the HP Jetdirect firmware upgrade capability is not a vulnerability specific to help protect against unauthorized connections. If...
HP Jetdirect 620n Print Server Setup Guide
Page 5
Specifications and Regulatory Statements Specifications 45 Regulatory Statements 46 E. B. HP Jetdirect EIO Control Panel Menus Introduction 36 Classic Control Panel 37 Graphical Control Panel 40 D. HP Jetdirect Solutions Summary Tools Overview 31 Supported Network Protocols 32 HP Installation Software 33 C. Warranty Service F. HP Support and Service HP Support Online 53 Firmware Upgrades 53 HP Support By Phone 54 5
Specifications and Regulatory Statements Specifications 45 Regulatory Statements 46 E. B. HP Jetdirect EIO Control Panel Menus Introduction 36 Classic Control Panel 37 Graphical Control Panel 40 D. HP Jetdirect Solutions Summary Tools Overview 31 Supported Network Protocols 32 HP Installation Software 33 C. Warranty Service F. HP Support and Service HP Support Online 53 Firmware Upgrades 53 HP Support By Phone 54 5
HP Jetdirect 620n Print Server Setup Guide
Page 31
... (TCP port 80) ■ Embedded Web Server, HTTPS (TCP port 443) ● HP management and support software: ■ HP Web Jetadmin software (TCP/IP and IPX/SPX networks) ■ HP Jetdirect Download Manager (HP Jetdirect firmware upgrades) HP Jetdirect Printing Support ● Embedded HP Jetdirect services: ■ LPD printing (TCP port 515) ■ IPP printing (TCP port 631) ■ FTP printing (TCP ports 20, 21) ■ Raw...
... (TCP port 80) ■ Embedded Web Server, HTTPS (TCP port 443) ● HP management and support software: ■ HP Web Jetadmin software (TCP/IP and IPX/SPX networks) ■ HP Jetdirect Download Manager (HP Jetdirect firmware upgrades) HP Jetdirect Printing Support ● Embedded HP Jetdirect services: ■ LPD printing (TCP port 515) ■ IPP printing (TCP port 631) ■ FTP printing (TCP ports 20, 21) ■ Raw...
HP Jetdirect 620n Print Server Setup Guide
Page 34
... Jetadmin hosted on your intranet ● Remote installation, configuration, and management of HP Jetdirect-connected print servers, non-HP printers that support the standard MIBs, and printers with embedded web servers ● Alerts and consumables management ● Remote firmware upgrades for HP Jetdirect print servers ● Asset tracking and utilization analysis HP Internet Printer Connection ● Supported Networks (TCP/IP): ■ Windows NT...
... Jetadmin hosted on your intranet ● Remote installation, configuration, and management of HP Jetdirect-connected print servers, non-HP printers that support the standard MIBs, and printers with embedded web servers ● Alerts and consumables management ● Remote firmware upgrades for HP Jetdirect print servers ● Asset tracking and utilization analysis HP Internet Printer Connection ● Supported Networks (TCP/IP): ■ Windows NT...
HP Jetdirect 620n Print Server Setup Guide
Page 53
...), the embedded Web server, and HP Jetdirect Download Manager (Windows) or HP Web Jetadmin software. The HP web site at : http://www.hp.com/go/webjetadmin_firmware ENWW 53 Firmware Upgrades Hewlett-Packard offers downloadable electronic upgrades for answers to questions about your way to start for HP Jetdirect print servers with internal Flash memory. F HP Support and Service HP Support Online Click your HP Jetdirect print server - 24 hours...
...), the embedded Web server, and HP Jetdirect Download Manager (Windows) or HP Web Jetadmin software. The HP web site at : http://www.hp.com/go/webjetadmin_firmware ENWW 53 Firmware Upgrades Hewlett-Packard offers downloadable electronic upgrades for answers to questions about your way to start for HP Jetdirect print servers with internal Flash memory. F HP Support and Service HP Support Online Click your HP Jetdirect print server - 24 hours...
HP Jetdirect Administrator's Guide
Page 8
....xx.nnnnnnnn 620n J7934A EIO slot 10/100TX Full** V.28.xx.nnnnnnnn * Limited support includes TCP/IP, IPX Direct Mode printing, AppleTalk (EtherTalk), LPD/Windows printing, limited upgrade capabilities. ** Full support includes TCP/IP, IPX/SPX, AppleTalk (EtherTalk), LPR/LPD, Security. ENWW Introducing the HP Jetdirect Print Server 8 Supported Print Servers The features and capabilities of HP Jetdirect print servers depend on the print server's product model...
....xx.nnnnnnnn 620n J7934A EIO slot 10/100TX Full** V.28.xx.nnnnnnnn * Limited support includes TCP/IP, IPX Direct Mode printing, AppleTalk (EtherTalk), LPD/Windows printing, limited upgrade capabilities. ** Full support includes TCP/IP, IPX/SPX, AppleTalk (EtherTalk), LPR/LPD, Security. ENWW Introducing the HP Jetdirect Print Server 8 Supported Print Servers The features and capabilities of HP Jetdirect print servers depend on the print server's product model...
HP Jetdirect Administrator's Guide
Page 12
.../go/webjetadmin_firmware Firmware Installation Tools Note HP Jetdirect ew2400 print servers will have factory-installed HP Jetdirect print servers). ● This manual, the HP Jetdirect Print Server Administrator's Guide for the applicable Jetdirect product models. ● HP Jetdirect Setup guides, supplied on CD-ROM with printers that contain upgradeable memory. The HP Web site: http://www.hp.com/support/net_printing is not supported. Firmware Upgrades Hewlett-Packard offers downloadable firmware upgrades for answers...
.../go/webjetadmin_firmware Firmware Installation Tools Note HP Jetdirect ew2400 print servers will have factory-installed HP Jetdirect print servers). ● This manual, the HP Jetdirect Print Server Administrator's Guide for the applicable Jetdirect product models. ● HP Jetdirect Setup guides, supplied on CD-ROM with printers that contain upgradeable memory. The HP Web site: http://www.hp.com/support/net_printing is not supported. Firmware Upgrades Hewlett-Packard offers downloadable firmware upgrades for answers...
HP Jetdirect Administrator's Guide
Page 13
... supported systems. For more information see Chapter 4. ● FTP (File Transfer Protocol) may be installed over a network using your Web browser. Firmware upgrades for supported HP Jetdirect print servers may be used to transfer a firmware upgrade image file to log into the device. To start an FTP session, use the device IP address or host name. After user...
... supported systems. For more information see Chapter 4. ● FTP (File Transfer Protocol) may be installed over a network using your Web browser. Firmware upgrades for supported HP Jetdirect print servers may be used to transfer a firmware upgrade image file to log into the device. To start an FTP session, use the device IP address or host name. After user...
HP Jetdirect Administrator's Guide
Page 16
Remote firmware upgrades for HP Jetdirect print servers. ● HP's preferred solution for ongoing management and installation of HP Jetdirect-connected print servers, non-HP printers that support the standard MIBs, and printers with Windows 2000, XP, Server 2003. Printing through the Internet to Internet Printing Protocol (IPP)-enabled HP Jetdirect-connected printers. ● Allows economical distribution of HP Jetdirect-connected printers. ● Supplied on the HP Jetdirect CD-ROM, and may...
Remote firmware upgrades for HP Jetdirect print servers. ● HP's preferred solution for ongoing management and installation of HP Jetdirect-connected print servers, non-HP printers that support the standard MIBs, and printers with Windows 2000, XP, Server 2003. Printing through the Internet to Internet Printing Protocol (IPP)-enabled HP Jetdirect-connected printers. ● Allows economical distribution of HP Jetdirect-connected printers. ● Supplied on the HP Jetdirect CD-ROM, and may...
HP Jetdirect Administrator's Guide
Page 56
... or disables SNMP operation on the print server during a forced TCP/IP reconfiguration (for example, when powered off/on . ENWW TCP/IP Configuration 56 This is required. 2: Prompt the user to allow sending data on product use BOOTP/DHCP). If set . In addition, firmware upgrades through current HP downloading utilities will disable all SNMP agents...
... or disables SNMP operation on the print server during a forced TCP/IP reconfiguration (for example, when powered off/on . ENWW TCP/IP Configuration 56 This is required. 2: Prompt the user to allow sending data on product use BOOTP/DHCP). If set . In addition, firmware upgrades through current HP downloading utilities will disable all SNMP agents...
HP Jetdirect Administrator's Guide
Page 59
... version than the installed version. scan-idle-timeout: Specifies the number of the firmware upgrade file. ENWW TCP/IP Configuration 59 The print server will attempt to -email feature in -one or more Jetdirect print servers with your multifunction or all-in the Web Scan server. 0 disables, 1 (default) enables. webscan-config: Enables or disables the Web Scan feature...
... version than the installed version. scan-idle-timeout: Specifies the number of the firmware upgrade file. ENWW TCP/IP Configuration 59 The print server will attempt to -email feature in -one or more Jetdirect print servers with your multifunction or all-in the Web Scan server. 0 disables, 1 (default) enables. webscan-config: Enables or disables the Web Scan feature...
HP Jetdirect Administrator's Guide
Page 90
... (Read-only parameter) The number of the system from which SNMP GetRequests the HP Jetdirect print server will be ASCII characters. DHCP Rebind Time (Read-only parameter) DHCP T2 timeout, specifying the DHCP lease rebind time (seconds). In addition, firmware upgrades through current HP downloading utilities will respond to either a user-specified community name or the factory...
... (Read-only parameter) The number of the system from which SNMP GetRequests the HP Jetdirect print server will be ASCII characters. DHCP Rebind Time (Read-only parameter) DHCP T2 timeout, specifying the DHCP lease rebind time (seconds). In addition, firmware upgrades through current HP downloading utilities will respond to either a user-specified community name or the factory...
HP Jetdirect Administrator's Guide
Page 93
... the installed version. The default address is awaiting data. READY: Indicates the HP Jetdirect print server is the factory-assigned address. laa Specifies a locally administered address (LAA) that the upgrade file is the IP address of the TFTP server, specifies the firmware version of the upgrade file, specifies and must be displayed. ENWW TCP/IP Configuration 93 DISABLED...
... the installed version. The default address is awaiting data. READY: Indicates the HP Jetdirect print server is the factory-assigned address. laa Specifies a locally administered address (LAA) that the upgrade file is the IP address of the TFTP server, specifies the firmware version of the upgrade file, specifies and must be displayed. ENWW TCP/IP Configuration 93 DISABLED...
HP Jetdirect Administrator's Guide
Page 122
... up the Support link located under Other Links in the left margin ● Refresh Rate: to update your HP Jetdirect print server with new features and enhancements (model ew2400 upgrade features are provided: ● Misc. Context Name: the view context in seconds) for secure environments. The... SNMPv3 Description This option disables the SNMP v1/v2c agents on the print server, which this user can access SNMP objects. Settings: for enabling miscellaneous advanced protocols and functions ● Firmware Upgrade: to set the time interval (in which is recommended for embedded ...
... up the Support link located under Other Links in the left margin ● Refresh Rate: to update your HP Jetdirect print server with new features and enhancements (model ew2400 upgrade features are provided: ● Misc. Context Name: the view context in seconds) for secure environments. The... SNMPv3 Description This option disables the SNMP v1/v2c agents on the print server, which this user can access SNMP objects. Settings: for enabling miscellaneous advanced protocols and functions ● Firmware Upgrade: to set the time interval (in which is recommended for embedded ...
HP Jetdirect Administrator's Guide
Page 128
Note HP Jetdirect ew2400 print servers will have limited upgrade capabilities. If not, then you to specify LPD (line printer daemon) print queues on LPD printing and print queues, see Chapter 5, "Configuring for the print server must be available on the print server before ENWW Using the Embedded Web Server 128 Then click Upgrade Firmware. The remaining six queues can be changed. that support firmware upgrades, this page...
Note HP Jetdirect ew2400 print servers will have limited upgrade capabilities. If not, then you to specify LPD (line printer daemon) print queues on LPD printing and print queues, see Chapter 5, "Configuring for the print server must be available on the print server before ENWW Using the Embedded Web Server 128 Then click Upgrade Firmware. The remaining six queues can be changed. that support firmware upgrades, this page...
HP Jetdirect Administrator's Guide
Page 150
....1X networks, the infrastructure components (such as required for client authentication on the print server model and firmware version. ENWW Using the Embedded Web Server 150 Disabling Telnet, FTP firmware upgrades, and RCFG is lost, you to configure 802.1X authentication settings on the Jetdirect print server as LAN switches) must use 802.1X protocols to control a port's access...
....1X networks, the infrastructure components (such as required for client authentication on the print server model and firmware version. ENWW Using the Embedded Web Server 150 Disabling Telnet, FTP firmware upgrades, and RCFG is lost, you to configure 802.1X authentication settings on the Jetdirect print server as LAN switches) must use 802.1X protocols to control a port's access...
HP Jetdirect Administrator's Guide
Page 199
As with other HP Jetdirect print servers, firmware upgrades may be downloaded using tools such as microwave ovens and cordless phones operate using similar radio frequencies. ● Reduce the distance between the printer and the Access Point or wireless PC. If a firmware download failure occurs on , the print server will improve the range and performance of interference. If it is...
As with other HP Jetdirect print servers, firmware upgrades may be downloaded using tools such as microwave ovens and cordless phones operate using similar radio frequencies. ● Reduce the distance between the printer and the Access Point or wireless PC. If a firmware download failure occurs on , the print server will improve the range and performance of interference. If it is...