www.beck-ipc.com

@CHIP-RTOS - Security notes


    IPC@CHIP® Documentation Index

Introduction

Here are some notes how to protect the IPC@CHIP® against unauthorized access.
Please check the following steps when preparing a release with the IPC@CHIP®.

  • General
  • WEB server
  • TELNET server
  • SSH server
  • FTP server
  • PPP server
  • Chiptool UDP config server
  • TFTP server
  • General TCPIP network security


  • General

    Steps to protect the IPC@CHIP®:

    1. Set the CHIP.INI entry SAFEMODE in section [DEVICE] to value 1. It will disable all the integrated services by default, like FTP, Telnet, Web server etc., with their standard user names and passwords. It also assures that after an update to a future RTOS release, all possible new services that this release implements are disabled by default.
      See SAFEMODE for more details.
    2. Enable only the services that you need in your application. Set the ENABLE entry of the respective service, e.g. Web servers ENABLE entry in the CHIP.INI.
    3. Define own user names and strong passwords for the selected services. Set the respective USERx and PASSWORDx entries in the CHIP.INI.
      IMPORTANT: Please note that you need to define both user names and passwords (USER0, USER1 and PASSWORD0, PASSWORD1) on most services to overwrite the default settings.


    Top of list
    Index page

    WEB server

    Steps to protect the IPC@CHIP® against unauthorized access via HTTP:

    1. Set web server root drive and root directory.
    2. When using the web server upload feature set a upload path, user name and password for the upload.
    3. When using protected paths, define user names and passwords for these paths.
    4. Consider to remove the standards CGI page "Main.htm" and "ChipCfg".


    Top of list
    Index page

    TELNET server

    Steps to protect the IPC@CHIP® against unauthorized access via Telnet:

    1. Consider to use SSH instead of Telnet.
    2. When using the Telnet server, define both user names and passwords.
    3. Check that the login delay is enabled.
    4. Consider to reduce the login retries.
    5. Consider to set a idle timeout.
    6. If the Telnet user should not be able to access the RTOS shell, disable the focus key and switch the focus to USER.


    Top of list
    Index page

    SSH server

    Steps to protect the IPC@CHIP® against unauthorized access via SSH:

    1. Generate and use an own RSA key and if desired DSA key for the SSH server.
    2. Define user name and password or generate user key files.


    Top of list
    Index page

    FTP server

    Steps to protect the IPC@CHIP® against unauthorized access via FTP:

    1. When using the FTP server, define both user names, passwords and access rights.
    2. Set FTP server root drive and root directory for each user.
    3. Check that the login delay is enabled.
    4. Consider to set a idle timeout.
    5. Enable FTPS (FTP over SSL) and disable FTP without SSL for control and data connections if possible.


    Top of list
    Index page

    PPP server

    Steps to protect the IPC@CHIP® against unauthorized access via PPP:

    1. When using the PPP server, define both user names and passwords and enable authentication.
    2. Consider to set a idle timeout.


    Top of list
    Index page

    Chiptool UDP config server

    Protect the IPC@CHIP® against unauthorized access by using the Chiptool program:

    1. Set the security level of the config server. Enable password protection or disable features that are not needed in the application.
    2. If password protection is enabled, set the password for ip config and password for flash programming.


    Top of list
    Index page

    TFTP server

    Protect the IPC@CHIP® against unauthorized access via TFTP:

    1. Disable the TFTP server via Shell command


    Top of list
    Index page

    General TCPIP network security


    1. There's a possibility to install a system server connection handler. It provides the possibility to generate IP- and/or Port-Filters and forbid connections to system servers.
    2. There's a possibility to suspend/resume system servers.
    3. Incoming IP and outgoing IP packets can be filtered within an user callback function.
    4. Incoming ARP packets can be filtered, too.


    Top of list
    Index page


    End of document