Advanced POWER Virtualization on IBM System p5 - Previous ...

5.7 Security considerations for Virtual I/O Servers
The Virtual I/O Server is crucial to the function of the system. Security is always a
concern. Although the Virtual I/O Server does not run a lot of services, it has
open ports in the network for connectivity and users can be created that may
have rights to alter specific system parameters. We will discuss the following
topics here:
► Network security
► System parameter security
► Viewing protocol entries related to security
5.7.1 Network security
After installation of the Virtual I/O Server, there is no IP address assigned to one
of the Ethernet interfaces until you configure it. If that has been done, by default
there are some services active on the system and available from the network that
should be carefully checked. Here is the output of a port scan that took place
after an IP address had been assigned to one of the network interfaces of the
Virtual I/O Server:
ftp
ssh
telnet
rcpbind
RMC connections
Ports 20 for data and 21 for control connection allows
unencrypted connections to the system; use the scp
command instead.
Port 22 is always encrypted.
Port 23 allows unencrypted connections to the system;
use the ssh command instead.
Port 111 is used for NFS connections.
Port 657 runs encrypted.
Stopping telnet and ftp services
The ftp and telnet commands can be closed if there are means to connect to
and exchange data with the Virtual I/O Server via an encrypted protocol. Since
SSH comes preinstalled with the system, we recommend stopping those
services and use SSH instead. To stop the services in the running system as well
as prevent them from starting after a reboot, use the stopnetsvc command.
Example 5-48 on page 359 shows how to use it.
358 <strong>Advanced</strong> <strong>POWER</strong> <strong>Virtualization</strong> on IBM System p5