SECURING FIBRE CHANNEL FABRICS - Brocade

Chapter 8: Securing FOS-Based FabricsMost organizations display a standard welcome message or banner atsystem login. Although this type of login banner might not be a majordeterrent, it can help minimize liability and provide legal support in theevent of a security breach. It should be a standard feature of any ITsecurity strategy.SAN and security administrators have several tools at their disposal totighten the security around these management interfaces.Encrypting Management CommunicationsCommunication between an FC switch and its management server isparticularly vulnerable to several types of attacks. Secure protocolsmust be used to prevent someone from sniffing or capturing cleartextinformation exchanged between the switch and management server.To encrypt communications when the CLI is used, Brocade FC switchessupport SSH from FOS 4.1.1. All that is required is an SSH client on amanagement station to access the CLI; there is no special configurationnecessary on the FC switch to implement SSH. Since SSH is thesecure equivalent of telnet, the unsecure telnet service should no longerbe available to users. This can be accomplished by disabling thetelnet service for switches running pre-FOS 5.3.0 or by denying port 23(telnet) using the IP filter feature on switches running FOS 5.3.0 orlater.One of the problems frequently encountered with SSH occurs when aSAN administrator creates a script and wants to use SSH to secure thecommunication when executing the script. Prior to FOS 6.1.0, a passwordhad to be hard-coded into the script, which could be considered asecurity violation, since the password was written in cleartext format inthe script. As of FOS 6.1.0, SSH public key authentication was introducedto allow for password-less authentication, specifically forauthenticating a user within a script. The procedure for implementingthis feature is well documented in the Fabric OS Administrator's Guide.It consists of creating a public/private key pair, which is exchangedbetween the switch and an authorized user.Encrypting communications between the GUI interfaces such as BrocadeWeb Tools, DCFM, and Brocade Network Advisor is achieved usingthe HTTPS service, which is based on SSL/TLS (introduced in FOS4.4.0). Enabling HTTPS requires a certificate that must be obtained froma third party prior to configuration and installed on each switch using thesecCertUtil command.134 Securing Fibre Channel Fabrics