SECURING FIBRE CHANNEL FABRICS - Brocade

Chapter 8: Securing FOS-Based Fabricsattack. A feature called upfront login was introduced in FOS 5.0.1, forcingusers to provide a username and password (in addition to switchinformation) to view the Brocade Web Tools GUI, a feature that hasbeen enabled by default since FOS 5.3.0.Once a user logs into an FC switch with telnet or SSH to use the CLI, alogin banner or message can be displayed. By default, the login banneris not set and should be customized. The login banner can be enabledand created using the banner command. The motd command can beused to set a message-of-the-day. A banner is displayed after the userhas logged into the switch and the motd is displayed prior to logging in.When you create a login banner or motd, use these guidelines:• Include language indicating that the user is logging in to a privatenetwork and unauthorized users will be prosecuted.• Include language indicating that any user accessing this interfaceis consenting to be monitored. This is to address privacy issues.• Do not provide more information than is necessary (do not includeorganization name, type of OS, and so on).There is legal precedence of a successful defense from hackers claimingthey were not informed they were not authorized to log into anetwork, which is why this must be stated clearly in the motd before theylog in to the targeted system. In other cases, authorized users loggedinto their employer’s network and performed illegal activities, gettingcaught via network monitoring. They used the defense that their right toprivacy had been violated, since they were not informed that they couldbe monitored. For this reason, it is important to explicitly require consentin the login banner or motd. As mentioned earlier, the first phase in anattack is to collect information. Do not provide unnecessary information,or information that could identify the organization or specifics about thehardware they are logging into, in the login banner or motd. For the mostpart, laws in the US have adapted to the technology and legal provisionsare already in place to address such issues. Nevertheless, it remainsgood practice to include explicit language, providing additional protectionand demonstrating due diligence.System and SAN administrators sometimes have a tendency to log intoa switch and forget to log out when they are no longer using the interface.Enable a telnet and Web Tools session timeout feature using thetimeout command (set to 15 minutes by default). The Web Tools sessiontimeout, available since FOS 6.2, can be set from the Web Toolsinterface.136 Securing Fibre Channel Fabrics