SECURING FIBRE CHANNEL FABRICS - Brocade

Fabric-Based Encryption3. (LDAP only) Install SSL certificate on a Microsoft Active Directory(AD) server and CA certificate on the switch for using LDAPauthentication.4. Block telnet, HTTP, and RPC (using IP filters).5. Disable boot PROM access.6. Configure the switch for signed firmware.7. Disable root access.8. Enable FIPS mode (using fipsCfg command).Refer to the Fabric OS Administrator's Guide for the version of firmwareyou are using before performing the procedure to make sure thatyou have the most complete and current information. Once FIPS modeis enabled, then several other steps are required to reset and zeroizecertain switch parameters.Other FC Security FeaturesA few other security features are available in FOS that have not beencovered in previous sections and that are worthy of mention.RSCN SuppressionIt was explained earlier that RSCNs are contained to the devices withina FOS-based zone. It is also possible to explicitly suppress RSCNs atthe port level. Some specialized applications are very sensitive andcan be affected by an RSCN. If the environment is static and neverchanges once it is installed, RSCNs can be disabled to prevent interruptions.RSCN suppression can be configured using the portCfgrscnsupr command.Signed FirmwareFirmware can be tampered with and a modified version of the firmwareinstalled on a switch. This type of attack, although unlikely on aBrocade switch, is usually performed by modifying the code to addinga “back door,” or malicious code known only by the author of the modifiedcode. To ensure that the code being installed on a switch is in factthe authorized version and has not been modified by a third party, ahash value of the firmware is calculated. This hash value is then digitallysigned with a private key at the source using the RSA algorithmand 1024-bit keys. The public key of the source is included in the firmwarepackage to allow the switch to authenticate the firmware. Thisfeature, called signed firmware, was introduced in FOS 6.1.0.Securing Fibre Channel Fabrics 151