Embedded Web Server Settings Lab

00:00

welcome back to print Security Intermediate Course. And this is a lab in which I'm going to show you how to use him by the Web server to do settings regarding security.

00:12

So let's not beat around the bush in Let's go directly to the

00:17

somebody do observer

00:19

and you accessing the Web server from the browser. And I have already opened this one on my,

00:26

um, color laser jet, uh, mfp that I have at home. So this is the only network printer that I have at home than the real one.

00:36

And, uh,

00:39

when you open the image of observer, this is what you get.

00:43

And, uh, this is very important here. This part here, you can see that I'm signed in. So let me just sign out. And you have seen that except information there is pretty much nothing I can access unless I sign in. So let me just sign in. You'll get the regular

01:03

sign in page. There are no user names here because this is meant to be accessed by administrator only, although you can create some other use names.

01:15

So

01:15

I'm signing in,

01:19

and now you can see that I can access the settings regarding everything on this device. And you, as you can see there quite a lot of them. And there there is

01:30

quite complex structure of these settings. But let's go to security tab and see what you can find their.

01:38

So there is general security. So basically, you have them

01:42

embedded Web server password, which has already been sent. If I want to change you, though, take the old password and new tight new passport twice. Then I can set the service access code,

01:53

which is needed to type in when you are,

01:57

um, doing something on the device in the service mode, which is exits prior to boot off the device upper devices operating system.

02:07

I have already said that, of course,

02:10

and, uh, also, if you're using some softer in this case digital sending softer. That is HB

02:21

selling. And together with all these devices, which allows you to

02:27

do something more than just canto folder or toe to send to email, this can file,

02:35

and then you would need to set the past four for that as well.

02:38

Then you can set the inventive obsession Time out, which is said here on the factory default 30 minutes. I suggest that you put it even shorter because if somebody's working in various ever better Web server and forgets to log out,

02:59

then this should log out anyway and prevent somebody else accessing the ambit of observer that somebody who doesn't have the

03:09

rights to do that.

03:12

And then we have very important thing regarding security. So we have bgl security. So by setting numerical piojo past Fordham or Pink Old, you are basically

03:25

setting, preventing some off the PDO file system commands, device attendance commands, S and MP pastoral commands and environment commands that the fact that default environment off the device, you prevent them from being executed unless the bgl password is provided

03:46

now. Because I'm using this device in my home and there is no danger that I got going to be sending malware infested the print file, I will not do that. But it's very simple to enter it here,

04:01

and also you can enable these commands there by default disabled, so I don't actually need this password.

04:11

Then I have also disabled for security reasons the

04:16

postscript privileged operators, Um, so

04:21

if, uh,

04:24

you have learned what the postscript can do to the wise. So by disabling this, I have done,

04:31

um, a little bit more in terms of security when it comes to print job security.

04:39

Also, what I have disabled on this device is P J L drive access and posted

04:46

postscript drive access, meaning that from both postscript file or P jail commands. You cannot access car drive on this device.

04:55

Um, I have enabled devices USB because I'm using it sometimes to scan some things on the scanner off this, uh, amfb

05:03

and I have enabled host, plug and play because this is a feature I need sometimes for specific reason. Now, as I mentioned again, this is a home printer. I mean printer used at home.

05:17

My home and I don't have many of the problems people, usually in companies have. So if you're in a company, you'd

05:26

be very, very smart to disabled thes things unless it's specifically requested by the business.

05:35

And you can see at the end the status off security settings. So I'm not going to go into details of this anymore.

05:45

But let me just jump to networking,

05:48

and the first thing you can see networking is you have TCP I P settings

05:57

and you have D c P I p version four, which I'm using at home. There is no absolutely no reason for me to use the six. It would cost too much for home network. But what I have done is that I have set

06:10

the i P configuration to be manual, meaning that when I set the this I p address for this device, it stays

06:18

the other possible, uh, ways for this device to get the I P address would be with good

06:27

B a, the H c p or photo I p

06:30

uh the ex cp means that it would be given by my

06:34

router at home

06:36

for my cable Internet. But I don't want that. I want this I i p address to be fixed so I can point the drivers using the i P address.

06:49

But so if you go to the network settings as well, you here can see that I can set the community name for us an MP version one and two

07:01

in some environments e

07:03

this thing s and MP setting the order community name is different than the fault. So it has to be different. It's usually public by default But if people are using S and MP and they want toe, make it more secure than there's an MP community name wouldn't be public,

07:23

um,

07:25

or so if they're using S and MP version three, that means it has to have used name authentication, protocol and pass phrase. And if you remember, if you're using this, I would suggest that the past phrases 255 bytes long, not shorter. So use the maximum.

07:44

But these are the most important ones for the basic embedded Web server security settings,

07:50

which is,

07:53

uh, other settings and this device. And I'm going to uncheck a lot of these and explain why so 9100 printings of this port

08:03

is now going to be closed. The reason why we're closing it because it's a legacy, it's easily hackable. I'm not going to go into details how

08:13

LPD printing as well if you remember this is on them on a list of recommending best practices for printing,

08:20

then tell that conflict is going to be disabled.

08:24

Um, also bonjour and their prints are going to be disabled,

08:30

I PP printing is going to be disabled. FTP printing. He's going to be disabled,

08:37

and that's pretty much it here. So these things

08:41

I I I'm going to disable, um on and also so for I p p an i p p s full printing. So for secure pull printing, which I'm not using at home because it makes no sense.

08:58

Uhm I'm going to leave the verify certificate anyway, but I'm not using it, but it doesn't

09:05

make any doesn't do any harm to leave it like this.

09:09

So

09:11

if I click apply now here these things are going to be applied. And now they're going to

09:16

ah

09:18

be set in according to best practices. So what else we can do regarding security? For example, in this device, we can go toe authorization on and we're having jet direct certificate. This is this here,

09:35

and I haven't intentionally set the certificate getting Internet Explorer, which is the best for

09:43

browsing this embedded. But server I'm not usually using it, so I'm not setting the certificate here.

09:50

Uh, but if you click on view, you can see the certificate for this device, which is there because we're connecting through https

10:03

connection.

10:07

This is very important thing regarding the

10:11

the security of device if you're using something like this in a small environment with the small number of devices, for example, this one allows for 20. You can define the ah I P V four addresses and masks on devices that are allowed to access this printer,

10:30

and you conexes this Web server access from only these I p addresses, and that's it.

10:37

So if you are, for example ah, accessing server from ah, remote desktop on and you know the I P address of the server, you can set it here on DA and on Lee. From that server, you can access the inventive observer. Know what the else Connexus This is very nice thing to do

10:56

if you're in a big company and you're afraid that somebody will

11:01

set access the embedded observing even if you had set the password and everything,

11:07

there is a way to break passwords or for somebody confined about your password, but they cannot access it from the outside. They have to log in to the server and then access this device. Otherwise they won't be a log.

11:20

So,

11:22

um, there are many other things that you can do about setting security on a device using about the Observer. It really depends on your knees. I have shown you is just the most important ones.

11:35

Also, I have shown you what my device, which is HP laser jet can do. Other windows have different menu structure, have different settings, but almost all of them have. All of these or the most important things are said to be

11:54

ableto. They have it in a medical service so that you can set it and make follow the best practices for Prince security. And this is what's important. So you have seen how it's done.

12:07

I'm not making any special ways for you to do by yourself, because you need you need absolutely the same model of device or

12:20

HP device with the future smart forefinger regions installed in this device.

12:26

And so So, if you want to practice, if you have a net for access to network printer Andi, it's not protected that it doesn't have the password. You can go there and do the two things just to see how it's done.

12:41

Um,

12:43

uh, so just look at this. Go through this and you can understand

12:48

how you can do these things.