RedMax EXtreme EX-LRT Guía para resolver problemas descargar pdf (Pagina 19)

Oracle SBC Security Guide

 0x10 – Enables a second sshd server that provides access to the linux system console. This server

process is different from the ssh server used to access the ACLI for configuration.

 0x80008 – enable source routing on the management port

For further information on boot flags refer to Section 4 “Configuration Elements A-M” of the ACLI

Reference Guide.

System ACLs

The Wancom0 Ethernet management interface should always be deployed in a secure non-public

network.

The SBC provides static System Access Control List functionality (ACL) to protect the Wancom0

interface from other devices that can access the management LAN remotely. Only the management

station(s) authorized for SBC access such as the Oracle Communications Session Element Manager

should be permitted with ACLs. All system ACLs are considered “allow” ACLs, and include a specific IP

source address / netmask and the IP protocol allowed. As the first ACL is created an implicit deny rule is

inserted as the final ACL.

The “system-access-list” configuration is detailed in Section 3 “System Configuration” of the ACLI

Configuration Guide.

Telnet/SSH

By default, telnet is enabled on the SBC Wancom0 management interface. Disable telnet and use SSH

instead. The exception is the 6000 series platforms which disable telnet by default.

To avoid unauthorized access to the telnet/SSH interface, a timeout should be configured to automatically

disconnect the terminal session after an appropriate period of time (i.e. 300 seconds). Timeouts are

disabled by default.

The SBC supports viewing, importing, and deleting public ssh keys used for authentication of SSHv2

sessions.

Configuration is detailed in Section 2 “Getting Started” of the ACLI Configuration Guide, and Section 4

“System Management” of the Maintenance and Troubleshooting Guide.

FTP/SFTP

By default, FTP is enabled on the SBC Wancom0 management interface. Disable FTP and use SFTP

instead. The exception is the 6000 series platforms which disable FTP by default.

Configuration is detailed in Section 2 “Getting Started” of the ACLI Configuration Guide.

GUI Management

The SBC can be managed by the Oracle Communications Session Element Manager either directly in an

ACLI session or via the a SOAP/XML interface over TCP ports 3000 and 3001.

By default these ports are enabled in system-config > remote-control. If the SBCs are not remotely

controlled by a Session Element Manager then this feature should be disabled.

CAUTION: Disabling the remote-control feature is incompatible with the SBC HA architecture.

Hence this functionality is considered optional and should only be deployed where HA and EMS

1 2 ... 14 15 16 17 18 19 20 21 22 23 24 ... 141 142

Sin comentarios

RedMax EXtreme EX-LRT Guía para resolver problemas Pagina 19