Secure MP?

[jmb]

Is there a way to make the management port on an 11.11 system secure? (This is a 7420). I see that SSL is available for Itanium servers, but this is RISC. Any way of putting ssh into the MP? Ideas?

Thanks.

[Sridhar Bhaskarla]

Hi,

No way I know of. You can probably try to limit it. Have another system (ssh gateway) in the same subnet as of your MP network and make sure it is on the same switch. Connect to the system using ssh and from there use telnet. This way only communication between the ssh gateway and the MP of the target system is unencrypted. If they are located in the same datacenter, then the risk is minimal.

-Sri

[Bill Hassell]

Other than the very latest servers, the management ports (LAN, modem or serial console) are far too open to allow remote access. For serial consoles, they should be connected to a secure terminal server that uses SSH to the server. For modems, always use airgap security (that is, throw away the phone cord). And for LAN connections to the managemant ports, never connect them to an open subnet. They should be isolated with a DMZ router and communication with the LAN consoles should take place via a system on the same LAN that only supports SSH from the outside world.

[jmb]

Bill, you say, "other than the latest servers". Which new servers are the exception to what you suggest, and how are they more secure?

[Bill Hassell]

I believe as you mentioned that the Itanium servers (non-PA-RISC) have SSL available. I don't think any PA-RISC servers have it.