CHAPTER 8
System Security
This chapter describes the StarOS security features.
This chapter explores the following topics:
•
Protection of Passwords, page 75
•
Support for ICSR Configurations, page 76
•
Encrypted SNMP Community Strings, page 77
•
Lawful Intercept Restrictions, page 77
•
Adding, Modifying and Removing Users, page 78
•
Test-Commands, page 79
Protection of Passwords
Users with privilege levels of Inspector and Operator cannot display decrypted passwords in the configuration
file via the command line interface (CLI).
Secure Password Encryption
By default for StarOS releases prior to 21.0 the system encrypts passwords using an MD5-based cipher (option
A). These passwords also have a random 64-bit (8-byte) salt added to the password. The chassis key is used
as the encryption key.
Setting a chassis key supports an encryption method where the decryption requires the knowledge of a "shared
secret". Only a chassis with knowledge of this shared secret can access the passwords. To decipher passwords,
a hacker who knew the chassis key would still need to identify the location of the 64-bit random salt value
within the encryption.
Passwords encrypted with MD-5 will have "+A" prefixes in the configuration file to identify the methodology
used for encrypting.
ASR 5500 System Administration Guide, StarOS Release 21.5
75
To Next Page
Loading...
Need help?
General
