StorageTek SL4000 Modular Library System

Security Guide

E84232-01

August 2017

StorageTek SL4000 Modular Library System Security Guide

E84232-01

Copyright © 2017, Oracle and/or its affiliates. All rights reserved.

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, then the following notice is applicable:

U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government.

This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications.

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group.

This software or hardware and documentation may provide access to or information about content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services unless otherwise set forth in an applicable agreement between you and Oracle. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services, except as set forth in an applicable agreement between you and Oracle.

Contents

Preface

- Documentation Accessibility

- Related Documentation

1 Overview

- Network Access

- General Security Principles

- Keep Software Up To Date

- Restrict Network Access

- Keep Up To Date on Latest Security Information

2 Security Features

- Library Interface Credential Requirements

- Users and Roles

- Certificates for HTTPS Interfaces

- Library Network Interfaces

- Default Port Numbers

- Browser and Web Services Interfaces

- Service Access

- SNMP

- E-mail

- DNS

- NTP

- Oracle Key Manager (OKM)

3 Installation

- Handing-Off the Library to the Customer

- Creating the Administrator User

- Configuring the HTTPS Certificate

- Redeployment

A Secure Deployment Checklist

Preface

This guide provides security principles and guidelines for Oracle's StorageTek SL4000 modular tape library (SL4000).

Documentation Accessibility

For information about Oracle's commitment to accessibility, visit the Oracle Accessibility Program website at http://www.oracle.com/pls/topic/lookup?ctx=acc&id=docacc.

Access to Oracle Support

Oracle customers that have purchased support have access to electronic support through My Oracle Support. For information, visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=info or visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=trs if you are hearing impaired.

Related Documentation

Go to the Tape Storage section of the Oracle Help Center (http://docs.oracle.com/en/storage/#tape) for additional SL4000 documentation:

- SL4000 Library Guide

- SL4000 SCSI Reference Guide

- SL4000 Safety and Compliance Guide

- SL4000 Licensing Information User Manual

1 Overview

This chapter describes the general security principles for the SL4000 tape library. For an overview of the product, see the SL4000 Library Guide.

Network Access

Oracle designs and documents all tape library products for use within a controlled server environment with no general network or user access. Network access is required between the library and various other servers and workstations, including:

- Workstations used to access the library through the GUI or SCI interfaces

- Servers running applications that use the SCI interface, such as an ACSLS server or a custom application that uses SCI

- SMTP servers for sending e-mail notifications

- SNMP servers

- SDP2 server for "phone-home" (ASR) functionality

- Oracle Key Manager (OKM) clusters for delivering encryption keys to tape drives

User access to the library requires credentials (id and password) to be created on the library and to be used when connecting to the library.

General Security Principles

The following principles are fundamental to using any product securely.

Keep Software Up To Date

Keep all software versions and patches up to date. This document assumes a software level of version 1.0.

Restrict Network Access

Keep the library behind a data center firewall to restricted access to a known network route, which can be monitored and restricted if necessary. As an alternative, you can substitute a firewall router for multiple, independent firewalls. You should identify the hosts allowed to attach to the library and block all other hosts where possible.

Keep Up To Date on Latest Security Information

Oracle continually improves its software and documentation. Check this document every release for revisions.

2 Security Features

This chapter describes security features of the SL4000 tape library.

Library Interface Credential Requirements

The library provides a browser-based GUI interface and a web services API (StorageTek Library Control Interface - SCI) for configuring, managing, and operating the library. Connecting with either interface requires valid credentials (user ID and password).

When using the GUI, whether remotely with a browser or locally at the operator panel, you must provide a valid user ID and password to log in.

When using SCI, you must embed the user ID and password into the SOAP header of each SCI method call. The library uses the WS-Security SOAP extension as defined by OASIS WS-SecurityPolicy 1.2 (July 2007). Because the credentials in the header are in plain text, SCI must use an HTTPS connection. The exact details of how to include the SOAP headers depends on the language used to invoke the web services API.

Users and Roles

There are two categories of users – customer (with four roles: Viewer, Operator, User, and Administrator) and service (with three roles: Service, Advanced Service, and Escalation). A user's role determines their access to GUI functions and SCI methods:

- See the ”User Roles” section of the SL4000 Library Guide for role descriptions and authorized GUI functions.

Creating Customer Users

The administrator can use the GUI to create customer users by defining the user ID, password, and role (see the ”Add, Modify, or Delete a User” section in the SL4000 Library Guide). Passwords must be at least eight characters long and include a mix of letters (uppercase or lowercase) and numbers.

Creating Service Users

Service users are either automatically generated by the library following the detection of a fault or manually created by the administrator. Service users have a specified role, but a randomly generated user ID and encrypted password (known as a key file). Oracle Services can decrypt the key file to provide the credentials to a field engineer. Service users expire 72 hours after creation and cannot be extended.

When the library detects a fault, it automatically creates a user with the "Service" role and generates an encrypted support bundle (which contains the service key file). You must manually transmit the support bundles to Oracle Service, unless you have configured the library to perform Automated Service Requests (ASR). If the fault requires more than 72 hours to resolve or requires a higher-level service role, the administrator may need to create an additional service user ID through the GUI (see the ”Add a Service User” in the SL4000 Library Guide).

Certificates for HTTPS Interfaces

To ensure the security of connections over HTTPS, a certificate is required on the library. The library supports three certificate types:

- Default certificate (weak encryption, not recommended for use beyond installation)

- Self-signed certificate (strong encryption, but requires a security exception in the browser)

- Third-party signed certificate (strong encryption, guaranteed security, automatically accepted by most browsers)

During initial installation, the library uses the default certificate. You should replace it by generating a new self-signed certificate (see "Generate a Self-Signed Certificate" in the SL4000 Library Guide). Using a self-signed certificate is secure, but will cause browsers to generate a warning when connecting to the library. To avoid this warning, you must configure a security exception in the browser or install a third-party signed certificate.

After generating a self-signed certificate, you may install a third-party signed certificate which offers the strongest encryption and security, and eliminates the need for a browser security exception. Creating a properly signed certificate is a two step process. First, download the certificate signing request (CSR) from the library and submit the CSR to a third-party certifying authority (CA). Then, once the CA creates the signed certificate, upload it to the library along with a copy of the CA's certificate (see "Install a Third-Party-Signed Certificate" in the SL4000 Library Guide). Provided the certificate is signed by a well known CA, the browser will connect over HTTPS without warnings.

Library Network Interfaces

The library has four sets of external network interfaces located in the Base Module's card cage on the Library Controller and Root Switch Cards. For a diagram of the physical locations of the ports, see "Base Module Card Cage" in the SL4000 Library Guide.

- Customer ports — Used to connect the library into the customer's network. Used for library management functions (configuration, code upgrades, monitoring, and so on). Used by applications that use the web services interface (SCI).

- Service port — May be used to connect to a "phone home server" (specifically Automated Service Requests (ASR) using SDP2). If connected to SDP2, the port will be connected continuously. Service engineers can also use this port while servicing the library.

- OKM port — Used to connect the library to an Oracle Key Management (OKM) cluster. However, you may connect to an OKM cluster using the Service or Customer interface.

- Inter-library ports — These ports are disabled and not used in a SL4000 library.

Default Port Numbers

By default, the library uses the port numbers listed in the table below. If using a firewall, configure it to allow traffic to use these ports. Enable the ports listed below on each of the network interfaces that are in use (except the OKM ports — you only need to enable the OKM ports on the network interface used to connect to the OKM cluster. See Oracle Key Manager (OKM)).

Port

IP

Protocol

Description

Direction

22

TCP

SSH

SSH access to Linux running on library. Only enabled for 72 hours after an "Escalation" role service user is created.

To library

25

TCP

SMTP

Connection to external SMTP (Simple Mail Transfer Protocol) server. Required if you have configured any e-mail destinations.

From library

53

TCP & UDP

DNS

DNS (domain name server) lookup.

From library

80

TCP

HTTP

Default port for browser access.

To library

161

UDP

SNMP

Inbound GET requests through SNMP.

To library

162

UDP

SNMP

Outbound SNMP TRAPs.

From library

123

TCP

NTP

Connection from library to an external NTP server.

From library

443

TCP

HTTPS

Default port for browser and web services interfaces.

To library

7104

TCP

HTTP

Alternate port for browser access.

To library

7102

TCP

HTTPS

Alternate port for browser and web services interfaces.

To library

7104

TCP

HTTP

Browser GUI based access to WebLogic console running on the library. Only accessible by an "Escalation" user.

To library

7105

TCP

HTTPS

Browser GUI based access to WebLogic console running on the library. Only accessible by an "Escalation" user.

To library

Externally Defined

TCP

HTTP & HTTPS

Servers that are configured to receive outbound SCI calls will listen for SCI calls on ports of their choice. Open these port number in any firewalls and provided the port numbers configuring the destination on the library.

From library

Externally Defined

TCP

OKM

If the library is configured to retrieve tape drive encryption keys from a OKM cluster, open the ports used for OKM (see the OKM documentation).

From library

Browser and Web Services Interfaces

The GUI can use both HTTP and HTTPS. The SCI interface uses only HTTPS to secure for the credentials passed in each request. By default, these two protocols are on their standard port number of 80 for HTTP and 443 for HTTPS. You can modify these ports in the GUI (see "Configure the Library with the Configuration Wizard" in the SL4000 Library Guide).

Service Access

Under normal library operations only customer-created users may log in to the library However, the administrator can enable service access when necessary (see Creating Service Users). Creating a service user with an Escalation role enables access to the library that is not normally allowed. Specifically, an Escalation user can log in to Linux on the library using SSH on port 22 and can access the WebLogic console function using port 7104 for HTTP or 7105 for HTTPS. Service users expire 72 hours after creation. The library disables port 22 if there are no enabled service users. The library always enables ports 7104 and 7105, but unless an Escalation user exists, there are no valid users that can log in to the WebLogic console.

SNMP

The library supports SNMP v3 protocol. The library uses ports 161 (inbound) and 162 (outbound) for SNMP GET commands and SNMP traps respectively.

E-mail

The library can send e-mail messages when certain events occur (see "Configuring Notifications" in the SL4000 Library Guide). If you configure e-mail destinations, you must also configure an SMTP server and open port 25.

DNS

DNS configuration is optional. You only need to configure DNS if destinations (SNMP, E-mail, Outbound SCI) use host names. You can add up to three DNS servers (see "Configure the Library with the Configuration Wizard" in the SL4000 Library Guide). DNS uses port 53.

NTP

The library can use an external NTP server to control the library clock. If using an external NTP server, you must open port 123.

Oracle Key Manager (OKM)

You can connect an OKM cluster to the library's customer port, service port, or OKM port. The location of the OKM appliance within your network determines which port you should use. You select the port during network configuration of the library (see "Configure the Library with the Configuration Wizard" in the SL4000 Library Guide). Unlike older tape libraries, the SL4000 only requires a single connection to OKM, rather than individual connections to each encrypted tape drive. You must open the ports used by OKM on the selected connection. See the OKM documentation for details on which port numbers to use.

3 Installation

An Oracle installation engineer will install and test the SL4000 library using a pre-defined user ID ("installer") which initially uses with a well-known password. The first step the installer performs is to change this password.

Handing-Off the Library to the Customer

After testing the SL4000, the installation engineer begins the hand-off process to transfer the library to the customer. The hand-off involves creating an Administrator user and finalizing the HTTPS certificate. The installation engineer initiates the hand-off, but the library administrator must complete the process.

Creating the Administrator User

In the first step of the hand-off, the administrator enters a user ID and password to create the Administrator account. After completing the hand-off, the library will remove the Installer user and the newly created Administrator user will be the ONLY account that can log in to the library.

Configuring the HTTPS Certificate

In the second step of the hand-off, the administrator configures the certificate for HTTPS. There are two options:

1. Continue to use the default certificate (not recommended)

2. Generate a new self-signed certificate.

If you do not generate a self-signed certificate, you can still access the library using HTTPS, but it will use the weakest form of encryption. If you generate a self-signed certificate, the library begins using it immediately. For best security, you should replace the self-signed certificate with a third-party signed certificate (see "Install a Third-Party Signed Certificate" in the SL4000 Library Guide).

Redeployment

If you need to decommission the library, an Administrator or Service user can reset the library to factory defaults through the GUI. However, you CANNOT undo this action. Redeploying the library will require Oracle Services to re-perform the installation and customer hand-off.

A Secure Deployment Checklist

The following security checklist includes guidelines that help secure the library:

- Enforce password management

- Enforce access controls

- Restrict network access

- Implement a firewall

- The firewall must no be compromised

- Monitor system access

- Check network IP addresses

- Contact Oracle Security Products if you encounter any vulnerability in Oracle tape libraries

Oracle Legal Notices

Copyright Notice

Copyright © 1994-2019, Oracle and/or its affiliates. All rights reserved.

License Restrictions Warranty/Consequential Damages Disclaimer

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

Warranty Disclaimer

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

Restricted Rights Notice

If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, then the following notice is applicable:

U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government.

Hazardous Applications Notice

This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications.

Trademark Notice

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group.

Third-Party Content, Products, and Services Disclaimer

This software or hardware and documentation may provide access to or information about content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services unless otherwise set forth in an applicable agreement between you and Oracle. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services, except as set forth in an applicable agreement between you and Oracle.

Pre-General Availability Draft Documentation Notice

If this document is in public or private pre-General Availability status:

This documentation is in pre-General Availability status and is intended for demonstration and preliminary use only. It may not be specific to the hardware on which you are using the software. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to this documentation and will not be responsible for any loss, costs, or damages incurred due to the use of this documentation.

Private Pre-General Availability Draft Documentation Notice

If this document is in private pre-General Availability status:

The information contained in this document is for informational sharing purposes only and should be considered in your capacity as a customer advisory board member or pursuant to your pre-General Availability trial agreement only. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions. The development, release, and timing of any features or functionality described in this document remains at the sole discretion of Oracle.

This document in any form, software or printed matter, contains proprietary information that is the exclusive property of Oracle. Your access to and use of this confidential material is subject to the terms and conditions of your Oracle Master Agreement, Oracle License and Services Agreement, Oracle PartnerNetwork Agreement, Oracle distribution agreement, or other license agreement which has been executed by you and Oracle and with which you agree to comply. This document and information contained herein may not be disclosed, copied, reproduced, or distributed to anyone outside Oracle without prior written consent of Oracle. This document is not part of your license agreement nor can it be incorporated into any contractual agreement with Oracle or its subsidiaries or affiliates.

Documentation Accessibility

For information about Oracle's commitment to accessibility, visit the Oracle Accessibility Program website at http://www.oracle.com/pls/topic/lookup?ctx=acc&id=docacc.

Access to Oracle Support

Oracle customers that have purchased support have access to electronic support through My Oracle Support. For information, visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=info or visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=trs if you are hearing impaired.