Slashdot Mirror

← Back to Stories (view on slashdot.org)

Security in UPS Software?

Posted by Cliff on from the keeps-you-up-thru-a-blackout-leaving-crackers-an-open-door dept.

Anonymous Coward asks: "Does anyone have experience with UPS software that has an eye towards security? i want an alternative to APC's 'Powerchute for Linux'. I've just discovered that Powerchute opens multiple ports and there are no options to turn this 'feature' off. What is even worse is that APC Support has announced no plans to address the issue. This means that if your firewall is running Powerchute, you might have security issues. Another example of the lax security: Powerchute requests root priveliges on install and has a certain 3-letter default password that anyone could guess within 5 minutes! Can anyone help with suggestions for alternative software?" Hmmm... I wonder if I accidentally put the default password in the text of this story.

2 of 42 comments (clear)

  1. Re:SNMP by Pauly · · Score: 3, Insightful
    You do know you're not likely to get to use anything better than SNMP v1. That's at least as big a security issue. SNMP v1 is rightly derided as Security is Not My Problem.

    My advice is to carefully firewall that machine with iptables. Block any network activity on the port that doesn't originate from the localhost. Also, be sure to filter spoofed packets.

    Or simply write your own damn software. How hard can it be to snoop the traffic on the serial line that connects to the UPS and reverse engineer the protocol?

  2. firewall the ports by Spacelord · · Score: 1, Insightful

    ipchains/iptables/ ... are your friend!

    Every server should have it's own firewall script anyway that only allows incoming traffic on a limited set of ports.