Slashdot Mirror
Secure Printing?
RiverWolf asks: "As a Systems Administrator (a.k.a. 'paranoid security freak') I spend much of my time tightening down systems, loading patches, and just generally making sure no one does what they're not supposed too. While tools like ssh have become a staple for file transfer and terminal sessions, I recently began looking at all the little print servers we have throughout my offices and wondered "hmm, can those things be sniffed?".
Until now, my focus for printing has always been 'just get it working', but if someone can sniff the print jobs (like payroll and other confidential information) as they go across the network, then it doesn't matter how locked down eveything else is.
Is there a standard for secure (encrypted transmission) network printing, or does anyone know of a way to do this? I found this document that deals with it in a round about fashion, but with dozens of printers spread throughout multiple locations, I don't see it as an option."
It should be pretty trivial to wrap unix print clients and servers in an openssl tunnel. The same has been doen before with mail (smtp, pop3, imap, etc) protocols and others, with minimal (in some cases zero) modification to the original client/server source code.
11*43+456^2
Switches, billy, and lots of 'em!
Just make sure there's no hubs between your server and your printer, that they're on a switched network, and that client-to-server traffic is all encrypted. voila!
This becomes more of an issue with printers that just have a direct ethernet jacks. Also, a scary fact is lots of them have default administrative modes that allow crackers to literally just telnet too them and type in a password. Printers are becoming a security issue at many places, I would love to see some intelligent feedback in this thread.
:(
Your network is only as good as the weakest link.
set up an ssl tunnel between each client node and the print server(s). STunnel might help you out with this.
The One Rule Of Chess You'll Ever Need: Don't play someone who carries a kit in their bookbag.
If you're printing confidential information like payroll, the the printer is probably not in a public location. Otherwise, it's just as easy to look at the paper coming out as it is to sniff packets, if not easier.
What's wrong with a private network or a direct computer->printer connection via parallel/usb in this special case?
Perhaps a little bit off topic, but one of my favorite pranks when I used to work in downtown Seattle was printing "Happy April Fool's Day" on every printer simultaneously at a freinds company. You would have thought with 25 printers they woudl have a more secure network!
.....
Shouldn't you be able to do tunneling over SSH between the user's machine and the print server? Or does the printer connect directly into the ethernet?
Why bother? I am sure some people would say it would be needed for government or secret, blah blah. Well I work in a "secure" government facility and the physical security alone is enough to make printing in the area safe and secure, and the network is isolated and sheilded, etc etc etc, so to me this is a mute point. Anyway once you print it it can be intercepted, copied etc, not to mention the fact that the last page is still technically on the print drum till it is used again.
An example, where I work when something that needs to be printed is secret or confidential or something like that a printer directly connected to a printer is used. There are switches to switch between secure printing and network printing as well.
this is the most important sig ever! In your face 446154!
Many swiches now incorporate VLAN technology which a good application for this kind of problem.
(Assuming you are in fully switched network with everything going straight into VLAN capable switches of course.
Isn't that it's purpose after all?
Finding a print server that will be able to handle IPSEC is anothing matter though but if you are talking an actual computer as a print server then it's a non-issue.
But do not forget about the physical security of a printer. Sure you can protect the data all you want but once it is physically printed on a peiece of paper anyone can look at it!
LPRng seems to support Kerberos, but I don't know if it provides data encryption or is just used for authentication. I've also been playing around with the idea of adding direct SSL support to LPRng as an experiment, but it would probably only work with this bounce queues from another system.
The reason I'm mentioning this is to point out the unstated assumption that the worst that happens is that somebody can sniff the traffic to your printer. To me, that takes a distance back seat to the risk that somebody could impersonate your printer or feed it additional jobs.
As an example of this, imagine a shared printer in the sales department where someone has quietly changed the IP address - the print jobs are actually going to a laptop hidden in a closet where they'er spooled off to a competitor before being forwarded to the expected printer.
Or imagine monthly checks being spooled to the same system where the attacker can learn exactly who you get services from... and/or insert checks to dummy organizations they control into the data stream.
You can use SSL tunnels to provide a measure of confidentiality, but if you're serious about security you really need to be thinking about autheticating the printer (and possibly clients as well).
For every complex problem there is an answer that is clear, simple, and wrong. -- H L Mencken
Most office printers there days are IP connected. Therefore there is a crucial lan path that is nearly impossible to encrypt which is from the printer server to the print device. The Print device has the print engine inside it which is just reading the Print language so to speak, in most cases postscript. The server is nothing more than a switching station for print jobs to send them off to the proper printers. More so since these printers are IP connected to begin with the printer server can be avoided entirely as a client workstation can be setup by a savy(and enabled user) to print directly to the printer via IP. In the end its the printer makers themseleves which might need to be involved in solving this providing encryption in the device itself and the printer drivers.
It is certainly possible to sniff the traffic going to the printers IP and pick out the Postscript/PCL/etc commands which generate the print out and then recreate the document as things sit right now. The answer would be to encrypt in the drivers and decrypt in the print engine on the printer I would imagine, using some kind of public/private key echange, or perhaps a tunnel....
Power Corrupts,Absolute Power Corrupts Absolutely, leaving one person(group)in charge is absolutely corrupt.
(It would have been even funnier if the professors knew about the trick and printed fake exams over the network and the real exams locally.)
As a Systems Administrator (a.k.a. 'paranoid security freak') I spend much of my time tightening down systems, loading patches, and just generally making sure no one does what they're not supposed too.
Why do you say that?
While tools like ssh have become a staple for file transfer and terminal sessions, I recently began looking at all the little print servers we have throughout my offices and wondered "hmm, can those things be sniffed?".
What happened when tools like ssh have become a staple for file transfer and terminal sessions you recently began looking at all the little print servers you have throughout your offices and wondered hmm can those things be sniffed?
Until now, my focus for printing has always been 'just get it working', but if someone can sniff the print jobs (like payroll and other confidential information) as they go across the network, then it doesn't matter how locked down eveything else is.
What would happen if now your focus for printing has always been 'just get it working' but if someone can sniff the print jobs like payroll and other confidential information as they go across the network then it does not matter how locked down eveything else is?
Is there a standard for secure (encrypted transmission) network printing, or does anyone know of a way to do this?
I don't understand.
I found this document that deals with it in a round about fashion, but with dozens of printers spread throughout multiple locations, I don't see it as an option.
Is it because deals with it in a round about fashion but with dozens of printers spread throughout multiple locations you do not see it as an option that you came to me?
Thanks!
Can you elaborate on that?
-- An Eliza Troll post: As insightful as the average Slashdot post, or your money back.
CUPS allows use of IPP (Internet Printing Protocol) over SSL. I don't know whether Windows even supports IPP but it's pretty nifty on UNIX systems.
Although I like the simplicity of having direct attatchment to such confidential documentation printers, that might not be possible.
Have fun !
You are using a switched network, right? If so, snooping is not an issue (well, not a BIG issue anyways). Otherwise you have much larger problems on your hands than printing. It amazes me that people are still using hubs... it's 2002 right? Although I have to admit, my campus is guilty. The people I support are on a switched network, but we had to provide our own infrastructure. Everyone else in the building are on 10BaseT hubs :(
Otherwise, look at LPRng which supports tcp_wrappers, doesn't run as root, doesn't need to run as a daemon on all systems, supports access control so you don't have to su - to delete print jobs, stop the printer, etc. Supports kerberos... I could go on.
-Steve
Some things to keep in mind:
fencepost
just a little off
If you have a printer that connects directly to ethernet (or it's brotheren thinnet), what I would recommend doing is set up a second network with a linux box that has 2 nics (or more).
Use the Linux box as a ssh tunnel/gateway. On the workstation side all printing traffic will be ssh tunnled, on the other side where the printers reside in your awesome printer room. Use a managed hub that has mac addresses of the printers locked down and disallow any traffic from anything else.
OR... add a nic to the linux box for every printer and lock down the mac addresses of the printers there.
Something fishy happens all secure printing jobs get broke off and new prints get sent to the printers "Printer Security Alarm" as well as a message to your favoriate Pager or SMS to your cell.
DRACO-
Consider yourself blessed if you are sneezed on by a dragon and only get wet, it could have been a fireball.
First, to everyone who thinks that having a switched network adds much of anything in the way of anti-sniffing security, you should probably look at tools like ettercap or dsniff _now_.
Since an encrypted channel between the printer and the workstation (most likely a windows client, possibly a *nix client) would have to be supported by both the printer and the client, you've got an ugly situation -- both the client and server need to support the encryption/authentication/etc. protocol.
This would be fine if you were just about to discard all of your printers and start fresh again, were able to find suitable products, and the products offered acceptable encryption. Given that this situation is rather unlikely, here's another approach:
Get a 'firewall' style box that supports vpns. Make sure that vpn 'clients' are available for all of your workstation platforms. Put all of the printers behind this vpn-device, on their own private network, including the server that 'shares' the printers.
When the user prints the print driver connects to the different network, through a vpn tunnel. The strength of the encryption on the vpn can be tuned independently of any other aspect of the system.
This leaves the rather obvious hole that someone could disconnect an ethernet cable from the printer, put in a small hub, and then sniff from there. Maybe you bolt the printers into a 'security box' that prevents access to the network connection, and do something similar to the wall jack. At some point you have to give up on paranoia and just monitor things.
"But actually trying to use m4 as a general-purpose langage would be deeply perverse" --ESR
Encrypted?? Sorry, I'm afraid not. Switches do not encrypt anything the traffic will still be plain text or plain PCL anyway. Additionally, sniffing a switched network is a trivial task.
I realize that old books state that one of the advantages of switches is security and the switch vendors preached this mantra for several years. But, it no longer holds true, if it ever did. The fact is that I can sniff your traffic on a switched network, even if your VLAN spans the globe.
I'm afraid that this isn't so. It is trivial to sniff a switched network so switches don't offer any security. LPRng doesn't help either as the problem isnt the print server daemon it is the printer itself.
For those that don't see the issue, I'll try to explain. Most if not all network printers today, do not have a secure channel between the submitter and the printer itself. This means that print jobs can be intercepted and read from the wire. Big deal? Well suppose that the print job is an ultra secret NSA document or perhaps the blueprint for a secret weapon, that would be a big deal.
The second issue is control of the printer itself. Suppose that the printer is a cheque printer in a bank or insurance company. It is possible for you to submit your own job to the printer. This means that you can print your own cheques on the companies official cheque stock. Now, I understand that network printers have authentication which can be turned on to control access to the printer. But, this password based access control is communicated in plain text on the wire, like a telnet session. That means that even if you password protect the printer, it is possible to sniff a legitimate print job and get the password. Then you have control of the printer and again start submitting your own jobs.
Right now, the only means of securing printers is to directly attach the printer to the print server, either via cable or a VLAN with only the printer and the server on it and no means of routing beyond the VLAN. Also, a secure channel is required between the client workstation that generates the print job and the print server. This can be done with ssl or ssh or even IPSec.
What is needed is a network printer that will speak only ssl or IPSec between the printer and the submitter, then the password based access control can be effective.