Download Xerox Workcentre 5755 Service Manual Software

Xerox WORKCENTRE 5755 Manuals Manuals and User Guides for Xerox WORKCENTRE 5755. We have 11 Xerox WORKCENTRE 5755 manuals available for free PDF download: System Administrator Manual, User Manual, Information Manual, Getting Started Manual, Datasheet, Secure Installation And Operation, How To Make. Xerox WorkCentre 5735/5790 Service Manual&Parts ListThis service repair manual has Detailed Pictures, Diagrams, It gives DOWNLOAD.

Xerox Workcentre 7765 Driver Download
Xerox Workcentre 5755 Manual
Xerox Workcentre 5740 Driver
Download Xerox Workcentre 5755 Driver

Size:Download

Xerox WorkCentre

5735/5740/5745/5755/5765/5775/5790

Information Assurance Disclosure Paper Version 2.0

Prepared by:

Larry Kovnat

Xerox Corporation

1350 Jefferson Road

Rochester, New York 14623

XEROX WorkCentre 5735/5740/5745/5755/5765/5775/5790 Information Assurance Disclosure Paper

Other company trademarks are also acknowledged.

Document Version: 1.00 (May 2010).

XEROX WorkCentre 5735/5740/5745/5755/5765/5775/5790 Information Assurance Disclosure Paper

1.	INTRODUCTION .................................................................	5
1.1.	Purpose ..........................................................................................	5
1.2.	Target Audience ..................................................................................	5
1.3.	Disclaimer ........................................................................................	5

2.	DEVICE DESCRIPTION............................................................		6
2.1.	Security-relevantSubsystems .....................................................................	6
2.1.1.		Physical Partitioning....................................................................................	6
2.1.2.		Security Functions allocated to Subsystems ............................................................	7
2.2.	Controller ........................................................................................	8
2.2.1.		Purpose ................................................................................................	8
2.2.2.		Memory Components ..................................................................................	8
2.2.3.		External Connections .................................................................................	10
2.2.4.		USB Ports .............................................................................................	10
2.2.	Fax Module.....................................................................................	11
2.3.1.		Purpose ...............................................................................................	11
2.3.2.		Hardware .............................................................................................	11
2.4.	Scanner .........................................................................................	11
2.4.1.		Purpose ...............................................................................................	11
2.4.2.		Hardware .............................................................................................	11
2.5.	Graphical User Interface (GUI) ..................................................................	12
2.5.1.		Purpose ...............................................................................................	12
2.5.2.		Hardware .............................................................................................	12
2.6.	Marking Engine (also known as the Image Output Terminal or IOT) .............................	13
2.6.1.		Purpose ...............................................................................................	13
2.6.2.		Hardware .............................................................................................	13
2.6.3.		Control and Data Interfaces ..........................................................................	13
2.7.	System Software Structure ......................................................................	13
2.7.1.		Open-sourcecomponents .............................................................................	13
2.7.2.		OS Layer in the Controller .............................................................................	13
2.7.3.		Network Protocols ....................................................................................	15
2.8.	Logical Access...................................................................................	16
2.8.1.		Network Protocols ....................................................................................	16
2.8.2.		Ports ..................................................................................................	17
2.8.3.		IP Filtering ............................................................................................	21

3.	SYSTEM ACCESS................................................................	22
3.1.	Authentication Model ...........................................................................	22

XEROX WorkCentre 5735/5740/5745/5755/5765/5775/5790 Information Assurance Disclosure Paper
3.2.	Login and Authentication Methods..............................................................	24
3.2.1.	System Administrator Login [All product configurations] ..............................................	24
3.2.2.	User authentication...................................................................................	24 I would like to install drivers for a psc 1510 all in one on my android tablet. I have used your download site before with success. But I didn't see - 2981899. The HP Print Service Plugin enables printing from your Android device to your HP printer over a Wi-Fi network, or using the Wi-Fi Direct connection for printers that support that connection type. Step 1: Install and turn on the HP Print Service Plugin. Hp deskjet free download - HP Orbit, HP All-in-One Printer Remote, HP Sprocket, and many more programs. Hp deskjet 1050 driver, hp deskjet 1050 print scan. The HP Print Service plugin is. Hp deskjet drivers for mac.
3.3.	System Accounts ................................................................................	26
3.3.1.	Printing [Multifunction models only]..................................................................	26
3.3.2.	Network Scanning [Multifunction models only] .......................................................	26
3.4.	Diagnostics .....................................................................................	27
3.4.1. Service [All product configurations] ...................................................................		27
3.4.2. Alternate Boot via Serial Port .........................................................................		27
3.4.3. tty Mode..............................................................................................		27
3.4.4. Diagnostics via Portable Service Workstation (PSW) Port ..............................................		27
3.4.5. Summary.............................................................................................		30
4. SECURITY ASPECTS OF SELECTED FEATURES ...................................		31
4.1.	Audit Log .......................................................................................	31
4.2.	Xerox Standard Accounting.....................................................................	39
4.3.	Automatic Meter Reads .........................................................................	40
4.4.	Encrypted Partitions ............................................................................	40
4.5.	Image Overwrite ................................................................................	40
4.5.1. Algorithm .............................................................................................		41
4.5.2. User Behavior .........................................................................................		41
4.5.3. Overwrite Timing .....................................................................................		41
5. RESPONSES TO KNOWN VULNERABILITIES .....................................		42
5.1.	Security @ Xerox (www.xerox.com/security) .....................................................	42
6. APPENDICES....................................................................		43
6.1.	Appendix A – Abbreviations .....................................................................	43
6.2.	Appendix B – Supported MIB Objects............................................................	45
6.3.	Appendix C –Standards .........................................................................	48
6.4.	Appendix E – References ........................................................................	50

XEROX WorkCentre 5735/5740/5745/5755/5765/5775/5790 Information Assurance Disclosure Paper

1. Introduction

The WorkCentre 5735/5740/5745/5755/5765/5775/5790 multifunction systems are among the latest versions of Xerox copier and multifunction devices for the general office.

1.1. Purpose

The purpose of this document is to disclose information for the WorkCentre products with respect to device security. Device Security, for this paper, is defined as how image data is stored and transmitted, how the product behaves in a networked environment, and how the product may be accessed, both locally and remotely. Please note that the customer is responsible for the security of their network and the WorkCentre products do not establish security for any network environment.

The purpose of this document is to inform Xerox customers of the design, functions, and features of the WorkCentre products relative to Information Assurance (IA).

This document does NOT provide tutorial level information about security, connectivity, PDLs, or WorkCentre products features and functions. This information is readily available elsewhere. We assume that the reader has a working knowledge of these types of topics. However, a number of references are included in the Appendix.

1.2. Target Audience

The target audience for this document is Xerox field personnel and customers concerned with IT security.

1.3. Disclaimer

The information in this document is accurate to the best knowledge of the authors, and is provided without warranty of any kind. In no event shall Xerox Corporation be liable for any damages whatsoever resulting from user's use or disregard of the information provided in this document including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Xerox Corporation has been advised of the possibility of such damages.

XEROX WorkCentre 5735/5740/5745/5755/5765/5775/5790 Information Assurance Disclosure Paper

2. Device Description

This product consists of an in put document handler and scanner, marking engine including paper path, controller, and user interface.

Document Feeder & Scanner Graphical User (IIT)

Interface (GUI)

Paper Trays

Marking Engine (IOT)

High-volumefinisher and

booklet maker accessories

High-capacityfeeder accessory

Figure 2-1WorkCentre Multifunction System

2.1.Security-relevantSubsystems

2.1.1.Physical Partitioning

The security-relevantsubsystems of the product are partitioned as shown in Figure2-2.

XEROX WorkCentre 5735/5740/5745/5755/5765/5775/5790 Information Assurance Disclosure Paper

and TOE internal wiring	(proprietary)
Button

Physicalexternal interface

Figure 2-2System functional block diagram

2.1.2. Security Functions allocated to Subsystems

Security Function	Subsystem
Image Overwrite	Controller
Graphical User Interface
System Authentication	Controller
Graphical User Interface
Network Authentication	Controller
Graphical User Interface
Security Audit	Controller
Cryptographic Operations	Controller
User Data Protection – SSL	Controller
User Data Protection – IP Filtering	Controller
User Data Protection – IPSec	Controller
User Data Protection – Disk Encryption	Controller
Network Management Security	Controller
Fax Flow Security	Fax Module
Controller
Graphical User Interface

XEROX WorkCentre 5735/5740/5745/5755/5765/5775/5790 Information Assurance Disclosure Paper

Security Function	Subsystem
Security Management	Controller
Graphical User Interface

Table 1 Security Functions allocated to Subsystems

2.2.Controller

2.2.1.Purpose

The controller provides both network and direct-connectexternal interfaces, and enables copy, print, email, network scan, server fax, internet FAX, and LanFAX functionality. Network scanning, server fax, internet fax, and LanFax, are standard features.

NOTE: The Copier only version includes a hard drive which is used to hold Operating System software, printing applications, and jam clearance videos. Job Image data is not stored on this disk.

Image Overwrite, which is included as a standard feature, enables both Immediate and On-Demandoverwrite of any temporary image data created on disk. The controller also incorporates anopen-sourceweb server (Apache) that exports a Web User Interface (WebUI) through which users can submit jobs and check job and machine status, and through which system administrators can remotely administer the machine.

The controller contains the image path, which uses proprietary hardware and algorithms to process the scanned images into high-qualityreproductions. Scanned images may be temporarily buffered in DRAM to enable electronicpre-collation,sometimes referred to asscan-once/print-many.When producing multiple copies of a document, the scanned image is processed and buffered in the DRAM in a proprietary format. Extended buffer space for very large documents is provided on the network disk. The buffered bitmaps are then read from DRAM and sent to the Image Output Terminal (IOT) for marking on hardcopy output. For long documents, the production of hardcopy may begin before the entire original is scanned, achieving a level of concurrency between the scan and mark operations.

The controller operating system is Wind River Linux, kernel v. 2.6.20+. (Note: Consistent with Flaw Remediation, this baseline may be updated as indicated by the ‘+’ sign. Unnecessary services such as rsh, telnet and finger are disabled in the OS. FTP is used in client-onlymode by the network scanning feature for the filing of scanned images and the retrieval of Scan Templates; however the controller does not contain an FTP server.

The controller works with the Graphical User Interface (GUI) assembly to provide system configuration functions. A System Administrator PIN must be entered at the GUI in order to access these functions.

2.2.2. Memory Components

Volatile Memory

Type (SRAM, DRAM,	Size	User	Function or Use	Process to Sanitize
etc)	Modifiable
(Y/N)
DDR2 SDRAM	1GB	N	Single Board Controller	Subsequent jobs overwrite
Upgradeable to	2GB	(System and user image stored)	the data and all images are
Upgradeable to	2GB	(System and user image stored)	lost at power off or reboot.

Additional Information: There are also a number of RAM buffers in the video path that are used for image manipulation (Reduce/Enlarge, etc.), and all have no data retention capability. When power is removed all data is lost. These buffers are typically built into the ASICs. Typical bleed down time for all volatile memory is 10 seconds.

XEROX WorkCentre 5735/5740/5745/5755/5765/5775/5790 Information Assurance Disclosure Paper

Non-VolatileMemory

Type (Flash, EEPROM,	Size	User	Function or Use	Process to Sanitize
etc)	Modifiable
(Y/N)
Flash ROM	128MB	N	Single Board Controller	No user image data stored
(Boot code and system file)
NVRAM	128KB	N	Single Board Controller	No user image data stored.
(Xerographic set points)

Additional Information: There are other non volatile memory devices in the system, but these are used solely for low level I/O control. Some examples of this distributed control are:

• Power distribution, Photoreceptor and main drive motors control

• Raster Output Scanner (ROS)

• Paper Registration

• Finisher

Table 2 Controller memory components

Media and Storage

Type (disk drives,	Removable	Size:	User	Function:	Process to Sanitize:
tape drives, CF/SD/XD	Y / N	Modifiable:
memory cards, etc.):	Y / N
Disk drive	N	80GB	N	Network Controller	On Demand Image
Application and Copy	Overwrite
Controller Application
software. Image
storage, processing and
Overflow EPC image
storage.
Fax Card	N	512MB	N	User FAX image data	User image data
stored	overwritten at the
completion of each fax
job.
Overwritten by
Standard or Full
ODIO operation
Table 3 Hard Disk Drives

XEROX WorkCentre 5735/5740/5745/5755/5765/5775/5790 Information Assurance Disclosure Paper

2.2.3. External Connections

Figure 2-3Back panel connections

Reportico PHP Report Designer An Open Source PHP web reporting tool. Design reports. Build Report Menus. Embed reports in web pages. Add criteria selection. Run to HTML, PDF, CSV. Bootstrap compatible. The Open Source PHP Reporting Tool Design Reports. Embed Reports. Criteria Groups Charts Expressions Drilldowns Integrated plugins for Joomla, Laravel, Yii 1.1 and 2.0 and October CMS.

Interface	Description / Usage
FAX line 1, RJ-11	Supports FAX Modem T.30 protocol only
FAX line 2, RJ-11	Supports FAX Modem T.30 protocol only
USB Host Port	Software upgrade
PSW USB Target Port	Direct-connectprinting; Xerox diagnostic tools (PSW and CAT)
and Xerox copier assistant
Ethernet	10/100/1000 Network connectivity
Scanner	Proprietary connection between the scanner and controller
carrying power and communications
Serial Port	Engineering development debug; default state is disabled
Foreign Device Interface (FDI)	Allows connection of optional access control hardware

Table 4 Controller External Connections

2.2.4. USB Ports

The WorkCentre contains a host connector for a USB flash drive, enabling upload of software upgrades and download of network logs or machine settings files.

Autorun is disabled on this port. No executable files will be accepted by the port.

Modifying the software upgrade, network logging or saved machine settings files will make the files unusable on a WorkCentre .

The data in the network logging file is encrypted and can only be decrypted by Xerox service.

The machine settings that can be saved and restored by a service technician are limited to controller and fax parameters that are needed for normal operation. For example, the fax address book can be saved and restored by a service technician.

There is no method for a user, administrator or technician to move image data from the WorkCentre to a USB device.

USB

USB port and location	Purpose
USB Host ports	Software upgrade

XEROX WorkCentre 5735/5740/5745/5755/5765/5775/5790 Information Assurance Disclosure Paper

USB Target port

Direct-connectprinting; Xerox diagnostic tools (PSW and CAT) and Xerox copier assistant

Table 5 USB Ports

2.2.Fax Module

2.3.1.Purpose

The embedded FAX service uses the installed embedded fax card to send and receive images over the telephone interface.

2.3.2. Hardware

The Fax module contains the fax modem and RJ-11connector. The Fax modem implements the T.30 fax protocol. The Fax module contains a CPU, BIOS, RAM, andNon-VolatileMemory.

Volatile Memory Description

Type (SRAM, DRAM, etc)	Size	User Modifiable	Function or Use	Process to Clear:
(Y/N)
SDRAM	80MB	N	FAX Card volatile memory	No user image data
stored

Additional Information:

All memory listed above contains code for execution and configuration information. No user or job data is permanently stored in this location.

Non-VolatileMemory Description

Type (Flash, EEPROM, etc)	Size	User Modifiable	Function or Use	Process to Clear:
(Y/N)
Flash ROM	4MB	N	FAX executable code.	No user image data
stored.

Additional Information:

All memory listed above contains code for execution and configuration information. No user or job data is stored in this location.

Table 6 Fax Module memory components

2.4.Scanner

2.4.1.Purpose

The purpose of the scanner is to provide mechanical transport of hardcopy originals and to convert hardcopy originals to electronic data.

2.4.2. Hardware

The scanner converts the image from hardcopy to electronic data. An optional document handler moves originals into a position to be scanned. The scanner provides enough image processing for signal conditioning and formatting. The scanner does not store scanned images. All other image processing functions are in the copy controller.

The DADF/Scanner contains a CPU, BIOS, RAM, and Non-VolatileMemory.

XEROX WorkCentre 5735/5740/5745/5755/5765/5775/5790 Information Assurance Disclosure Paper

Volatile Memory Description

Type (SRAM, DRAM, etc)	Size	User Modifiable	Function or Use	Process to Clear:
(Y/N)
SRAM	6KB	N	Scanner volatile memory; no user	Power Off System
image data stored

Additional Information:

All memory listed above contains code for execution and configuration information. No user or job data is permanently stored in this location.

Non-VolatileMemory Description

Type (Flash, EEPROM, etc)	Size	User Modifiable	Function or Use	Process to Clear:
(Y/N)
Flash ROM	128MB	N	Scanner executable code	No user image data
stored

Additional Information:

All memory listed above contains code for execution and configuration information. No user or job data is stored in these locations.

Table 7 Scanner memory components

2.5.Graphical User Interface (GUI)

2.5.1.Purpose

The GUI detects soft and hard button actuations, and provides text and graphical prompts to the user. The GUI is sometimes referred to as the Local UI (LUI) to distinguish it from the WebUI, which is exported by the web service that runs in theccontroller. Images are not transmitted to or stored in the GUI. The Start hard button is located on the GUI panel.

2.5.2. Hardware

The user interface contains a FPGA that contains RAM and Non-VolatileMemory.

Volatile Memory Description

Type (SRAM, DRAM, etc)	Size	User Modifiable	Function or Use	Process to Clear:
(Y/N)
DRAM	2KB	N	User Interface volatile memory; no	Power Off System
user image data stored

Additional Information:

All memory listed above contains code for execution and configuration information. No user or job data is permanently stored in this location.

Non-VolatileMemory Description

Type (Flash, EEPROM, etc)	Size	User Modifiable	Function or Use	Process to Clear:
(Y/N)
Flash ROM	32KB	N	no user image data stored	No user image data
stored

Additional Information:

All memory listed above contains code for execution and configuration information. No user or job data is stored in this location.

XEROX WorkCentre 5735/5740/5745/5755/5765/5775/5790 Information Assurance Disclosure Paper

Table 8 User Interface memory components

2.6. Marking Engine (also known as the Image Output Terminal or IOT)

2.6.1. Purpose

The Marking Engine performs copy/print paper feeding and transport, image marking and fusing, and document finishing. Images are not stored at any point in these subsystems.

2.6.2. Hardware

The marking engine is comprised of paper supply trays and feeders, paper transport, laser scanner, xerographics, and paper output and finishing. The marking engine contains a CPU, BIOS, RAM and Non-VolatileMemory.

2.6.3. Control and Data Interfaces

Images and control signals are transmitted from the copy controller to the marking engine across a proprietary interface.

2.7.System Software Structure

2.7.1.Open-sourcecomponents

Open-sourcecomponents in the connectivity layer implementhigh-levelprotocol services. Thesecurity-relevantconnectivity layer components are:

•Apache 2.2.11, with mod_ssl integrated (http and https)

•PHP 5.3.1

•OpenSSL 0.9.8l (SSL)

•SAMBA 3.0.30 (SMB)

•Netsnmp 5.0.9 (SNMPv3)

2.7.2.OS Layer in the Controller

The OS layer includes the operating system, network and physical I/O drivers. The controller operating system is Wind River Linux, kernel v. 2.6.20+. Xerox may issue security patchesfor the OS, in which case the Xerox portion of the version number (i.e. after the ‘+’ sign) will be incremented.

The crypto library for IPSec is provided by the kernel.

IP Filtering is also provided by the kernel.

XEROX WorkCentre 5735/5740/5745/5755/5765/5775/5790 Information Assurance Disclosure Paper

Figure 2-4Controller Operating System layer components

XEROX WorkCentre 5735/5740/5745/5755/5765/5775/5790 Information Assurance Disclosure Paper

2.7.3. Network Protocols

Figure 2-5is an interface diagram depicting the protocol stacks supported by the device, annotated according to the DARPA model.

Figure 2-5IPv4 Network Protocol Stack

XEROX WorkCentre 5735/5740/5745/5755/5765/5775/5790 Information Assurance Disclosure Paper

Figure 2-6IPv6 Network Protocol Stack

2.8.Logical Access

2.8.1.Network Protocols

The supported network protocols are listed in Appendix D and are implemented to industry standard specifications (i.e. they are compliant to the appropriate RFC) and are well-behavedprotocols. There are no ‘Xerox unique’ additions to these protocols.

2.8.1.1.IPSec

The device supports IPSec tunnel mode. The print channel can be secured by establishing an IPSec association between a client and the device. A shared secret is used to encrypt the traffic flowing through this tunnel. SSL must be enabled in order to set up the shared secret.

When an IPSec tunnel is established between a client and the machine, the tunnel will also be active for administration with SNMPv2 tools (HP Open View, etc.), providing security for SNMP SETs and GETS with an otherwise insecure protocol. SNMP Traps may not be secure if either the client or the device has just been rebooted. IP Filtering can be useful to prevent SNMP calls from non-IPSecclients.

Once an IPSec channel is established between two points, it stays open until one end reboots or goes into power saver,. Only network clients and servers will have the ability to establish an IPSec tunnel with the machine. Thus

XEROX WorkCentre 5735/5740/5745/5755/5765/5775/5790 Information Assurance Disclosure Paper

device-initiatedoperations (like scanning) cannot assume the existence of the tunnel unless a print job (or other client initiated action) has been previously run since the last boot at either end of the connection.

2.8.2. Ports

The following table summarizes all potential open ports and subsequent sections discuss each port in more detail.

Default	Type	Service name
Port #
25	TCP	SMTP
53	UDP	DNS
68	UDP	BOOTP/DHCP
80	TCP	HTTP
88	UDP	Kerberos
110	TCP	POP-3client
137	UDP	NETBIOSName Service
138	UDP	NETBIOS-DatagramService; SMB filing and Scan template retrieval
139	TCP	NETBIOS; SMB filing and Scan template retrieval
161	UDP	SNMP
162	UDP	SNMP trap
389	UDP	LDAP
396	TCP	Netware
427	UDP	SLP
443	TCP	SSL
515	TCP	LPR
631	TCP	IPP
1900	UDP	SSDP
3003	TCP	http/SNMP reply
9100	TCP	raw IP

Table 9 Network Ports

Please note that there is no ftp port in this list. ftp is only used to export scanned images and to retrieve Scan Job Templates, and will open port 21 on the remote device. An ftp port is never open on the controller itself.

2.8.2.1.Port 25, SMTP

This unidirectional port is open only when Scan to E-mailor Internet Fax(I-Fax)is exporting images to an SMTP server, or when email alerts are being transmitted. SMTP messages & images are transmitted to the SMTP server from the device.

2.8.2.2.Port 53, DNS

Designating a DNS server will allow the device to resolve domain names. This can be configured via the LocalUI or WebUI.

2.8.2.3.Port 68, DHCP

This port is used only when performing DHCP, and is not open all of the time. To permanently close this port, DHCP must be explicitly disabled. This is done in User Tools via the Local User Interface or via the TCP/IP page in the Properties tab on the WebUI.

XEROX WorkCentre 5735/5740/5745/5755/5765/5775/5790 Information Assurance Disclosure Paper

2.8.2.4.Port 80, HTTP

The embedded web pages communicate to the machine through a set of unique APIs and do not have direct access

Network Controller
I
n
request	t
	e
http		request
	r
		machine
server	n
		information
	response		a
l		response
A
P
I

The HTTP port can only access the HTTP server residing in the controller. The embedded HTTP server is Apache. The purpose of the HTTP server is to:

•Give users information of the status of the device;

•View the job queue within the device and delete jobs;

•Allow users to download print ready files and program Scan to File Job Templates;

•Allow remote administration of the device. Many settings that are on the Local UI are replicated in the device’s web pages. Users may view the properties of the device but not change them without logging into the machine with administrator privileges.

The HTTP server can only host the web pages resident on the hard disk of the device. It does not and cannot act as a proxy server to get outside of the network the device resides on. Hence the server cannot access any networks (or web servers) outside of the customer firewall.

When the device is configured with an IP address, it is as secure as any device inside the firewall. The web pages are accessible only to authorized users of the network inside the firewall.

This service (and port) may be disabled in User Tools via the Local User Interface or via the TCP/IP page in the Properties tab on the WebU. Please note that when this is disabled, IPP Port 631 is also disabled.

HTTP may be secured by enabling Secure Sockets Layer.

2.8.2.4.1.Proxy Server

The device can be configured to communicate through a proxy server. Features that can make use of a proxy server include the Automatic Meter Read feature, scanning to a remote repository, or retrieving scan templates from a remote template pool.

XEROX WorkCentre 5735/5740/5745/5755/5765/5775/5790 Information Assurance Disclosure Paper

2.8.2.5.Port 88, Kerberos

This port is only open when the device is communicating with the Kerberos server to authenticate a user, and is only used only to authenticate users in conjunction with the Network Scanning feature. To disable this port, authentication must be disabled, and this is accomplished via the Local User Interface.

This version of software has Kerberos 5.1.1 with DES (Data Encryption Standard) and 64-bitencryption. The Kerberos code is limited to user authentication, and is used to authenticate a user with a given Kerberos server as a valid user on the network. Please note that the Kerberos server (a 3rd party device) needs to be set up for each user. Once the user is authenticated, the Kerberos software has completed its task. This code will not and cannot be used to encrypt or decrypt documents or other information.

This feature is based on the Kerberos program from the Massachusetts Institute of Technology (MIT). The Kerberos network authentication protocol is publicly available on the Internet as freeware at http://web.mit.edu/kerberos/www/. Xerox has determined that there are no export restrictions on this version of the software. However, there are a few deviations our version of Kerberos takes from the standard Kerberos implementation from MIT. These deviations are:

1)The device does not keep a user’s initial authentication and key after the user has been authenticated. In a standard Kerberos implementation, once a user is authenticated, the device holds onto the authentication for a programmed timeout (the usual default is 12 hours) or until the user removes it (prior to the timeout period). In the Xerox implementation, all traces of authentication of the user are removed once they have been authenticated to the device. The user can send any number of jobs until the user logs off the system, either manually or through system timeout.

2)The device ignores clock skew errors. In a standard implementation of Kerberos, authentication tests will fail if a device clock is 5 minutes (or more) different from the Kerberos server. The reason for this is that given enough time, someone could reverse engineer the authentication and gain access to the network. With the5-minutetimeout, the person has just 5 minutes to reverse engineer the authentication and the key before it becomes invalid. It was determined during the implementation of Kerberos for our device that it would be too difficult for the user/SA to keep the device clock in sync with the Kerberos server, so the Xerox instantiation of Kerberos has the clock skew check removed. The disadvantage is that this gives malicious users unlimited time to reverse engineer the user’s key. However, since this key is only valid to access the Network Scanning features on a device, possession of this key is of little use for nefarious purposes.

3)The device ignores much of the information provided by Kerberos for authenticating. For the most part, the device only pays attention to information that indicates whether authentication has passed. Other information that the server may return (e.g. what services the user is authenticated for) is ignored or disabled in the Xerox implementation. This is not an issue since the only service a user is being authenticated for is access to an e- mail directory. No other network services are accessible from the Local UI.

Xerox has received an opinion from its legal counsel that the device software, including the implementation of a Kerberos encryption protocol in its network authentication feature, is not subject to encryption restrictions based on Export Administration Regulations of the United States Bureau of Export Administration (BXA). This means that it can be exported from the United States to most destinations and purchasers without the need for previous approval from or notification to BXA. At the time of the opinion, restricted destinations and entities included terroristsupporting states (Cuba, Iran, Libya, North Korea, Sudan and Syria), their nationals, and other sanctioned entities such as persons listed on the Denied Parties List. Xerox provides this information for the convenience of its customers and not as legal advice. Customers are encouraged to consult with legal counsel to assure their own compliance with applicable export laws.

2.8.2.6.Port 110, POP-3Client

This unidirectional port is used when receiving an Internet Fax (I-Fax)orE-Mail.These jobs may only be printed, and the port is only open ifI-Faxis enabled and while receiving the job. It is not configurable.

XEROX WorkCentre 5735/5740/5745/5755/5765/5775/5790 Information Assurance Disclosure Paper

2.8.2.7.Ports 137, 138, 139, NETBIOS

For print jobs, these ports support the submission of files for printing as well as support Network Authentication through SMB. Port 137 is the standard NetBIOS Name Service port, which is used primarily for WINS. Port 138 supports the CIFS browsing protocol. Port 139 is the standard NetBIOS Session port, which is used for printing. Ports 137, 138 and 139 may be configured in the Properties tab of the device’s web page.

For Network Scanning features, ports 138 and 139 are used for both outbound (i.e. exporting scanned images and associated data) and inbound functionality (i.e. retrieving Scan Templates). In both instances, these ports are only open when the files are being stored to the server or templates are being retrieved from the Template Pool. For these features, SMB protocol is used.

2.8.2.8.Ports 161, 162, SNMP

These ports support the SNMPv1, SNMPv2c, and SNMPv3 protocols. Please note that SNMP v1 does not have any password or community string control. SNMPv2 relies on a community string to keep unwanted people from changing values or browsing parts of the MIB. This community string is transmitted on the network in clear text so anyone sniffing the network can see the password. Xerox strongly recommends that the customer change the community string upon product installation. SNMP is configurable, and may be explicitly enabled or disabled in the Properties tab of the device’s web pages.

SNMP traffic may be secured if an IPSec tunnel has been established between the agent (the device) and the manager (i.e. the user’s PC).

The device supports SNMPv3, which is an encrypted version of the SNMP protocol that uses a shared secret. Secure Sockets Layer must be enabled before configuring the shared secret needed for SNMPv3.

2.8.2.9.Port 389, LDAP

Xerox Workcentre 7765 Driver Download

This is the standard LDAP port used for address book queries in the Scan to Email feature.

2.8.2.10. Port 396, Netware

This configurable port is used when Novell Netware is enabled to run over IP.

2.8.2.11. Port 427, SLP

When activated, this port is used for service discovery and advertisement. The device will advertise itself as a printer and also listen for SLP queries using this port. It is not configurable. This port is explicitly enabled / disabled in the Properties tab of the device’s web pages.

2.8.2.12. Port 443, SSL

This is the default port for Secure Sockets Layer communication. This port can be configured via the device’s web pages. SSL must be enabled before setting up either SNMPv3 or IPSec or before retrieving the audit log (see Sec. 4.1). SSL must also be enabled in order to use any of the Web Services (Scan Template Management, Automatic Meter Reads, or Network Scanning Validation Service).

SSL should be enabled so that the device can be securely administered from the web UI. When scanning, SSL can be used to secure the filing channel to a remote repository.

Xerox Workcentre 5755 Manual

SSL uses X.509 certificates to establish trust between two ends of a communication channel. When storing scanned images to a remote repository using an https: connection, the device must verify the certificate provided by the remote repository. A Trusted Certificate Authority certificate should be uploaded to the device in this case.

To securely administer the device, the user’s browser must be able to verify the certificate supplied by the device. A certificate signed by a well-knownCertificate Authority (CA) can be downloaded to the device, or the device can generate aself-signedcertificate. In the first instance, the device creates a Certificate Signing Request (CSR) that can be downloaded and forwarded to thewell-knownCA for signing. The signed device certificate is then uploaded to the device. Alternatively, the device will generate aself-signedcertificate. In this case, the generic Xerox root CA certificate must be downloaded from the device and installed in the certificate store of the user’s browser.

Xerox Workcentre 5740 Driver

The device supports only server authentication.

Download Xerox Workcentre 5755 Driver

Next >= Page 1 =123