Fuji Xerox ApeosPort-V 5070 Parts list manual

ApeosPort-V 5070 DocuCentre-V 5070
ApeosPort-V 4070 DocuCentre-V 4070
Security Function Supplementary Guide
z
Before Using the Security Function...................................................................................................... 2
z
Settings for the Secure Operation 1
(Initial Settings Procedures Using Control Panel) ........................................................................ 8
z
Settings for the Secure Operation 2
(Initial Settings Procedures Using CentreWare Internet Services)........................................12
z
Settings for the Secure Operation 3 (Regular Review by Audit Log) ....................................20
z
User Authentication..................................................................................................................................22
z
Self Testing...................................................................................................................................................23
z
Appendix........................................................................................................................................................24
Microsoft, Windows, and Internet Explorer are trademarks or registered trademarks of Microsoft
Corporation in the U.S. and other countries.
All product/brand names are trademarks or registered trademarks of the respective holders.
XEROX, the sphere of connectivity design, CentreWare, ApeosWare, and EasyAdmin are trademarks or
registered trademarks of Xerox Corporation in the U.S. or Fuji Xerox Co., Ltd.
Important
1. This manual is copyrighted with all rights reserved. Under the copyright laws, this manual may not be
copied or modified in whole or part, without the written consent of the publisher.
2. Parts of this manual are subject to change without prior notice.
3. We welcome any comments on ambiguities, errors, omissions, or missing pages.
4. Never attempt any procedure on the machine that is not specifically described in this manual.
Unauthorized operation can cause faults or accidents. Fuji Xerox is not liable for any problems resulting
from unauthorized operation of the equipment.
An export of this product is strictly controlled in accordance with Laws concerning Foreign Exchange and
Foreign Trade of Japan and/or the export control regulations of the United States.

Before Using the Security Function
2
5
Before Using the Security Function
This section describes the security functions and confirmation matters.
Preface
This guide is intended for the manager and system administrator of the organization where
the machine is installed, and describes the setup procedures related to security.
For general users, this guide describes the operations related to security features.
For information on the other features available for the machine, refer to the following
guidance.
Security Features
ApeosPort-V 5070/4070, DocuCentre-V 5070/4070 have the following security features:
z
Hard Disk Data Overwrite
z
Hard Disk Data Encryption
z
User Authentication
z
System Administrator's Security Management
z
Customer Engineer Operation Restriction
z
Security Audit Log
z
Internal Network Data Protection
z
Information Flow Security
z
Self Test
Model Guide Manual No.
ApeosPort-V 5070/4070
DocuCentre-V 5070/4070
User Guide ME7148E2-1
Administrator Guide ME7149E2-1

Before Using the Security Function
3
5
Settings for the Secure Operation
For the effective use of the security features, the System Administrator (Machine
Administrator) must follow the instructions below:
For details on the setting procedures, refer to the following sections.
"Settings for the Secure Operation 1 (Initial Settings Procedures Using Control Panel)" (P.8)
"Settings for the Secure Operation 2 (Initial Settings Procedures Using CentreWare Internet Services)" (P.12)
"Settings for the Secure Operation 3 (Regular Review by Audit Log)" (P.20)
z
Passcode Entry for Control Panel Login
Set to [On].
z
Overwrite Hard Disk
Set to [1 Overwrite] or [3 Overwrites].
z
Data Encryption
Set to [On], and then enter an encryption key of 12 characters.
z
Authentication
Set to [Login to Local Accounts] or [Login to Remote Accounts].
z
Private Print
Set to [According to Print Auditron] or [Save as Private Charge Print Job].
z
Store & Send Link
Set to disabled.
z
Self Test
Set to [On].
z
Software Download
Set to [Disabled].
z
Set Auto Clear
Set to [On].
z
Set Report Print
Set to [Disabled].
z
System Administrator Passcode
Change the default passcode to another passcode of 9 or more characters.
z
Maximum Login Attempts
Set to [5] times.
z
Access Control
Set to [Locked] for [Device Access], and [Lock All] for [Service Access].
z
User Passcode Minimum Length
Set to [9] characters.
z
SSL/TLS
Set to enabled.
z
WebDAV
Set to Disabled.
z
Send E-mail
Set to disabled: DocuCentre-V only.
z
Set Receive E-mail
Set to Disabled.
z
IPP
Set to enabled.

Before Using the Security Function
4
5
z
IPSec
Set to enabled.
z
SNMP v1/v2c
Set to disabled.
z
SNMP v3
Set to enabled.
z
S/MIME
Set to enabled.
z
WSD(Scan)
Set to disabled.
z
SOAP
Set to disabled.
z
USB
Set to disabled.
z
CSRF
Set to enabled.
z
LDAP Server
Set the LDAP Server information.
z
Kerberos Server
Set the Kerberos Server information.
z
Service Representative Restricted Operation
Set to [Enabled], and enter a passcode of 9 or more characters.
z
Audit Log
Set to enabled.
z
Browser Refresh
Set to [Disabled].
z
Job Deletion
Set to [Administrator Only].
Important • The security will not be warranted if you do not correctly follow the above setting instructions.
•The Information Flow Security feature requires no special setting by the System Administrator.
•When you set Data Encryption [On] again, enter an encryption key of 12 characters.
For Optimal Performance of the Security Features
The manager (of the organization that the machine is used for) needs to follow the
instructions below:
z
The manager needs to assign appropriate people as system and machine administrators,
and manage and train them properly.
z
The system administrator need to train users about the machine operation and
precautions according to the policies of their organization and the product guidance.
z
The machine needs to be placed in a secure or monitored area where the machine is
protected from unmanaged physical access.
z
If the network where the machine is installed is to be connected to external networks,
configure the network properly to block any unauthorized external access.
z
Users need to set a user ID and a passcode on [Accounting Configuration] of printer
driver.

Before Using the Security Function
5
5
z
Users and administrators need to set passcode and an encryption key according to the
following rules for the client PC login and the machine’s setup.
- Do not use an easily guessed character strings passcode.
- A passcode needs to contain both numeric and alphabetic characters.
z
Administrators need to set the account policy in the remote authentication server as
follows.
- Set password policy to 9 or more characters.
- Set account lockout policy to 5 times.
z
Users and administrators need to manage and operate the machine so that their user IDs
and passcodes may not be disclosed to another person.
z
The users need to set a user ID and a passcode certainly on [Accounting Configuration] of
printer driver.
z
For secure operation, all of the remote trusted IT products that communicate with the
machine shall implement the communication protocol in accordance with industry
standard practice with respect to RFC/other standard compliance (SSL/TLS, IPSec, SNMP
v3, S/MIME) and shall work as advertised.
SSL/TLS
For the SSL client (Web browser) and the SSL server that communicate with the machine,
select a data encryption suite from the following.
z
SSL_RSA_WITH_RC4_128_SHA
z
SSL_RSA_WITH_3DES_EDE_CBC_SHA
z
TLS_RSA_WITH_AES_128_CBC_SHA
z
TLS_RSA_WITH_AES_256_CBC_SHA
z
TLS_RSA_WITH_AES_128_CBC_SHA256
z
TLS_RSA_WITH_AES_256_CBC_SHA256
(The recommended browser is Microsoft
®
Internet Explorer
®
7/8/9/10)
S/MIME
For the machine and E-mail clients, select an Encryption Method/Message Digest Algorithm
from the following.
z
3Key Triple-DES/168bit, AES/128bit, AES/192bit, AES/256bit
z
SHA1, SHA256
IPSec
For the IPSec host that communicates with the machine, select an Encryption Method/
Message Digest Algorithm from the following.
z
AES(128bit)/SHA1
z
3Key Triple-DES(168bit)/SHA1

Before Using the Security Function
6
5
SNMP v3
The encryption method of SNMPv3 is DES/56bit or AES 128bit. Set [Message Digest
Algorithm] to [SHA1].
Confirm the Machine ROM version and the System Clock
Before making initial settings, the System Administrator (Machine Administrator) needs to
check the ROM version of the machine and the system clock of the machine.
How to check by Control Panel
1 Press the <Machine Status> button on the control panel.
2Select [Software Version] on the [Machine Information] screen.
You can identify the software versions of the components of the machine on the screen.
How to check by Print Report
1 Press the <Machine Status> button on the control panel.
2Select [Print Reports] on the [Machine Information] screen.
3Select [Printer Reports].
4Select [Configuration Report].
5Press the <Start> button on the control panel.
You can identify the software versions of the components of the machine by Print Report.
How to check the System Clock
1Press the <Log In/Out> button on the control panel.
2Enter the system administrator’s ID with the numeric keypad or the keyboard displayed.
3Select [Enter].
4Select [Tools].
5Select [System Settings].
6Select [Common Service Settings].
Important
• For secure operation, while you are using CentreWare Internet Services, please do not
access other web site, and do not use other applications.
• For secure operation, when you change [Authentication Type], or prior to disposing of the
machine, please initialize the hard disk by resetting [Data Encryption] and changing
[encryption key].
• For preventing SSL vulnerability, you should set the machine address in the proxy exclusion
list of browser.
By this setting, secure communication will be ensured because the machine and the remote
browser communicate directly without proxy server, and thus you can prevent man-in-the-
middle attack.
• Because DocuCentre-V does not have S/MIME function, please do not use the E-mail and
Internet Fax.

Before Using the Security Function
7
5
7Select [Machine Clock/Timers].
You can check the time and the date of the system clock. If you need to change the time
and the date, refer to the following procedures.
8Select the required option.
9Select [Change Settings].
10 Change the required setting.
11 Select [Save].
12 To exit the [Tools] screen, select [Close] twice.

Settings for the Secure Operation 1 (Initial Settings Procedures Using Control Panel)
8
5
Settings for the Secure Operation 1
(Initial Settings Procedures Using Control Panel)
This section describes the initial settings related to security features, and how to set them
on the machine's control panel.
Authentication for entering the System Administration mode
1Press the <Log In/Out> button on the control panel.
2Enter the system administrator’s ID with the numeric keypad or the keyboard displayed.
3Select [Next].
4Enter the system administrator’s passcode from keyboard when passcode is required.
5Select [Enter].
6Select [Tools].
Set Passcode Entry for Control Panel Login
1
Select [Authentication/Security Settings] on the [Tools] screen.
2 Select [Authentication].
3 Select [Passcode Policy].
4 Select [Passcode Entry for Control Panel Login].
5 Select [Change Settings].
6 Select [On].
7 Select [Save].
Set Overwrite Hard Disk
1Select [Authentication/Security Settings] on the [Tools] screen.
2Select [Overwrite Hard Disk].
3Select [Number of Overwrites].
4Select [1 Overwrite] or [3 Overwrites].
5Select [Save].
Set Data Encryption
1Select [System Settings] on the [Tools] screen.
2Select [Common Service Settings].

Settings for the Secure Operation 1 (Initial Settings Procedures Using Control Panel)
9
5
3Select [Other Settings].
4On the [Other Settings] screen, select [Data Encryption].
5Select [Change Settings].
6Select [On].
7Select [New Encryption Key].
8Enter a new encryption key of 12 characters using the keyboard displayed, and then select
[Save].
9Select [Re-enter the Encryption Key].
10 Enter the same passcode using the keyboard displayed, and then select [Save].
11 Select [Save].
12 Select [Yes] to make the change.
13 Select [Yes] to reboot.
Set Authentication
1Select [Authentication/Security Settings] on the [Tools] screen.
2Select [Authentication].
3Select [Login Type].
4Select [Login to Local Accounts] or [Login to Remote Accounts].
5Select [Save].
When [Login to Remote Accounts] is selected in step 4, proceed to steps 6 to 13.
6Select [System Settings] on the [Tools] screen.
7Select [Connectivity & Network Setup].
8Select [Remote Authentication/Directory Service].
9Select [Authentication System Setup].
10 Select [Authentication System].
11 Select [Change Settings].
12 Select [LDAP], [Kerberos(Windows 2000)], or [Kerberos(Solaris)].
13 Select [Save].
Set Private Print
1Select [Authentication/Security Settings] on the [Tools] screen.
2Select [Authentication].
3Select [Charge/Private Print Settings].
4Select [Receive Control].
5Select [Change Settings].

Settings for the Secure Operation 1 (Initial Settings Procedures Using Control Panel)
10
5
6Select [According to Print Auditron].
7Select [Save as Private Charge Print Job] for [Job Login Success].
8Select [Delete Job] for [Job Login Failure].
9Select [Delete Job] for [Job without User ID].
10 Select [Save].
11 To exit the [Charge/Private Print Settings] screen, select [Close].
Set Store & Send Link
1Select [System Settings] on the [Tools] screen.
2Select [Common Service Settings].
3Select [Screen/Button Settings].
4Select [Services Home].
5Select [Change Settings].
6Select [Store & Send Link].
7Select [(Not Assigned)].
8Select [Save] twice.
9To exit the [Screen/Button Settings] screen, select [Close].
Set Software Download
1Select [System Settings] on the [Tools] screen.
2Select [Common Service Settings].
3Select [Other Settings].
4Select [Software Download].
5Select [Change Settings].
6Select [Disabled].
7Select [Save].
8To exit the [Other Settings] screen, select [Close].
Set Auto Clear
1Select [System Settings] on the [Tools] screen.
2Select [Common Service Settings].
3Select [Machine Clock/Timers].
4Select [Auto Clear].