Xerox WORKCENTRE 7425 Manual

WorkCentre 7425/7428/7435
Security Function Supplementary
Guide
Version 1.0, August 2009

2
Table of Contents
Before Using the Security Function..................................................................
Preface .......................................................................................................................................................5
Security Features...................................................................................................................................6
Settings for the Secure Operation ................................................................................................6
Data Restoration...................................................................................................................................7
Starting use of the data encryption feature and changing the settings...................7
Use of the Overwrite Hard Disk......................................................................................................8
Service Representative Restricted Operation ..........................................................................8
For Optimal Performance of the Security features ..............................................................9
Confirm the Machine ROM version and the System Clock ............................................ 0
How to check by Control Panel......................................................................................... 0
How to check by Print Report............................................................................................ 0
How to check the Clock........................................................................................................ 0
Initial Settings Procedures Using Control Panel...................................... 11
Authentication for entering the System Administration mode...................................
Change the System Administrator’s Passcode ....................................................................
Set Maximum Login Attempts.....................................................................................................
Set Service Rep. Restricted Operation...................................................................................... 2
Set Overwrite Hard Disk.................................................................................................................. 2
Set Scheduled Image Overwrite ................................................................................................. 2
Set Authentication ............................................................................................................................ 3
Set Access Control ............................................................................................................................. 3
Set Private Print .................................................................................................................................. 3
Set User Passcode Minimum Length........................................................................................ 4
Initial Settings Procedures Using CentreWare Internet Services .... 1
Preparations for settings on the CentreWare Internet Services ................................. 5
Set SMB................................................................................................................................................... 5
Set SSL/TSL ........................................................................................................................................... 6
Configuring Machine certificates............................................................................................... 6
Set IPSec ................................................................................................................................................ 7
Set IPSec Address .................................................................................................... 7
Set SNMPv3.......................................................................................................................................... 8
Set S/MIME........................................................................................................................................... 9
Regular Review by Audit Log ............................................................................ 20
Set Audit Log........................................................................................................................................20
Import the Audit Log File...............................................................................................................20
Authentication for the Secure Operation ................................................... 21
Overview of Authentication..........................................................................................................2
Users Controlled by Authentication ...............................................................................2
Machine Administrator........................................................................................................2

3
Authenticated Users (with System Administrator Privileges)..............................22
Authenticated Users (with No System Administrator Privileges) ......................22
Unauthenticated Users........................................................................................................22
Local Machine Authentication (Login to Local Accounts)..............................................22
Functions Controlled by Authentication ......................................................................23
Local Access................................................................................................................23
Remote Access..........................................................................................................23
Authentication for Folder...............................................................................................................25
Types of Folder........................................................................................................................25
Machine Administrator Shared Folder............................................................25
Only Machine Administrator can change the settings............................ 25
Personal Folder..........................................................................................................25
Operations available for Folder.........................................................................26
Operation Using Control Panel........................................................................ 28
User Authentication..........................................................................................................................28
Create/View User Accounts...........................................................................................................28
On the Tools screen, ...............................................................................................28
User ID..........................................................................................................................29
User Name..................................................................................................................29
Passcode......................................................................................................................29
E-mail Address...........................................................................................................29
Account Limit.............................................................................................................29
User Role......................................................................................................................29
Reset Total Impressions........................................................................................29
Reset Account............................................................................................................29
Change User Passcode by General User.................................................................................30
Folder / Stored File Settings..........................................................................................................3
Folder Service Settings.........................................................................................................3
Files Retrieved By Client........................................................................................3
Print & Delete Confirmation Screen ................................................................3
Quality/File Size for Retrieval..............................................................................3
Stored File Settings................................................................................................................32
Expiration Date for Files in Folder ....................................................................32
Stored Job Expiration Date..................................................................................32
Minimum Passcode Length for Stored Job................................................... 32
Print Order for All Selected Files ........................................................................32
Create Folder........................................................................................................................................33
Folder Name ..............................................................................................................33
Check Folder Passcode ..........................................................................................33
Delete Files After Retrieval...................................................................................33
Delete Expired Files.................................................................................................33
Send from Folder................................................................................................................................34
File Name/Stored Date..........................................................................................34
Refresh..........................................................................................................................34

4
Select All.......................................................................................................................34
Print................................................................................................................................34
Delete............................................................................................................................34
Private Charge Print..........................................................................................................................35
Refresh..........................................................................................................................35
Select All.......................................................................................................................35
Delete............................................................................................................................35
Print................................................................................................................................35
Operation Using CentreWare Internet Services ...................................... 36
Accessing CentreWare Internet Services................................................................................37
Print ..........................................................................................................................................................38
Scan (Folder Operation)..................................................................................................................39
Folder icons.................................................................................................................39
Folder Number ..........................................................................................................39
Folder Name ..............................................................................................................39
Number of Files in this Folder.............................................................................39
File List..........................................................................................................................39
Delete............................................................................................................................39
Edit .................................................................................................................................39
Create ...........................................................................................................................39
Folder: List of Files..................................................................................................................40
Edit Folder..................................................................................................................................40
Folder Setup..............................................................................................................................4
Import the files........................................................................................................................4
Change User Passcode by System Administrator (Using CentreWare Internet Services) 42
Problem Solving....................................................................................................... 43
Fault Clearance Procedure.............................................................................................................43
Fault Codes ...........................................................................................................................................44
Appendix..................................................................................................................... 48
Copyright 2009 by Fuji Xerox Co., Ltd. All rights reserved.

5
Before Using the Security Function
Preface
This guide is intended for the manager and system administrator of the organization where the machine is
installed, and describes the setup procedures related to security.
And for general users, this guide describes the operations related to security features.
For information on the other features available for the machine, refer to the following Guidance.
WorkCentre 742 /7428/743 System Administrator Guide
:Version 1.0, January 2009
WorkCentre 742 /7428/743 User Guide
:Version 1.0, January 2009
WorkCentre 742 /7428/743 is supported by the following ROM version.
Controller+PS ROM Ver. 1.180.9
IOT ROM Ver. 40.10.0
IIT ROM Ver. 22.13.1
ADF ROM Ver. 20.0.0
Important:
The machine has obtained IT security certification for Common Criteria EAL3.
This certifies that the target of evaluation has been evaluated based on the certain evaluation criteria and
methods, and that it conforms to the security assurance requirements.
Note, however, that your ROM and Guidance may not be the certified ver ion becau e it may have been
updated along with machine improvement .

6
Security Features
WorkCentre 742 /7428/743 has the following security features:
•Hard Disk Data Overwrite
•Hard Disk Data Encryption
•User Authentication
•System Administrator’s Security Management
•Customer Engineer Operation Restriction
•Security Audit Log
•Internal Network data protection
•FAX Flow Security
Settings for the Secure Operation
For the effective use of the security features, The System Administrator (Machine Administrator) must follow the
instructions below:
•Passcode Entry from Control Panel Default [On].
•The System Administrator Passcode Change the default passcode "1111" to another passcode of 9 or more
characters.
•Maximum Login Attempts Default [ ] Times.
•Service Rep. Restricted Operation Set to [On], and then enter a passcode of 9 or more characters.
•Overwrite Hard Disk Set to [1 Overwrite] or [3 Overwrites].
•Data Encryption Default [On]
•Scheduled Image Overwrite Set to [Enabled].
•Authentication Set to [Login to Local Accounts]
•Access Control Set to [Locked] for Device Access and Service Access
•Private Print Set to [Save in Private Charge Print]
•User Passcode Minimum Length Set to [9] characters.
•SMB Set to [Disabled] for [NetBEUI]
•SSL/TLS Set to [Enabled]
•IPSec Set to [Enabled]
•SNMP v1/v2c Set to [Disabled]
•SNMPv3 Set to [Enabled]
•S/MIME Set to [Enabled]
•Audit Log Set to [Enabled]
Important:
• The security will not be warranted if you do not correctly follow the above setting instructions.
• FAX Flow Security feature requires no special setting by System Administrator.
• When you set Data Encryption [On] again, enter an encryption key of 12 characters.

7
Data Restoration
The enciphered data cannot be restored in the following conditions.
•When a trouble occurs in the hard disk.
•When you have forgotten the encryption key.
•When you have forgotten the System Administrator ID and a passcode when making [Service Rep. Restricted
Operation] set to [On].
Starting use of the data encryption feature and
changing the settings
When data encryption is started or ended, or when the encryption key is changed, the machine must be restarted.
The corresponding recording area (the hard disk) is reformatted when restarting. In this case, the previous data is
not guaranteed.
The recording area stores the following data.
•Spooled print data
•Print data including the secure print and sample print
•Forms for the form overlay feature
•Folder and job flow sheet settings (Folder name, passcode, etc.)
•Files in Folder
•Address book data
Important:
Be sure to save all necessary settings and files before starting to use the data encryption feature or changing the
settings.
An error occurs if the connected hard disk does not match the encryption settings.

8
Use of the Overwrite Hard Disk
In order to protect data stored on the hard disk from unauthorized retrieval, you can set the overwrite conditions
to apply to data stored on the hard disk.
You can select the number of overwrite passes from one time or three times. When [1 Overwrite] is selected, “0” is
written to the disk area. When [3 Overwrites] is selected, overwriting is carried out with the method recommended
by the National Security Agency (NSA). [3 Overwrites] ensures higher security than [1 Overwrite].
The setting also overwrites temporarily saved data such as copy documents.
Important:
If the machine is powered off during the overwriting operation, unfinished files may remain on the hard disk.
The overwriting operation will resume if you power the machine on again with the unfinished files remaining
on the hard disk.
Service Representative Restricted Operation
Specifies whether the Service Representative has full access to the security features of the machine, including the
ability to change System Administrator settings.
For the WorkCentre 742 /7428/743 , select [On] and then set [Maintenance Passcode] to restrict the Service
Representative from entering the System Administration mode.
Important:
If the System Administrator’s user ID and passcode are lost when [Service Rep. Restricted Operation] is set to [On],
not only you but also we are no longer able to change any setting in the System Administration mode.

9
For Optimal Performance of the Security
features
The manager (of the organization that the machine is used for) needs to follow the instructions below:
•Assign appropriate persons as system and machine administrators, and manage and train them properly.
•If the network where the machine is installed is to be connected to external networks, configure the network
properly to block any unauthorized external access.
•The users have to set a user ID and a passcode certainly on accounting configuration of printer driver.
•Users and administrators have to set passcodes and encryption key according to the following rule for the
client PC login and the machine’s setup.
・ Do not use an easily guessed character strings passcodes.
・ Passcodes have to contain both numeric and alphabetic.
•For secure operation, all of the remote trusted IT products that communicate with the machine implement the
communication protocol in accordance with industry standard practice with respect to RFC/other standard
compliance (SSL/TLS, IPSec, SNMPv3, S/MIME) and work as advertised.
•The settings described below are required same as the machine’s configuration.
1. SSL/TLS
Set the SSL client （ WEB browser ） and SSL server that communicate with the machine as
following data encryption suite
・ SSL_RSA_WITH_RC4_128_SHA
・ SSL_RSA_WITH_3DES_EDE_CBC_SHA
・ TLS_RSA_WITH_AES_128_CBC_SHA
・ TLS_RSA_WITH_AES_2 6_CBC_SHA
（ Specifically, recommended browser is Microsoft internet Explorer 6/7, Netscape 7.x, Mozilla
Firefox 2.x/3.x ）
2. S/MIME
Set the machine and mail clients as following Encryption Method/Message Digest Algorithm.
・ RC2(128bit)/SHA1
・ 3Key Triple-DES(168bit)/SHA1
3. IPSec
Set the IPSec host that communicates with the machine as following Encryption
Method/Message Digest Algorithm.
・ AES(128bit)/SHA1
・ 3Key Triple-DES(168bit)/SHA1
4. SNMPv3
Encryption Method of SNMPv3 is DES fixed. Set the Message Digest Algorithm to SHA1.
Important:
For secure operation, while you are using the CentreWare Internet Services, please do not access other
web site.

10
Confirm the Machine ROM version and the
System Clock
Before initial settings, the System Administrator (Machine Administrator) has to check the machine ROM version
and the system clock of the machine.
How to check by Control Panel
1. Press the <Machine Status> button on the control panel.
2. Select [Machine information] on the touch screen.
3. Select [Software Version] on the [Machine information] screen.
You can identify the software versions of the components of machine on the screen.
How to check by Print Report
1. Press the <Machine Status> button on the control panel.
2. Select [Print Reports] on the [Machine information] screen.
3. Select [Printer Reports] on the touch screen.
4. Select [Configuration Reports].
. Press the <Start> button on the control panel.
You can identify the software versions of the components of machine by Print Report.
How to check the Clock
1. Press the <Log In / Out> button on the control panel.
2. Enter the System Administrator’s Login ID and Passcode if prompted (default admin, 1111).
3. Select [Enter] on the touch screen.
4. Press the <Machine Status> button on the control panel.
. Select [Tools] on the touch screen.
6. Select [System Settings].
7. Select [Common Service Settings].
8. Select [Machine Clock/Timers].
You can Check the time and date of internal clock. If it is required to change, refer to following procedures.
1. Select the required option.
2. Select [Change Settings].
3. Change the required setting. Use the scroll bars to switch between screens.
4. Select [Save].

11
Initial Settings Procedures Using
Control Panel
This chapter describes the initial settings related to Security Features, and how to set them on the machine’s
control panel.
Authentication for entering the System
Administration mode
1. Press the <Log In/Out> button on the control panel.
2. Enter "admin" with the keyboard displayed. This is the factory default "ID".
3. Select [Next] on the touch screen.
4. Enter "1111" for passcode from the keyboard.
. Select [Enter] on the touch screen.
6. Select [Tools].
Change the System Administrator’s Passcode
1. Select [Authentication/Security Settings] on the [Tools] screen.
2. Select [System Administrator Settings].
3. Select [System Administrator’s Passcode].
4. On the [System Administrator's Passcode] screen, Select [Keyboard].
. Enter a new passcode of 9 or more characters in [New Passcode], and select [Save].
6. In [Retype Passcode], select [Keyboard].
7. Enter the same passcode, and select [Save] twice.
8. In the [Do you want to change the System Administrator’s Passcode?] screen, select [Yes].
Set Maximum Login Attempts
1. Select [Authentication/Security Settings] on the [Tools] screen.
2. Select [Authentication].
3. Select [Maximum Login Attempts By System Administrator].
4. On the [Maximum Login Attempts] screen, select [Limit Attempts].
. With [ ] and [ ], set [ ].
6. Select [Save].

12
Set Service Rep. Restricted Operation
1. Select [System Settings] on the [Tools] screen.
2. Select [Common Service Settings].
3. Select [Other Settings].
4. On the [Other Settings] screen, select [Service Rep. Restricted Operation].
. Select [Change Settings].
6. Select [On].
7. Select [Maintenance Passcode].
8. Select [Keyboard], and enter a new passcode of 9 or more characters in [New Passcode].
9. Select [Save].
10. Select [Keyboard], and enter the same passcode in [Retype Passcode].
11. Select [Save].
12. Select [Save] twice.
13. In the [Do you want to proceed?] screen, select [Yes].
14. In the [Do you still want to proceed?] screen, select [Yes].
Set Overwrite Hard Disk
1. Select [Authentication/Security Settings] on the [Tools] screen.
2. Select [Overwrite Hard Disk].
3. Select [Number of Overwrites].
4. On the [Number of Overwrites] screen, select [1 Overwrite] or [3 Overwrites].
. Select [Save].
Set Scheduled Image Overwrite
1. Select [Authentication/Security Settings] on the [Tools] screen..
2. Select [Overwrite Hard Disk].
3. Select [Scheduled Image Overwrite].
4. On the [Scheduled Image Overwrite] screen, Select [Daily] or [Weekly] or [Monthly].
. Set [Day], [Hour], [minutes],
6. Select [Save].

13
Set Authentication
1. Select [Authentication/Security Settings] on the [Tools] screen.
2. Select [Authentication].
3. Select [Login Type].
4. On the [Login Type] screen, select [Login to Local Accounts].
. Select [Save]
Set Access Control
1. Select [Authentication/Security Settings] on the [Tools] screen.
2. Select [Authentication].
3. Select [Access Control].
4. Select [Device Access].
. On the [Device Access] screen, select [Locked] for [All Services Pathway].
6. Select [Save].
7. Select [Service Access].
8. On the [Service Access] screen, select [Locked] for all Items by [Change Settings].
9. To exit the [Access Control] screen, select [Close] in the upper right corner of the screen.
Set Private Print
1. Select [Authentication/Security Settings] on the [Tools] screen.
2. Select [Authentication].
3. Select [Charge/Private Print Settings].
4. On the [Charge/Private Print Settings] screen, select [Received Control].
. Select [Change Settings].
6. On the [Receive Control] screen, select [According to Print Auditron].
7. Select [Save as Private Charge Print Job] for [Job Login Success] selection.
8. Select [Delete Job] for [Job Login Failure] selection.
9. Select [Delete Job] for [Job Without User ID] selection.
10. Select [Save].
11. To exit the [Charge/Private Print Settings] screen, select [Close] in the upper right corner of the screen.

14
Set User Passcode Minimum Length
1. Select [Authentication/Security Settings] on the [Tools] screen.
2. Select [Authentication].
3. Select [Passcode Policy].
4. On the [Passcode Policy] screen, select [Minimum Passcode Length].
. Select [Change Settings].
6. On the [Minimum Passcode Length] screen, select [Set].
7. With [ ] and [ ], set [9].
8. Select [Save].
9. To exit the [Passcode Policy] screen, select [Close] in the upper right corner of the screen.
10. To exit the [Tools] screen, press the < Services> button on the control panel.

15
Initial Settings Procedures Using
CentreWare Internet Services
This section describes the initial settings related to Security Features, and how to set them on CentreWare Internet
Services.
Preparations for settings on the CentreWare
Internet Services
Prepare a computer supporting the TCP/IP protocol to use CentreWare Internet Services.
CentreWare Internet Services supports the browsers satisfied "SSL/TLS" (1.8) conditions.
1. Open your Web browser and enter the TCP/IP address of the machine in the Address or Location field, press
the <Enter> key at Your Workstation.
2. Enter the System Administrator’s ID and passcode if prompted.
3. Display the [Properties] screen by clicking the [Properties] tab.
Set SMB
1. Click [+] on the left of the [Connectivity] folder on the [Properties] screen.
2. Click [Port Setting].
3. Uncheck the [NetBEUI] box for [SMB].
4. Click the [Apply] button.

16
Set SSL/TSL
1. Click [+] on the [Security] folder on the [Properties] screen.
2. Click [Machine Digital Certificate Management].
3. Click the [Create New Self Signed Certificate] button.
4. Set the size of the Public Key as necessary.
. Set Issuer as necessary.
6. Click the [Apply] button.
7. Click [SSL/TLS Settings].
8. Select [Enabled] check box for [HTTP - SSL / TLS Communication].
9. Click the [Apply] button.
10. Click the [Reboot Machine] button.
Configuring Machine certificates
1. Click [+] on the left of the [Security] folder on the [Properties] screen.
2. Click [Machine Digital Certificate Management].
3. Click the [Upload Signed Certificate] button.
4. Enter a file name for the file you want to import, or select the file to be imported by clicking the [Browse]
button.
. Enter the [Password], and Enter the [Retype Password].
6. Click the [Import] button.

17
Set IPSec
Note: Before etting [Digital Signature] for [IKE Authentication Method], you will have to import an IPSec
certificate according to ame procedure a "Configuring Machine Certificate " (3.4).
1. Click [+] on the left of the [Security] folder on the [Properties] screen.
2. Click [IPSec].
3. Enable the [Protocol] by placing a check mark in the [Enabled] box.
Choose [Pre-Shared Key] setting (4 - ) or [Digital Signature] setting (6 -11).
4. Select [Pre-Shared Key] for IKE Authentication Method. This is to use the Shared Secret (between this device
and remote computers also possessing the secret).
. Enter a Pre-Shared Key in the [Shared Key] and [Verify Shared Key] box.
Please set the IPSec address successively.
6. Click [Certificate Management] in the [Security] folder.
7. Select [IPSec] for Certificate Purpose.
8. Click the [Display the list] button, and check a desirable Certificate.
9. Click the [Certificate Details] button.
10. Click the [Use this certificate] button.
11. On the [IPSec] screen, Select [Digital Signature] for IKE Authentication Method.
Please set the IPSec address successively.
Set IPSec Addre
12. Enter the IP Address in the [Specify Destination IPv4 Address] box on the [IPSec] screen.
13. Enter the IP Address in the [Specify Destination Ipv6 Address] box.
14. Select [Enabled] or [Disabled] from the [Communicate with Non-IPSec Device] dropdown list.
1 . Click the [Apply] button.
16. Click the [Reboot Machine] button.

18
Set SNMPv3
1. Click [+] on the left of the [Connectivity] folder on the [Properties] screen.
2. Click [+] on the left of the [Protocols] folder.
3. Click [SNMP Configuration].
4. Check the [Enable SNMPv3 Protocol] box.
. Uncheck the [Enable SNMP v1/v2c Protocols] box.
6. Click the [Apply] button.
7. Click the [Edit SNMPv3 Properties] button and check the [Account Enabled] for [Administrator Account].
8. Enter a new Authentication Password (minimum 8 characters).
9. Enter the Confirm Authentication Password.
10. Enter a new Privacy Password (minimum 8 characters).
11. Enter the Confirm Privacy Password.
12. Check the [Account Enabled] for [Print Drivers/Remote Clients Account].
13. Click the [Apply] button.
Note:
•Authentication Password and Privacy Password have to be changed certainly from default Password.
•In using SNMPv3, use the IPSec protocol simultaneously. Therefore the IP address of the client for SNMPv3
have to be set according to the procedures "Set IPSec Address" (3. ).
Enter the IP Address in the [Specify Destination IPv4 Address] box.
•Since the machine cannot communicate by SNMP v1/v2, the port setting on the client Print Driver have to be
select [LPR] for [Protocol], and uncheck the [SNMP status Enabled].

19
Set S/MIME
Note:
•To use E-mail with this machine, E-mail function has to be enabled and configured as stated in the System
Administrator Guide’s "Scan to E-mail".
•Before S/MIME setting, you will have to Import an S/MIME certificate according to same procedure as
"Configuring Machine Certificates" (3.4).
1. Click [Configuration Overview] on the [Properties] screen.
2. Click [Settings] for [E-mail].
3. Click the [Configure] button for [E-mail Settings], and enter the machine’s E-mail address in the [From address]
box.
4. Click the [Apply] button.
. Click [+] on the left of the [Security] folder on the [Properties] screen.
6. Click [Certificate Management].
7. Select [S/MIME] for [Certificate Purpose].
8. Click the [Display the list] button, and check a desirable Certificate.
9. Click the [Certificate Details] button.
10. Click the [Use this certificate] button.
11. Click [SSL/TLS Settings].
12. Check the [Enabled] box for [S/MIME Communication].
13. Click the [Apply] button.
14. Click the [Reboot Machine] button.
1 . After the machine is restarted, refresh the browser and Click [Properties] tab.
16. Click [+] on the left of the [Security] folder.
17. Click [S/MIME Settings].
18. Uncheck the [Enabled] check box for [Receive Untrusted Email].
19. Click the [Apply] button.

20
Regular Review by Audit Log
This section describes the setting and importing method for the Audit Log from the System Administrator client via
CentreWare Internet Services.
The Audit Log, regularly reviewed by the Security Administrator, often with the aid of third party analyzing tools,
helps to assess attempted security breaches, identify actual breaches, and prevent future breaches.
The important events of TOE such as device failure, configuration change, and user operation are traced and
recorded based on when and who operated what function.
Auditable events are stored with time stamps into NVRAM. When the number of stored events reaches 0, the 0
logs on NVRAM is stored into one file ("audit log file") within the internal HDD. Up to 1 ,000 events can be stored.
When the number of recorded events exceeds 1 ,000, the oldest audit log file is overwritten and a new audit event
is stored.
There is no deletion function.
Set Audit Log
1. Open your Web browser and enter the TCP/IP address of the machine in the Address or Location field, press
the <Enter> key.
2. Supply the Administrator ID and Password, when prompted.
3. Click the [Properties] tab.
4. Click [+] on the left of the [Security] folder.
. Click [Audit Log].
6. Check the [Enabled] box for [Audit Log].
7. Click the [Apply] button.
Import the Audit Log File
The following describes methods for importing the Audit Log. The audit logs are only available to system
administrators and can be downloaded via CentreWare Internet Services for viewing and analysis. The logged
data is not viewable from the local UI. And additionally requires the enabling of SSL/TLS encryption for
Accessing to the logged data.
1. Open your Web browser and enter the TCP/IP address of the machine in the Address or Location field, press
the <Enter> key.
2. Supply the Administrator ID and Password, when prompted.
3. Click the [Properties] tab.
4. Click [Audit Log].
. Click [Export as text file].