Xerox D95 Manual

Version 1.0
February 2012
Xerox
®
D95/D110/D125
Copier/Printer
Security Function Supplementary
Guide

©2012 Xerox Corporation. All rights reserved. Xerox®, Xerox and esign®, CentreWare® and
FreeFlow® are trademarks of Xerox Corporation in the United States and/or other countries.
Microsoft® and Windows® and registered trademarks of Microsoft Corporation.
BR3663

Xerox
®
D95/D110/D125 Copier/Printer Security Function Supplementary Guide i
Ta le of Contents
Table of Contents ................................................................................................... i
Before Using the Security Function................................................................ 1
Preface ....................................................................................................................................................... 1
Security Features ................................................................................................................................... 2
Settings for the Secure Operation .................................................................................................. 3
Data Restoration.................................................................................................................................... 3
Starting Use of the Data Encryption Feature and Changing the Settings ................... 4
Use of the Overwrite Hard Disk ....................................................................................................... 4
Service Representative Restricted Operation ............................................................................ 5
For Optimal Performance of the Security Features ................................................................ 5
Confirm the Machine ROM Version and the System Clock ................................................. 7
How to Check y Control Panel ........................................................................................... 7
How to Check y Print Report .............................................................................................. 7
How to Check the System Clock ......................................................................................... 7
Initial Settings Procedures Using Control Panel........................................ 9
Authentication for Entering the System Administration Mode......................................... 9
Use Passcode Entry from Control Panel....................................................................................... 9
Change the System Administrator’s Passcode ...................................................................... 10
Set Maximum Login Attempts ...................................................................................................... 10
Set Service Representative Restricted Operation.................................................................. 10
Set Overwrite Hard Disk ................................................................................................................... 11
Set Scheduled Image Overwrite ................................................................................................... 11
Set Data Encryption .......................................................................................................................... 11
Set Authentication ............................................................................................................................. 12
Set Access Control .............................................................................................................................. 12
Set Private Print ................................................................................................................................... 13
Set User Passcode Minimum Length.......................................................................................... 13
Set Auto Clear ...................................................................................................................................... 14
Set Report Print .................................................................................................................................... 14
Set Self Test .......................................................................................................................................... 14
Set Software Download ................................................................................................................... 15
Initial Settings Procedures Using Xerox
®
CentreWare
®
Internet
Services ................................................................................................................... 17
Preparations for Settings on the Xerox
®
CentreWare
®
Internet Services .................. 17

ii Xerox
®
D95/D110/D125 Copier/Printer Security Function Supplementary Guide
Set SMB ................................................................................................................................................... 17
Set Xerox
®
FreeFlow
®
....................................................................................................................... 18
Set We DAV ......................................................................................................................................... 18
Set Receive E-mail .............................................................................................................................. 18
Set IPP ..................................................................................................................................................... 18
Set LDAP Server ................................................................................................................................... 19
Set Ker eros Server ............................................................................................................................ 19
Set SSL/TSL ............................................................................................................................................ 20
Configuring Machine Certificates ............................................................................................... 20
Set IPSec ................................................................................................................................................. 21
Set IPSec Address ............................................................................................................................... 21
Set SNMPv3 ........................................................................................................................................... 22
Set S/MIME ........................................................................................................................................... 23
Set Browser Refresh ........................................................................................................................... 23
Set Jo Deletion .................................................................................................................................. 24
Regular Review by Audit Log ......................................................................... 25
Set Audit Log ........................................................................................................................................ 25
Import the Audit Log File ................................................................................................................ 26
Self Testing .......................................................................................................... 27
Set Self Test .......................................................................................................................................... 27
Authentication for the Secure Operation ................................................ 29
Overview of Authentication ........................................................................................................... 29
Users Controlled y Authentication ............................................................................... 29
Machine Administrator ........................................................................................................ 29
Authenticated Users (with System Administrator Privileges) ............................. 30
Authenticated Users (with No System Administrator Privileges) ...................... 30
Unauthenticated Users ....................................................................................................... 30
Local Machine Authentication (Login to Local Accounts) ................................................ 30
Remote Authentication (Login to Remote Accounts)......................................................... 30
Functions Controlled y Authentication ................................................................................... 31
Authentication for Folder ................................................................................................................ 32
Types of Folder ........................................................................................................................ 32
Operation Using Control Panel .................................................................... 35
User Authentication .......................................................................................................................... 35
Create/View User Accounts ............................................................................................................ 36
Change User Passcode y General User ................................................................................... 37
Jo Deletion y System Administrator ...................................................................................... 38
Folder / Stored File Settings ........................................................................................................... 38
Folder Service Settings ......................................................................................................... 38

Xerox
®
D95/D110/D125 Copier/Printer Security Function Supplementary Guide iii
Stored File Settings ................................................................................................................ 39
Create Folder ........................................................................................................................................ 39
Send from Folder ................................................................................................................................ 40
Private Charge Print ........................................................................................................................... 41
Operation Using Xerox
®
CentreWare
®
Internet Services .................. 43
Accessing Xerox
®
CentreWare
®
Internet Services ............................................................... 43
Print .......................................................................................................................................................... 45
Scan (Folder Operation) .................................................................................................................. 45
Folder: List of Files .................................................................................................................. 47
Edit Folder ................................................................................................................................. 48
Folder Setup ............................................................................................................................. 48
Import the files ....................................................................................................................... 49
Printing Jo Deletion ......................................................................................................................... 49
Change User Passcode y System Administrator (Using Xerox
®
CentreWare
®
Internet Services) ................................................................................................................................ 49
Problem Solving ................................................................................................. 51
Fault Clearance Procedure .............................................................................................................. 51
Fault Codes............................................................................................................................................ 52
Security @ Xerox ................................................................................................ 59
Appendix ............................................................................................................... 60

Xerox
®
D95/D110/D125 Copier/Printer Security Function Supplementary Guide 1
Before Using the
Security Function
This section describes the certified security functions and the items to be confirmed.
Preface
This guide is intended for the manager and system administrator of the organization where
the machine is installed, and describes the setup procedures related to security.
For general users, this guide describes the operations related to security features.
For information on the other features available for the machine, refer to your User Guide or
your System Administrator Guide.
The security features of the Xerox
®
95/ 110/ 125 Copier/Printer are supported by the
following ROM versions.
Controller ＋ PS ROM Ver. 1.201.1
IOT ROM Ver. 83.25.0
IIT ROM Ver. 9.8.0
A F ROM Ver. 13.10.0
Important:
The machine has obtained IT security certification for Common Criteria EAL3+ALC_FLR.2.
This certifies that the target of evaluation has been evaluated based on the certain evaluation
criteria and methods, and that it conforms to the security assurance requirements.
Note: Your ROM and user documentation may not be the certified version because they may
have been updated along with machine improvements.
For the latest information on security and operation concerning your device, download the
latest versions from http://www.support.xerox.com/support
1

2 Xerox
®
D95/D110/D125 Copier/Printer Security Function Supplementary Guide
Security Features
Xerox
®
95/ 110/ 125 Copier/Printer have the following security features:
•Hard isk ata Overwrite
•Hard isk ata Encryption
•User Authentication
•System Administrator’s Security Management
•Customer Engineer Operation Restriction
•Security Audit Log
•Internal Network data protection
•Self-Test
•Information Flow Security

Xerox
®
D95/D110/D125 Copier/Printer Security Function Supplementary Guide 3
Settings for the Secure Operation
For the effective use of the security features, the System Administrator (Machine
Administrator) must follow the instructions below:
Passcode Entry from Control Panel Set to [Enabled].
The System Administrator Passcode Change the default passcode "1111" to another
passcode of 9 or more characters.
Maximum Login Attempts efault [5] Times.
Service Rep. Restricted Operation Set to [On], and enter a passcode of 9 or more
characters.
Overwrite Hard isk efault [3 Overwrites].
ata Encryption efault [On].
Scheduled Image Overwrite Set to [Enabled].
Authentication Set to [Login to Local Accounts] or [Login to Remote
Accounts].
Access Control Set to [Locked] for evice Access and Service Access.
Private Print Set to [Save as Private Charge Print].
User Passcode Minimum Length Set to [9] characters.
Auto Clear efault [Enabled].
Report Print Set to [ isable].
Self-Test Set to [Enabled].
Software ownload Set to [ isabled].
SMB Set to [ isabled] for [NetBEUI].
Xerox
®
FreeFlow
®
Set to [ isabled].
Receive E-mail efault [ isabled].
Web AV Set to [ isabled].
IPP efault [Enabled].
SSL/TLS Set to [Enabled].
IPSec Set to [Enabled].
SNMPv1/v2c Set to [ isabled].
SNMPv3 Set to [Enabled].
S/MIME Set to [Enabled].
Audit Log Set to [Enabled].
Browser Refresh Set to [ isabled].
Job eletion Set to [Administrator Only].
Important:
The security will not be effective if you do not correctly follow the above setting instructions.
The Information Flow Security feature requires no special settings by System Administrator.
When you set ata Encryption [On] again, enter an encryption key of 12 characters.
Data Restoration
The enciphered data cannot be restored in the following conditions.
•When a problem occurs in the hard disk.
•Without the correct encryption key.
•Without the correct System Administrator I and passcode when setting [Service Rep.
Restricted Operation] to [On].

4 Xerox
®
D95/D110/D125 Copier/Printer Security Function Supplementary Guide
Starting Use of the Data Encryption
Feature and Changing the Settings
When data encryption is started or ended, or when the encryption key is changed, the machine
must be restarted. The corresponding recording area (the Hard isk) is reformatted when
restarting. In this case, the previous data is not guaranteed.
The recording area stores the following data:
•Spooled print data
•Print data including the secure print and sample print
•Forms for the form overlay feature
•Folder and job flow sheet settings (Folder name, passcode, etc.)
•Files in Folder
•Address book data
Important:
Be sure to save all necessary settings and files before starting to use the data encryption
feature or changing the settings.
An error occurs if the connected hard disk does not match the encryption settings.
Use of the Overwrite Hard Disk
In order to protect the data stored on the hard disk from unauthorized retrieval, you can set
the overwrite conditions to apply them to the data stored on the hard disk.
You can select the number of overwrite passes as one or three times. When [1 Overwrite] is
selected, “0” is written to the disk area. [3 Overwrites] ensures higher security than [1
Overwrite].
The feature also overwrites temporarily saved data such as copy documents.
Important:
If the machine is powered off during the overwriting operation, unfinished files may remain on
the hard disk. When the power is restored, the overwriting operation will resume with the
unfinished files remaining on the hard disk.

Xerox
®
D95/D110/D125 Copier/Printer Security Function Supplementary Guide 5
Service Representative Restricted
Operation
Specifies whether the Service Representative has full access to the security features of the
machine, including the ability to change System Administrator settings.
For the 95/ 110/ 125 Copier/Printer, select [On] and then set [Maintenance Passcode] to
restrict the Service Representative from entering the System Administration mode.
Important:
If the System Administrator’s user I and the passcode are lost when [Service Rep. Restricted
Operation] is set to [On], neither you nor the Xerox representative will be able to change any
setting in the System Administration mode.
For Optimal Performance of the Security
Features
The manager (of the organization that the machine is used for) needs to follow the
instructions below:
•The manager needs to assign appropriate people as system and machine administrators,
and manage and train them properly.
•The manager and system administrators need to train users about the security policies
and procedures of their organization.
•The machine needs to be placed in a secure or monitored area where the machine is
protected from unmanaged physical access.
•If the network where the machine is installed is to be connected to external networks,
configure the network properly to block any unauthorized external access.
•The users must set a user I and a passcode on [Accounting Configuration] of printer
driver.
•Users and administrators need to set passcodes and an encryption key according to the
following rules for the client PC login and the machine’s setup:
-o not use easily guessed character strings for passcodes.
-A passcode needs to contain both numeric and alphabetic characters.
•Users and administrators need to manage and operate the machine so that their user I s
and passcodes may not be disclosed to another person.
•Administrators need to set the account policy in the remote authentication server as
follows:
-Set password policy to [9 or more characters].
-Set account lockout policy to [5 times].
•For secure operation, all of the remote trusted IT products that communicate with the
machine shall implement the communication protocol in accordance with industry
standard practice with respect to RFC/other standard compliance (SSL/TLS, IPSec,
SNMPv3, S/MIME) and shall work as advertised.

6 Xerox
®
D95/D110/D125 Copier/Printer Security Function Supplementary Guide
•The settings described below are required for both the machine’s configuration and the
client’s configuration.
1) SSL/TLS
For the SSL client (Web browser) and the SSL server that communicate with the
machine, select a data encryption suite from the following:
-SSL_RSA_WITH_RC4_128_SHA
-SSL_RSA_WITH_3 ES_E E_CBC_SHA
-TLS_RSA_WITH_AES_128_CBC_SHA
-TLS_RSA_WITH_AES_256_CBC_SHA
(The recommended browser is Microsoft
®
Internet Explorer 6/7/8)
2) S/MIME
For the machine and E-mail clients, select an Encryption Method/Message igest
Algorithm from the following:
-RC2 (128bit)/SHA1
-3Key Triple- ES (168bit)/SHA1
3) IPSec
For the IPSec host that communicates with the machine, select an Encryption
Method/Message igest Algorithm from the following:
-AES (128bit)/SHA1
-3Key Triple- ES (168bit)/SHA1
4) SNMPv3
The encryption method of SNMPv3 is fixed to ES. Set [Message igest Algorithm] to
[SHA1].
Important:
•For secure operation, while you are using the Xerox
®
CentreWare
®
Internet Services, do
not access other web sites.
•For secure operation, when you change [Authentication Type], initialize the hard disk by
resetting [ ata Encryption] and changing [encryption key].
•For preventing SSL vulnerability, you should set the machine address in the proxy
exclusion list of browser.
•With this setting, secure communication will be ensured because the machine and the
remote browser communicate directly without proxy server, and thus you can prevent
man-in-the-middle attacks.
•o not use Backup Restore function, because they have not been evaluated.

Xerox
®
D95/D110/D125 Copier/Printer Security Function Supplementary Guide 7
Confirm the Machine ROM Version and
the System Clock
Before making initial settings, the System Administrator (Machine Administrator) needs to
check the ROM version of the machine and the system clock of the machine.
How to Check y Control Panel
1. Press the <Machine Status> button on the control panel.
2. Select [Machine information] on the touch screen.
3. Select [Software Version] on the [Machine information] screen.
You can identify the software versions of the components of the machine on the screen.
How to Check y Print Report
1. Press the <Machine Status> button on the control panel.
2. Select [Print Reports] on the [Machine information] screen.
3. Select [Printer Reports] on the touch screen.
4. Select [Configuration Reports].
5. Press the <Start> button on the control panel.
You can identify the software versions of the components of the machine by Print Report.
How to Check the System Clock
1. Press the <Log In/Out> button on the control panel.
2. Enter the System Administrator’s Login I and the passcode if prompted (default I :
“admin”, default passcode: “1111”).
3. Select [Enter] on the touch screen.
4. Press the <Machine Status> button on the control panel.
5. Select [Tools] on the touch screen.
6. Select [System Settings].
7. Select [Common Service Settings].
8. Select [Machine Clock/Timers].
You can check the time and the date of the internal clock. If you need to change the time and
the date, refer to the following procedures.
9. Select the required option.
10. Select [Change Settings].
11. Change the required setting. Use the scroll bars to switch between screens.
12. Select [Save].

Xerox
®
D95/D110/D125 Copier/Printer Security Function Supplementary Guide 9
Initial Settings
Procedures Using
Control Panel
This section describes the initial settings related to Security Features, and how to set them on
the machine’s control panel.
Authentication for Entering the System
Administration Mode
1. Press the <Log In/Out> button on the control panel.
2. Enter "admin" with the keyboard displayed. This is the factory default I .
3. Select [Next] on the touch screen.
4. Enter "1111" from the keyboard when passcode is required.
5. Select [Enter] on the touch screen.
6. Press the <Machine Status> button on the control panel.
7. Select [Tools].
Use Passcode Entry from Control Panel
1. Select [Authentication/Security Settings] on the [Tools] screen.
2. Select [Authentication].
3. Select [Passcode Policy].
4. On the [Passcode Policy] screen, select [Passcode Entry from Control Panel].
5. Select [Change Settings].
6. On the [Passcode Entry from Control Panel] screen, select [On].
7. Select [Save].
8. To exit the [Passcode Policy] screen, select [Close].
2

10 Xerox
®
D95/D110/D125 Copier/Printer Security Function Supplementary Guide
Change the System Administrator’s
Passcode
1. Select [Authentication/Security Settings] on the [Tools] screen.
2. Select [System Administrator Settings].
3. Select [System Administrator’s Passcode].
4. Select [New Passcode].
5. Enter a new passcode of 9 or more characters using the keyboard displayed, and then
select [Save].
6. Select [Retype Passcode].
7. Enter the same passcode, and then select [Save].
8. Select [Save].
9. A confirmation window appears. Select [Yes] to confirm your entry.
Set Maximum Login Attempts
1. Select [Authentication/Security Settings] on the [Tools] screen.
2. Select [Authentication].
3. Select [Maximum Login Attempts By System Administrator].
4. On the [Maximum Login Attempts] screen, select [Limit Attempts].
5. With [▲] and [▼], set [5].
6. Select [Save].
Set Service Representative Restricted
Operation
1. Select [System Settings] on the [Tools] screen.
2. Select [Common Service Settings].
3. Select [Other Settings].
4. On the [Other Settings] screen, select [Service Rep. Restricted Operation].
5. Select [Change Settings].
6. Select [On].
7. Select [Maintenance Passcode].
8. Select [New Passcode].
9. Enter a new passcode of 9 or more characters by using the keyboard displayed, and then
select [Save].
10. Select [Save].

Xerox
®
D95/D110/D125 Copier/Printer Security Function Supplementary Guide 11
11. Select [Retype Password/Passcode].
12. Enter the same passcode by using the keyboard displayed, and then select [Save].
13. Select [Save].
14. Select [Yes] to apply the change.
15. A confirmation window appears. Select [Yes] to confirm your entry.
16. To exit the [Other Settings] screen, select [Close].
Set Overwrite Hard Disk
1. Select [Authentication/Security Settings] on the [Tools] screen.
2. Select [Overwrite Hard isk].
3. Select [Number of Overwrites].
4. On the [Number of Overwrites] screen, select [1 Overwrite] or [3 Overwrites].
5. Select [Save].
Set Scheduled Image Overwrite
1. Select [Authentication/Security Settings] on the [Tools] screen.
2. Select [Overwrite Hard isk].
3. Select [Scheduled Image Overwrite].
4. On the [Scheduled Image Overwrite] screen, select [ aily], [Weekly], or [Monthly].
5. Set [ ay], [Hour],and [Minutes],
6. Select [Save].
Set Data Encryption
1. Select [System Settings] on the [Tools] screen.
2. Select [Common Service Settings].
3. Select [Other Settings].
4. On the [Other Settings] screen, select [ ata Encryption].
5. Select [Change Settings].
6. Select [On].
7. Select [New Encryption Key].
8. Enter a new encryption key of 12 characters by using the keyboard displayed, and then
select [Save].
9. Select [Re-enter the Encryption Key]
10. Enter the same passcode, and then select [Save].

12 Xerox
®
D95/D110/D125 Copier/Printer Security Function Supplementary Guide
11. Select [Save].
12. Select [Yes] to apply the change.
13. Select [Yes] to reboot.
Set Authentication
1. Select [Authentication/Security Settings] on the [Tools] screen.
2. Select [Authentication].
3. Select [Login Type].
4. On the [Login Type] screen, select [Login to Local Accounts] or [Login to Remote
Accounts].
5. Select [Save].
When [Login to Remote Accounts] is selected in step 4, proceed to steps 6 to 12.
6. Select [System Settings] on the [Tools] screen.
7. Select [Connectivity & Network Setup].
8. Select [Remote Authentication Server Setting].
9. Select [Authentication System Setup].
10. Select [Authentication System].
11. Select [Change Settings].
12. On the [Authentication System] screen, select [L AP] or [Kerberos].
13. Select [Save].
14. To exit the [Remote Authentication Server Setting] screen, select [Close].
Set Access Control
1. Select [Authentication/Security Settings] on the [Tools] screen.
2. Select [Authentication].
3. Select [Access Control].
4. Select [ evice Access].
5. On the [ evice Access] screen, select [Locked] for [Service Pathway], [Job Status Pathway],
and [Machine Status Pathway].
6. Select [Save].
7. Select [Service Access].
8. On the [Service Access] screen, select an item and then select [Change Settings].
9. Select [Locked].
10. Select [Save].
Perform steps 8 and 10 for each item.
11. Select [Close].