Potential Symmetrix Security Vulnerability/Auditing Issues

Question

It could be assumed that most of the Sym's out there field have some sort of remote dial-in/support capabilty.
When EMC remotely dials into a box to do support, there is no auditing reporting available that tells the customer, who dialed in, when they were connected and what was done on the machine. There should be a method or SYMCLI command that can pull this info and be able to report on it. This should be something that can be printed out by a customer and handed to a security auditor. Since there is not even basic login/logout accounting available to the customer, it's impossible to determine if someone is attempting to remotely hack into the machine. What if a disgruntled EMC tech decides to mess with an array or steal data? (Although that's very very unlikely, the potential is still there.)
Some EMCer's in other threads (ie. mlee) have suggested to physically limit access to the machines but still there is not access auditing available. Limiting access is not really an acceptable solution because it limits the ability of EMC to support the arrays.

Farhan-WyGkB · Answer

One way to restrict dial in is by maiking the System Operators make the physical phone connection to the symm's modem. The symm is able to dial out, but in order for EMC to dial in they have dial in via from the Operations Staff. The Ops then verify identity ( from there access list) and make the physical connection ( just like Phone Operators did in the old days). This is long winded, but doesn't pose a threat because dial in is authenticated and recorded for auditing reinforced by requesting bonified a Service Request Number.

sysmgr1 · Answer

Farhan,This is not an option because it restricts the Sym's ability to dial home. The goal is not to restrict the functionality or the ability of EMC to perform support on their products in any way. The goal is simply to report who, what, where and when. Who from EMC dialed in? What did they do? Where did they dial in or which array did they access? Finally, when did they access the machine? Dial homes should be reported too, so that there if there is a recurring hardware issue, then it could be addressed. If EMC has nothing to hide, then they should easily be able to do this.

Farhan-WyGkB · Answer

I know of a site where they use one number for the symm to dial out and another to dial in. That way the symm will always report dial homes, but the Operator will have to make the physical connection for dial in. A record of all dial in and dial out activities can be made this way.

With regards to a record of dial homes. The symm will dial home for errors that we'll never understand as its quite a complex beast, so having visbilty of these type of dial homes isn't relevent ( as its's not in our remit as end users ) or may be even seen as over kill to some people.

Lee_Neel · Answer

Guys, You should all really check out the Secure Remote Support Gateway. Get rid of the modems and know who is doing what.Lee

sysmgr1 · Answer

After further research, the ESRS product is not the answer. The objective is not to restrict anyone but rather just to basic reporting. This is just more 'Windows Gooey' that ends up more of a problem than a solution.

sysmgr1 · Answer

Would anyone from EMC like to comment?

sysmgr1 · Answer

Thanks for the reply Matt.What would it take to make these files available? Since the SYMCLI/SYMAPI programs talk directly to the service processor, this seems like it would be easy to do, right?

MrTS2Symm · Answer

Sysmgr,

All Symmetrix machines require a phone line for maintenance capability.
The audit of any and all work with respect to the Symmetrix is recorded on the Service Processor in log files. This information is from inline's commands entered after a person logs in, along with periodic and scheduled checks.

As far as 'hacking' into the Symmetrix, the software for connection is proprietary and password protected. There are also Customers that enable dial in access, but that is added overhead on the Customer.

Hosts are notified of errors via console messages. These are not all events or errors, but ones that are deemed noteworthy and can be enabled or disabled via Customer request with the local EMC personal.

sysmgr1 · Answer

The problem is not how to restrict and control access.
The issue concerns simple reporting of who, what, where and when. Certainly this information could be supplied from the sym somehow. The symcli commands get practically everything else. It seems silly to have to install an external security system to get this basic info. ESRS is wasteful overkill.

sysmgr1 · Answer

MrTS2Sym,Why is the audit of all work done on the Symmetrix by EMC, kept from the customers' view?

MrTS2Symm · Answer

Sysmgr,

Maintenance work performed on any Symmetrix is not kept form Customers. Anything that has any potential impact to Customers is first discussed with them for both authorization and monitoring.

From the beginning of EMC Symmetrix time, it has been one of the working benefits with the Symmetrical layout and configuration, non disruptive and transparent maintenance be performed with minimal Customer engagement. Customers have their own business to attend to and focus on.

The logs within the Service Processor being proprietary format are intelligible by trained EMC personal.

By Customers for working with real time and statistical information needs, there are packages as EMC Control Center that have the capability of managing all size Data Centers.

I hope that this answers your question.

JasonBailey · Answer

The issue concerns simple reporting of who,
what, where and when. Certainly this information
could be supplied from the sym somehow. The symcli
commands get practically everything else.

This is an enhancement request.

To submit an enhancement request, log in to Powerlink and navigate to Support > About EMC Customer Service > Contact EMC Customer Service, then select "Software Product Enhancement Request" from the selection list. Fill out and submit your enhancement request and it will be routed to the proper development organization for consideration.

This is not meant to disregard your points, its simply the best way to get what you are saying in front of the right people for a formal review.

Let us know how you go.

sysmgr1 · Answer

Thanks Jason,I will do that. We'll see how it goes.

Symmetrix

Potential Symmetrix Security Vulnerability/Auditing Issues

Was this post helpful?