The traffic for O&M, signaling, trusted payload, and untrusted payload uses separate vNICs. Virtual switch traffic separation is also a requirement in the cloud environment for vMRF. For more information on security requirements in the cloud environment for vMRF, refer to the vMRF Infrastructure Requirements.

The Northbound Interface (NBI) is assumed to be accessed from a trusted O&M network. O&M traffic is secured using various security protocols, see Services, Ports, and Protocols for the details. Other protocols, for example, Telnet or FTP, are not permitted on the O&M interface.

It is recommended to configure a rate limit in an external firewall for protection of the NBI. For a description of the O&M traffic architecture, refer to Security Management for ECLI, NETCONF, and SFTP Users.

vMRF uses Role-Based Access Control (RBAC) with different rules that can be granted to various role groups. vMRF uses an external Lightweight Directory Access Protocol (LDAP) server to provide user authentication. It is recommended to follow the operator's security policy when defining O&M users and assigning specific roles to them. It is recommended that access to sensitive information is restricted to those roles and operations personnel who need the access.

The following default roles are defined in vMRF:

Users have access to CLI commands as defined by the POSIX groups shown in Table 2. It is possible for a user to be a member of multiple POSIX groups. It is recommended that access to sensitive information is restricted to those roles and operations personnel who need the access. Media Stream Recording (MSR) access must only be granted to Ericsson troubleshooters. For more information, refer to Media Stream Recording.

The emergency user is a user that can log on to the system controller using SSH through the NBI, even when the LDAP server is unavailable. The emergency user is defined during deployment and cannot be changed during operation. The emergency user has access to all MOs and can therefore log on to the system to restore LDAP connectivity and return the system to normal operation.

SSH login for the root user is not permitted for normal users. The root user is locked, so that normal users cannot change to root with the su root command. The emergency user can change to root with the sudo -i command.

Logging in through the serial port is not permitted.

SSH host keys (RSA, DSA, ECDSA) for the VMs of the VNF cluster are generated automatically by the first VM during the deployment process, and copied to all other VMs. The fingerprints of the SSH host keys are visible in the console tool after deployment.

An SSH session is an interval that starts when a user is authenticated and can start operations. It ends when the user exits, or when the connection to the VNF is closed because of user inactivity. If the session ends because of inactivity, the situation is called idle session time-out.

Idle session time-out is a fixed time of 30 minutes and is enforced for all CLI command, NETCONF, and file access sessions. Traffic is monitored only in the client-to-server direction.

The vMRF SSH interface uses a mechanism to protect against password cracking with brute-force attacks. The mechanism temporarily bans login attempts from IP addresses that reach the maximum allowed number of failed login attempts. The ban period and the maximum allowed number of failed login attempts are preconfigured in vMRF.

The ban period is set to 10 minutes, and the maximum allowed number of failed login attempts is 10. This means that after 10 unsuccessful login attempts, no more login attempts are allowed from the given IP address for 10 minutes.

This section provides the instructions for operating the security functionality of the product.

Even though vMRF has been installed and hardened securely, administrator and user activity over time can introduce security exposures. Also, new vulnerabilities which need to be mitigated are frequently found in the existing products. Therefore it is necessary to maintain the security posture of the product in service on a regular, ongoing basis.

This section describes recommended periodic operations.

• Take system backups regularly according to the vMRF Backup and Restore Guideline.

• Restrict access to backup files so that unauthorized persons cannot view or modify the included sensitive data. This recommendation also refers to backups stored in an external server.

• Apply password policies on the LDAP server to enforce password complexity, aging, and recovery.

• Ensure that no unnecessary accounts exist.

• Ensure that no unnecessary listening ports are open.

• Ensure that no shared user accounts are used.

• Ensure that the emergency user password is not known by more people than necessary.

• Ensure that user rights are assigned only to real needs.

• Monitor the log of access and authorization events in the system by using the following commands:

  • journalctl _COMM=sshd – sshd access logs

  • journalctl SYSLOG_FACILITY=10 – authentication logs

  • journalctl _COMM=com – NBI audit logs

Patches are delivered as new vMRF SW packages. A new SW package is deployed as a new vMRF VNF, and if needed, the old VNF can be deleted.