Lexmark 47B1001 manual

Common Criteria Installation Supplement and Administ rator Guide Novem ber 2011 www.lex mark.com Lexmark and Lexmark with diamond design a re trademarks of Lexmark International , Inc., registered in the United States and/or o th er cou ntries. All other trademarks are the property of their respective owners. © 2011 Lexmark Internati onal, Inc. Al[...]

Edit ion notice November 2011 The followin g parag raph does not a pply to a ny country whe re such pr ovisions a re inconsistent wi th local law: LEXMA RK IN TERN AT IONA L, IN C., PR OVIDE S THI S PU BLI CAT ION “A S IS ” WITHOU T WARRA NTY OF AN Y KIN D, EIT HER EXP RESS OR IMPL IED, INCL UDIN G, BUT NOT LI MITE D TO, THE IMP LIED WA RRANT I[...]

Cont ent s Ove rview and fi rst ste ps.. .... ....... ... ....... .... ... ....... .... ... ........ ... ....... .... ... ....... ... 5 Overvi e w..... .. ... .... ..... ... .... .. ... ... .... .. ... ...... ... ... ... ... ... ... ... ...... ... ... ... ... ... ... ... ...... ... ... ... ... ... . ..... ... ... ... ... ... ... ... ..5 Using this [...]

Creating securi ty temp lates usi ng the EWS ... ....... ...... ....... ....... ...... ...... ........ ............ ....... ....... ...... .... .......... ...... 3 2 Contro llin g ac cess to d evice functio n s....... .. ... ... ... ... ... ...... ... ... ... .. .... .. ... ...... ... ... ... ... ... ... ..... .... .. ... . ..... ... ... 33 Confi g[...]

Overview and first steps Overview This g uide des cribes how to config ure a support ed L exma rk TM m ultif unction printer ( MFP) to r each Com mon Criter ia Eval uat ion A ssura nce Le vel 2 (EAL 2). It is c riti cal that you carefully f ollo w the instruc tions in this guide, as failure to d o so may result in a device that does not m eet the r[...]

Operating environmen t The instruct ions pr ovided i n this guide a re ba sed on the f ollowing as sumptio ns an d obje ctives: • The MFP is ins talled in a cooperative, no nhos tile environm ent that is physically s ecure or monitor ed and provides prot ection fr om unaut horized access to MFP ex ternal i nterfaces. • The adm inistra tion plat[...]

Atta ching a lock Once a lo ck i s attached, the met al plate an d syste m board can not be rem oved, an d the securit y jumper ca nnot be acce ssed withou t caus ing visible d amage to the d evice. Note: If you are using a Lexm ark 650 0e scanner with a T6 50, T6 52, T65 4, or T656 printer , then you mu st attach a lock t o both the sca nner and t[...]

3 Verify that the M FP is in Conf iguratio n m ode by locating the Exit C onfi g Me nu icon in the l ower r ight co rner of the touch s cre en. 4 Scro ll thro ugh t he conf iguration me nus to locate the Disk E ncryption me nu se lection. 5 Touc h Disk Enc ryption > En a ble . Warning: Enabling d isk encryptio n will erase th e contents of the h[...]

Installing the minimum configura tion You c an achieve an eval uated c onfi guration on a no n-netw orked (stan dalone) devic e in just a fe w steps. Fo r t his conf iguration , all t asks are per formed a t the de vi ce, using the to uch sc reen. Co nf ig ur in g th e dev i ce Configura ti on check list This c hecklist outlin es the st eps r equir[...]

3 Retype the pas sword, and the n touch Done to sa ve the new pa ssword and r eturn to the E dit Bac kup Passwor d scr een. 4 Set Use Ba ckup Pa ssword to On . 5 Touc h Submit . Creating u ser ac counts Creating intern al (dev ice) accoun ts for use with t he evalu ated configur ation i nvolves no t only as sig ning a us er ID an d password to eac [...]

G rou p name T ype of user grou p wo uld be sel ect ed fo r Authenticated_Users • Administr ators permitt ed to access all devi ce functions • Administrator s permitted to us e device functions and acc ess the Reports menu • Admini strators permitted to use device functions and access the Sec u rit y m en u • No n ‑ adminis tra tors (all [...]

3 Type a uni que name to identify the template. Us e a de scriptiv e na me, such as ”Admini st rator_Only” or “Authent icate d_Users,” and then t ouch Done . 4 On th e Authentic ation Set up scree n, se lect the inte rnal a ccounts building block, and the n touch Done . 5 On th e Author izatio n Setup sc reen, sel ect t he intern al ac coun[...]

Acc ess co ntrol Le ve l of pr ote ct io n Paper Menu at the Dev ice Authenti cated us ers only Paper Menu Remotely Authenticated users on ly Reports Menu at the Device Administrator access only Reports Menu Remo tely Admini strator access only Settings Menu at the Devic e Admini strator access only Settings Menu Rem otely Admini strator access onl[...]

Acc ess co ntrol Le ve l of pr ote ct io n Held Jo bs Acce ss Di sabl e d Use Profiles Authenti cated users only Change Language fr om Home Screen A uthenticated users only Cancel Jobs at the Device Administrator access only PictBridge Printing Not appl icable—USB po rt disabled Solution 1 Authenti cated users only Note : When eS F applications a[...]

Administering the devic e This c hapter d escribe s how to co nfigure additio nal sett ings a nd fu nctions t hat m ay be availab le on yo ur devic e. Using the Embed ded Web Server Many set tings c an be con figured using ei ther the Em bedded W eb Ser ve r (EWS ) or the t ou ch sc reen. Access ing the EWS 1 Type t he devic e IP addre ss or hos t [...]

• Cou nt ry /Re gi on —Type the countr y or region where the company or organization issuing th e certificate is lo c at ed ( 2 ‑ c h aracter m aximum ). • Pro vinc e Na me —Type the province where the com p any or organization issuing the certificate is located. • Cit y N ame —Type the city wher e the company or organization issuing [...]

The cont ents of the fi le shou ld be in th e followi ng format: ----- BE GI N CERTI FI CA TE--- -- MIIE 1jC CA 76gA wI BA gIQY 6sV 0K L3tI hB tl r4gH G8 5zANB gk qh kiG9 w0B AQ UFAD Bs … l3DT bPe 0m nIbT q0 iW qKEa Vne 1v vaDt 52 iS pEQy ev wgUcH D1 6r Fy+s OnC aQ == ----- EN D CE RTIFI CA TE ----- • Download Si gning Req uest —Download o r [...]

Disabling the AppleT alk pro tocol IP is the on ly net work pr otocol pe rmit ted under this ev al uation. T he AppleT alk pr otoc ol must be dis abled. Using the EWS Note: For i nformat io n about a ccessin g th e EWS, se e “Using the E mbedded Web S erv er” on pag e 1 5. 1 From t he E mbed ded Web S erve r, clic k Settings > Network/Ports [...]

3 Click Submit . Other settin gs and f unct ions Ne t wor k Tim e P rot oc ol Use Netwo rk Time Protoco l (NTP) to automatic ally sync MFP date and time setti ngs with a trust ed clock so that Kerbero s request s and audit log events w ill be accurately time ‑ stam ped. Note: If you r network uses DHCP, th en verify tha t NTP settings are not aut[...]

3 Unde r Simple Ker beros Setup, f or KDC Address , t ype the IP addr ess o r host name of the KDC ( Key Dist ri bution Cen ter ) I P . 4 For K DC P ort, ty pe the num ber o f the po rt used by the Kerbero s serve r. 5 For Realm, type the realm used by the Kerberos server. No te: The Realm ent ry must be ty ped i n all upp ercase let ters. 6 Click [...]

3 Type the IP addr ess o r hos t name of the R emote Sys log Se rver , and then sele ct the Ena ble Rem ote Syslo g check box. No te: Th e Enabl e R e m ot e Sy sl og check b ox is un availabl e until an IP addres s or host na me is entere d. 4 Type the Re mote Sys log P ort nu mber u sed on the de stination se rver . 5 For R emo te Sy slog M ethod[...]

9 If you wan t the MFP to a dd a digital signa ture to e-mail a lerts, then s et “Digitall y sign ex ports” to On . 10 For “Severity of events to log,” select 5 ‑ No t ice . The chosen se verity level and anythin g higher (0–4) wil l be logged. 11 If you wan t the MFP to s end all events re gar dless of severity to the r emote server, t[...]

3 Type the Prima ry SMT P Gatew ay Port num ber o f the des ti nation s erver. 4 If you are u sing a se condar y or backup SMTP serv er, then typ e the IP ad dress or host name a nd S MTP por t for that ser ver. 5 For SMT P Tim eout, type the number of seconds (5–30) the device will w ait for a r espons e from the S MTP server before timing out. [...]

6 If you w ant t o receive res ponses to mes sages se nt f rom th e MFP (in c ase o f faile d or boun ced messa ges), t hen pr ov id e a Re ply A ddr es s . 7 Set U se SSL t o Disable d , Negotia te or Require d to specif y whether e-ma il will be sent using an encrypted link. 8 If the SMTP server requires user credentials, th en select a method fo[...]

Setting up a fax storage location (optional) 1 Turn off t he MFP using the p ower switch. 2 Si multaneo usly pr ess an d hol d the 2 and 6 keys on the numeric keypad whi le turning th e MFP ba ck on. It takes approxi mate ly a mi nute to boo t into the Co nfigurat ion me nu. Once t he MFP is ready, t he touc h screen displ ays a list of func tions [...]

Exam p le : Employees in the warehouse w ill be given access to black ‑ an d ‑ white print ing only, adm inistra tive office staff will be abl e to print i n black and w hite and send f axes, and emplo yees in the m arketing depa rtment w ill have acc ess to bl ack ‑ and ‑ white pr inting, c olor pri nti ng, and f axing. Scenario 1: Crea ti[...]

5 Click Setti ngs > Security > Se curity Se tup > Int ernal A ccoun ts . 6 Click Add an Internal Acc ount , and then provide the information needed for each account: • Accoun t Name —Type the use r's account name (example : “Jack S mith”). • User ID — Type an I D for t he acco unt (exam ple: “jsmi th”). • Pas swor d [...]

• Mail Attrib ute —Type the mail attribute. • Full Name At t ribute —Type the full name attribute. • Search Base —Specify the no de in the LDA P serve r where u ser acc ounts reside. Mu ltiple sear ch base s can be en tered, sepa rat ed by s emicolon s. Note: A search base c onsist s of mul ti ple attribut es, such as cn ( common name )[...]

• Full Name At t ribute —Type the full name attribute. • Search Base —Specify the no de in the LDA P serve r where u ser acc ounts reside. Mu ltiple sear ch base s can be en tered, sepa rat ed by s emicolon s. Note: A search base c onsist s of mul ti ple attribut es, such as cn ( common name ), ou (o rg anizat ional unit), o (org anizat ion[...]

Configu ring Common A ccess Card access A se t of Pu b l ic Ke y Inf ras tr uc tu re (PK I) em bedded a pplicat ions comes i nst alled on the M FP. T hese ap plicat ions prov ide for addi tio nal func tionali ty, i ncluding the use of Smar t Card s suc h as the Depa rtment of Defens e Common A ccess Card (CAC). For more i nformation on us ing a car[...]

• Domain —This is t he car d dom ain that should be mappe d to the spe cifi ed real m. T his is the pr incipal name us ed on t he card an d sho uld be li sted by it self, fo llowe d by a comm a, a peri od, and t hen the pri nci pal name again. This value is case ‑ sensi tive and usu ally app ears i n lowe rcase. Mul tiple v alues can be ent e[...]

Creat ing s ecuri ty t empla tes us ing the EW S A securit y templat e is assigned to e ach devic e function to control w hich us ers are perm itted to access that funct ion. At a minimum, you must crea te two sec urity templates: one for "Admini strator_O nly" and one for "Authenticated_Users." If there is a need to grant acces[...]

Notes: • Clicking Delete Li st from the Manage Security T emplates s creen w ill delete all s ecurity t emplates o n the MFP, regardless of wh ich one is s elected. To delete a n individual sec urity template, select it from t he list, a nd then cli ck Delete E ntry . • You can delete a security t empla te only if it is not in use; how ever, se[...]

• V eri f y J o b Ex pi r at io n —T his can be set to Off , Same as Confident ial Prin t , or one of four inter vals rang ing fro m one hour to one week. • Repeat J ob Expirat ion — This ca n be set to Of f , S ame as C onfident ial Print , or one of fo ur interv als ranging fro m one hour to one week. 8 Under A dvanc ed S ettings, selec t[...]

Acc ess control Leve l o f pr otec tion Network/Ports Menu at the Device Administr ator ac c ess only Network/Ports Menu R emotely Administr ator ac cess only Manage Shortcuts at the D evice Authenticated users only Manage Shortcuts R emotel y Authenticated users only Supplies Menu at the Device Authenticated users onl y Supplies Menu Rem otely Aut[...]

Acc ess control L evel of prot ectio n Use Profiles Authenticated users onl y Change Language from Home Screen Authenticated users onl y Cancel Jobs at the Device Administrator access only PictBridge Printing Not ap plicable–USB port disabled Devi ce Solu tions Acc ess control Leve l of prot ecti on Solution 1 Authenticated users onl y No te : Wh[...]

Troubleshooting Lo gin is sues “Unsupported USB Device” error message M AKE SU RE A S UPPORTED S MART C AR D RE AD ER IS ATTAC HED Only the Om niKey read er t hat ca me with the printe r is su pport ed. Remove t he un suppo rted r eader an d att ach the Omni Key reader. The printer hom e screen fails to re turn to a locked state when not in use[...]

“The KDC and MF P clocks are differe nt bey ond an accept able range; c heck the MFP's date and time” e rror messa ge This er ror indicates that the p rinter clo ck is more than five m inutes out of s ync with th e domain co ntro ller clock. V ERIFY TH E DAT E AND TI M E ON THE PRINTER 1 From t he Embe dded Web S erver, c lick Settings >[...]

“The Doma in Controller I ssu ing Certi ficate ha s not b een inst alled” error mes sag e M AKE SU RE THAT THE CORRECT CERTIFIC ATE HA S BEE N IN STA LLE D ON TH E PRINT ER For info rmatio n on inst alling, view ing, or modi fying ce rtif icates, see “Creating an d mod ifying di gital certific ates” on page 15 . “The KDC di d not resp ond[...]

“Realm on t he card w as not found in t he Kerberos C onfigurati on Fi le” error me ssag e This err or oc curs during Smart Card lo gin. U PLOAD A K ERB ERO S CONFI G URATION FI LE AND MAKE SU RE THE RE AL M HA S BEE N ADDED TO THE FILE The PKI Authent icati on sett ings do not support multiple Ke rberos R ealm entries . If mult iple real ms ar[...]

LDAP issues LDAP look ups ta ke a long ti me an d the n fail This iss ue c an occu r during lo gin (at “Ge tting Us er Info”) or durin g addres s book sear ches. Tr y one or mo re of th e follow ing: M AKE SU RE P OR T 3 89 ( NON ‑ SSL) AND P ORT 636 (SSL) ARE NOT BLOCKED BY A FIR EWALL The printer u ses thes e ports to communicate with the L[...]

Held Jobs/ Pr int Re lea se L ite is sues “You are not authori zed to us e th is feature ” Held Jobs e rror mess age A DD TH E USER TO THE APPROPRIA TE A CTI VE D IREC TOR Y GR OUP If user autho rizati on is enabled f or Held Jobs, then a dd t he user t o an Active D irec tory group t hat is i ncluded in the autho ri zatio n list for th e Held [...]

Jobs are pri ntin g out imme dia tely Try one o r more of th e foll owi ng : M AKE SU RE PKI H ELD J OBS IS IN STA LLED AND RUN NING 1 From t he Embe dded Web S erver, c lick Settings > Devic e Solu tions > So l u ti o ns (e S F) . 2 Verify that the PKI Held Jobs s olution appears in the l ist of inst alled s olution s and that it i s in a ?[...]

Appendix A: Using the touch screen Understa nding th e home screen The screen located on the front of the MFP is touch ‑ sensitiv e an d can be us ed t o access devic e func tions and navig ate setti ngs and configur ation m enus. The ho me sc reen l ooks simil ar to t his (yours may c ontai n addi tional ic on s): @ Status/ Supplies Ready . Copy[...]

To ty pe a sin gle upperc ase or s hift char acter, touc h Shif t , and the n to uch th e letter or numbe r you ne ed to upper case. To t urn on C aps Lock, t ouch Cap s , and then continue typing . Caps Lock will remain engaged unt il you touch Cap s ag ain . Password ~ 1 2 345 678 90 - = Q WE R T Y U I O P [ ] AS D F G H J KL ; Clear Backspace [...]

Appendix B: Acro nyms Acronyms used in this guide CA C ert i f ica te A u th or it y CAC C omm on A cc ess C ard D C Domai n Co ntro ller DHCP Dynamic Host Configuration Protocol DN S Do m a in N am e S er v ic e DoD Department of Defense EAL E va lua t ion As su r an ce Leve l EWS Embedded Web Server GIF Graphic Inter change Format GS S API Gener [...]

Appendix C: Description o f acce ss controls Acces s contr ols Depend ing on t he devic e type and inst alled options , som e access co ntrols (ref erred t o on s ome devi ces a s Function Access C ontro ls) may no t be availabl e for your print er. Administrative Menus Func tion acc ess contr ol What i t does Configuration Menu This protec ts acce[...]

Func tion acc ess contr ol What i t does Settings Menu Rem otely T his protects access to the General and Pr int Settings secti ons of the Setti ngs menu from the Embedded W eb S erver. Supplies Menu at the Device This protec ts access to the S upplies menu from th e printer contr ol panel. Supplies Menu Rem otely This protec ts access to the S upp[...]

Func tion acc ess contr ol What i t does Create Profiles This contr ols the abi lity to c reate new profiles. E ‑ mail Function This contr ols access to the Scan to E ‑ mail fun cti on. Fax Function This controls access to the Scan to Fax function. Flash Drive Color Printing Thi s c ontrols the ability to print c olor from a flash dr ive. Users[...]

Appendix D : Using Common Acces s Cards Using a Common Access Card to acc ess the printer 1 Insert you r Common Acces s Card int o the card re a der attach ed to the p rinter. 2 Whe n prompt ed, enter your P IN usin g the keyp ad t hat appea rs o n the touc h scree n, and t hen touc h Next . It may take a moment for the printer to valida te your cr[...]

Notices LEXMARK SOFTWARE LICENSE A GREEMENT PLEAS E READ CAR EFULL Y BEFO RE IN STAL LING AN D/OR U SIN G THI S SOFTW ARE : This Softw are License Ag reement ("License Agreement") is a legal agreement between you (either an individual or a single entity) and Lexmar k Inter national, In c. ("L exmark") tha t, to the extent your L[...]

c Res ervat ion of Rig hts. The S oftware Pro gram, i ncluding all fonts, is c opyri ghted and owned b y Lexmark I nternationa l, Inc . and/or i ts suppl iers. Lexmark r eserv es all right s not express ly granted to you in t his Lice nse Agreement. d Free ware. N otwiths tanding the t erm s and conditions of this Li cense Agre em ent, all or any p[...]

all copies of the Sof twar e Progra m t ogethe r with all m odif icati ons, docu mentat ion, and mer ged port ions i n any for m. 11 TAXES. You agree that you are respo nsible for paymen t of any taxe s includin g, withou t limitatio n, any goods and services and personal property taxes, resulting from this Agreement or your Use of the Softw are Pr[...]

Index A access c ontrols list of 47 setting a t the device 1 2 us i n g th e EW S to s e t 34 acrony ms 46 AppleTa lk disabling 18 assumpt ion s 6 au dit lo gg ing configu ring 20 auth enticati on token 3 0 B backup passw ord us i n g th e to uch sc r e en to enable 9 before configurin g the device veri fy ing fi rmwa re 6 verifying phys ical inte [...]

securi ty a udit log configu ring 20 secu rity cer tificates creating and modi fying 15 secu rit y obj ectives 6 secu ri ty re set jum pe r enabling 25 secu ri ty sl ot finding 7 secur i ty templates us i n g th e EW S to cr ea t e 3 2 us i n g th e to uch sc r e en to crea te 11 setting d ate and time 19 shutting do wn port acce ss 18 Smart Car ds[...]

www.l e xmar k.com *3065326* PN  3065326  Rev .  001[...]