# Current use of certificates is useless

**URL:** <https://forums.digi.com/t/current-use-of-certificates-is-useless/6553>\
**Category:** Digi CM & Passport\
**Created:** [May 23, 2007, 1:13pm UTC](https://forums.digi.com/t/current-use-of-certificates-is-useless/6553 "2007-05-23T13:13:16Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![uscallesen](https://avatars.discourse-cdn.com/v4/letter/u/8baadc/32.png) [@uscallesen](https://forums.digi.com/u/uscallesen)\
**Post date:** [May 23, 2007, 1:13pm UTC](https://forums.digi.com/t/current-use-of-certificates-is-useless/6553/1 "2007-05-23T13:13:16Z")

</div>

I’m currently working router “backdoor” setup based on Portserver TS1/2 devices.

I’ve encountered a few shortcomings in the security features supported by these devices.

1. The root account is always able to login to the PortServer - this is probably quite usefull, but i also leaves the root account open to bruteforce attacks. Why not make it possible to associate a public key (for SSH) to the root user aswell ?? This way it would actually be able to control all access to the PortServer with certificates - which at this point makes no sense as the root account is always allowed to login anyway…

2. Listening TCP ports - the portserver has several ports listening even after disabling the associated services - telnet for instance - even when disabled leaves port TCP21 open.

I really hope you will consider addressing these issues as they would make it possible to use the PortServers directly over the internet without any further security measures.

---

<div class="post-metadata">

**Author:** ![userid0](https://avatars.discourse-cdn.com/v4/letter/u/f6c823/32.png) [@userid0](https://forums.digi.com/u/userid0)\
**Post date:** [May 23, 2007, 1:19pm UTC](https://forums.digi.com/t/current-use-of-certificates-is-useless/6553/2 "2007-05-23T13:19:22Z")

</div>

It sounds as though the Digi PassPort or Digi CM products would better suit your security needs:

[http://www.digi.com/products/consoleservers/](http://www.digi.com/products/consoleservers/)

---

<div class="post-metadata">

**Author:** ![uscallesen](https://avatars.discourse-cdn.com/v4/letter/u/8baadc/32.png) [@uscallesen](https://forums.digi.com/u/uscallesen)\
**Post date:** [May 23, 2007, 1:25pm UTC](https://forums.digi.com/t/current-use-of-certificates-is-useless/6553/3 "2007-05-23T13:25:25Z")

</div>

I only need 1 or 2 serial connections per site and the security “flaws” I pointed out should be possible to implement / fix on the PortServer TS 1/2 boxes.

I consider this more a bug report than a feature request really 😉

---

<div class="post-metadata">

**Author:** ![userid0](https://avatars.discourse-cdn.com/v4/letter/u/f6c823/32.png) [@userid0](https://forums.digi.com/u/userid0)\
**Post date:** [May 23, 2007, 1:29pm UTC](https://forums.digi.com/t/current-use-of-certificates-is-useless/6553/4 "2007-05-23T13:29:00Z")

</div>

I recommend pursuing this with your Digi Sales Representative. Posting bugs/change requests on the forum will not be viewed by Engineering/Product Management.