How to restrain servers to connect to certain USB ports/groups?

USB Edgeport
1

How can I block server admins from changing to an other group / USB-ports? We intended to use a AnywhereUSB/14 connected to several servers but they should only be connected to a specified group or USB-ports each. With the local config utility they have the possibility to disconnect, configure and change the group number. They can also do a total reboot on the hub! When others are connected! It feels far from “enterprise”…
How can we prevent this?

2

Hello,

  1. Once a host PC is connected to an AnywhereUSB, you should not be able to disconnect it via the AnywhereUSB Configuration Utility on a different PC. The Disconnect button only applies to the PC you’re running it on. In the case of the AnywhereUSB/14 specifically (which supports multi-host connections), clicking the Disconnect button only disconnects that particular local host PC from the Group that it’s connected to.

  2. Once a host PC is connected to a particular Group, it’s not possible for a different PC to connect to that same Group. While you can input an “already taken” Group number in the configuration, it won’t let you connect to it. The AnywhereUSB Configuration Utility would give an error “Group x is not available on the Remote Hub, it is owned by 1.2.3.4” where x is the Group number in question and 1.2.3.4 is the IP address of the host PC that’s already connected to that Group.

  3. About being able to reboot an AnywhereUSB, that’s unfortunately correct. Note that the AnywhereUSB will automatically re-connect to the host PC(s) after getting rebooted.

3

Hello,

The same for me, in a hosting environment this is a must, and so I was suprised that it’s not possible.
Is there already an update?

Regards,
Aad

4

But in the case pc1 has made a disconnect or is shutdown, any other pc or server could connect to the group intended for pc1. From our point of view not acceptable. We want to have the possibility to restrain certain group to specific pc or server.

5

What you said is correct.

I strongly suggest contacting your local Digi sales representative to discuss getting a “change request” done to fit your requirements. To get that process started, please make a support case with us, and reference this forum topic (8444) in the case notes.

http://www.digi.com/support/eservice/index.jsp

If you don’t already have an account on our support site, you’ll need to create one in order to create the case.

I’ll then connect you with your local Digi sales rep to pursue this.

6

Hi all
Is there an update to your feature request? It is exactly the same we need as well (and actualy expected when buying the device…).
Cheers, Roger

7

Hello, everyone.

We now have new beta AnywhereUSB/14 firmware that addresses some security issues.

With this new firmware, the AnywhereUSB/14 no longer responds to Reboot or (Network) Configuration requests from the AnywhereUSB Configuration Utility. This prevents “anyone” from rebooting the unit or changing the unit’s network settings.

Please note the following:

A. We have not made any changes to the AnywhereUSB Configuration Utility (we may in the future). This means that the Reboot and Configure buttons will still exist in the AnywhereUSB Configuration Utility, however they will no longer have an effect on AnywhereUSB/14 units that are running the new firmware.

B. In order to reboot a unit that’s running the new firmware, or change the unit’s network settings, you must to log into the Web UI or CLI, both of which already can be password-protected.

C. The Digi Device Discovery Utility, which uses a different protocol than the AnywhereUSB Configuration Utility, can still be used to re-configure a unit’s network settings. This is a Digi service (ADDP) that can be disabled on the AnywhereUSB/14 if needed, to “lock it down” even more.

D. This firmware is for the AnywhereUSB/14 model only.

Note that, once a computer is connected to a Group, it’s not possible for another computer to connect to that Group (unless, of course, the “connected” computer crashes/reboots/shuts down/etc.). With the production firmware, as you may have noticed, it’s possible to “steal” or “hijack” an AnywhereUSB by configuring a computer to connect to a Group, then rebooting the AnywhereUSB. However, the new firmware should address that security hole (if you will) by disabling the Reboot button.

If anyone is interested in this new beta firmware, please e-mail support.wizards@digi.com and reference this forum thread (ID # 8444).

8

Jeremy,

This firmware indeed does what you say.
Almost perfect in my case, just one step to go.
Create a password on each USB portgroup and the product suits.

Regards,
Aad