Migrating from TFTP configuration download to HFS (TCP_6970)

[Nadav]

Hi everyone,

I'm interested in changing the configuration download mechanism for desktop phones from TFTP to HFS (TCP_6970). This is mostly due cutting down the time until the phone is operational.

Is there any disadvantage to using HFS assuming all phones support it? Are there any negative security implications compared to TFTP?

[Deepak Rawat]

There are no such disadvantages as such. HFS over TFTP is definitely better in terms of faster transfer of files, firmware etc. As far as the question stays:

Which one is better. Then definitely the answer is TFTP as it always had been there and is still there which makes it more of an option from a reliability perspective over HFS which is slightly a newer mechanism for the phones to receive files, Firmware etc at this point of time. But customers are moving towards HFS and lot of them are using it over TFTP and you can only see it increasing over a period of time

Below is a a thread wherein a good discussion happened over this, quite old but still hold some good pointers there:

https://supportforums.cisco.com/discussion/12255201/phone-firmware-update-over-http

Regards

Deepak

[Manish Gogna]

Hi Please check the "HFS Download Support for IP Phone Firmware and Configuration Files" section of the following link which has the following security recommendations

Security Recommendations

Like any access interface, the HFS download service can open router files that should only be accessed by authorized persons. Security issues are made more severe by the fact that the HFS download service is HTTP based, enabling anyone with a simple web browser to access sensitive files, such as configuration or image files, by entering a random string of words.

However, the HFS security problem is restricted to the loose binding operation, where the administrator provides an HFS home path in which the phone firmware and other related files are stored.

In the case where a unique directory path (where only the phone firmware files are stored) is used as the HFS home path

(config-telephony)# hfs home-path flash:/cme/loads/

only those files that are in flash:/cme/loads/ can be accessed.

But when it is the root directory path that is used as the HFS home path

(config-telephony)# hfs home-path flash:/

there is a risk of making configuration files and system images, which are stored in the root directory shared with the phone firmware files, accessible to unauthorized persons.

The following are two recommendations on how to make firmware files inaccessible to unauthorized persons:

• Create a unique directory, which is not shared by any other application or used for any other purpose, fpr IP phone firmware files. Using a root directory as the HFS home path is not recommended.
• Use the ip http access-class command to specify the access list that should be used to restrict access to the HTTP server. Before the HTTP server accepts a connection, it checks the access list. If the check fails, the HTTP server does not accept the request for a connection. For more information on the ip http access-class command, see Cisco IOS Web Browser Commands.

http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucme/admin/configuration/guide/cmeadm/cmesystm.html#pgfId-1059165

Manish

[Nadav]

Hi Manish,

Thank you for the quick reply.

Is there any documentation on whether the "home-path" for HFS on CUCM (and not CME) is isolated from files other than firmware and configuration? I have ACLs in place but I have no idea whether allowing HFS is overall a worse security option than TFTP.

Does TFTP access an isolated folder on CUCM? I'm looking to make a solid case that HFS is no greater a security risk than TFTP assuming exact ACLs are in place.

[Manish Gogna · Accepted solution]

Hi,

Unfortunately there is no documentation for HFS with CUCM either in public docs or internally. The TCP / UDP port usage guide for cucm does mention 6970 for HTTP service from the TFTP server to phones and gateways, however there are no further details

http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/port/9_0_1/CUCM_BK_T98E8963_00_tcp-port-usage-guide-90/CUCM_BK_T98E8963_00_tcp-port-usage-guide-90_chapter_01.html

The location of files accessed on TFTP server via TFTP or HFS would be the same, however there is no real info available on which one is more secure.

If i find something related to this over the next few days i will update this post.

Manish

[Nadav]

Thank you :)