PS Connection security
Configure HTTPS certificate
A custom certificate that is trusted by all client computers should be configured for MyQ Print Server. Three modes of certificate management are available:
![Certificate settings in the MyQ web UI](../../../__attachments/1188364314/ServerCerts.png?inst-v=f576f6b0-eb9f-4035-8724-3dad44b7106e)
By default, MyQ Print Server creates its own root CA certificate and uses it to sign server and client certificates. The public portion of this certificate can be exported and deployed to the client certificate trust store, e.g., by using Group Policy or MDM.
Organizations with their own PKI already trusted might prefer the second option. MyQ Print Server uses its own intermediate CA to issue server and client certificates. The autogenerated intermediate CA certificate must be signed by the company’s CA so that it is trusted by clients.
If the corporate security policy does not allow for an intermediate CA certificate to be installed on MyQ Print Server, or a certificate issued by a public certificate authority is to be used, manual certificate management must be used instead.
Regardless of the CA mode, certificates are physically stored in the “C:\ProgramData\MyQ\Cert” directory, which may contain the following files:
server.pfx – server certificate with both public and private keys
server.cer – server certificate with public key
server.key – server private key
ca-root.crt – company root CA certificate with public key
ca-myq.pfx – issuing CA certificate with both public and private keys
ca-myq.crt – issuing CA certificate with public key
ca-myq.key– issuing CA private keys
Private keys of the local issuing CA (used in the first two modes of operation) are always protected by a randomly generated password that is stored in the internal Firebird database in an encrypted form.
Block unencrypted HTTP traffic
Unencrypted HTTP traffic should not be enabled in the MyQ Print Server configuration:
![Web server port settings in MyQ Easy Config](../../../__attachments/1188364314/WebPortsPrint.png?inst-v=f576f6b0-eb9f-4035-8724-3dad44b7106e)
Block unused ports
Decrease the attack surface by disabling firewall rules for protocols not used by MyQ Print Server:
![Firewall rules](../../../__attachments/1188364314/FirewallRules.png?inst-v=f576f6b0-eb9f-4035-8724-3dad44b7106e)
Encrypt connections to MyQ Central Server
Only use HTTPS to connect to MyQ Central Server:
![Central server connection settings](../../../__attachments/1188364314/EncryptCentralConnection.png?inst-v=f576f6b0-eb9f-4035-8724-3dad44b7106e)
Use strong passwords for server-to-server authentication
Password for communication between central server and site should be strong (password complexity):
![Servers communication password](../../../__attachments/1188364314/CommunicationPwd.png?inst-v=f576f6b0-eb9f-4035-8724-3dad44b7106e)
Secure SMTP traffic
When the SMTP protocol is used to send emails or to receive documents from network scanners, TLS encryption should always be enforced to ensure data confidentiality.
![SMPT server settings](../../../__attachments/1188364314/SMTP.png?inst-v=f576f6b0-eb9f-4035-8724-3dad44b7106e)
TLS encryption should also be enforced when the IMAP protocol is used, while the legacy POP3 protocol should be avoided:
![SMTP server IMAP settings](../../../__attachments/1188364314/SMTPIMAP.png?inst-v=f576f6b0-eb9f-4035-8724-3dad44b7106e)
Use strong and unique RADIUS passwords
If RADIUS authentication is used, always generate strong shared secrets that are specific to the MyQ Print Server:
![Radius server settings](../../../__attachments/1188364314/RadiusSettings.png?inst-v=f576f6b0-eb9f-4035-8724-3dad44b7106e)
Encrypt LDAP traffic
TLS encryption should be used to secure all LDAP traffic:
![LDAP settings in MyQ web UI](../../../__attachments/1188364314/LDAPProperties.png?inst-v=f576f6b0-eb9f-4035-8724-3dad44b7106e)
For security reasons, do not use START TLS, as it is vulnerable to MITM attacks. A certificate issued by a trusted CA must be configured on all LDAP servers (Active Directory domain controllers).
Secure SNMP traffic
Insecure SNMPv1 communication with devices should be avoided:
![SNMP profiles](../../../__attachments/1188364314/SNMP.png?inst-v=f576f6b0-eb9f-4035-8724-3dad44b7106e)
Only use SNMPv3 with a strong password and configure more secure cryptographic algorithms to be used (SHA1 and AES):
![SNMP profile settings](../../../__attachments/1188364314/SNMPSettings.png?inst-v=f576f6b0-eb9f-4035-8724-3dad44b7106e)
Secure printer credentials
Printer credential management is done outside of MyQ Print Server and is vendor specific. If possible, strong, randomly generated passwords should be used to manage printers:
![Printer credentials settings](../../../__attachments/1188364314/PrinterCredentials.png?inst-v=f576f6b0-eb9f-4035-8724-3dad44b7106e)
Always use FQDN
To prevent MITM attacks, strictly use fully qualified domain names in all configuration windows:
![Server hostname setting](../../../__attachments/1188364314/Hostname.png?inst-v=f576f6b0-eb9f-4035-8724-3dad44b7106e)
Protect REST API keys
When REST APIs are used, protect the client secrets from unnecessary exposure and perform periodic secret rollover:
![REST API settings in the MyQ web UI](../../../__attachments/1188364314/RestAPISettings.png?inst-v=f576f6b0-eb9f-4035-8724-3dad44b7106e)