USB

The general process for using USB autorun is as follows (steps 1, 2, and 7 require an upcoming update to PCM+, as described above):

Syntax

The show autorun command displays autorun configuration status information, as shown in the following example.

  HP Switch(config)# show autorun

   Autorun configuration status
 
    Enabled        : Yes
    Secure-mode    : Disabled
    Encryption-key :

By default, the switch is unsecured when shipped (that is, USB autorun is enabled by default.) However, as soon as an operator or manager password is configured, autorun is disabled and must be re-enabled at the configuration level of the CLI before it can be used. The requirement to use PCM+ to create a valid AutoRun file helps prevent a nonauthorized command file from being created and processed by the switch.

In terms of physical security, access to the switch's console port and USB port are equivalent. Keeping the switch in a locked wiring closet or other secure space helps to prevent unauthorized physical access. As additional precautions, you have the following configuration options via the CLI.

You can verify autorun operations by checking the following items:

AutoRun status files.

The following files are generated during autorun operations and written to the USB flash drive:

• Report files (.xml file)—show which CLI commands have been run. The file name includes a serial number and datetime stamp to indicate when and on which device the AutoRun file was executed.

• Result files (.txt file)—contain the CLI output for each command that was run on the switch, allowing you to verify whether a command was executed successfully or not.

	NOTE: PCM+ provides a mechanism to read these status files and capture the results of the commands executed. It also allows you to verify the report files for their authenticity and reject files that have not been signed. The status files do not include any records of post commands that may have been executed after the USB flash drive was removed from the switch.

You can use autorun secure mode to verify the authenticity of autorun command files. Secure-mode is configured using the autorun secure-mode command and can be enabled under both of the following conditions:

There is an additional security option to install a valid key-pair for signing the result files that are generated during autorun operations. You can generate the key-pair on the switch using the crypto key generate autorun [rsa] command.

	NOTE: You can also install the key-pair from a tftp server or via the USB port using the copy [ tftp | usb ] autorun-key-file ipaddr filename command. The filename must contain the private key and the matching public key in a X509 certificate structure. Both the private key and the X509 certificate must be in PEM format.

When using software version K.13.58, if the USB port is disabled (no usb-port command), the USB autorun function does not work in the USB port until the USB port is enabled, the config file is saved, and the switch is rebooted. The 5-volt power to the USB port remains on, even after the USB port has been disabled.

For software versions after K.13.58, the 5-volt power applied to the USB port is synchronized with the enabling of the USB port, that is, when the USB port is enabled, the 5 volts are supplied; when the USB port is disabled, the 5 volts are not supplied. For previous software versions, the power was supplied continuously. The autorun function does not require a switch reboot, but the USB device must be inserted at least once after the port is enabled so the switch recognizes that the device is present. If the USB device is inserted, and then the USB port is enabled, the switch does not recognize that a USB device is present.

For software versions K.14.XX, the USB port can be disabled and enabled without affecting the autorun feature. When the USB port is enabled, the autorun feature activates if a USB device is already inserted in the USB port.

Power is synchronized with the enabling and disabling of USB ports as described above for K.13.59 and later software.