REQUIRED CHANGES FOR PDU COMPLIANCE
California Senate Bill 327
This technical note provides information about the new California law, Senate Bill 327, as follows:
1. Highlights what you can expect from this Bill in 2020 in our PDU products and firmware.
2. Informs you of Raritan’s action plan and implementation strategy for compliance.
3. Tells you what to do if you perform automated or bulk configuration/provisioning of new PDUs.
QS RuleWhat Is This Bill?
Senate Bill 327 is a cybersecurity law covering Internet of Things(IoT) devices that requires minimum security features for everydevice.
Starting January 1, 2020, SB-327 requires any manufacturer of adevice that connects "directly or indirectly" to the internet to be
more responsible for ensuring privacy and security for California
residents by equipping devices with "reasonable" security featuresthat are designed to prevent unauthorized access, modification, orinformation disclosure.
If the device can be accessed outside a local area network with apassword:

Default PDU configuration:
The factory default configuration has these services changed todisabled:••

SNMP AgentSCP interface (disabled until default password is changed)

The factory default configuration has these services remain
enabled:•••HTTPS Server
SSH ServerConsole

1. The device needs either to come with a unique password foreach device, orNotes:

2. The device must force users to set their own password the firsttime they connect, eliminating generic default credentials
that could be hacked. Note: This is the route Raritan has
chosen to implement.

The network TCP/IP stack and DHCP remain enabled by default.

A "connected device" is defined as a device with an Internet
Protocol (IP) or Bluetooth address, and capable of connecting
directly or indirectly to the Internet.
The SB-327 bill, and related bills, are designed to protect devices
and their information from "unauthorized access, destruction, use,modification, or disclosure." Note that there may be other similarbills in the near future originating in other states, or nationally. If
so, Raritan will keep you informed in updated Technical Notes.
QS RuleRaritan’s Action Plan
To comply with SB-327, for Raritan’s PDU products and for thePDU’s firmware, the following plan has been implemented byRaritan, starting with Xerus firmware version 3.6.0 for January2020.
 What’s new in Xerus firmware version 3.6.0:• Factory-default changes:
 Only secure access (physical or by secure networkprotocols) is enabled by default.
 During the first log in, before any service can be used, you
are forced to change the default password.
• Configuration changes to enable insecure features provide a
warning, require confirmation, and are logged.
• Configuring a PDU with factory settings via a USB drive requires
using the set_password option, which changes the user’s
password before any commands can be executed. Access tounits with factory settings will be denied unless theset_password option is used.
SB-327REQUIRED CHANGES FOR PDU COMPLIANCE 

Firmware updates to units in the field do not change any defaults
until a reset to factory defaults occurs.

Default password change requirement:
The default password must be changed upon first use, before anyother configuration changes or device access are allowed. In factory
default configuration, the following protocols and tools, with thefollowing restrictions, allow you to first update the default
password: HTTPS Server Web User Interface:• Restricted to a password change page/form only.
HTTPS Server (JSON API Web Service):•

API limited to only system identification and a password change
for the default account.



SSH Server:•

Prompts for a password change.

Console:•

Prompts for a password change.

Notes:
Once the default password is changed, the restrictions are removed
and the PDU resumes normal operations for the protocols and tools
listed above.
Upon any restart to factory defaults, the restrictions will again be
enforced and a change to the default password will again berequired.
QS Rule1

PDU Automated Configuration, Bulk Configuration, andProvisioning
PDU automated configuration, bulk configuration, and provision
processes are still supported by Xerus firmware version 3.6.0 PDUs
in factory default configuration, although with restrictions andchanges:••

If you are using your own automation and configuration tools
to provision PDUs, you will have to accommodate the requiredchanging of the password the first time you access the PDU.
If you are using USB thumb drives for provisioning, a newpassword has to be provided by adding the "set_password"
option to the configuration file.

QS RuleSB-327
REQUIRED CHANGES FOR PDU COMPLIANCE 2