Security and privacy

ICX Setup handles switch credentials and pushes firmware, so it’s built to be careful with both. Here’s exactly what it stores, what it logs, and what leaves your Mac.

No account, no backend, no telemetry

ICX Setup has no sign-up and no cloud service. It talks only to the switch in front of you — over the console cable or SSH on your local network — and, during an upgrade, serves firmware to that switch from your own Mac. Nothing is sent to the internet and there is no analytics.

Secrets live in the Keychain

Everything sensitive is stored in the macOS data-protection Keychain (service com.neuralconfig.ICX-Setup), never in plain preferences:

• Switch passwords you save in Settings.
• Pinned SSH host keys (see below).
• Ephemeral TLS material for the firmware server — generated per session, marked never to sync off the device, and deleted when the server stops.

Keychain items are only accessible while the Mac is unlocked.

SSH host-key pinning

ICX Setup pins each switch’s SSH host key on first connection (trust on first use) and refuses to connect if the key later changes — a guard against someone impersonating the switch. The stored fingerprint is a standard OpenSSH SHA256:… value you can verify with ssh-keygen -lf.

It fails closed: if it can’t read a pinned key from the Keychain, or can’t save a new one, it refuses the connection rather than trusting an unverified key. See Connecting to a switch for what to do when a key legitimately changes after a factory reset.

Session logs are redacted

The terminal session can be logged to a file for the record. Before anything is written, ICX Setup masks secrets, replacing them with [redacted]:

• Your saved switch passwords.
• Secrets in config lines — the value after password, community, or key (including enable passwords, SNMP community strings, and RADIUS/TACACS keys).
• SNMPv3 auth and privacy secrets.

Redaction works on whole lines, so a secret split across two reads can’t slip through. Password prompts aren’t echoed by ICX, so typed passwords never reach the log in the first place.

The firmware server

During an upgrade, firmware is served from your Mac over HTTPS, not TFTP:

• A self-signed certificate (RSA 2048, with your Mac’s IP as its subject name) is generated in-process each session — no openssl shell-out, so it works inside the App Sandbox.
• Each session mints a random per-session token that must be the first part of the request path; requests without it get a 403.
• The server only serves files from the firmware folder you selected, and resolves paths so a request can’t escape that folder.

ICX Setup also records the SHA-256 of the exact image it served, so you can compare it against the vendor’s published hash and detect a tampered file.

---

Questions about how something is stored or transmitted? Contact support.