Policy Settings

Minimum Length

6 characters

Type in the minimum password length.

Password Quality

Basic

Select the required password quality; works in conjunction with minimum Password requirements below:

• Basic: Sets the minimum password length as the only requirement to accept a new password.

• Strong: Adds more strict requirements to the password structure. Checks for minimum length as well as other criteria such as minimum number of required upper case characters, digits, and symbols.

Uppercase Letters

0

(Password Quality must be Strong) Specify the minimum required number of uppercase letters.
Range: 0-40. 

Digits

0

(Password Quality must be Strong) Specify the minimum required number of digits. 

Range: 0-40. 

Symbols

0

(Password Quality must be Strong) Specify the minimum required number of symbols.

Range: 0-40. 

Remember Last (Passwords)

5

(Password Quality must be Strong) This option determines the number of unique new passwords that must be associated with a user account before an old password can be reused.

The range: 5-500.

Minimum Lifetime (Days)

0

(Password Quality must be Strong) This option restricts the user's ability to change their password. Enforcing a minimum password lifetime helps prevent repeated password changes to defeat the password reuse or history enforcement requirement. 

The range: 0 (no restriction) to 7 days.

Password Expiration

Disabled

Check this checkbox to enable Password expiration.

Change Password After (Days)

N/A if Disabled
----------
90 days if Enabled

(Password Expiration must be enabled) Type in the number of days after which users must change their passwords (from 1-180 days).

Auto Logout

Disabled

Check this checkbox to automatically log users out after a specified period of idle time.

When enabled, if a user has been inactive for longer than the specified period of time, he/she will be logged out and redirected to the Sign-in page. Systems that are left logged on may represent a security risk for an organization.

Logout when Idle for (Minutes)

N/A if Disabled
----------
15 minutes if Enabled

(Auto Logout must be enabled) Specifies the maximum length of time the system may be idle before the user will be logged out. Range: 1 - 1440 minutes.

Limit Login Attempts

Disabled

Check this checkbox to lock a user account after the specified number of consecutive failed sign-in attempts during the specified time period. This may be used to reduce the risk of unauthorized system access via user password guessing. 

Max Failed Attempts

N/A if Disabled
----------
3

(Limit Login Attempts must be enabled) Specifies the maximum number of consecutive failed sign-in attempts allowed during the specified time interval before the account will be locked. Range: 3-10

Failed Interval (Minutes)

N/A if Disabled
----------
15 minutes if Enabled

(Limit Login Attempts must be enabled) Specifies the time period during which the consecutive failed sign-in attempts will be counted to lock out the account. Range: 5-60 minutes   

Disable Inactive Accounts

Disabled

Check this checkbox to enable automatic disabling of user accounts after the specified number of days of account inactivity.

Inactivity Timeout (Days)

N/A if Disabled
----------
90 Days if Enabled

(Disable Inactive Accounts must be enabled) Specifies the number of days (since the last login) after which the user account will be disabled.
Range: 1-365 days 

Disabled accounts can be re-enabled either via the “account <uname> enable” CLI command or from the Web Interface Admin>Accounts List View where the Action drop-down list will include an option to re-enable a disabled account.

Compliance

None

Specifies the required cryptographic compliance, either:

• None

• FIPS 140: Applies cryptographic modules accredited under the Federal Information Processing Standard (FIPS).

• NDPP v1.1: Activates cryptographic security to a level compliant with the National Information Assurance Partnership (NIAP) Network Device Protection Profile, Revision 1.1.

• SP800-52 Revision 1 (deprecated): Applies cryptographic modules accredited under the National Institute of Standards and Technology (NIST) Special Publication 800-52, Revision 1.

• SP800-52 Revision 2: Supersedes SP800-52 Revision 1. Applies cryptographic modules accredited under the NIST Special Publication 800-52, Revision 2.

Min TLS Version

TLSv1.3

Specifies which TLS (Transport Layer Security) versions are accepted from the HTTPS client. 

Options are:

• TLSv1.3

• TLSv1.2

• TLSv1.1

• TLSv1.0

Strict Transport Security

Disabled

Check this checkbox to enable HTTP Strict Transport Security (HSTS). HSTS forces web browsers to only contact the Web interface over HTTPS, instead of using HTTP.