Device security
2.6
Security configuration
34
UM Security BRS-2A
Release
8.7
05/2022
Maximum number of failed user logins in a row: For security reasons, configure the value as low as
possible. For availability reasons, configure it as high as practical. practical. Use a value >0. Chose
a value that corresponds to your situation.
Waiting time before the device auto-unlocks a locked user account: For security reasons, configure
the value as high as possible. For availability reasons, configure it as low as practical. Use a
value >0. Chose a value that corresponds to your situation.
These steps helps ensure that the device will lock out a user after the maximum number of failed
user logins in a row and then enforces a waiting period.
Configure a dedicated user account login policy as needed:
Configure a maximum number of failed user logins in a row until the device locks the respective
user account (
delivery state: 0 (no limit)
).
Configure a waiting time (Login attempts period in minutes) before the device auto-unlocks a
locked user account (
delivery state: 0 (no waiting time)
).
Note:
Access to the CLI using the serial connection is exempt from the login policy. Users
accessing the CLI using the serial connection have an unlimited number of login attempts. They are
also not required to wait for the next login attempt, that is, the Login attempts period does not apply.
This ensures access to the device management in situations where availability may be critical, and
for users who already have physical access to the device.
2.6.18
Configure a dedicated user account password policy
Note:
Hirschmann assumes that, when reading this section, you have already created a dedicated
user account password policy
(see on page 19 “Plan a dedicated user account password policy”)
.
Configure a dedicated user account password policy as needed:
Minimum required number of uppercase characters (delivery state: 1)
Minimum required number of lowercase characters (delivery state: 1)
Minimum required number of digits in a password (delivery state: 1)
Minimum required number of special characters (delivery state: 1)
Note:
To deter attackers, consider using different passwords on different devices, even for user
accounts with the same name.
2.6.19
Configure dedicated user account names and access roles for device
management
Note:
Hirschmann assumes that, when reading this section, you have already created a dedicated
user account name and access role policy
(see on page 20 “Plan a dedicated user account name
and access role policy for device management”)
.
Hirschmann also assumes that you have created a dedicated policy for SNMPv3 authentication
and encryption types, and for the related passwords.
For details on the privileges of the individual access roles, see the user manual "Configuration",
chapter "Access roles".
Configure dedicated user accounts as needed:
Assign the device login policy.
Assign the device password policy.
Summary of Contents for HIRSCHMANN HiOS-2A
Page 6: ...Contents 6 UM Security BRS 2A Release 8 7 05 2022 ...
Page 8: ...Document History 8 UM Security BRS 2A Release 8 7 05 2022 ...
Page 10: ...Safety instructions 10 UM Security BRS 2A Release 8 7 05 2022 ...
Page 54: ...Network security support 3 11 Configure logging 54 UM Security BRS 2A Release 8 7 05 2022 ...
Page 62: ...Index 62 UM Security BRS 2A Release 8 7 05 2022 ...
Page 66: ......
