Chapter 5: PTP 820S Management
System Security Features
Defenses in User and System Authentication Procedures
User Configuration and User Profiles
User configuration is based on the Role-Based Access Control (RBAC) model. According to the
RBAC model, permissions to perform certain operations are assigned to specific roles. Users are
assigned to particular roles, and through those role assignments acquire the permissions to
perform particular system functions.
In the PTP 820S GUI, these roles are called user profiles. Up to 50 user profiles can be configured.
Each profile contains a set of privilege levels per functionality group, and defines the management
protocols that can be used to access the system by users to whom the user profile is assigned.
The system parameters are divided into the following functional groups:
•
Security
•
Management
•
Radio
•
Ethernet
•
Synchronization
A user profile defines the permitted access level per functionality group. For each functionality
group, access levels are defined separately for read/write operations. The following access levels
can be assigned:
•
None – No access to this functional group.
•
Normal – The user has access to parameters that require basic knowledge about the functional
group.
•
Advance – The user has access to parameters that require advanced knowledge about the
functional group, as well as parameters that have a significant impact on the system as a
whole, such as restoring the configuration to factory default settings.
User Identification
PTP 820S supports the following user identification features:
•
Configurable inactivity time-out for automatically closing unused management channels
•
Optional password strength enforcement.
When password strength enforcement is enabled;
passwords must comply with the following rules:
o
Password must be at least eight characters long.
o
Password must include at least three of the following categories: lower-case characters,
upper-case characters, digits, and special characters.
o
When calculating the number of character categories, upper-case letters used as the first
character and digits used as the last character of a password are not counted.
o
The password cannot have been used within the user’s previous five passwords.
•
Users can be prompted to change passwords after a configurable amount of time (password
aging).
27
Password strength enforcement is planned for future release.
Page 5-18