Cambium PTP 670 Series, Руководство пользователя

Страница: 76 / 594

Chapter 1: Product description System management
Page 1-52
Password complexity
PTP 670 allows a network operator to enforce a configurable policy for password complexity.
Password complexity configuration additionally allows a pre-determined best practice
configuration to be set.
SNMP control of passwords
PTP 670 allows the role-based and identity-based passwords for the web-based interface to be
updated using the proprietary SNMP MIB. This capability is controlled by the SNMP Control of
Passwords, and is disabled by default.
SNMP Control of Passwords can be used together with SNMPv3 to provide a secure means to
update passwords from a central network manager. However, password complexity rules are
not applied.
Further reading
For information about… Refer to…
How to log in and use the menu Using the web interface on page 6-6
Planning the security material needed for
HTTPS/TLS. Security planning on page 3-56
How to configure user accounts Local User Accounts page on page 6-72
RADIUS authentication
PTP 670 supports remote authentication for users of the web interface using the Remote
Authentication Dial-In User Service (RADIUS) with one of the following authentication
methods:
•
Challenge Handshake Authentication Protocol (CHAP)
•
Microsoft CHAP Version 2 (MS-CHAPv2)
PTP 670 supports connections to primary and secondary RADIUS servers. The RADIUS
interface is configured through the RADIUS Authentication page of the web-based interfaces.
PTP 670 RADIUS supports the standard Service Type attribute to indicate authentication roles
of System Administrator and Read Only together with a vendor specific attribute to indicate
authentication roles of Security Officer, System Administrator, and Read Only.
Remote authentication can be used in addition to local authentication, or can be used as a
replacement for local authentication. If remote and local authentications are used together, PTP
670 checks log in attempts against locally stored user credentials before submitting a challenge
and response for remote authentication. Remote authentication is not attempted if the
username and password match locally stored credentials, or fails against the local database.
RADIUS is only available when PTP 670 is configured for Identity-based User Accounts.