FireBrick FB6402, Руководство пользователя

Страница: 40 / 196

System Administration
23
4.1.4.2. Logged in IP address
The FireBrick allows a general definition of IP groups which allow a name to be used in place of a range of
IP addresses. This is a very general mechanism that can be used for single IP addresses or groups of ranges
IPs, e.g. admin-machines may be a list or range of the IP addresses from which you want to allow some access.
The feature can also be useful even where only one IP is in the group just to give the IP a meaningful name
in an access list.
These named IP groups can be used in the allow list for a user login, along with specific IP addresses or ranges
if needed.
However, IP groups can also list one or more user names and implicitely include the current IP address from
which those users are logged in to the web interface. This can be useful for firewall rules where you may have
to log in to the FireBrick, even as a NOBODY level user, just to get your IP address in an access list to allow
further access to a network from that IP.
4.1.4.3. Restrict by profile
By specifying a profile name using the profile attribute, you can allow logins by the user only when the
profile is in the Active state (see Chapter 9). You can use this to, for example, restrict logins to be allowed
only during certain times of the day, or you can effectively suspend a user account by specifying an always-
Inactive profile.
4.1.5. Password change
Normally, all config data is updated via the config edit process, and this allows a new password to be set for
any user.
However, there is also a menu to allow a logged in user to change their own password. This does not require
the user to have any config access permission. Simply enter the old password, and the new password twice
and the password is updated.
If you have OTP set up on a user, then you cannot change the password simply using the configuration editor
(unless also setting a new OTP from scratch or removing the OTP). In such cases the password should be set
using the password change web page. This is also good practice is it avoids the administrator knowing people's
passwords.
4.1.6. One Time Password (OTP)
A login to the FireBrick normally requires only a username and password. However you can configue an
additional security measure using a One Time Password (OTP) device. These are available as key fobs that
show a code, but are more commonly done by use of a mobile phone application.
In order for the device to work you need a key which is known to the FireBrick and the device. However, this
is very simple to set up. A user can access the Password / OTP menu where a random key is allocated and
displayed within a QR 2D bar code. Most authenticator applications simply scan the QR code and start showing
the 6 digit number on the display (which changes every 30 seconds). You then enter your password and a code
from your device and you are set up.
It is possible for anyone with configuration access to edit your user settings and remove the OTP settings if you
wish. This can be useful if you lose or break the phone, for example. You may want to keep a local configuration
user as a backup as well, as OTP cannot be used if the clock is not set for any reason.
When you login, after you submit your username and password you are asked for a code from the authenticator
to complete the login process.
It is also possible to enter the password as the authenticator code followed by the configured password. This is
useful if using http authentication to access a web page where there is no separate option for the authentictor
input to be provided.