Configuring Password Policies

Scenario

To keep up with service security requirements, you can set password security rules, user login security rules, and user locking rules on FusionInsight Manager.

• Modify password policies based on service security requirements, because they involve user management security. Otherwise, security risks may be incurred.
• Change the user password after modifying the password policy, and then the new password policy can take effect.

Modifying a Password Policy (Versions Earlier Than MRS 3.1.2)

1. Log in to FusionInsight Manager.
2. Choose System > Permission > Security Policy > Password Policy.
3. Click Modify in the Operation column and modify the password policy as prompted.
   For details about the parameters, see Table 1.

   Table 1 Password policy parameters

   Parameter	Description
   Minimum Password Length	Indicates the minimum number of characters a password contains. The value ranges from 8 to 32. The default value is 8.
   Character Types	Indicates how many character types in the following types a password can contain at least: uppercase letters, lowercase letters, digits, spaces, and special characters (~`!?,.:;-_'(){}[]/<>@#$%^&*+|\=). The value can be 4 or 5. The default value is 4, which means that a password can contain uppercase letters, lowercase letters, digits, and special characters. If you set the parameter to 5, a password can contain all the five character types mentioned above.
   Password Retries	Indicates the number of consecutive wrong password attempts allowed before the system locks the user. The value ranges from 3 to 30. The default value is 5.
   User Lock Duration (Min)	Indicates the time period in which a user is locked when the user lockout conditions are met. The value ranges from 5 to 120. The default value is 5.
   Password Validity Period (Day)	Indicates the validity period of a password. The value ranges from 0 to 90. 0 indicates that the password is permanently valid. The default value is 90.
   Repetition Rule	Indicates the number of previous passwords that cannot be reused when you change the password. The value ranges from 1 to 5. The default value is 1. This policy applies to only human-machine accounts.
   Password Expiration Notification (Days)	Indicates the number of days in advance users are notified that their passwords are about to expire. After the value is set, if the difference between the cluster time and the password expiration time is smaller than this value, the user receives password expiration notifications. When logging in to FusionInsight Manager, the user will be notified that the password is about to expire and a message is displayed asking the user to change the password. The value ranges from 0 to X (X must be set to the half of the password validity period and rounded down). Value 0 indicates that no notification is sent. The default value is 5.
   Interval for Deleting Authentication Failure Records (Min)	Indicates the interval of retaining incorrect password attempts. The value ranges from 0 to 1440. 0 indicates that incorrect password attempts are permanently retained, and 1440 indicates that incorrect password attempts are retained for one day. The default value is 5.

4. Click OK to save the configurations. Change the user password after modifying the password policy, and then the new password policy can take effect.

Adding a Password Policy (MRS 3.1.2 or Later)

1. Log in to FusionInsight Manager.
2. Choose System > Permission > Security Policy > Password Policy.
3. Click Add Password Policy and modify the password policy as prompted.
   For details about the parameters, see Table 2.

   Table 2 Password policy parameters

   Parameter	Description
   Password Policy Name	The value is a string of 3 to 32 characters, including case-insensitive letters, digits, underscores (_), and hyphens (-). It cannot start with a hyphen (-).
   Minimum Password Length	Indicates the minimum number of characters a password contains. The value ranges from 8 to 32.
   Character Types	Indicates how many character types in the following types a password can contain at least: uppercase letters, lowercase letters, digits, spaces, and special characters (~`!?,.:;-_'(){}[]/<>@#$%^&*+|\=). The value can be 4 or 5. The default value is 4, which means that a password can contain uppercase letters, lowercase letters, digits, and special characters. If you set the parameter to 5, a password can contain all the five character types mentioned above.
   Password Retries	Indicates the number of consecutive wrong password attempts allowed before the system locks the user. The value ranges from 3 to 30.
   User Lock Duration (Min)	Indicates the time period in which a user is locked when the user lockout conditions are met. The value ranges from 5 to 120.
   Password Validity Period (Day)	Indicates the validity period of a password. The value ranges from 0 to 90. 0 indicates that the password is permanently valid.
   Repetition Rule	Indicates the number of previous passwords that cannot be reused when you change the password. The value ranges from 1 to 5. The default value is 1. This policy applies to only human-machine accounts.
   Password Expiration Notification (Days)	Indicates the number of days in advance users are notified that their passwords are about to expire. After the value is set, if the difference between the cluster time and the password expiration time is smaller than this value, the user receives password expiration notifications. When logging in to FusionInsight Manager, the user will be notified that the password is about to expire and a message is displayed asking the user to change the password. The value ranges from 0 to X (X must be set to the half of the password validity period and rounded down). Value 0 indicates that no notification is sent.
   Interval for Deleting Authentication Failure Records (Min)	Indicates the interval of retaining incorrect password attempts. The value ranges from 0 to 1440. 0 indicates that incorrect password attempts are permanently retained, and 1440 indicates that incorrect password attempts are retained for one day.

4. Click OK to save the configurations.

   A new user uses the default password policy. After a new password policy is created, you can manually select the password policy when creating a user. You can modify the password policy of an existing user. For details, see Modifying User Information.

A maximum of 32 password policies can be created.

Modifying a Password Policy (MRS 3.1.2 or Later)

1. Log in to FusionInsight Manager.
2. Choose System > Permission > Security Policy > Password Policy.
3. Click Modify in the row that contains the target password policy. On the Modify Password Policy page, modify the password policy as prompted.

   For details about the parameters, see Table 2.

4. Click OK to save the configurations.

• Users (except admin) cannot modify their own password policies.
• After the password policy bound to a user is modified, if the remaining password validity period is greater than the password validity period in the new password policy, the password validity period is set to the validity period in the new password policy. If the remaining password validity period is less than the password validity period in the new password policy, the password validity period remains unchanged.

Deleting a Password Policy (MRS 3.1.2 or Later)

1. Log in to FusionInsight Manager.
2. Choose System > Permission > Security Policy > Password Policy.
3. Click Delete in the row that contains the target password policy. In the dialog box that is displayed, click OK.

The default password policy and the password policy that has been bound to a user cannot be deleted.