Configuring Password Policies

Scenario

To keep up with service security requirements, you can set password security rules, user login security rules, and user locking rules on FusionInsight Manager.

• Modify password policies based on service security requirements, because they involve user management security. Otherwise, security risks may be incurred.
• Change the user password after modifying the password policy, and then the new password policy can take effect.

Procedure

1. Log in to FusionInsight Manager.
2. Choose System > Permission > Security Policy > Password Policy.
3. Click Modify in the Operation column and modify the password policy as prompted.
   For details about the parameters, see Table 1.

   Table 1 Password policy parameters

   Parameter	Description
   Minimum Password Length	Indicates the minimum number of characters a password contains. The value ranges from 8 to 32. The default value is 8.
   Character Types	Indicates how many character types in the following types a password can contain at least: uppercase letters, lowercase letters, digits, spaces, and special characters (~`!?,.:;-_'(){}[]/<>@#$%^&*+|\=). The value can be 4 or 5. The default value is 4, which means that a password can contain uppercase letters, lowercase letters, digits, and special characters. If you set the parameter to 5, a password can contain all the five character types mentioned above.
   Password Retries	Indicates the number of consecutive wrong password attempts allowed before the system locks the user. The value ranges from 3 to 30. The default value is 5.
   User Lock Duration (Min)	Indicates the time period in which a user is locked when the user lockout conditions are met. The value ranges from 5 to 120. The default value is 5.
   Password Validity Period (Day)	Indicates the validity period of a password. The value ranges from 0 to 90. 0 indicates that the password is permanently valid. The default value is 90.
   Repetition Rule	Indicates the number of previous passwords that cannot be reused when you change the password. The value ranges from 1 to 5. The default value is 1. This policy applies to only human-machine accounts.
   Password Expiration Notification (Days)	Indicates the number of days in advance users are notified that their passwords are about to expire. After the value is set, if the difference between the cluster time and the password expiration time is smaller than this value, the user receives password expiration notifications. When logging in to FusionInsight Manager, the user will be notified that the password is about to expire and a message is displayed asking the user to change the password. The value ranges from 0 to X (X must be set to the half of the password validity period and rounded down). Value 0 indicates that no notification is sent. The default value is 5.
   Interval for Deleting Authentication Failure Records (Min)	Indicates the interval of retaining incorrect password attempts. The value ranges from 0 to 1440. 0 indicates that incorrect password attempts are permanently retained, and 1440 indicates that incorrect password attempts are retained for one day. The default value is 5.

4. Click OK to save the configurations. Change the user password after modifying the password policy, and then the new password policy can take effect.