Enable and define password policy settings

If you authenticate administrators or Web Portal users with internal authentication, you can enforce a password policy.

Before you begin

You must be logged on using an administrator account with sufficient permissions to change the password policy settings. Permissions to manage Administrator elements or unrestricted permissions (superuser) are required. If administrative Domains are configured, you must be logged on to the Shared Domain.

The settings in the password policy are applied to:

Administrator and Web Portal user accounts defined using Administrator and Web Portal User elements.
SMC administrator accounts that are replicated as local administrator accounts on NGFW Engines.
The root account on NGFW Engines.
The Management Server database password.
For the Management Server database password, only requirements for length, uppercase characters, lowercase characters, and numbers are applied. Special characters are not allowed in the Management Server database password.

You can define the following settings in the password policy:

Session limits and idle timeouts
Restrictions on failed logon attempts
Automatic disabling of inactive accounts
Requirements for password age and expiration
Requirements for password strength

Note: If you have previously changed the default password policy settings in the SGConfiguration.txt file, the settings are automatically applied on the Password Policy tab. Any further modifications you make to the SGConfiguration.txt file have no effect.

For more details about the product and how to configure features, click Help or press F1.

Steps

Select Menu > System Tools > Global System Properties.
Click the Password Policy tab.
Select Enforce Password Settings for All the Administrators and Web Portal Users.

Note: The password policy is enforced by default.
Select the password policy settings.
For information about the options that you must select in a Common Criteria certification environment, see the Common Criteria Certification User’s Guide.
Click OK.

Global System Properties dialog box — Password Policy tab

Use this tab to change settings for password strength, password expiration, failed logons, and actions related to temporary and long-term inactivity in the administrator password policy.

Option	Definition
Enforce Password Settings for All the Administrators and Web Portal Users	When selected, enforces the password settings for all administrators and Web Portal users.

Option	Definition
Logon Options section
Only one Logon Session for Each User	When selected, an administrator or Web Portal user can open only a single session at a time to the Management Client or to the Web Portal.
Administrator User Name is Case Sensitive	When selected, uppercase and lowercase letters in the administrator user name are considered to be different from each other.
Disable Account After Failed Logon Attempts	When selected, administrator accounts are disabled when the maximum number of failed logon attempts in the specified length of time is reached.
Maximum Number of Failed Logon Attempts	The maximum number of failed logon attempts. The default is 8 attempts.
Attempts Within	The length of time for counting the number of failed logon attempts. Select the time unit from the drop-down list. The default is 30 minutes.
Temporarily Lock Account After Failed Logon Attempts	When selected, administrators or Web Portal users are temporarily locked when the maximum number of failed logon attempts is reached.
Maximum Number of Failed Logon Attempts	The maximum number of failed logon attempts. The default is 6 attempts. This option is selected by default.
Lock Account for	The length of time for which the account is locked. Select the time unit from the drop-down list. The default is 30 minutes.
Disable Accounts That Have Been Inactive For	When selected, administrator or Web Portal user accounts that have not been used for the specified length of time are automatically disabled. Select the time unit from the drop-down list. The default is 3 months.
Lock the Management Client Window After the User Session is Idle for	When selected, the Management Client window is locked when an administrator has been idle for the specified length of time. Select the time unit from the drop-down list. The default is 15 minutes.
Hide the Management Client Window Content	When selected, the content of the Management Client window is hidden when the screen is locked.
Close the Management Client	When selected, the Management Client is automatically closed when the screen is locked.
Allow Logon Only From Listed IP Addresses	When selected, administrators or Web Portal users can only log on from hosts that have the listed IP addresses. You can enter up to 170 IP addresses.
Add	Adds an IP address to the list.
Remove	Removes the selected IP address from the list.

Option	Definition
Password Age and Expiration section
Require Password Change After First Logon	When selected, the administrator or Web Portal user must change the password after the first time they log on.
Minimum Time Before Next Password Change	When selected, the administrator or Web Portal user password cannot be changed again before the specified length of time. Select the time unit from the drop-down list. The default is 3 days.
Password Expires After	When selected, specifies the length of time after which administrator or Web Portal user passwords expire and must be changed. Select the time unit from the drop-down list. The default is 3 months.
Notify User When Password Expires in	When selected, the administrator or Web Portal user is notified that the password is about to expire the specified length of time before expiration. Select the time unit from the drop-down list. The default is 7 days.
Disable Account Automatically After Password Expiration	When selected, the administrator or Web Portal user account is automatically disabled when the password expires.
Limit Reuse of Previous Passwords (Number of Previous Passwords)	When selected, the administrator or Web Portal user cannot use a password that has already been used in the specified number of previous passwords. The default is 8.

Option	Definition
Password Complexity Requirements section
Minimum Number of Characters in Password	When selected, administrator or Web Portal user passwords must contain the specified minimum number of characters. The default is 10 characters. This option is selected by default.
Minimum Number of Required Characters	When selected, administrator or Web Portal user passwords must contain the specified minimum number of required characters. Note: The total number of required characters must not be larger than the value of the Minimum Number of Characters in Password option. This option is selected by default.
Uppercase	The minimum number of required uppercase letters. The default is 0.
Lowercase	The minimum number of required lowercase letters. The default is 1.
Special Characters	The minimum number of special characters. Special characters include the following characters: !@#$%^&*() The default is 0.
Numbers	The minimum number of required numeric characters. The default is 1.
Maximum of Same Characters Between Previous and New Password	When selected, administrator or Web Portal user passwords must not have more than the specified number of characters in common with the previous password. The default is 4 characters.
Reset to Default	Discards the changes and reverts to the default settings.