R3721-F3210-F3171-HP High-End Firewalls Access Control Configuration Guide-6PW101

167
Step Command Remarks
4. Configure a password for the
local user.
password { cipher | simple }
password
Optional.
A local user with no password
configured directly passes
authentication after providing the
valid local username and
attributes. To enhance security,
configure a password for each
local user.
In FIPS mode, the firewall does
not support this command. To set
a password, use the password
control feature.
5. Specify the service types for
the local user.
service-type { dvpn | ftp |
lan-access | { ssh | telnet |
terminal } * | portal | ppp | web }
By default, no service is
authorized to a local user.
In FIPS mode, the firewall does
not support the ftp and telnet
keywords.
6. Place the local user to the
state of active or blocked.
state { active | block }
Optional.
When created, a local user is in
active state by default, and the
user can request network
services.
7. Set the maximum number of
concurrent users of the local
user account.
access-limit max-user-number
Optional.
By default, there is no limit to the
maximum number of concurrent
users of a local user account.
This limit is not effective for FTP
users.
8. Configure the password
control attributes for the local
user.
• Set the password aging time:
password-control aging
aging-time
• Set the minimum password
length:
password-control length length
• Configure the password
composition policy:
password-control composition
type-number type-number
[ type-length type-length ]
Optional.
By default, the password control
attributes of the user group to
which the local user belongs
apply, and any password control
attribute that is not configured in
the user group uses the global
setting. The global settings
include a 90-day password aging
time, a minimum password length
of 10 characters, and at least one
password composition type and
at least one character required for
each password composition type.
The minimum password length is
8 characters.
In FIPS mode, the value of the
type-number argument must be 4.