The syslog-ng Store Box (SSB) appliance can use password policies to enforce minimal password strength and password expiry. Password policies apply only to locally managed users, including the built-in admin and root users. They have no effect on users managed from an LDAP database, or if you authenticate your users to a RADIUS server or via OpenID Connect.

The following describes how to create a password policy.

To create a password policy

  1. Navigate to AAA > Settings.

    Figure 71: AAA > Settings > User database — Configure password policies

  2. Verify that the Authentication method is set to Password provided by database and that the User database is set to Local.

    NOTE: If the setting of these fields is different (for example LDAP or RADIUS or OpenID Connect), then SSB manages the passwords of the admin and root users locally.

  3. Set how long the passwords are valid in the Password expiration field. After this period, SSB users will have to change their password. To disable password expiry, enter 0.

  4. To prevent password-reuse (for example, when a user has two passwords and instead of changing to a new password only switches between the two), set how many different passwords the user must use before reusing an old password.

  5. To enforce the use of strong passwords, select the level of password-complexity from the Minimal password strength field. As you type, SSB shows the strength of the password under the password field.

    NOTE: The strength of the password is determined by its entropy: the variety of numbers, letters, capital letters, and special characters used, not only by its length. A strong password must have at least 12 characters, including lowercase and uppercase letters, numbers, and special characters.

    The Enable cracklib option executes some simple dictionary-based attacks to find weak passwords.

  6. Click .

    NOTE: If you increase the Minimal password strength, users whose existing password is weaker than required are forced to change their passwords immediately after their next login. The new passwords must comply with the strength requirements set in the password policy.