Page History

...

Use the admin object to configure the following system administration-related

...

object on the 

...

, such as audit log state,

...

account manageent, local authentication, password rules

...

.

...

Set Command

Command Syntax

Command syntax for the set command is shown below.

% set system admin <SYSTEM NAME> accountManagement
	accountAging
		accountAgingPeriod <30-180>
		state <disabled | enabled>
	bruteForceAttack
		allowAutoUnlock <disabled | enabled>
		consecutiveFailedAttemptAllowed <1-10>
		state <disabled | enabled>
		unlockTime <30-3600 seconds>
	maxSessions <1-5>
	passwordAging
		passwordAgingPeriod <30-180>
		passwordExpiryWarningPeriod <3-14> 
		state <disabled | enabled>
	sessionIdleTimeout 
		idleTimeout <1-120>
		state <disabled | enabled>

% set system admin <SYSTEM NAME> auditLogState <disabled | enabled>

% set system admin <SYSTEM NAME> banner <system name>
	ackBanner <disable | enable>
	bannerText <text>

% set system admin <SYSTEM NAME> cliSetWarningSupport <disabled | enabled>

% set system admin <SYSTEM NAME> contact <contact_info>

% set system admin <SYSTEM NAME> dod
	cliAccess <disabled | enabled>
	mode <disabled | enabled>
	pmAccess <disabled | enabled>

...

...

% set system admin <SYSTEM NAME> dspMismatchAction <preserveCapacity | preserveRedundancy>

% set system admin <SYSTEM NAME> externalAuthenticationEnabled <false | true>

% set system admin <SYSTEM NAME> fips-140-2 mode <disabled | enabled>

% set system admin <SYSTEM NAME> localAuthenticationEnabled <false | true>

% set system admin <SYSTEM NAME> location <location_info> 

% set system admin <SYSTEM NAME> passwordRules 
	maximumRepeatingCharsCount <#>
	minimumDiffWithOldPassword <#>
	minimumLength <#>
	minimumNumberOfDigits <#>
	minimumNumberOfLowercaseChars <#>
	minimumNumberOfOtherChars <#>
	minimumNumberOfUppercaseChars <#>
	passwordHistoryDepth <#>

% set system admin <SYSTEM NAME> rest state <disabled | enabled>

% set system admin <SYSTEM NAME> standbyServerState <disabled | enabled>

% set system admin <SYSTEM NAME> utilMonitorStatsInterval <#>

% set system admin <SYSTEM NAME> utilMonitorStatsNumOfPastInterval <#> 

Command Parameters

...

...

Parameter

...

Length/Range

...

Description

...

admin

...

N/A

...

Use this object to specify system name.

...

Use this feature to manage system level account and password related settings. See Account Management Parameters table below for details.

...

auditLogState

...

N/A

...

Use this flag to specify the management audit log state.

• disabled
• enabled (default)

...

banner

...

1-23

...

Use this parameter to customize the post-login banner from EMA and CLI applications.

• ackBanner – Enable flag to require user to acknowledge (accept) the banner before gaining access to the system each time the user logs into the system.
  
  • disabled (default)
  • enabled 
• bannerText  – Use this parameter to specify the banner text to display when users login to EMA and CLI applications.

...

cliSetWarningSupport

...

N/A

...

When this flag is enabled, warning prompts are configured for the "set" command.

• disabled
• enabled (default)

...

contact

...

N/A

...

Use parameter to specify system contact information. (default is "Unknown")

...

Use this object to enable DoD mode, and to enable/disable CLI and/or EMA access for temporary troubleshooting and diagnostics.

• cliAccess – Use this flag to temporarily enable CLI for troubleshooting and diagnostic while the SBC is in DoD mode.
  • disabled (default)
  • enabled
• mode – Use this flag to enable/disable DoD Mode.
  • disabled (default)
  • enabled
• pmAccess – Use this flag to temporarily enable EMA's Platform Mode for troubleshooting and diagnostic while the SBC is in DoD mode.
  • disabled (default)
  • enabled

...

Use this parameter to specify the action to take if a DSP mismatch is detected between the active and standby servers. 

• preserveCapacity – The Active 

  Spacevars
  0 product

  continues to use the extra DSP capacity, as needed, assuming appropriate session licenses are in place; partial redundancy is in effect.

  Note
  If a switchover occurs, calls using the extra, non-matching DSP capacity on Active are not protected during switchover (i.e. partial redundancy).

• preserveRedundancy (default) – The Active automatically triggers a graceful dry-up in an attempt to align DSP hardware capabilities. Once dry-up completes, the Active SBC uses the protected, matching DSP capacity to preserve redundancy.

  Note
  During the dry-up period, active calls using the extra, non-matching DSP capacity are not protected in the event that a switchover occurs before the dry up completes.

...

externalAuthenticationEnabled

...

N/A

...

The confd CLI user information stored on remote RADIUS server is available for authentication.

• false (default)
• true

...

 Use this object to enable FIPS-140-2 mode.

• disabled (default)
• enabled 

For complete details of configuring the 

...

localAuthenticationEnabled

...

N/A

...

The confd CLI user information stored locally is available for authentication.

• false
• true (default)

...

location

...

N/A

...

Specifies the physical location of the system.

...

passwordRules

...

N/A

...

The rules implementing confd user password policy.

• maximumRepeatingCharsCount – Maximum number of consecutive repeating characters in the password. (range: 3-16 / default = 3).
• minimumDiffWithOldPassword  – The minimum differences between the old and the new passwords (range 1-8 / default - 4).
• minimumLength – Minimum number of characters that should be present in the password. (range: 8-24 / default = 8)
• minimumNumberOfDigits – Minimum number of digits that should be present in the password. (range: 0-16 / default = 1)
• minimumNumberOfLowercaseChars – Minimum number of lower case characters that should be present in the password. (range: 0-16 / default = 1)
• minimumNumberOfOtherChars –-Minimum number of non-alpha-numeric characters that should be present in the password. (range: 0-16 / default = 1)
• minimumNumberOfUppercaseChars – Minimum number of upper case characters that should be present in the password. (range: 0-16 / default = 1)
• passwordHistoryDepth –The number of latest passwords that should be prevented from re-use. (range: 0-10 / default = 4)

...

Enable this flag to allow

• disabled (default)
• enabled

...

standbyServerState

...

N/A

...

Use this flag to manually enable or disable standby server if the active server fails.

• disabled
• enabled (default)

...

utilMonitorStatsInterval

...

5-60

Specifies time interval for system resource monitoring statistics. This parameter defines the range of timer interval in minutes used by configuration management for measuring the statistics of certain resources. (default = 15).

...

utilMonitorStatsNumOfPastInterval

...

1-12

...

The number of past intervals that can be configured for retrieving the statistics data. (default = 4).

Request Command

Command syntax for the request command is shown below.

Command Syntax

% request system admin <SYSTEM NAME>
	loadConfig
		allowOldVersion <no | yes>
		filename 
	reGenerateSshRsaKeys
	reKeyConfdEncryptionKeys
	removeSavedConfig fileName <filename>
	restart
	saveConfig fileNameSuffix <suffix>
	setHaConfig
		bondMonitoring <currentValue | direct-connect | network-connect> 
		leaderElection <currentValue | enhanced | standard>
	softReset
	switchover
	verifyDatabaseIntegrity <activeAndStandbyPolicy | activeConfigAndActivePolicy | all>
	zeroizePersistenKeys

Command Parameters

...

...

...

Parameter

...

Description

...

loadConfig

Load saved configuration and restart the system without rebooting the servers.

...

• no
• yes

...

filename – Enter the configuration file to load.

...

Use this control to regenerate system configuration database encryption keys.

...

removeSavedConfig

...

Remove the saved configuration from the system.

• fileName – Specify filename of configuration to remove from the system.

...

restart

...

Restart system (all CEs).

...

saveConfig

...

Save the current configuration.

• fileNameSuffix – Use this parameter to specify the filename suffix to use when saving the configuration.

...

Use this action command to configure SBC for Geographical Redundancy High Availability (GRHA) mode when active and standby servers are located in two different data centers to protect SBCs against data center and network failures. To configure/change just one setting, use currentValue option for the other setting.

• bondMonitoring – Select the bond monitoring type for GRHA mode.
  • currentValue 
  • direct-connect
  • network-connect
• leaderElection – Select the leader election algorithm type to use for GRHA mode.
  • currentValue 
  • enhanced
  • standard

References:

• Refer to SBC Redundancy for feature details.
• Refer to Show Table System or Show Status System for statistics details
• Refer to Enabling SBC Core Geographical Redundancy HA Mode best practice for configuration details.

...

softReset

...

Restart the applications on the system without rebooting the server(s).

...

switchover

...

Perform a switchover of the management applications and restart all applications on currently active server.

...

Use this command to verify that the

• activeAndStandbyPolicy – Check if policy databases on the active and standby servers are in sync.
• activeConfigAndActivePolicy – Check if the policy and configuration databases on the active server are in sync.
• all – Perform both of the above checks.

To view the results of the above checks, use the 'show table system databaseIntegrity' command. See Show Table System for details.

...

Use this control to securely erase all persistent CSPs from the system. The 

Command Examples

The following example displays system administrative information:

% show system admin
admin sbx1 {
    auditLogState       enabled;
    dspMismatchAction   preserveRedundancy;
    passwordRules {
        minimumLength                 8;
        minimumNumberOfUppercaseChars 1;
        minimumNumberOfLowercaseChars 1;
        minimumNumberOfDigits         1;
        minimumNumberOfOtherChars     1;
        passwordHistoryDepth          4;
        maximumRepeatingCharsCount    3;
        minimumDiffWithOldPassword    4;
    }
    fips-140-2 {
        mode disabled;
    }
    dod {
        mode disabled;
    }
} 

The following example sets the Banner content to require user acknowledgement:

% set system admin SBC01 banner ackBanner enabled bannerText "This computer system, including all related equipment and network devices (including Internet access), are provided for authorized use only"
% commit

The following example uses the Account Management feature to accomplish the following actions:

• Allows a locked account to unlock after five minutes
• Enables 

  Spacevars
  0 product

  to defend against brute force attacks
• Sets the number of consecutive failed attempts to "3"

% set system admin MYSBC accountManagement bruteForceAttack state enabled allowAutoUnlock enabled consecutiveFailedAttemptAllowed 3 unlockTime 300

% show system admin MYSBC accountManagement bruteForceAttack
state                           enabled;
consecutiveFailedAttemptAllowed 3;
allowAutoUnlock                 enabled;
unlockTime                      300;

To set bond monitoring type to 'network-connect' and leader election algorithm type to 'enhanced':

% request system admin sbx1 setHaConfig bondMonitoring network-connect leaderElection enhanced  

To set bond monitoring type to 'direct-connect' and retain current setting of leader election algorithm:

...

...