Product Documentation
ADC
Current Release 13.1 13.0 12.1
View PDF

User account and password management

May 31, 2023
反对tributed by:
H S S

Citrix ADC enables you to manage user accounts and password configuration. Following are some of the activities that you can perform for a system user account ornsrootadministrative user account on the appliance.

  • System user account lockout
  • Lock system user account for management access
  • Unlock a locked system user account for management access
  • Disable management access for system user account
  • Force password change fornsrootadministrative users
  • Remove sensitive files in a system user account
  • Strong password configuration for system users

System user account lockout

To prevent brute force security attacks, you can configure the user lockout configuration. The configuration enables a network administrator to prevent a system user to log on to a Citrix ADC appliance. And also unlock the user account before the lock period expires.

At the command prompt, type:

set aaa parameter -maxloginAttempts -failedLoginTimeout -persistentLoginAttempts (ENABLED | DISABLED)

Note

The “persistentLoginAttempts” parameter must be ENABLED to get the details of persistent storage of unsuccessful user login attempts across reboots.

Example:

set aaa parameter -maxloginAttempts 3 -failedLoginTimeout 10 -persistentLoginAttempts ENABLED

Configure system user account lockout by using the GUI

  1. Navigate toConfiguration > Security > AAA-Application Traffic > Authentication Settings > Change authentication AAA Settings.

  2. In theConfigure AAA Parameterpage, set the following parameters:

    1. Max Login Attempts. The maximum number of logon attempts allowed for the user to try.
    2. Failed Login Timeout. The maximum number of invalid logon attempts by the user.
    3. Persistent Login Attempts. Persistent storage of unsuccessful user login attempts across reboots.

  3. ClickOK.

    GUI configuration for system user account lockout

When you set the parameters, the user account gets locked for 10 minutes for three or more invalid login attempts. Also, the user cannot log on even with valid credentials for 10 minutes.

Note

If a locked user tries to log on to the appliance, an error message,RBA Authentication Failure: maxlogin attempt reached for test.displays.

Lock system user account for management access

The Citrix ADC appliance enables you to lock a system user for 24 hours and deny access to the user.

Citrix ADC appliance supports the configuration for both system user and external users.

Note

The feature is supported only if you disable thepersistentLoginAttemptsoption in theaaaparameter.

At the command prompt type:

set aaa parameter –persistentLoginAttempts DISABLED

Now, to lock a user account, at the command prompt, type:

lock aaa user test

Lock a system user account by using the GUI

  1. Navigate toConfiguration > Security > AAA-Application Traffic > Authentication Settings > Change authentication AAA Settings.

    GUI procedure to lock system user account

  2. InConfigure AAA Parameter, in thePersistent Login Attemptslist, selectDISABLED.
  3. Navigate to系统>用户管理>用户.
  4. Select a user.

  5. In the Select Action list, selectLock.

    Select lock option

Note

The Citrix ADC GUI does not have an option to lock external users. To lock an external user, the ADC administrator must use the CLI. When a locked system user (locked with lock authentication, authorization, and auditing user command) attempts to log in to Citrix ADC, the appliance displays an error message, “RBA Authentication Failure: User test is locked down for 24 hours.”

When a user is locked to log on to management access, console access is exempted. Locked user is able to log on to console.

Unlock a locked system user account for management access

System users and external users can be locked for 24 hours using the lock authentication, authorization, and auditing user command.

Note

The ADC appliance allows admins to unlock the locked user and the feature does not require any settings in “persistentloginAttempts” command.

At the command prompt, type:

unlock aaa user test

Configure system user unlock by using the GUI

  1. Navigate to系统>用户管理>用户.
  2. Select a user.

  3. ClickUnlock.

    Configure system user unlock

The Citrix ADC GUI only lists system users created in the ADC, so there is no option in the GUI to unlock external users. To unlock an external user, thensrootadministrator must use the CLI.

Disable management access for system user account

当外部身份验证配置appliance and as an admin you prefer to deny access to system users to log on to management access, you must disable the localAuth option in the system parameter.

At the command prompt, type the following:

set system parameter localAuth

Example:

set system parameter localAuth DISABLED

Disable management access to system user by using the GUI

  1. Navigate toConfiguration > System > Settings > Change Global System Settings.

  2. InCommand Line Interface (CLI)section, unselect theLocal Authenticationcheck box.

    GUI procedure to disable management access to system user

By disabling the option, local system users cannot log on to ADC management access.

Note

External authentication server must be configured and reachable to disallow local system user authentication in the system parameter. If external server configured in ADC for management access is unreachable, local system users can log on to the appliance. The behavior is set up for recovery purpose.

Force password change for administrative users

Fornsrootsecured authentication, the Citrix ADC appliance prompts the user to change the default password to a new one if theforcePasswordChangeoption is enabled in the system parameter. You can change yournsrootpassword either from CLI or GUI, on your first login with the default credentials.

At the command prompt, type:

set system parameter -forcePasswordChange ( ENABLED | DISABLED )

SSH session example for NSIP:

ssh nsroot@1.1.1.1联系1.1.1.1:22……反对nection established. To escape to local shell, press Ctrl+Alt+]. ############################################################################### WARNING: Access to this system is for authorized users only # Disconnect IMMEDIATELY if you are not an authorized user! # ############################################################################### Please change the default NSROOT password. Enter new password: Please re-enter your password: Done

Remove sensitive files in a system user account

To manage sensitive data such as authorized keys and public keys for a system user account, you must enable theremoveSensitiveFilesoption. The commands that remove sensitive files when the system parameter is enabled are:

  • rm cluster instance
  • rm cluster node
  • rm high availability node
  • clear config full
  • join cluster
  • add cluster instance

At the command prompt, type:

set system parameter removeSensitiveFiles ( ENABLED | DISABLED )

Example:

set system parameter -removeSensitiveFiles ENABLED

Strong password configuration for system users

For secured authentication, the Citrix ADC appliance prompts system users and administrators to set strong passwords to log on to the appliance. The password must be long and must be a combination of:

  • One lower case character
  • One upper case character
  • One numeric character
  • One special character

At the command prompt, type:

set system parameter -strongpassword -minpasswordlen

Where,

Strongpassword. After enabling strong password (enable all/enablelocal) all the passwords or sensitive information must have the following:

  • At least 1 lower case character
  • At least 1 upper case character
  • At least 1 numeric character
  • At least 1 special character

Exclude the list inenablelocalis -NS_FIPS,NS_CRL,NS_RSAKEY,NS_PKCS12, NS_PKCS8, NS_LDAP,NS_TACACS,NS_TACACSACTION,NS_RADIUS,NS_RADIUSACTION,NS_ENCRYPTION_PARAMS. So no Strong Password checks are performed on these ObjectType commands for the system user.

Possible values:enableall,enablelocal禁用默认值:禁用

minpasswordlen. Minimum length of the system user password. When the strong password is enabled by default, the minimum length is 4. User entered value can be greater than or equal to 4. Default minimum value is 1 when the strong password is disabled. Maximum value is 127 in both cases.

Minimum value: 1 Maximum value: 127

Example:

set system parameter -strongpassword enablelocal -minpasswordlen 6

Default user account

Thensrecoveruser account can be used by the administrator to recover the Citrix ADC appliance. You can log in to the ADC appliance bynsrecoverif the default system users (nsroot) are unable to log in due to any unforeseen issues. Thensrecoverlogin is independent of user configurations and lets you access the shell prompt directly. You are always allowed to log in through thensrecoverirrespective of the maximum configuration limit is reached.

User account and password management
May 31, 2023
反对tributed by:
H S S
May 31, 2023
反对tributed by:
H S S

In this article

Site feedback | Privacy and legal terms | Cookie preferences | 反对sent settings | docs.cloud.com
© 1999-Cloud Software Group, Inc. All rights reserved.