Table of Contents
Advertisement
Chapter 9
Security
9.2.2.2 Idle User Timeout
Each ONS 15454 CTC or TL1 user can be idle during his or her login session for a specified amount of
time before the CTC window is locked. The lockouts prevent unauthorized users from making changes.
Higher-level users have shorter default idle periods and lower-level users have longer or unlimited
default idle periods, as shown in
to the Cisco ONS 15454 Procedure Guide for instructions.
Table 9-3
Security Level
Superuser
Provisioning
Maintenance
Retrieve
9.2.2.3 User Password, Login, and Access Policies
Superusers can view real-time lists of users who are logged into CTC or TL1 by node. Superusers can
also provision the following password, login, and node access policies:
•
•
•
Note
The superuser cannot modify the privilege level of an active user. The CTC displays a warning message
when the superuser attempts to modify the privilege level of an active user.
78-18106-01
ONS 15454 Default User Idle Times
Idle Time
15 minutes
30 minutes
60 minutes
Unlimited
Password length, expiration and reuse—Superusers can configure the password length using NE
defaults. The password length, by default, is set to a minimum of six and a maximum of 20
characters. You can configure the default values in CTC node view with the Provisioning > Defaults
> Node > security > password Complexity tabs. The minimum length can be set to eight, ten or
twelve characters, and the maximum length to 80 characters. The password must be a combination
of alphanumeric (a-z, A-Z, 0-9) and special (+, #,%) characters, where at least two characters are
nonalphabetic and at least one character is a special character. Superusers can specify when users
must change and when they can reuse their passwords.
Locking out and disabling users—Superusers can provision the number of invalid logins that are
allowed before locking out users and the length of time before inactive users are disabled.
Node access and user sessions—Superusers can limit the number of CTC sessions a user login can
have to just one session. Superusers can also prohibit access to the ONS 15454 using the LAN or
TCC2/TCC2P RJ-45 connections.
In addition, a Superuser can select secure shell (SSH) instead of Telnet at the CTC Provisioning >
Security > Access tabs. SSH is a terminal-remote host Internet protocol that uses encrypted links. It
provides authentication and secure communication over unsecure channels. Port 22 is the default
port and cannot be changed. Port 22 is only for VxWorks access. To use secure TL-1 you need a
secure shell program and you need to use port 4083. Superuser can also configure EMS and TL1
access states to secure and non-secure modes.
Table
9-3. The user idle period can be modified by a Superuser; refer
Cisco ONS 15454 Reference Manual, R8.5
9.2.2 Security Policies
9-7
Advertisement
Table of Contents
