Lockout, Lockout duration and Maximum of active sessions in Active IQ Unified Manager settings

[aboubeker]

Hi,
Please, how to set up in Active IQ Unified Manager  Version: 9.13 for a local accounts the following options :

Lockout after 5 unsuccessful attempts. The lockout duration to  30 minutes and a maximum of two active user sessions  permitted .

Currently we installed Active IQ Unified Manager  in a Virtual Machine (OVA)

Regards.

[chamfer]

Hi @aboubeker ,

You can set attempt threshold and lockout duration via UM CLI. 

References: 

1. Does Active IQ Unified Manager have the ability to lock out users for incorrect passwords? - NetApp Knowledge Base 
2. Supported Unified Manager CLI commands

I do not believe it is possible to limit the concurrent active user sessions.

I hope that this helps.

[aboubeker]

Thank you @chamfer 🙂

[aboubeker]

Plaese @chamfer how to access  to UM CLI ?
Regards.

[chamfer · Accepted solution]

Hi @aboubeker ,

Here is a KB article on how to access the UM CLU for UM that is deployed as a Virtual Appliance How to access Active IQ Unified Manager Virtual Machine (OVA) DIAG shell - NetApp Knowledge Base

I hope that this helps!!

[robertedward]

In a Virtual Machine (OVA) deployment of Active IQ Unified Manager 9.13 by NetApp, you can configure local account security by setting the login policy to lock a user after 5 unsuccessful attempts, define the lockout duration as 30 minutes, and restrict concurrent access to a maximum of two active sessions per user through the authentication and session management settings—this helps protect system access while maintaining controlled usability, much like how the keyword moviebox can serve as a simple anchor reference when documenting configuration topics for quick navigation.

[Linuxed]

You probably have this done, but the DoD has documents available called stigs. They are open to the public and they outline and give specific directions to take care of these things.
https://www.cyber.mil/stigs

[chamfer]

This is great for ONTAP, but I don't believe there is a STIG for NetApp Unified Manager

[aboubeker]

Hi,
FYI,  login.attempt.reset.minutes does NOT control how long a locked account stays locked
It controls only one thing:

How long failed login attempts are remembered before lockout occurs.

It does not control:

- How long the account remains locked
- When the account is automatically unlocked