Login Security

The internal SonicOS Web-server now only supports SSL version 3.0 and TLS with strong ciphers (128 bits or greater) when negotiating HTTPS management sessions. SSL implementations prior to version 3.0 and weak ciphers (symmetric ciphers less than 128-bits) are not supported. This heightened level of HTTPS security protects against potential SSLv2 rollback vulnerabilities and ensures compliance with the Payment Card Industry (PCI) and other security and risk-management standards.

TIP: SonicOS uses advanced browser technologies such as HTML5, which are supported in most recent browsers. Dell SonicWALL recommends using the latest Chrome, Firefox, Internet Explorer (9.0 or above), or Safari (does not operate on Windows platforms) browsers for administration of SonicOS. Mobile device browsers are not recommended for Dell SonicWALL appliance system administration.

SonicOS password constraint enforcement configuration ensures that administrators and users are using secure passwords. This password constraint enforcement can satisfy the confidentiality requirements as defined by current information security management systems or compliance requirements, such as Common Criteria and the Payment Card Industry (PCI) standard.

•

Password must be changed every (days) – requires users to change their passwords after the designated number of days has elapsed. When a user attempts to login with an expired password, a pop-up window will prompt the user to enter a new password. The User Login Status window now includes a Change Password button so users can change their passwords at any time. The default number of days is 90.

•	Bar repeated passwords for this many changes – requires users to use unique passwords for the specified number of password changes. The default number is 4.

•	New password must contain 4 characters different from the old password – requires users to change at least 4 alphanumeric characters in their old password when creating a new one.

•	Enforce a minimum password length of – sets the shortest allowed password.

•	Enforce password complexity – specifies how complex a user’s password must be to be accepted. The drop-down menu provides these options:

•	None (default)

•	Require both alphabetic and numeric characters

•	Require alphabetic, numeric, and symbolic characters – for symbolic characters only !, @, #, $, %, ^, &, *, (, and ) are allowed; all others are denied

•	Complexity Requirement – When the password complexity option is selected, sets the minimum number of alphanumeric and symbolic characters in a user’s password. The default number for each is 0.

•	Upper Case Characters

•	Lower Case Characters

•	Number Characters

•	Symbolic Characters

•	Apply these password constraints for – the checkboxes specify to which classes of users the password constraints are applied. By default, all checkboxes are selected.

•	Administrator – refers to the default administrator with the username admin.

•	Other full administrators

•	Limited administrators

•	Guest administrators

•	Other local users

•

Log out the Administrator after inactivity of (minutes) – sets the length of inactivity time that elapses before you are automatically logged out of the Management Interface. By default, the Dell SonicWALL Security Appliance logs out the administrator after 5 minutes of inactivity. The inactivity timeout can range from 1 to 9999 minutes.

TIP: If the Administrator Inactivity Timeout is extended beyond five minutes, you should end every management session by clicking Logout in the upper right corner of the page to prevent unauthorized access to the firewall’s Management Interface.

•	Enable administrator/user lockout – locks administrators and users out of accessing the appliance after the specified number of incorrect login attempts. This option is disabled by default. See Enable Administrator/User Lockout .

•	Failed login attempts per minute before lockout – specifies the number of incorrect login attempts within a one-minute time frame that triggers a lockout. The minimum number is 1, the maximum number is 9999, and the default is 5.

•	Lockout Period (minutes) – specifies the number of minutes that the administrator or user is locked out. The minimum time is 1 minute, the maximum time is 60 minutes, and the default is 5 minutes.