Security Policies - Cisco ONS 15454 Reference Manual

9.2 9.2.2 Security Policies

9.2.2 Security Policies
Users with Superuser security privileges can provision security policies on the ONS 15454. These
security policies include idle user timeouts, password changes, password aging, and user lockout
parameters. In addition, a Superuser can access the ONS 15454 through the TCC2/TCC2P RJ-45 port,
the backplane LAN connection, or both.
9.2.2.1 Superuser Privileges for Provisioning Users
Superusers can grant permission to Provisioning users to retrieve audit logs, restore databases, clear
performance monitoring (PM) parameters, activate software loads, and revert software loads. These
privileges can only be set using CTC network element (NE) defaults, except the PM clearing privilege,
which can be granted to a Provisioning user using the CTC Provisioning> Security > Access tabs. For
more information about setting up Superuser privileges, refer to the Cisco ONS 15454 Procedure Guide.
9.2.2.2 Idle User Timeout
Each ONS 15454 CTC or TL1 user can be idle during his or her login session for a specified amount of
time before the CTC window is locked. The lockouts prevent unauthorized users from making changes.
Higher-level users have shorter default idle periods and lower-level users have longer or unlimited
default idle periods, as shown in
to the Cisco ONS 15454 Procedure Guide for instructions.
Table 9-3
Security Level
Superuser
Provisioning
Maintenance
Retrieve
9.2.2.3 User Password, Login, and Access Policies
Superusers can view real-time lists of users who are logged into CTC or TL1 by node. Superusers can
also provision the following password, login, and node access policies:
•
•
•
Cisco ONS 15454 Reference Manual, R7.0.1
9-6
ONS 15454 Default User Idle Times
Idle Time
15 minutes
30 minutes
60 minutes
Unlimited
Password expirations and reuse—Superusers can specify when users must change and when they can
reuse their passwords.
Locking out and disabling users—Superusers can provision the number of invalid logins that are
allowed before locking out users and the length of time before inactive users are disabled.
Node access and user sessions—Superusers can limit the number of CTC sessions a user login can
have to just one session. Superusers can also prohibit access to the ONS 15454 using the LAN or
TCC2/TCC2P RJ-45 connections.
In addition, a Superuser can select secure shell (SSH) instead of Telnet at the CTC Provisioning >
Security > Access tabs. SSH is a terminal-remote host Internet protocol that uses encrypted links. It
provides authentication and secure communication over unsecure channels. Port 22 is the default
port and cannot be changed. Superuser can also configure EMS and TL1 access states to secure and
non-secure modes.
Table 9-3. The user idle period can be modified by a Superuser; refer
Chapter 9 Security
OL-9217-01