Kemp Support, how can we help?

The latest application delivery knowledge and expertise at your fingertips.

GUI passwords restrictions and storing

 

Information

 

Summary:

The article describes handling, storing, and restrictions for GUI user passwords.

Environment:

Product: Flowmon OS

Version: Any

Platform: Any

Question/Problem Description:

How the GUI passwords are stored in FOS?

Steps to Reproduce:  
Error Message:  
Defect Number:  
Enhancement Number:  
Cause:  
Resolution:

User passwords are hashed with the PHP password_hash function (https://www.php.net/manual/en/function.password-hash.php) using the CRYPT_BLOWFISH algorithm.
After the hashing, hashes are stored in the database. 

The only requirement for a user password is 4 characters length, and no restrictions are currently planned. It is possible to use LDAP, Active Directory, or TACACS for the authentication and force the password policy there. 
 
There is no user lock implemented after failed logins.
 
The only initial password is for the "admin" user (GUI) and "flowmon" user (SSH). These are recommended to be changed in our hardening guidelines:
https://support.kemptechnologies.com/hc/en-us/articles/4405890423821-Flowmon-Hardening-Guidelines

Workaround:  
Notes:  

Was this article helpful?
0 out of 0 found this helpful

Comments