System information

Operation 1-15
Software Release 2.0.1
C613-03018-00 REV A
■
Do include both uppercase and lowercase characters. The passwords
stored by the router are case-sensitive, so “bgz4kal” and “Bgz4Kal” are
different.
■
Do avoid words found in a dictionary, unless combined with other random
alphabetic and numeric characters.
■
Do not use the login name, or the word “password” as the password.
■
Do not use your name, your mothers name, your spouses name, your pets
name, or the name of your favourite cologne, actor, food or song.
■
Do not use your birth date, street number or telephone number.
■
Do not write down your password anywhere.
A manager can alter the password for any user with the command:
SET USER=username PASSWORD=password
This may be necessary if the user has forgotten the password. A log message is
generated whenever the password for a manager account is changed.
A user who is logged in can change their own password using the command:
SET PASSWORD
which prompts for the old password, the new password and confirmation of
the new password. The new password and the confirmation must be identical
for the change to take affect. This reduces the chances of a typing error causing
the password to be different from what the user intended.
Database Security
A manager session that is left unattended is a severe security risk. In particular,
the User Authentication Database can be modified from a manager session. To
reduce the risk of unauthorised activity, a subset of manager commands
(Table 1-3 on page 1-16), called the security commands, have a security timer.
When one of the security commands is entered from a manager session, the
security timer is started. Each time a security command is entered the timer is
restarted. If a security command is entered after the timer has expired, the
manager is prompted to re-enter the password correctly before the command
will be actioned. If the password is not entered correctly the password prompt
will be repeated a set number of times, and if the correct password is still not
entered a log message is generated and the session is logged off.
The security timer enables a manager to make successive additions and
modifications to the database at one time without having to re-enter the
password for every command.
The security timer does not provide a foolproof security mechanism. Managers
should always attempt to log out of a manager session before leaving a
terminal unattended.