Datasheet

9-6
Cisco ONS 15454 SDH Reference Manual, R7.0
October 2008
Chapter 9 Security
9.2.2 Security Policies
9.2.2.1 Superuser Privileges for Provisioning Users
Superusers can grant permission to Provisioning users to retrieve audit logs, restore databases, clear
performance monitoring (PM) parameters, activate software loads, and revert software loads. These
privileges can only be set using CTC network element (NE) defaults, except the PM clearing privilege,
which can be granted using the CTC Provisioning > Security > Access tabs. For more information on
setting up Superuser privileges, refer to the Cisco ONS 15454 SDH Procedure Guide.
9.2.2.2 Idle User Timeout
Each ONS 15454 SDH CTC or TL1 user can be idle during his or her login session for a specified
amount of time before the CTC window is locked. The lockouts prevent unauthorized users from making
changes. Higher-level users have shorter default idle periods and lower-level users have longer or
unlimited default idle periods, as shown in Table 9-3. The user idle period can be modified by a
Superuser; refer to the Cisco ONS 15454 SDH Procedure Guide for instructions.
9.2.2.3 User Password, Login, and Access Policies
Superusers can view real-time lists of users who are logged into CTC or TL1 by node. Superusers can
also provision the following password, login, and node access policies.
• Password expirations and reuse—Superusers can specify when users must change and when they can
reuse their passwords.
• Locking out and disabling users—Superusers can provision the number of invalid logins that are
allowed before locking out users and the length of time before inactive users are disabled.
• Node access and user sessions—Superusers can limit the number of CTC sessions one user can have,
and they can prohibit access to the ONS 15454 SDH using the LAN or MIC-C/T/P connections.
In addition, a Superuser can select secure shell (SSH) instead of Telnet at the CTC Provisioning >
Security > Access tabs. SSH is a terminal-remote host Internet protocol that uses encrypted links. It
provides authentication and secure communication over unsecure channels. Port 22 is the default
port and cannot be changed.
Note The superuser cannot modify the privilege level of an active user. The CTC displays a warning message
when the superuser attempts to modify the privilege level of an active user.
9.2.2.4 Secure Access
Secure access is based on SSH and SSL protocols. Secure access can be enabled for EMS (applicable to
CTC). When access is set to secure, CTC provides enhanced SFTP and SSH security when
communicating with the node.
Table 9-3 ONS 15454 SDH Default User Idle Times
Security Level Idle Time
Superuser 15 minutes
Provisioning 30 minutes
Maintenance 60 minutes
Retrieve Unlimited