Chapter 14 Service Console Security

Procedure

1Log in to the service console and acquire root privileges.

2Run the following command.

esxcfg-auth --usecrack=retriesminimum_lengthlc_credituc_creditd_creditoc_credit n retries: number of retries users are allowed before they are locked out.

n minimum_length: minimum password score, or effective length, after credits have been applied.

NOTE The pam_cracklib.so plug-in does not accept passwords less than six characters, regardless of credits used and regardless of the value that you assign to minimum_length. In other words, if minimum_length is 5, users must still enter no fewer than six characters.

nlc_credit: maximum number of credits allowed for lowercase letters.

nuc_credit: maximum number of credits allowed for uppercase letters.

nd_credit: maximum number of credits allowed for numbers.

noc_credit: maximum number of credits allowed for special characters, such as underscore or dash. The password requirements for the plug-in are configured according to the parameters you entered.

Example: esxcfg-auth --usecrack Command

esxcfg-auth --usecrack=3 9 1 -1 -1 1

nUsers are allowed three attempts to enter their password before they are locked out.

nThe password score must be nine.

nUp to one credit is given for using lowercase letters.

nAt least one uppercase letter is required. No extra credit is given for this character type.

nAt least one number is required. No extra credit is given for this character type.

nUp to one credit is given for using special characters.

Using these sample values, the password candidate xyzpqe# would fail:

(x + y + z + p +q + e + #) + (lc_credit + oc_credit) = 9

While the password score is nine, it does not contain the required uppercase letter and number. The password candidate Xyzpq3# would be accepted:

(X + y + z + p +q + 3 + #) + (lc_credit + oc_credit) = 9

The password score for this example is also nine, but this password includes the required uppercase letter and number. The uppercase letter and number do not add extra credit.

Cipher Strength

Transmitting data over insecure connections presents a security risk because malicious users might be able to scan data as it travels through the network. As a safeguard, network components commonly encrypt the data so that it cannot be easily read.

To encrypt data, the sending component, such as a gateway or redirector, applies algorithms, or ciphers, to alter the data before transmitting it. The receiving component uses a key to decrypt the data, returning it to its original form. Several ciphers are in use, and the level of security that each provides is different. One measure of a cipher’s ability to protect data is its cipher strength—the number of bits in the encryption key. The larger the number, the more secure the cipher.