IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
Configuring<br />
three<br />
strikes<br />
login<br />
policy<br />
The<br />
three<br />
strikes<br />
login<br />
policy,<br />
available<br />
<strong>for</strong><br />
LDAP-based<br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
installations,<br />
enables<br />
you<br />
to<br />
specify<br />
a<br />
maximum<br />
number<br />
of<br />
failed<br />
login<br />
attempts<br />
(n)<br />
and<br />
a<br />
penalty<br />
lockout<br />
time<br />
(x),<br />
such<br />
that<br />
after<br />
″n″<br />
failed<br />
login<br />
attempts<br />
a<br />
user<br />
is<br />
locked<br />
out<br />
<strong>for</strong><br />
″x″<br />
seconds<br />
(or<br />
the<br />
account<br />
is<br />
disabled).<br />
The<br />
three<br />
strikes<br />
login<br />
policy<br />
is<br />
used<br />
to<br />
prevent<br />
computer<br />
password<br />
attacks.<br />
The<br />
policy<br />
creates<br />
a<br />
condition<br />
where<br />
a<br />
user<br />
must<br />
wait<br />
a<br />
period<br />
of<br />
time<br />
be<strong>for</strong>e<br />
making<br />
more<br />
login<br />
attempts<br />
that<br />
fail.<br />
For<br />
example,<br />
a<br />
policy<br />
could<br />
dictate<br />
3<br />
failed<br />
attempts<br />
followed<br />
by<br />
a<br />
180<br />
second<br />
penalty.<br />
This<br />
type<br />
of<br />
login<br />
policy<br />
can<br />
prevent<br />
random<br />
computer-generated<br />
login<br />
attempts<br />
occurring<br />
many<br />
times<br />
a<br />
second.<br />
The<br />
three<br />
strikes<br />
login<br />
policy<br />
requires<br />
the<br />
joint<br />
contribution<br />
of<br />
two<br />
pdadmin<br />
policy<br />
command<br />
settings:<br />
v<br />
Maximum<br />
number<br />
of<br />
failed<br />
login<br />
attempts<br />
policy<br />
set<br />
max-login-failures<br />
v<br />
Penalty<br />
<strong>for</strong><br />
exceeding<br />
failed<br />
login<br />
attempt<br />
setting<br />
policy<br />
set<br />
disable-time-interval<br />
The<br />
penalty<br />
setting<br />
can<br />
include<br />
an<br />
account<br />
lockout<br />
time<br />
interval<br />
or<br />
a<br />
complete<br />
disabling<br />
of<br />
the<br />
account.<br />
If<br />
a<br />
login<br />
policy<br />
is<br />
set<br />
(as<br />
an<br />
example)<br />
<strong>for</strong><br />
three<br />
failed<br />
attempts<br />
followed<br />
by<br />
specific<br />
lockout<br />
time<br />
penalty,<br />
a<br />
fourth<br />
attempt<br />
(correct<br />
or<br />
incorrect)<br />
will<br />
result<br />
in<br />
an<br />
error<br />
page<br />
that<br />
states<br />
the<br />
account<br />
is<br />
temporarily<br />
unavailable<br />
because<br />
of<br />
password<br />
policy.<br />
The<br />
time<br />
interval<br />
is<br />
specified<br />
in<br />
seconds—the<br />
minimum<br />
recommended<br />
time<br />
interval<br />
is<br />
60<br />
seconds.<br />
If<br />
the<br />
disable-time-interval<br />
policy<br />
is<br />
set<br />
to<br />
″disable″,<br />
the<br />
user<br />
is<br />
locked<br />
out<br />
of<br />
the<br />
account<br />
and<br />
the<br />
LDAP<br />
account<br />
valid<br />
attribute<br />
<strong>for</strong><br />
this<br />
user<br />
is<br />
set<br />
to<br />
″no″.<br />
An<br />
administrator<br />
re-enables<br />
the<br />
account<br />
through<br />
the<br />
Web<br />
Portal<br />
<strong>Manager</strong>.<br />
Note:<br />
Setting<br />
the<br />
disable-time-interval<br />
to<br />
″disable″<br />
results<br />
in<br />
additional<br />
administration<br />
overhead,<br />
because<br />
the<br />
account<br />
must<br />
be<br />
manually<br />
re-enabled<br />
by<br />
the<br />
administrator.<br />
Once<br />
the<br />
account<br />
is<br />
re-enabled,<br />
the<br />
updated<br />
account<br />
valid<br />
in<strong>for</strong>mation<br />
might<br />
not<br />
be<br />
immediately<br />
available.<br />
This<br />
situation<br />
can<br />
occur<br />
when<br />
using<br />
<strong>WebSEAL</strong><br />
with<br />
an<br />
LDAP<br />
environment<br />
that<br />
includes<br />
replicated<br />
LDAP<br />
servers.<br />
In<br />
this<br />
case,<br />
the<br />
updated<br />
in<strong>for</strong>mation<br />
is<br />
propagated<br />
to<br />
the<br />
LDAP<br />
replicas<br />
according<br />
to<br />
the<br />
LDAP<br />
configuration<br />
settings<br />
that<br />
specify<br />
the<br />
time<br />
interval<br />
<strong>for</strong><br />
per<strong>for</strong>ming<br />
updates.<br />
Account<br />
lock<br />
policy<br />
with<br />
load-balanced<br />
<strong>WebSEAL</strong><br />
servers<br />
You<br />
use<br />
the<br />
three<br />
strikes<br />
login<br />
policy<br />
to<br />
ensure<br />
that<br />
an<br />
account<br />
is<br />
locked<br />
after<br />
a<br />
specified<br />
number<br />
of<br />
login<br />
attempts.<br />
This<br />
policy<br />
per<strong>for</strong>ms<br />
as<br />
expected<br />
in<br />
a<br />
configuration<br />
involving<br />
one<br />
<strong>WebSEAL</strong><br />
server.<br />
In<br />
a<br />
configuration<br />
involving<br />
multiple<br />
front-end<br />
<strong>WebSEAL</strong><br />
servers<br />
with<br />
a<br />
load-balancing<br />
mechanism,<br />
the<br />
results<br />
of<br />
the<br />
policy<br />
are<br />
affected<br />
by<br />
the<br />
fact<br />
that<br />
each<br />
<strong>WebSEAL</strong><br />
server<br />
maintains<br />
its<br />
own<br />
local<br />
count<br />
of<br />
failed<br />
login<br />
attempts.<br />
For<br />
example,<br />
if<br />
the<br />
max-login-failures<br />
value<br />
is<br />
set<br />
to<br />
three<br />
(3)<br />
attempts,<br />
and<br />
the<br />
client<br />
fails<br />
the<br />
first<br />
three<br />
attempts,<br />
the<br />
account<br />
on<br />
this<br />
server<br />
is<br />
locked.<br />
However,<br />
as<br />
the<br />
client<br />
continues<br />
login<br />
attempts,<br />
the<br />
load-balancing<br />
mechanism—detecting<br />
a<br />
112<br />
<strong>IBM</strong><br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
<strong>for</strong><br />
e-<strong>business</strong>:<br />
<strong>WebSEAL</strong><br />
<strong>Administration</strong><br />
Guide
Change language