Login Policy

The Login Policy controls concurrent system access to a specified number of users, sets the maximum number of unsuccessful login attempts, specifies the response to login failure, and specifies the login mode (single-factor or two-factor).

Note:

If user authentication fails or a user is locked out of the system, the OCSBC will not display the reason why the login failed.

The single instance login-config configuration element defines login policy.

1. From admin mode, use the following command path to access the login-config configuration element:

   ORACLE# configure terminal
   ORACLE(configure)# security 
   ORACLE(security)# admin-security
   ORACLE(admin-security)# login-config
   ORACLE(login-config)# 
   			 

   login-config configuration element properties are shown below with their default values

   concurrent-session-limit         2
   max-login-attempts               3
   login-attempt-interval           4
   lockout-interval                 60
   send-alarm                       enabled
   login-auth-mode                  single-factor
   enable-login-banner              enabled

2. concurrent-session-limit—specifies the maximum number of simultaneous connections allowed per user name

   Allowable values are integers within the range 1 through 10, with a default of 2 (simultaneous connections).

   Retain the default value, or specify a new connection limit.

   ORACLE(login-config)# concurrent-session limit 4
   ORACLE(login-config)#

3. max-login-attempts—specifies the number of consecutive unsuccessful login attempts that trigger disconnection of a console, SSH, or SFTP session.

   Allowable values are integers within the range 2 through 100, with a default of 3 (sessions).

   Retain the default value, or specify a new threshold value.

   ORACLE(login-config)# max-login-attempts 5
   ORACLE(login-config)# 

4. login-attempt-interval—specifies an idle interval in seconds imposed after an unsuccessful login attempt.

   Allowable values are integers within the range 4 through 60, with a default value of 4 seconds.

   Retain the default value, or specify a new login interval.

   ORACLE(login-config)# login-attempt-interval 6
   ORACLE(login-config)#

5. lockout-interval—specifies the number of seconds that logins from an interface are not allowed after the max-login-attempts threshold has been reached
   Allowable values are integers within the range of 15 through 300. The default value is 60 seconds.

   Note:

   The minimum lockout-interval is 15 when the JITC feature is enabled, but remains 30 when only the Admin Security feature is provisioned.

   Retain the default value, or specify a new lockout interval.

   ORACLE(login-config)# lockout-interval 30
   ORACLE(login-config)# 

6. send-alarm—enables the generation and transmission of alarms in the event of an interface lockout

   Allowable values are enabled (the default) or disabled.

   Retain the default value, or select disabled to squelch alarm generation.

   ORACLE(login-config)# send-alarm disabled
   ORACLE(login-config)# 

7. login-auth-mode—specifies the local login authentication mode

   Allowable values are single-factor (the default) or two-factor.

   single-factor authentication requires the service requester to present a single authentication credential, a password.

   two-factor authentication requires the service requester to present two authentication credentials, a password and a passcode.

   Retain the default value, or specify two-factor authentication.

   ORACLE(login-config)# login-auth-mode two-factor
   ORACLE(login-config)# 

8. enable-login-banner—enables or disables display of the login banner

   Allowable values are enable (the default) or disable.

   Retain the default value, or disable login banner display.

   ORACLE(login-config)# enable-login-banner disable
   ORACLE(login-config)# 

   A sample login policy configuration appears below:

   ORACLE(login-config)# concurrent-session limit 4 
   ORACLE(login-config)# max-login-attempts 5 
   ORACLE(login-config)# login-attempt-interval 6 
   ORACLE(login-config)# lockout-interval 30 
   ORACLE(login-config)# done 
   ORACLE(login-config)# exit 
   ORACLE(admin-security)# 

   Defines a login-config configuration element that allows four simultaneous connections per user name. An idle interval of 6 seconds is imposed after an unsuccessful login attempt. Five consecutive unsuccessful login attempts trigger a 30-second lockout of the interface over which the unsuccessful logins were received. By default, single-factor authentication, alarm generation, and login banner display are enable.