Unified Access Gateway supports configuration settings to allow Unified Access Gateway to comply with the Photon 3 OS Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG).
This OS compliance requires specific configuration in the Unified Access Gateway appliance.
The configuration changes are listed as follows:
- Deploy the FIPS version of Unified Access Gateway.
- Configure the following parameters during deployment.
Note: You can configure these parameters only at the time of deployment. If you do not configure during deployment, Unified Access Gateway includes the default values.
| Parameter | Description |
|---|---|
| dsComplianceOS | Set to true to enable DISA STIG OS compliance settings. |
| rootPasswordExpirationDays | Number of days after which the root password must be mandatorily reset.
Set the value to 90. |
| passwordPolicyMinLen | Minimum length of the root password.
Set the value to 8. |
| passwordPolicyMinClass | Minimum complexity of the root password.
Set the value to 4. |
| sshEnabled | Set to true to automatically enable SSH access on the deployed appliance. |
| sshLoginBannerText | Set to an appropriate login banner that includes the text
You are accessing a U.S. Government System. |
| rootSessionIdleTimeoutSeconds | Duration in seconds after which an idle session of the root user will expire.
Set the value to 900. |
| passwordPolicyFailedLockout | Number of failed login attempts after which admin user access is locked out temporarily.
Set the value to 3. |
| sshInterface | Set to eth0, eth1 or eth2 according to which Unified Access Gateway NIC SSH is accessed.
For example, sshInterface=eth0. |
| sshPort | Set to an unused port value other than port 22.
For example, sshPort=30. |
| syslogUrl | Set the syslog URL.
For example, syslog://mysyslog.example.int:514. |
| ntpServers |
Set the hostname(s) for NTP servers.
For example, mytimesvr1.example.int, mytimesvr1.example.int. |
Was this page helpful?