Platform Access Security

Platform access security controls user login and platform access. Administrators can restrict access sources through IP allowlists and blocklists, and manage login policies, password strength, two-factor authentication, VNC console passwords, VM password strength, and host password encrypted storage through security settings.

IP Allowlist and Blocklist

IP allowlists and blocklists control platform access by identifying and filtering visitor IP addresses. A blocklist denies access from specified IP addresses, while an allowlist permits access from specified IP addresses.

If no IP blocklists or allowlists are added, requests from all IP addresses are allowed by default.
If only an IP blocklist is added, IP addresses in the blocklist are denied access to the platform, while other IP addresses are allowed.
If the same IP address is added to both lists, the allowlist takes precedence over the blocklist, and requests from that IP address are allowed.
You cannot use an IP allowlist alone. Add at least one IP blocklist before using an IP allowlist. Otherwise, the IP allowlist does not take effect.

Add an IP Allowlist or Blocklist Rule

Procedure

In the navigation pane, choose System Management > IP Allowlist/Blocklist.
Click Add IP Allowlist/Blocklist.

In the Add IP Allowlist/Blocklist dialog, configure the following options:

Option	Description
Name	Enter a name for the IP allowlist or blocklist.
Description	Enter a brief description for the IP allowlist or blocklist.
Type	Select blocklist or allowlist.
IP Address	Enter IP addresses, IP address ranges, or IP/mask values. Separate multiple IP addresses with commas. You can add up to 100 entries.

Manage IP Allowlist and Blocklist Rules

Procedure

In the navigation pane, choose System Management > IP Allowlist/Blocklist.
Select a target list and click Actions.
- To modify the name and description of the list, select Edit Name and Description.
- To modify the IP addresses in the list, select Modify Configuration.
- To remove the IP access restriction from the platform, select Delete.

Security Settings

ZSphere provides security settings for scenarios that require stronger platform access protection. Administrators can configure platform login policies, password strength, two-factor authentication, VNC console password requirements, VM password strength, and host password encrypted storage.

Modify Security Settings

Procedure

In the navigation pane, choose System Management > Security Settings.
Select the item to modify, and then click the Edit icon to complete the configuration.

Security Setting Options

Category	Item Name	Item Description
Login Policy	Restrict Concurrent Connections for Users	Specify whether to limit the number of simultaneous connection sessions for each user. Default: false. If enabled, each user can only have one active connection session with the platform. When a new session is established, the previous session will be automatically closed.
	Session Timeout	If a session times out, you will need to log in again to access the system. Default: 2 hours. Units: seconds, minutes, hours, and days.
	Login Verification Code Settings	Specify whether to require a verification code after a specified number of consecutive failed login attempts. Default: false. If enabled, you can set the maximum number of continuous login failures that will trigger the verification code requirement. Enter an integer that is equal to or greater than 3.
	Login Password Update Cycle	Specify whether to enforce regular updates of login passwords. Default: false. If enabled, you can specify the update interval. The default interval is 90 days. When the update period is reached, you will be prompted to change your password upon logging into the platform. You can also set the number of recent passwords that cannot be repeatedly used. For example, if you set this parameter to 3, you will not be able to reuse any of your last three passwords when logging into the platform.
	Failed Login Lockout Settings	Specify whether to lock a user's account after consecutive failed login attempts. Default: false. If enabled, set Max Login Attempts to an integer from 1 to 10 and Lockout Duration to an integer from 0 to 1,440 minutes. When the number of consecutive failed login attempts reaches the limit, the account is locked for the specified duration.
	Login Password Strength	Specify whether to enforce the user-created login passwords to meet a certain level of complexity and security. Default: false. If enabled, you can specify the required range for password length and enforce the use of a combination of digits, lowercase letters, uppercase letters, and special characters.
	Two-Factor Authentication	Specify whether to enable two-factor authentication (2FA) for platform logins. Default: false.
Virtual Machine	VNC Console Password	Specify whether to require a password for VNC console login. Default: false. If enabled, you can specify the length range for the VNC console password. The default range is 6-8 characters. Additionally, you can enforce the use of a combination of digits, letters, and special characters.
Virtual Machine	VM Password Strength	Specify whether to require login passwords for virtual machines. Default: false. The VM password format is m-n, with values ranging from 8 to 32 integers. Default: 8 to 18. The password supports a combination of digits, letters, and special characters. Before you set a login password for a virtual machine, make sure that cloud-init is installed in the VM system image. We recommend that the version of cloud-init be 0.7.9, 17.1, 19.4, 19.4, or later.
Host	Host Password Encryption Policy	Specifies whether and how to encrypt the login password of hosts in the database. Default: None. Options include None and LocalEncryption. None: Do not encrypt the login password of hosts. LocalEncryption: Encrypt the login password of hosts by using the encryption feature provided by the platform.

PreviousIdentity and Access Management NextSSL Certificate