Password policies¶

The Password policies module defines the rules applied to the automatic rotation of passwords in the vault. Each policy centralises a generation scheme, a renewal period, a list of allowed special characters and, depending on the mode, the list of target accounts or aliases.

The contents of the forms depend on the vault mode chosen in the global options. See Password vault for the choice of mode.

Common principles¶

The main grid lists the existing policies. An icon at the start of each row visually indicates whether the policy is enabled (green) or not. In "Systancia Access" mode, two extra columns show the policy type (local / service) and its version.

Password mask¶

The mask is a sequence of characters that tells, for each position, the set of values from which the service picks a character at random.

Character	Corresponding set
`O`	All digits (0-9) and caps
`P`	Caps from `G` to `Z`
`N`	All digits (0-9)
`L`	All lower case (`a` to `z`)
`U`	All caps (`A` to `Z`)
`A`	Alphanumeric characters
`S`	All special symbols
`I`	All lower case and caps
`X`	All alphanumeric characters and special symbols

Example: for a mask LLUN, a possible generated password is pnR5.

Fixed mask

A mask of the form FIXED:<value> is accepted and always produces the same value. The characters <, > and & are forbidden inside the fixed value.

Default policies — "embedded" mode¶

Two policies are created when the organisation is created and cannot be deleted:

Policy	Role
DefaultPolicy	Main default policy, initially without rotation or aliases. It can be edited freely. It is the policy to which new aliases are attached by default.
NorotationPolicy	Policy without rotation: the Password mask, Renewal period, Special characters and Enable the policy fields are disabled. It cannot be modified to enable rotation.

Protection of the default policies

The DefaultPolicy, DefaultComputerPolicy and NorotationPolicy policies cannot be deleted. The delete button is disabled as soon as one of them is in the selection. If another policy is deleted, the aliases that were attached to it are automatically reassigned to DefaultPolicy.

Add a policy — "Systancia Access" mode¶

Click the + button of the toolbar. Mandatory fields: Name, Password mask, Renewal period, Inactivity period of computers.

Field	Description
Name	Name of the policy.
Password mask	See the character table above.
Renewal period (days)	Number of days between two rotations.
Special characters	List of special characters allowed in the generation process.
Related accounts	List of accounts the policy applies to.
Excluded accounts	List of excluded accounts. Every account that is not listed is then targeted. Only one of the two filters can be filled at a time.
Enable the policy	Enables or disables the policy. Disabled for the default policies.
Enable accounts discovery	Activates automatic account discovery (reserved for local account policies).
Local account policy / Service account policy	Exclusive choice; selecting one automatically disables the other.
Inactivity period of computers (days)	Number of days after which an unused computer is excluded from the policy. The value `0` never excludes it. Only applies to local account policies.
Advanced settings	Three options available for local account policies: Services management, Auto enabling of services for password rotation, Scheduled tasks management. Auto enabling can be used only when both the other two are checked.

Syntax of account filters¶

One or more filters can be combined with a comma to make up a Related accounts or Excluded accounts list.

Syntax	Effect
`prefix*`	Selects the accounts starting with `prefix`.
`*suffix`	Selects the accounts ending with `suffix`.
`full_name`	Selects the accounts with exactly this name.

Preconditions¶

To activate the Password policies page in "Systancia Access" mode:

the vault access configuration must have been successfully completed — see Password vault;
a Systancia Access server in version 10.0.0.7 or newer must be available.

Add a policy — "embedded" mode¶

Click the + button of the toolbar. Mandatory fields: Name, Password mask, Renewal period.

Field	Description
Name	Name of the policy.
Password mask	See the character table. Disabled for `NorotationPolicy`.
Renewal period (days)	Number of days between two rotations.
Special characters	List of allowed special characters.
Enable the policy	Enables or disables the policy. Checked by default.
Key type	For aliases using an SSH key: choice between `RSA` and `ECDSA`.
ECDSA curve	`NIST P-256`, `NIST P-384` or `NIST P-521`. Shown when the key type is `ECDSA`.
RSA key size	Numeric value between `2048` and `16384`. Shown when the key type is `RSA`.
Operations through a site	If checked, rotation operations are routed through a site picked in the list.

A two-column drag-and-drop list (available / selected) allows associating aliases with the policy. Each grid has a search field and a Select all button.

Alias / policy association

An alias can only be associated with one policy. The selected aliases are automatically disassociated from their former policy upon validation. An alias disassociated without being attached to another policy is moved back under DefaultPolicy.

Edit a policy¶

Select the policy in the list and click the edit button, or double-click the row. The edit window uses the fields of the add form matching the active mode. The Name field is read-only once the policy has been created.

Delete a policy¶

Select one or more policies and click the × button. Confirmation is asked. The default policies are protected and cannot be deleted. In "embedded" mode, the aliases attached to a deleted policy are automatically moved back under DefaultPolicy.