Documentation | Support

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Forcepoint Appliances Command Line Interface > Conventions > Basic account management
Basic account management
CLI Guide | Forcepoint Appliances | v8.4.x
A person who is logged in as admin and working in the config mode can view, enable, and disable the audit account status and can change the password for the admin and audit accounts. An admin user can also display, create, modify, or delete a user account.
Configure accounts
 
Action and Syntax
Details
Change the password for the admin account.
set account admin
--password
 
You are prompted to enter the current password, and then prompted to enter and confirm the new password.
Note that the admin password is first set when you run the firstboot script.
The password must be 8 to 15 characters in length and it must include:
*
At least one uppercase character
*
At least one lowercase character
*
At least one number
*
At least one character in the set:
! # % & ' ( ) * + , - . / ; < = > ? @
[ ] ^ _ { | } ~
Exclude all of the following:
*
The special characters: space $ : ` \ "
*
The previous 3 passwords for the account
*
The device's hostname
*
The user name of any appliance service account (admin, root, tech-support, audit)
*
Common appliance- or company-related names
See if the audit account is enabled or disabled.
show account audit
--status
The audit account is disabled by default.
Enable or disable the audit account.
set account audit
--status <enabled|disabled>
 
Set or change the audit account password.
set account audit
--password
You are prompted to enter the password.
The --status and --password parameters cannot be used at the same time.
When enabling the audit account for the first time, also set a password.
The password must be 8 to 15 characters in length and it must include:
*
At least one uppercase character
*
At least one lowercase character
*
At least one number
*
At least one character in the set:
! # % & ' ( ) * + , - . / ; < = > ? @
[ ] ^ _ { | } ~
Exclude all of the following:
*
The special characters: space $ : ` \ "
*
The previous 3 passwords for the account
*
The device's hostname
*
The user name of any appliance service account (admin, root, tech-support, audit)
*
Common appliance- or company-related names.
Enable or disable remote CLI access via SSH.
set access ssh
--status <enabled|disabled>
SSH status is enabled or disabled for all active accounts.
Valid users include admin, audit, and tech-support. There is no access via SSH for the root user, as this is a reserved internal account.
Display whether remote CLI access via SSH is enabled or disabled.
show access ssh
--status
 
Display the admin account email address.
show account email
 
Define an email address to use for admin account password recovery.
set account email
--address <address>
A temporary password is sent to this email address when you request automated password recovery help.
You must also define an SMTP server. (See next command.)
Technical Support can also manually issue a temporary password if you provide the security code you see in the appliance iDRAC console.
Send a test email using the email/SMTP configuration.
send test_email
 
Display the SMTP server settings used with the admin email address to facilitate password recovery.
show account smtp
Displays:
*
Server IP address or hostname
*
Server port
*
Server user name
*
Server password
Define an SMTP server for use during admin account password recovery.
set account smtp
--host <location>
--port <port>
--user <name>
Password recovery requires you to define:
1.
An SMTP server
2.
A valid email address to receive a temporary password
The host location can be either the SMTP server's IPv4 address or its hostname.
The SMTP port is optional (set to 25, by default).
The user is the account to use to connect to the SMTP server.
Example:
(config)# set account smtp
--host 10.0.0.25 --port 25
--user smtpuser
For admin account password recovery, enter Ctrl+P at the console logon prompt.
 
The old password will be overwritten as soon as the admin types "yes" in the confirmation dialog box.
If you have lost or forgotten your admin password, you can either:
*
Have a temporary password sent to the email address configured on the appliance.
*
Contact Technical Support to receive a temporary password by providing the security code displayed on the console.
Use the temporary password to log on to the appliance. You will be prompted to set a new password.
The password must be 8 to 15 characters in length and it must include:
*
At least one uppercase character
*
At least one lowercase character
*
At least one number
*
At least one character in the set:
! # % & ' ( ) * + , - . / ; < = > ? @
[ ] ^ _ { | } ~
Exclude all of the following:
*
The special characters: space $ : ` \ "
*
The previous 3 passwords for the account
*
The device's hostname
*
The user name of any appliance service account (admin, root, tech-support, audit)
Common appliance- or company-related names
Delete the password recovery email address.
delete account email
 
Delete SMTP settings.
delete account smtp
 
Display Technical Support account access or activity history.
show account tech-support
--status
show account tech-support
--history
The --status and --history parameters cannot be used at the same time.
The activity history includes both local and remote access via the tech-support account.
Enable or disable access for Technical Support.
set account tech-support
--status <enabled|disabled>
A temporary tech support password is generated when you enable this access. Technical Support retrieves the passcode from a special URL.
To allow Technical Support remote access, SSH access must also be enabled with:
set access ssh --status enabled
When a technician uses the tech-support account, the session ends automatically after 15 minutes of inactivity.
View the logon history of the tech-support account with:
show account tech-support --history
Show users or show a specific user.
show user
[--name <unique_user_name>]
Name: (optional) User name for the account to display.
Example:
(view)# show user --name jdoe
Create a user account.
create user
--name <unique_user_name>
--type <audit|admin>
[--status <enabled|disabled>]
Name: User name for the account to display.
The user name must:
*
Contain only lower case letters, numbers, and the underscore character ( _ )
*
Be 30 or fewer characters
*
Begin with the underscore character or a letter
Type: Account authorization type (audit or admin)
Status: (optional) Initial status of the user (enabled or disabled). Default is disabled.
Example:
(config)# create user
--name jdoe --status enabled
--type audit
Update user account settings.
set user
--name <unique_user_name>
--type <audit|admin>
[--status <enabled|disabled>]
[--password]
Name: User name for the account to display.
Type: Account authorization type (audit or admin)
Status: (optional) Initial status of the user (enabled or disabled). Default is disabled.
Password: (optional) Specify an account password using the interactive menu.
Example:
(config)# set user
--name jdoe --password --status enabled --type audit
 
Delete a user account.
delete user [--name <unique_user_name>]
Name: (optional) User name for the account to display.
Example:
(config)# delete user --name <jdoe>
Session management
 
Action and Syntax
Details
Enter the appliance CLI config mode.
config
The admin must be in view mode to access config mode. The admin password is required.
Audit accounts do not have access to this mode.
Enter the appliance CLI diagnose mode.
diagnose
The admin must be in view mode to access diagnose mode.
Display connection information for active CLI sessions.
show session
 
End a config mode session immediately.
clear session
--config
Ends the session for whichever admin is in config mode, and allows another admin to enter config mode.
Exit the current config mode.
exit
If you are working in the config or diagnose mode, you return to the view mode.
If you are in the view mode, your session ends and you exit the appliance CLI.
 

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Forcepoint Appliances Command Line Interface > Conventions > Basic account management
Copyright 2017 Forcepoint. All rights reserved.