KACE Systems Deployment Appliance 9.1 Common Documents

Enable SSH Root Login (KACE Support)

Enabling SSH provides remote access to the Quest KACE Support team. Quest KACE recommends enabling SSH before you begin to use the appliance. SSH remote access is the only method that the Support team can use to diagnose and fix problems if the appliance becomes unresponsive.

On the left navigation pane, click Settings > Control Panel to display the Control Panel, then click Security to display the Security Settings page.

Select the Allow SSH Root Login (KACE Support) check box.

Click Save.

Prevent brute-force login attacks

You can configure the appliance to prevent multiple consecutive attacks from obtaining appliance credentials.

The Brute Force Detection settings on the Security Settings page allow you to configure the number of failed authentication attempts within a specified time frame, after which the appliance prevents any logins for that user name.

On the left navigation pane, click Settings > Control Panel to display the Control Panel, then click Security to display the Security Settings page.

On the Security Settings page, under Brute Force Detection, specify the following:

◦

The maximum number of failed login attempts. You can specify any value between three and ten attempts. The default setting is three attempts.

◦

The number of minutes during which the appliance prevents that specific user from logging in. You can specify any number of minutes between one and 60. The default setting is five minutes.

When the appliance disables a user from logging in, other users are not affected and can log in to the appliance during the specified time period, when they provide valid credentials.

Click Save.

Enable Two-Factor Authentication

Two-Factor Authentication (2FA) provides stronger security for users logging into the appliance by adding an extra step to the login process. It relies on the authenticator app to generate verification codes. The app generates a new six-digit code at regular intervals. When administrators enable 2FA on the appliance, applicable end users are prompted for a verification code each time they log in.

Start by installing the authenticator app on your mobile Android or iOS device. You can download the app from Google Play and Apple App Store.

Only users with Admin-level permissions have the ability to enable 2FA. Read-only administrators cannot manage this feature.

NOTE: Using the reset_admin_password command to reset the administrator's password also resets the 2FA token. For more information about this command, see Use the Command Line Console to reset the Administrator's password.

On the left navigation pane, click Settings > Control Panel to display the Control Panel, then click Security to display the Security Settings page.

On the Security Settings page, under Two-Factor Authentication, select Enable Two-Factor Authentication.

Click Save.

Complete the 2FA configuration on the Configure Two-Factor Authentication page that appears.

Click the iOS or Android icon to display the applicable QR code.

Scan app store QR code to download the authenticator app.

Use the authenticator app on to scan the QR code.

The 6-digit code that appears is valid for 30 seconds. If you enable this feature, ensure that appliance server's clock is accurate, as well as the device running the authenticator app. The app relies on current time to create the token. If the server's clock is not synchronized with those of the devices running the authenticator app, token validation may fail, which may result in account lockouts.

In the Verification Code field, type the 6-digit code from the authenticator app.

Click Finish Configuration.

The Configure Two-Factor Authentication page closes and the Dashboard appears, indicating that you are now logged in to the appliance with the newly configured 2FA credentials.

Complete additional 2FA configuration options, as applicable.

On the left navigation pane, click Settings > Control Panel to display the Control Panel, then click Security to display the Security Settings page.

When you enable 2FA on the appliance, only those users who have 2FA enabled can log in using this additional layer of security. To enforce 2FA for all users logging into the appliance, under Two-Factor Authentication, select Require Two-Factor Authentication for all users. This option overrides the 2FA configuration associated with individual user accounts. For more information, see Add or edit local administrator accounts.

To specify the length of time during which users who require 2FA can bypass 2FA authentication, under Transition Window, specify the desired time period. This way, for example, if a user leaves their phone at home and cannot generate a new code, they can still access the appliance during the specified amount of time.

Click Save.