everpure.flashblade.purefb_password_policy module – Manage the FlashBlade management password policy
Note
This module is part of the everpure.flashblade collection (version 1.29.0).
You might already have this collection installed if you are using the ansible package.
It is not included in ansible-core.
To check whether it is installed, run ansible-galaxy collection list.
To install it, use: ansible-galaxy collection install everpure.flashblade.
You need further requirements to be able to use this module,
see Requirements for details.
To use it in a playbook, specify: everpure.flashblade.purefb_password_policy.
New in everpure.flashblade 1.28.0
Synopsis
Configure the array-wide password policy that applies to local FlashBlade management users authenticating with a password (Web UI, CLI/SSH).
The policy is a singleton configuration resource, normally named
management, that always exists on the array. It cannot be created or deleted, only modified, so this module has no state option.Passwords of AD/LDAP users are governed by the external directory service and are not affected by this policy.
Requirements
The below requirements are needed on the host that executes this module.
python >= 3.9
py-pure-client
netaddr
datetime
pytz
distro
pycountry
urllib3
Parameters
Parameter |
Comments |
|---|---|
FlashBlade API token for admin privileged user. |
|
ID of the API Client that issues the identity token. Used with private_key_file. |
|
Disable insecure certificate warnings Choices:
|
|
Whether policy enforcement is enabled. Choices:
|
|
Whether passwords are tested against a dictionary of known leaked passwords. Requires passwords longer than 6 characters. Choices:
|
|
Whether the username is prevented from being a substring of the password. Only applies to usernames of 4 characters and longer. Choices:
|
|
FlashBlade management IP address or Hostname. |
|
A pre-signed JWT to authenticate with, as an alternative to api_token. The token is exchanged by the array for a short-lived access token. Requires a matching API Client to be registered on the array (see everpure.flashblade.purefb_apiclient). |
|
The API Client’s trusted identity issuer registered on the array. Used with private_key_file. |
|
Key ID of the API Client that issues the identity token. Used with private_key_file. |
|
Duration, in seconds, of the account lockout after max_login is exceeded. Range between 1 second and 90 days (7776000 seconds). Set to 0 to disable the lockout duration rule. |
|
Maximum number of failed login attempts allowed before the user is locked out. Range between 1 and 100. Set to 0 to disable the maximum login attempts rule. |
|
Maximum time, in seconds, a password remains valid before the user is required to change it. Set to 0 to disable password expiration. The array stores this with one-hour precision, so the value must be a whole number of hours (a multiple of 3600). Range between 1 day (86400 seconds) and 99999 days (8639913600 seconds), and must be greater than min_password_age. Requires FlashBlade REST API 2.18 (Purity//FB 4.6.0) or higher. |
|
Number of character groups (lowercase letters, uppercase letters, numbers, special characters) required to be present in a password. Range between 1 and 4. Set to 0 to disable the character group rule. |
|
Minimum number of characters per group to count the group as present. Must be 1 or greater. Set to 0 to disable the characters per group rule. |
|
Minimum number of characters required in a password. Range between 1 and 100. |
|
Minimum time, in seconds, that must pass before a password can be changed again. The array stores this with one-hour precision, so the value must be a whole number of hours (a multiple of 3600). Range between 0 and 7 days (604800 seconds). |
|
Name of the password policy. The array provides a single built-in policy named Default: |
|
Number of previous passwords tracked to prevent reuse. Range between 0 and 64. |
|
Path to the PEM RSA private key used to sign an identity token, as an alternative to api_token. Requires client_id, key_id, issuer and username. |
|
Password protecting private_key_file, if encrypted. |
|
Username the issued token should be granted to. Must be a valid user on the array. Used with private_key_file. |
Notes
Note
Options that are omitted leave the corresponding policy setting unchanged.
Durations are given in seconds; the array stores them in milliseconds.
Rules disabled by setting 0 are reported by the array as absent (null) values; the GUI displays them as 0.
The array only allows max_login and lockout to transition between enabled (non-zero) and disabled (0) together, so supply both in the same task when enabling or disabling the lockout rules. Once both are enabled, each can be changed independently.
Password policies require FlashBlade REST API 2.16 (Purity//FB 4.5.2) or higher; max_password_age additionally requires REST API 2.18 (Purity//FB 4.6.0) or higher.
The min_password, max_login and lockout options use the same names and units as the equivalent options of everpure.flashblade.purefb_admin.
You must set
PUREFB_URLandPUREFB_APIenvironment variables if fb_url and api_token arguments are not passed to the module directlyToken-based authentication (id_token, or private_key_file with client_id, key_id, issuer and username) may be used as an alternative to api_token, and requires a matching API Client registered on the array via everpure.flashblade.purefb_apiclient
Examples
- name: Enforce password complexity and length
everpure.flashblade.purefb_password_policy:
min_password: 12
min_character_groups: 3
min_characters_per_group: 1
enforce_username_check: true
enforce_dictionary_check: true
fb_url: 10.10.10.2
api_token: T-55a68eb5-c785-4720-a2ca-8b03903bf641
- name: Lock accounts for 30 minutes after 5 failed logins
everpure.flashblade.purefb_password_policy:
max_login: 5
lockout: 1800
fb_url: 10.10.10.2
api_token: T-55a68eb5-c785-4720-a2ca-8b03903bf641
- name: Expire passwords after 90 days, at most one change per day
everpure.flashblade.purefb_password_policy:
max_password_age: 7776000
min_password_age: 86400
password_history: 5
fb_url: 10.10.10.2
api_token: T-55a68eb5-c785-4720-a2ca-8b03903bf641
- name: Disable password expiration
everpure.flashblade.purefb_password_policy:
max_password_age: 0
fb_url: 10.10.10.2
api_token: T-55a68eb5-c785-4720-a2ca-8b03903bf641
- name: Disable password policy enforcement
everpure.flashblade.purefb_password_policy:
enabled: false
fb_url: 10.10.10.2
api_token: T-55a68eb5-c785-4720-a2ca-8b03903bf641