The passwords information type is optional for the product configuration file.

The passwords information type allows you to create a random password for each individual device. This is often required because of global security regulations. If the product does not require random passwords, the information type can be omitted from the product configuration file. If Passwords configuration objects are defined, production records must be enabled and a production record encryption key must be supplied. With a production record you can extract passwords from a device once it is provisioned.

Using this feature, a random password is generated for each password configuration object by the Security Appliance, using an algorithm supplied with the product template. The pseudocode for this algorithm is provided in the example below. The algorithm works by inputting strings of characters which the algorithm randomly selects characters from, to create the password. These strings are called policies, because they attempt to emulate the OEM’s password policy where the password must comprise certain types of characters. In the example, each of the four policies is represented by a string of characters. For the lowercase letter policy, the string would be something like "abcdefghjkmnpqrstuvwxyz". Using strings allows you to exclude certain characters such as the letter l as it is very similar to the number 1. When the password is created, the algorithm selects at least one character from each policy string to ensure that all policies have been met. Because of this, a password’s length must at least equal the number of policy strings in the configuration object. This ensures that the password is long enough to contain at least one character from each of the policy strings.

It is strongly recommended that passwords be as long as practicable while using as many policies and characters in those policies as possible.

Example

This is pseudocode for the password generation algorithm.

def default_password(list_of_policies, password_length):

  policy_1 = "ABCDEFGHJKLMNPQRSTUVWXYZ"  #string to pass through policyArray[]
  policy_2 = "abcdefghjkmnpqrstuvwxyz"   #string to pass through policyArray[]
  policy_3 = "23456789"                  #string to pass through policyArray[]
  policy_4 = "+.,!%$"                    #string to pass through policyArray[]
  pass_length = 12        #integer to come from password_length argument
  //create a pool (string) of all possible characters
  all_chars = Policy_1 + Policy_2 + Policy_3 + Policy_4
  //randomize the position of the chars to reduce any selection biases
  all_chars = random(all_chars)

  for pass_char in range(pass_length):    #Loop over length of password
    //Get random no. from SA and convert to value <= length of All_chars
    rand_num = API call (len(All_chars))
    rand_char = All_chars[rand_num]  #Select random character from All_chars
    password += rand_char                 #Add random char to password

    //check which policy has been met by random character
    for policy in range(list_of_policies):
      if rand_char in policy:
        // Update a list of Bools to indicate which policies have been met
        if not policies_met_list[index]:
          policies_met_list[index] = True
          //keep a tally of the number of policies that have been met
          policies_met += 1
          index += 1

  if (pass_length – pass_char -1) <= (len(list_of_policies) – policies_met) and 
    policies_met != len(list_of_policies):
    all_chars = "" //reset the all characters variable
    //set a flag to, if a reduced set of characters, randomize the final password
    randomize_flag = true
    for remain in range(number_of_policies):
        if not policy_met_list[index]:
            all_chars += policy_remain #rebuild list of chars to choose from
        index += 1

  if randomize_flag:
    random(password)