These pages allows administrators to set the default policies - regarding HTTP, FTP, SSH, and Mobile interfaces - for all new users on the in the organization. Changes to the policies on these pages will be given the option of also being applied to all existing users in the organization. Policies set here can be changed per user in the User Profile (User Authentication section).
Note: For all of these interfaces, if you plan on using different interface policies for different groups of users, you may want to explore the various create users as a clone of... options available in MOVEit DMZ. For example, you may want all your users except those using External Authentication (EA) to present a certificate during the authentication process. To accomplish this, set the organization's default interface values to require client certs and set the EA source to clone a template user that does not require client cert authentication during new EA user creation.
HTTP
This page allows administrators to set the default HTTP interface policy for all new users in the organization. Changes to the policy on this page will be given the option of also being applied to all existing users in the organization. The policy options available are:
Allow HTTPS Access via Web Interface by Default: Determines whether users will be allowed to access the system via web browsers.
Allow HTTPS Access via HTTP Clients by Default: Determines whether users will be allowed to access the system via other HTTP clients, such as MOVEit Central, MOVEit DMZ API and the MOVEit Wizard.
SSL Client Cert Required by Default: Determines whether users signing on to the HTTPS interface will be required to present a valid SSL client certificate in order to authenticate to the system.
Password Also Required with SSL Client Cert by Default: Determines whether users who sign on to the HTTPS interface with a valid SSL client certificate will also be required to submit a valid password in order to authenticate to the system.
Match Cert CN to Username/Full Name: When enabled, SSL client certificate that have a CN value that matches the username or full name of the incoming user AND is signed by a Certificate Authority trusted by the system will be considered valid and acceptable for authentication purposes.
Allow Username from Client Certificate: When enabled, users will be given the option on the signon page to have MOVEit DMZ automatically determine their username from their client certificate and attempt to sign them on. DMZ will first search its internal certificate store for a matching certificate, then if possible it will search properly configured LDAP external authentication sources. If a matching certificate is found, the associated username is assumed and a signon is attempted. If a matching certificate is not found, or the user requires a password in addition to the client certificate, they will be returned to the signon page with a message indicating the need for further credentials.
If a matching client certificate is found, and the user is successfully signed on with the associated username, a long-term cookie will be set which will allow DMZ to automatically forward them to the username autodetection routines in the future. Thus, the user will always log directly on to the system whenever they bring up the web site, as long as their client certificate is provided and is still valid.
FTP
This page allows administrators to set the default FTP interface policy for all new users in the organization. Changes to the policy on this page will be given the option of also being applied to all existing users in the organization. The policy options available are:
Allow FTP/SSL Access by Default: Determines whether users will be allowed to access the system via secure FTP over SSL.
Allow Insecure FTP Access by Default: Determines whether users will be allowed to access the system via insecure plain-text FTP. Requires Non-Secure FTP to be enabled and allowed for the IP addresses for each user. See the FTP Configuration doc page for more information.
SSL Client Cert Required by Default: Determines whether users signing on to the FTP over SSL interface will be required to present a valid SSL client certificate in order to authenticate to the system.
Password Also Required with SSL Client Cert by Default: Determines whether users who sign on to the FTP over SSL interface with a valid SSL client certificate will also be required to submit a valid password in order to authenticate to the system.
Match Cert CN to Username/Full Name: When enabled, SSL client certificate that have a CN value that matches the username or full name of the incoming user AND is signed by a Certificate Authority trusted by the system will be considered valid and acceptable for authentication purposes.
Holding Tank retention: Determines how long SSL client certificates and SSH client keys entered into the cert/key holding tank will be allowed to remain there. Certs or keys older than this number of days will be removed from the holding tank.
This page allows administrators to set the default SSH interface policy for all new users in the organization. Changes to the policy on this page will be given the option of also being applied to all existing users in the organization. The policy options available are:
Allow SSH Access by Default: Determines whether users will be allowed to access the system via SSH.
SSH Key Required by Default: Determines whether users signing on to the SSH interface will be required to present a valid SSH client key in order to authenticate to the system.
Password also required with valid SSH Key by Default: Determines whether users who sign on to the SSH interface with a valid SSH client key will also be required to submit a valid password in order to authenticate to the system.
Holding Tank retention: Determines how long SSL client certificates and SSH client keys entered into the cert/key holding tank will be allowed to remain there. Certs or keys older than this number of days will be removed from the holding tank.
Management of user holding tank keys is also performed here. For more information on the SSH client key holding tank, see the SSH Keys Holding Tank document page.
Mobile
This page allows administrators to set the default Mobile interface policy for all new users in the organization. Changes to the policy on this page will be given the option of also being applied to all existing users in the organization. Policies set here can be changed per user in the User Profile (User Authentication section).sys
The policy options available are:
Allow access to the Mobile interface by default: Determines whether users will be allowed to sign on to MOVEit by using the Mobile app or web.
Note: Ipswitch suggests that for security reasons you do not allow mobile access to admins, fileadmins or users that are utilized for bulk data transfers such as nightly FTPS/SFTP transfers.
Allow caching of credentials on mobile devices: This determines whether mobile app users will be allowed to cache credentials on the device for quick sign-on using a PIN.
Required PIN length: This specifies the minimum digits required for the PIN. Choose 4, 5, or 6 digits.
Note: The app always requires that users do not repeat or simply increment numbers when creating the PIN. For example, the app will not allow 1111 or 12345 as a PIN.
