How to set 2FA to local superuser

Purushotham — Thu, 22 Dec 2022 10:03:03 GMT

Prerequisites

Currently, user has two admin accounts.

Default local admin account(Superuser)
New local admin account synchronized with Cisco Duo(Superuser)

End user has to consider how to treat “Default local admin account”.

As a result of consideration, the following items are the options to deal with it:

Option1: To make “Default local admin account” synchronized with some authenticator like Duo or enhance the login security of this account in some way.

Option2: To delete “Default local admin account”

■Verification (Done)

Option1:Paloalto claims that a local superuser account is not assigned to any form of external authentication service other than just password authentication on the firewall.

This is to ensure that users can still access the firewall, in the event where the network or the authentication server goes down, and this will be the only local account to access the firewall.

⇒It means that it is impossible to make “Default local admin account” synchronized with multi-factor authenticator.

Option2:He tried to delete “Default local admin account” but it could not be carried out with the message “At least, one local Superuser needs to be defined in Administrators”.

■What is the checking point in this issue to Paloalto？

Regarding Option 1, Please confirm more to Paloalto if there are other ways to enhance authentication and security for this option 1.

Re: How to set 2FA to local superuser

OtakarKlier — Thu, 22 Dec 2022 19:23:06 GMT

Hello,

Correct, the builtin or local accounts to the firewall are all stored on the firewall and do not use external means for authentication. Best option is to use the 'Minimum Password Complexity' and set the settings fairly high and tight. Here are the settings for the STIG, but the password lengths should be over 30 and randomly generated along with rotated.

If you utilize the password change, make sure you do it prior to it needing to be changed or you could get locked out of it! Also if you use API passwords, these will also change when the passwords are changes/rotated.

Regards,

topic Re: How to set 2FA to local superuser in General Topics

How to set 2FA to local superuser

Re: How to set 2FA to local superuser