topic Re: Default Master Key lifetime in General Topics

Default Master Key lifetime

Rboehme — Wed, 12 Dec 2018 11:40:52 GMT

Dear Comm,

I do understand that we use the master key for encrypting our private keys and passwords stored on the firewall. However I am wondering why we should touch this key at anytime? What is the default lifetime of the default master key? I assume it to be 0 (=infinite) as I cant find anything about this question even in the PANOS admin guide. Please clarify:

- What is the default lifetime of the native/default master key?

- Why should we change it (periodically? How often?)

Thanks and kind regards,

Rene

Re: Default Master Key lifetime

BPry — Wed, 12 Dec 2018 18:23:33 GMT

@Rboehme,

The default master key is infinite and will never expire. You would want to modify this prior to deploying the firewalls as best practice as by default everyone has the same master key from factory. Essentially if you never change this key it would be easier for someone to get your password by reverse engineering your hash values.

You can obviously modify the master key post deploy if you want, you just have to take more care to do it properly and insure the consequences of modifying the master key won't kill off any of your existing processes.

Re: Default Master Key lifetime

Rboehme — Wed, 19 Dec 2018 14:00:59 GMT

@BPry Thanks a lot sir. that helped me out.