Blocking users automatically at the DMZ level 🚀

The DMZ can be configured to reject authentication attempts from invalid users, without needing to request verification from the STENG.

To prevent unauthorized access to the DMZ, a blacklist must be created and added to an internal DMZ directory:

• wlp/usr/server/dmzgw/dmz/conf/blacklist.users.txt

A whitelist can also be created and added to the same directory:

• wlp/usr/server/dmzgw/dmz/conf/whitelist.users.txt

The file blacklist.users.txt contains the usernames or patterns of usernames to be blocked.

The file whitelist.users.txt contains usernames or patterns of usernames that are permitted to access the DMZ by bypassing the blacklist, as long as their credentials are correct. The whitelist does not grant access without credentials; it only creates exceptions to the blacklist. For example, if the blacklist includes the pattern prim*, no users whose usernames start with "prim" will be able to authenticate. However, if it's necessary to allow the user primeur-prod to authenticate, this username can be added to the whitelist. This creates an exception to the blacklist, enabling only the user primeur-prod to log in.

If a user is on both the blacklist and whitelist, they are allowed to access the system. If a blacklisted user attempts to log in, they will receive a bad credentials error.

In the .txt files:

• Usernames are case-insensitive.

• The * special character is allowed for any character, string or space.

• Any spaces at the beginning or end of the line are removed.

• Blank lines are removed.

Each line of the .txt file should contain either individual usernames or patterns that include multiple users. For example, you can use prim* to represent all usernames that begin with prim.

If two or more usernames are listed on the same line of the blacklist, none of them will be blocked. For instance, if you list JANEDOE JOHNSMITH on the same line, the system will not block user JANEDOE or user JOHNSMITH from logging in. To correctly block both users, enter each username on a separate line, in this way:

JANEDOE JOHNSMITH

No reboot is required after updating the .txt files, but reading the blacklist and whitelist is not immediate. The system will read them after 60 seconds.

If there are multiple DMZs, a file must be added to each DMZ gateway.