> For the complete documentation index, see [llms.txt](https://doc.engenius.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://doc.engenius.ai/bmc-user-guide/security/security-policies.md). # Security Policies A key principle of security is to minimize the "attack surface" by disabling any services that you don't need. The BMC allows you to control which management protocols are active and to enforce system-wide rules for session timeouts and password strength. This chapter shows you how to configure these global security policies to harden your BMC. ## **Enabling or disabling services** The **Policies** page gives you granular control to enable or disable individual services. 1. In the sidebar menu, navigate to **Security and access** > **Policies**. 2. In the **Services** section, you will see a list of toggles for various protocols.
You can control key services such as: * **Network IPMI**: Allows remote management via `ipmitool`. This is a powerful but potentially insecure protocol if not managed correctly. * **KVM**: Enables the graphical remote console. * **Virtual Media**: Allows mounting of remote images. * **SOL SSH**: Enables text-based console access over SSH. * **SNMP**: Allows the server to be monitored by network management systems. You can enable different versions (v1, v2c, v3) individually. {% hint style="success" %} **Best Practice: Disable unused services** Every enabled service is a potential entry point for an attacker. As a standard security practice, you should disable any protocol you are not actively using. For example, if you only use the web interface and KVM, you should consider disabling IPMI, SNMP, and SOL SSH. {% endhint %} ## **Setting session timeouts and password policies** The **Configurations** section on the same page lets you enforce global rules for all users. * **Web Session Timeout**: Sets the inactivity period (in seconds) before a user is automatically logged out of the web interface. A shorter timeout enhances security. * **KVM Session Timeout**: Sets a separate timeout for KVM sessions. * **Password Complexity**: Enforces minimum password requirements for all local users. You can choose from levels like `Low`, `Medium`, or `High`. This is a critical policy for preventing weak passwords. * **Password History**: Prevents users from reusing old passwords. You can set it to remember the last 1 to 15 passwords. After making your changes, click the **Save** button next to the setting you modified. ## Field Reference ### **Services**
ServiceDescription
Network IPMIEnables out-of-band platform management via IPMI tools (e.g., ipmitool).
KVMEnables the graphical remote console. You can also set the KVM Port Value.
Web PortSets the port number for the web interface (default is 443 for HTTPS).
Virtual MediaEnables the ability to mount remote images for OS installation or diagnostics.
SOL SSHEnables text-based Serial-over-LAN console access over SSH. You can also set the SOL SSH Port Value.
SSDPEnables the Simple Service Discovery Protocol for network discovery.
SNMPEnables the Simple Network Management Protocol for monitoring. You can enable SNMPv1, SNMPv2c, and SNMPv3 individually and set the SNMP Port value.
OpenSSL FIPS ModeEnables FIPS (Federal Information Processing Standards) compliance mode for cryptographic modules.
### **Configurations**
ConfigurationDescription
Web Session TimeoutSets the inactivity period in seconds (between 30 and 86400) before a user is automatically logged out of the web interface.
KVM Session TimeoutSets a separate inactivity timeout in seconds (between 30 and 86400) for KVM sessions.
SOL Non-Volatile Bit RateSelects the bit rate for the Serial-over-LAN communication.
ComplexityEnforces minimum password strength requirements for all local users. You can choose from Disabled, Low, Medium, or High.
Password HistoryPrevents users from reusing old passwords. You can set it to remember the last 0 to 5 passwords.
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://doc.engenius.ai/bmc-user-guide/security/security-policies.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.