Technical Tip: Explanation of password-change timers settings in FortiPAM

[idumancic]

Description	This article explains two timers for password settings in FortiPAM.
Scope	FortiPAM, FortiSRA v1.5.
Solution	In the FortiPAM system, there are two default timers for password change, visible through the full configuration settings in the CLI: config system global Here is the explanation: Password-change-drain Enter an integer value from <30> to <2000> (default = <50>) <----- Password-change-drain (default 50ms) option is to read from SSH server side, since the FortiPAM cannot determine if the server side sends all the response, FortiPAM has to use one timer to do that, i.e.. FortiPAM tries to read 50ms or 2000ms, if no data is coming in, the system could assume the server side has finished sending. Any data from the server will reset this timer. Password-change-network-delay Enter an integer value from <30> to <120> (default = <60>)<-----  Password-change-network-delay (default 60ms) stands for, FortiPAM sends out one command line to the SSH server, how long will FortiPAM expect it to response, For example, if a user makes authentication and first expects the prompt, such kind procedure needs network delay to control the waiting time.