---
title: Policy Key Definition
slug: kronpam-reference-guide-3-6-0/policy-key-definition
description: Learn how to define White Key and Black Key policies using the Kron PAM Web GUI in this document. Discover how regex classes are used to create these policies, allowing or denying users from using specific commands. The document also demonstrates how to g
docTags: 
createdAt: 2022-07-27T10:40:19.000Z
---

Policies might be White Key and/or Black Key. White Key permits users to use the white key commands, and Black Key restricts users to using black key commands. 

**Policies are created based on Regex Classes:**

Policies might be White Key and/or Black Key. White Key permits users to use the white key commands, and Black Key restricts users to using black key commands. 


**Policies are created based on Regex Classes:**

-
  “.\*” means all commands.
-
  If “.\*” is used after a command, it means all commands starting with that command.

The table below shows the Policy Key types that can be defined from the Kron PAM Web GUI. 

| **Policy Key Types**     | **Definition**                                                   |
| ------------------------ | ---------------------------------------------------------------- |
| **Black Key**            | Restricted commands.                                             |
| **RADIUS Attribute**     | Allowed RADIUS attributes. Ex: cisco-avpair := shell\:priv-lvl=1 |
| **TACACS Attribute**     | Allowed TACACS attributes. Ex: priv-lvl=15                       |
| **User Behavior Rating** | Commands to be detected as suspicious behavior to block.         |
| **White Key**            |  Allowed commands.                                               |
| **XML File**             | XML file that contains context-aware policies.                   |

To define a policy with White and/or Black keys:

1. Click on the **Policy ** > +**Add.**

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/yS7gHJBGEPIAxYEX8uagt_image.png)

1. To create a **White Key Policy**:
   - Select the **Type** as **White Key **and **Next** then fill in the mandatory fields. (Key, Element Type(s))
   - Click **Save**.
2. To create a **Black Key Policy**:
   - Select the **Type **as **Black Key **and **Next** then fill in the mandatory fields. (Key, Element Type(s))
   - Click **Save**.

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/yDtUZ5ixaU0Vc-a8YG47v_image.png" size="76" width="682" height="474" position="center" caption="Defining Policy Key" showCaption="true"}

The policy definition **Key **parameter contains the allowed or restricted commands in their regex form. The **CommandPatternGenerator** button next to the key definition can be used to create these regex statements.


Input the desired command into the **Commands** tab, denoting the **auto-completion point** with a “ **‘** ” (single quote) character. Click the button to create the regex statement. The “auto-completion point” is the point in a command string where hitting TAB completes the remainder of the command. For example, for **clear**, the auto-completion point is **cl**. This means hitting TAB after typing **cl** will complete the command to **clear** in the CLI screen.

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/o5JOS6fYwnaweku_pb7uy_image.png" size="78" width="676" height="458" position="center" caption="Command Pattern Generator" showCaption="true"}

The regex statement created for the above example can be seen in the figure below. Since the auto-completion point with a single quote character was between **l** and **e** (cl’ear), the regex statement is created as **(?i)cl(e|ea|ear)?**. Therefore, hitting TAB on the keyboard after typing **cl** will be enough to complete the **clear** command on the terminal.

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/vYTwLkza0ap6oZxudWUmn_image.png" size="72" width="730" height="502" position="center" caption="Command Pattern Generator" showCaption="true"}

All users have an ubaThreshold value on their user property, which can be viewed from the **User Accounts** page. The default value of ubaThreshold is 50. 
**User Behavior Rating** works as a grey key command. When a policy key is defined with the** User Behavior Rating** type, a **Rate **field appears for admin users to set the value. 

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/FTbcF0UU8_Q9OLqbocHRz_image.png "ubaThreshold Value on User Property")

Let’s define a date command as an example. 

As shown in the figure below, select the** Type** as **User Behavior Rating**, enter the **Rate** as 20
and then associate this date policy key with a device realm. After that, whenever a user, who is assigned this policy, executes the date command, the user will gain 20 points. If the same user executes this policy three times, the user gains 60 points and, as such, will exceed the 50 default value of the ubaTreshold property. At this point, the date command becomes a black key for this user, meaning that the user will no longer execute the date command.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/gVkZ_VjGqqJccYH6EP_uk_image.png "Defining User Behavior Rating")

By default, white key commands are prompted at the beginning of the SSH session. In case one needs to be transparent the following definition needs to be added at 

If you want to hide the list of white keys shown at the beginning of the session by default, the following definition should be made.

- **/pam/ssh/conf/nsso.properties **file:
- **sc.policy.list.whiteKeys**=**false **(default value is true) 

To prevent white and black policies from being listed on the screen during a session, set the **“disableDumpPolicyKey”** parameter to true for the relevant user group. When this parameter is enabled, users in that group will not see the policy lists on the screen during the session.

- Open **Users > User Group > Custom Properties > Add Parameter**
- Set **disableDumpPolicyKey **as** true.**

If **sc.policy.dump=false** is set in the nsso.properties file, the policy list display feature will be disabled for all users.

- /pam/gui/netright/netright.properties
- sc.policy.dump=false