It seems like your browser didn't download the required fonts. Please revise your security settings and try again.
Barracuda Campus Barracuda Campus
Barracuda Web Application Firewall
Overview Documentation Training Certification Materials

Admin Password Masking for the Barracuda Web Application Firewall Instances Deployed in Amazon Web Services (AWS)

  • Last updated on

By default, you can log into the Barracuda Web Application Firewall instance on Amazon Web Services using the following credentials:

     Username: admin

     Password: AWS instance-ID

If you want to enable Role-Based Administration (RBA) for the Barracuda Web Application Firewall using a remote LDAP authentication service, you can use the backup-based BYOL CloudFormation template. The backup-based CFT includes the “maskAdminPassword” parameter that masks the admin password, and enables the admin user to log into the Barracuda Web Application Firewall using the LDAP password. If “maskAdminPassword” is enabled in the CFT and the Barracuda Web Application Firewall is bootstrapped, the local administrator cannot access the Barracuda Web Application Firewall with the default credentials (i.e., Username: admin, Password: AWS instance ID). 

If the backup file does not include the LDAP configuration and maskAdminPassword is enabled in the CFT, the Barracuda Web Application Firewall becomes inaccessible. This is an irreversible activity. Therefore, ensure the backup file includes the LDAP server details configured in External Authentication Services in the ADVANCED > Admin Access Control page before enabling “maskAdminPassword” in the CFT.


You can mask the admin password and allow LDAP users to access the Barracuda Web Application Firewall web interface with their LDAP credentials (LDAP username and password). The Barracuda Web Application Firewall allows you to associate a LDAP group to a single role or multiple roles. Users belonging to the specified LDAP group name(s) gain privileges of the associated role to access the Barracuda Web Application Firewall web interface. For example, if an LDAP group is associated with the Audit-Manager role, the users of that group are allowed to view logs on the system and are prevented from accessing any other objects.

Currently, admin password masking can be achieved only when bootstrapping is performed using a backup stored in Amazon S3 bucket.  See "Backup Bootstrapping" in the Bring-Your-Own-License (BYOL) Auto Scaling article.