|
|
|
Use these commands to configure a policy for managing user passwords.
Syntax
set password-controls complexity <1-4> min-password-length <6-128> palindrome-check {on |off} |
show password-controls complexity min-password-length palindrome-check |
show password-controls all |
Important - After you add, configure, or delete features, run the save config command to save the settings permanently.
Parameters
Parameter |
Description |
|
The required number of character types:
Character types are:
Changes to this setting do not affect existing passwords.
|
|
The minimum number of characters in a Gaia user, or an SNMP user password. Does not apply to passwords that were already configured.
|
|
A palindrome is a sequence of letters, numbers, or characters that can be read the same in each direction.
|
Syntax
set password-controls history-checking {on | off} history-length <1-1000> |
show password-controls history-checking history-length |
show password-controls all |
Important - After you add, configure, or delete features, run the save config command to save the settings permanently.
Parameters
Parameter |
Description |
|
Check for reuse of passwords for all users. Enables or disables password history checking and password history recording. When a user's password is changed, the new password is checked against the recent passwords for the user. An identical password is not allowed. The number of passwords kept in the record is set by Does not apply to SNMP passwords.
|
|
The number of former passwords to keep and check against when a new password is configured for a user.
|
Syntax
set password-controls expiration-lockout-days <1-1827 | never> expiration-warning-days <1-366> force-change-when {no | password} password-expiration <1-1827 | never> |
show password-controls expiration-lockout-days expiration-warning-days force-change-when password-expiration |
show password-controls all |
Important - After you add, configure, or delete features, run the save config command to save the settings permanently.
Parameters
Parameter |
Description |
|
Lockout users after password expiration. After a user's password has expired, user has this number of days to log in and change it. If a user does not change the password within that number of days, the user will be unable to log in - the user will be locked out. The administrator can unlock a user that is locked out from the User Management > Users page.
|
|
How many days before the user's password expires to start generating warnings to the user that user must change the password. A user that does not log in, will not see this warning.
|
|
Forces a user to change password at first login, after the user's password was changed using the command
|
|
The number of days, for which a password is valid. After that time, the password expires. The count starts when the user changes the password. Users are required to change an expired password the next time they log in. Does not apply to SNMP users.
|
Syntax
set password-controls deny-on-nonuse allowed-days <30-1827> enable {on | off} |
show password-controls deny-on-nonuse |
show password-controls all |
Important - After you add, configure, or delete features, run the save config command to save the settings permanently.
Parameters
Parameter |
Description |
|
Configures the number of days of non-use before locking out the unused account. This only takes effect, if
|
|
Denies access to unused accounts. If there were no successful login attempts within a set time, the user is locked out and cannot log in.
|
Syntax
set password-controls deny-on-fail allow-after <60-604800> block-admin {on | off} enable {on | off} failures-allowed <2-1000> |
show password-controls deny-on-fail |
show password-controls all |
Important - After you add, configure, or delete features, run the save config command to save the settings permanently.
Parameters
Parameter |
Description |
|
Allow access again after a user was locked out (due to failed login attempts). The user is allowed access after the configured time, if there were no login attempts during that time.
Examples:
|
|
This only takes effect if If the configured limit of failed login attempts for the
|
|
If the configured limit is reached, the user is locked out (unable to log in) for a configured time. Warning - Enabling this leaves you open to a "denial of service" - if an attacker makes unsuccessful login attempts often enough, the affected user account will be locked out. Consider the advantages and disadvantages of this option, in light of your security policy, before enabling it.
|
|
This only takes effect if The number of failed login attempts that a user is allowed before being locked out. After making that many successive failed attempts, future attempts will fail. When one login attempt succeeds, counting of failed attempts stops, and the count is reset to zero,
|
