Cisco Catalyst 2960 Series, Configuration Manual

Page: 1136 / 2288

Restrictions for Password Strength and Management for Common Criteria
Only four concurrent users can log on to the system by using vty at any moment.
Information About Password Strength and Management for Common Criteria
Password Composition Policy
The password composition policy allows you to create passwords of any combination of upper and lowercase
characters, numbers, and special characters that include
“ ! ” , “ @ ” , “ # ” , “ $ ” , “ % ” , “ ^ ” , “ & ” , “ * ” , “ ( “ , and “ ) ” .
Password Length Policy
The administrator has the flexibility to set the password's minimum and maximum length. The recommended
minimum password length is 8 characters. The administrator can specify both the minimum (1) and the
maximum (64) length for the password.
Password Lifetime Policy
The security administrator can provide a configurable option for a password to have a maximum lifetime. If
the lifetime parameter is not configured, the configured password will never expire. The maximum lifetime
can be configured by providing the configurable value in years, months, days, hours, minutes, and seconds.
The lifetime configuration will survive across reloads as it is a part of the configuration, but every time the
system reboots, the password creation time will be updated to the new time. For example, if a password is
configured with a lifetime of one month and on the 29th day, the system reboots, then the password will be
valid for one month after the system reboots.
Password Expiry Policy
If the user attempts to log on and if the user's password credentials have expired, then the following happens:
1 The user is prompted to set the new password after successfully entering the expired password.
2 When the user enters the new password, the password is validated against the password security policy.
3 If the new password matches the password security policy, then the AAA database is updated, and the
user is authenticated with the new password.
4
If the new password does not match the password security policy, then the user is prompted again for the
password. From AAA perspective, there is no restriction on the number of retries. The number of retries
for password prompt in case of unsuccessful authentication is controlled by the respective terminal access
interactive module. For example, for telnet, after three unsuccessful attempts, the session will be terminated.
If the password's lifetime is not configured for a user and the user has already logged on and if the security
administrator configures the lifetime for that user, then the lifetime will be set in the database. When the same
user is authenticated the next time, the system will check for password expiry. The password expiry is checked
only during the authentication phase.
Consolidated Platform Configuration Guide, Cisco IOS Release 15.2(4)E (Catalyst 2960-X Switches)
1054
Restrictions for Password Strength and Management for Common Criteria