Cisco ISR 4000 Family Routers Administrator Guidance
Page
16
of
66
When creating administrator accounts, all individual accounts are to be set to a privilege level of
one. This is done by using the following commands:
TOE-common-criteria(config)#
username <name> password <password>
to create a new username and password combination, and
TOE-common-criteria(config)#
username <name> privilege 1
to set the privilege level of <name> to 1.
3.2.5 Session Termination
Inactivity settings must trigger termination of the administrator session. These settings are
configurable by setting
TOE-common-criteria(config)#
line vty <first> <last>
TOE-common-criteria(config-line)#
exec-timeout <time>
TOE-common-criteria(config-line)#
line console
TOE-common-criteria(config)#
exec-timeout <time>
To save these configuration settings to the startup configuration:
copy run start
where first and last are the range of vty lines on the box (i.e. “0 4”), and time is the period of
inactivity after which the session should be terminated. Configuration of these settings is limited
to the privileged administrator (see Section 4.1).
The line console setting is not immediately activated for the current session. The current console
session must be exited. When the user logs back in, the inactivity timer will be activated for the
new session.
3.2.6 User Lockout
User accounts must be configured to lockout after a specified number of authentication failures
TOE-common-criteria(config)#
aaa local authentication attempts max-fail [
number of failures
]
where number of failures is the number of consecutive failures that will trigger locking of the
account. Configuration of these settings is limited to the privileged administrator (see Section 4.1).
Related commands:
clear aaa local user fail-attempts
[username
username
| all]
Clears the unsuccessful login
attempts of the user.
clear aaa local user lockout
username [username]
Unlocks the locked-out user.
show aaa local user lockout
Displays a list of all locked-out
users.
