ESR service routers. ESR-Series. Functionality description. Version 1.12.0
433
•
•
•
•
•
•
•
14.3.1 Recommendations
It is recommended to always enable the default password change request for the admin user.
It is recommended to limit the lifetime of passwords and prohibit reusing at least the previous
password.
It is recommended to set the minimum password length requirement greater than 8 characters.
It is recommended to set requirements for the use of lowercase and uppercase letters, numbers and
special characters.
14.3.2 Configuration example
Objective:
Configure a password policy with a requirement to change the default password, a password validity
period of 1 month, and a ban on using the last 12 passwords.
Set the minimum password length to 16 characters, the maximum to 64 characters.
The password must contain at least 3 uppercase letters, at least 5 lowercase letters, at least 4 digits and
at least 2 special characters. The password must contain all 4 types of characters.
Solution:
Enable the default password reset request for admin user:
esr(config)# security passwords
default
-expered
Set the password lifetime to 30 days and prohibit the use of the previous 12 passwords:
esr(config)# security passwords lifetime
30
esr(config)# security passwords history
12
Set a limit to the password length:
esr(config)# security passwords min-length
16
esr(config)# security passwords max-length
64
Set a limit on the minimum number of characters of the respective types:
esr(config)# security passwords upper-
case
3
esr(config)# security passwords lower-
case
5
esr(config)# security passwords special-
case
2
esr(config)# security passwords numeric-count
4
esr(config)# security passwords symbol-types
4
14.4 AAA policy configuration
The algorithms for AAA policy are described in the
AAA configuration
section of this manual.
For detailed information on the commands for AAA policy, see
in the CLI Commands
Reference.
