111
Step Command
Remarks
4.
Configure the password
composition policy for super
passwords.
password-control super
composition type-number
type-number
[
type-length
type-length
]
•
In non-FIPS mode, a default
super password must contain at
least one character type and at
least one character for each
type.
•
In FIPS mode, a default super
password must contain four
character types and at least
one character for each type.
Displaying and maintaining password control
Execute
display
commands in any view and
reset
commands in user view.
Task Command
Display password control configuration.
display password-control
[
super
]
Display information about users in the
password control blacklist.
display password-control blacklist
[
user-name
name
|
ip
ipv4-address
|
ipv6
ipv6-address
]
Delete users from the password control
blacklist.
reset password-control blacklist
[
user-name
name
]
Clear history password records.
reset password-control history-record
[
user-name
name
|
super
[
role
role name
] ]
NOTE:
The
reset password-control history-record
command can delete the history password records of one or
all users even when the password history function is disabled.
Password control configuration example
Unless otherwise noted, devices in the configuration example are operating in non-FIPS mode.
Network requirements
Configure a global password control policy to meet the following requirements:
•
An FTP or VTY user failing to provide the correct password in two successive login attempts is
permanently prohibited from logging in.
•
A user can log in 5 times within 60 days after the password expires.
•
A password must contain at least 16 characters.
•
A password expires after 30 days.
•
The minimum password update interval is 36 hours.
•
The maximum account idle time is 30 days.
•
A password cannot contain the username or the reverse of the username.