IBM WebSphere XS40, Справочник по командам

Страница: 46 / 1066

Parameters
lockout-duration minutes
Specifies the number of minutes to lock out an account after exceeding the
maximum number of failed login attempts. A value of 0 indicates that
accounts are locked out until reset by a privileged administrator. Use an
integer in the range of 0 through 1000. The default is 1.
max-login-failure count
Specifies the maximum number of failed login attempts to allow before
lockout. A value of 0 disables account lockout. Use an integer in the range
of 0 through 64. The default is 3.
Context
Available only when the appliance is in Common Criteria mode.
Guidelines
The account command defines whether to lock out a local user account after a
specific number of failed login attempts and, if lockout is enabled, the duration to
lock out the local account. To enable lockout behavior and define the duration to
lock out the account requires two invocations of the
account command.
v An invocation with the max-login failure parameter defines the number of
failed login attempts to permit before a successful login. If the value is 3 and the
user has failed three consecutive login attempts, the behavior on the next login
attempt for this user is as follows:
– If failure, the account is locked out. The duration of the lockout depends on
the value defined by the lockout-duration parameter.
– If successful, the account is not locked out and the count is reset.
If the value is 0, lockout behavior is disabled. Repeated successive login failures
by a user do not cause lockout of that account.
v
An invocation with the lockout-duration parameter defines the duration to lock
out an account after exceeding the permitted number of failed login attempts
defined by the invocation with the
max-login failure command. Instead of
locking out an account for a specific duration, the account can be locked out
until re-enabled by a privileged administrator. To lock out accounts until reset,
set the duration to 0.
When lockout behavior is enabled and an account is locked out, a privileged
administrator can use the Global
reset username command to re-enable the
account. To re-enabled the account
1. The administrator will change the password on the account with the reset
username command.
2. The user will be prompted to again change the password on initial login.
Note: The account command applies to all accounts including the
admin
account.
The only difference is that the
admin
account cannot be locked out until
reset. When the duration is 0, the
admin
account is locked out for 120
minutes or until re-enabled by another administrator.
Related Commands
reset username
20
Command Reference