1

A coworker and I recently migrated a core from old Dell switches to two HP 5700 running Comware 7 and IRF. What we have noticed is that every 5 days, the user accounts no longer accept the passwords. Even if no unsuccessful attempts were made whatsoever, all of the accounts lock every 5 days. We only have HTTPS and SSH protocols enabled for remote access over the VTY lines. What we find is that, when we enter the wrong password, it asks us to re-enter the correct one. However, once we do, it simply terminates the connection.

The only way that I have found to fix it is by getting physical, console access, deleting the accounts, and re-creating them. Is there a way to fix this?

Unfortunately, this is a sensitive client, so I will not be able to post the entire configuration, but I can post certain parts upon request:

VTY Line configuration:

line vty 0 4
  authentication-mode scheme
  user-role network-admin
  user-role network-operator
  set authentication password hash $h$6$[password omitted]
  protocol inbound ssh

Local User Admin:

local-user admin class manage
  access-limit 100
  service-type ssh terminal https
  authorization-attribute user-role network-admin
  authorization-attribute user-role network-operator
  password-control aging 90
  password-control login-attempt 10 exceed lock-time 1

Local User User1:

Local-user user1 class manage
  access-limit 3
  service-type ssh terminal https
  authorization-attribute user-role network-admin
  authorization-attribute user-role network-operator

Local User User2:

local-user user2 class manage
  service-type ssh https
  authorization-attribute user-role network-admin
  authorization-attribute user-role network-operator

Thank you.

  • display password-control and display password-control blacklist may shed some light on it. Based on what you've provided, they shouldn't expire for 90 days. And the default setup does allow expired users to still login -- the change the password. (consult the HP FlexFabric 5700 Security Configuration Guide, there may be other AAA configuration in there.) – Ricky Beam Apr 1 '15 at 19:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.