Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this community
I have a cisco 2520 version 15.2 out of box today.
I was trying to setup a password policy and no idea how but I managed to lock myself out, did not know about the "reload in X" command until now.
I need to create a password policy that will disable inactive user accounts with in 90 days of not logging in. What would be the cli commands for that?
I have looked up the correct command and aaa something I did there locked me out.
aaa common-criteria policy but as I understand it, it has to be applied to local users explicitly. So if you have a normal username defined, you should still be able to login. (as long as the config wasn't saved, a reload / power-cycle should get you back up.)
As of writing this answer, full password aging isn't supported. The lifetime policy is only in reference to when the password was entered. Reloading the system effectively re-enters all users, as it loads the startup-config. (yes, a reboot will un-expire passwords.)
The local user database really isn't intended for this sort of thing. TACACS+/RADIUS has always been the way to properly police user accounts. Systems can be configured to have no local accounts; 'tho without network access, no one can login. (we've all be there by accident) Usually systems will be configured to fallback to local users only if the network is down. (where one's security policy can allow such static accounts.)
[See also: Authentication, Authorization, and Accounting Configuration Guide, Cisco IOS Release 15SY]
c5921-base-1#show aaa common-criteria policy all
=======================================================
Policy name: aaa-policy-1
Minimum length: 6
Maximum length: 64
Upper Count: 0
Lower Count: 0
Numeric Count: 0
Special Count: 0
Number of character changes 4
Valid for 15 minutes
=======================================================
[12:04 PM]:telnet 192.168.1.230
...
login: user1
Password: [15min old 1st password]
New Password: [new 2nd password]
c5921-base-1#exit
[12:27 PM]:telnet 192.168.1.230
...
login: user1
Password: [new 2nd password]
New Password:
telnet> q
Connection closed.
(reload, yes the address changed)
[12:28 PM]:telnet 192.168.1.236
...
login: user1
Password: [no longer expired 2nd password]
c5921-base-1#exit
Connection closed by foreign host.
To say this stuff is half-baked would suggest it's been baked at all. Password aging is done in RAM -- invisibly too, and lost on a reload. The password changing mechanism doesn't ask for confirmation, and does not commit the changed config. Cisco freely admits this crap requres type 7 passwords. (how many decades have they been saying that's "not supported" and will be removed?)
