0

I have a cisco 2520 version 15.2 out of box today.

I was trying to setup a password policy and no idea how but I managed to lock myself out, did not know about the "reload in X" command until now.

I need to create a password policy that will disable inactive user accounts with in 90 days of not logging in. What would be the cli commands for that?

I have looked up the correct command and aaa something I did there locked me out.

1 Answer 1

2

aaa common-criteria policy but as I understand it, it has to be applied to local users explicitly. So if you have a normal username defined, you should still be able to login. (as long as the config wasn't saved, a reload / power-cycle should get you back up.)

As of writing this answer, full password aging isn't supported. The lifetime policy is only in reference to when the password was entered. Reloading the system effectively re-enters all users, as it loads the startup-config. (yes, a reboot will un-expire passwords.)

The local user database really isn't intended for this sort of thing. TACACS+/RADIUS has always been the way to properly police user accounts. Systems can be configured to have no local accounts; 'tho without network access, no one can login. (we've all be there by accident) Usually systems will be configured to fallback to local users only if the network is down. (where one's security policy can allow such static accounts.)

[See also: Authentication, Authorization, and Accounting Configuration Guide, Cisco IOS Release 15SY]

c5921-base-1#show aaa common-criteria policy all 
=======================================================
Policy name: aaa-policy-1
Minimum length: 6
Maximum length: 64
Upper Count: 0
Lower Count: 0
Numeric Count: 0
Special Count: 0
Number of character changes 4
Valid for 15 minutes
=======================================================

[12:04 PM]:telnet 192.168.1.230
...
login: user1
Password: [15min old 1st password]

New Password: [new 2nd password]

c5921-base-1#exit

[12:27 PM]:telnet 192.168.1.230
...
login: user1
Password: [new 2nd password]

New Password: 
telnet> q
Connection closed.

(reload, yes the address changed)

[12:28 PM]:telnet 192.168.1.236
...
login: user1
Password: [no longer expired 2nd password]

c5921-base-1#exit
Connection closed by foreign host.

To say this stuff is half-baked would suggest it's been baked at all. Password aging is done in RAM -- invisibly too, and lost on a reload. The password changing mechanism doesn't ask for confirmation, and does not commit the changed config. Cisco freely admits this crap requres type 7 passwords. (how many decades have they been saying that's "not supported" and will be removed?)

3
  • Thank you for the reply, however I do not see the command to set the policy that will disable inactive user accounts with in 90 days of not logging in Aug 16, 2021 at 22:39
  • Doesn't currently support that. You can set the lifetime of the password. But even that is a bit of kludge. IOS doesn't keep track of when a password is set, or the last time a user logged in. (where would it store it? NVRAM is a finite resource, flash does have a rewrite lifetime.) If you read the fine print, "lifetime" is from boot, or entry of the password.
    – Ricky
    Aug 17, 2021 at 0:52
  • Sorry to take so long to flesh this out. Power went out and I went down a rabbit hole chasing a different issue. (15.1.4M12a has gremlins too.)
    – Ricky
    Aug 17, 2021 at 16:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.