aaa common-criteria policy
but as I understand it, it has to be applied to local users explicitly. So if you have a normal username
defined, you should still be able to login. (as long as the config wasn't saved, a reload / power-cycle should get you back up.)
As of writing this answer, full password aging isn't supported. The lifetime
policy is only in reference to when the password was entered. Reloading the system effectively re-enters all users, as it loads the startup-config. (yes, a reboot will un-expire passwords.)
The local user database really isn't intended for this sort of thing. TACACS+/RADIUS has always been the way to properly police user accounts. Systems can be configured to have no local accounts; 'tho without network access, no one can login. (we've all be there by accident) Usually systems will be configured to fallback to local users only if the network is down. (where one's security policy can allow such static accounts.)
[See also: Authentication, Authorization, and Accounting Configuration Guide, Cisco IOS Release 15SY]
c5921-base-1#show aaa common-criteria policy all
=======================================================
Policy name: aaa-policy-1
Minimum length: 6
Maximum length: 64
Upper Count: 0
Lower Count: 0
Numeric Count: 0
Special Count: 0
Number of character changes 4
Valid for 15 minutes
=======================================================
[12:04 PM]:telnet 192.168.1.230
...
login: user1
Password: [15min old 1st password]
New Password: [new 2nd password]
c5921-base-1#exit
[12:27 PM]:telnet 192.168.1.230
...
login: user1
Password: [new 2nd password]
New Password:
telnet> q
Connection closed.
(reload, yes the address changed)
[12:28 PM]:telnet 192.168.1.236
...
login: user1
Password: [no longer expired 2nd password]
c5921-base-1#exit
Connection closed by foreign host.
To say this stuff is half-baked would suggest it's been baked at all. Password aging is done in RAM -- invisibly too, and lost on a reload. The password changing mechanism doesn't ask for confirmation, and does not commit the changed config. Cisco freely admits this crap requres type 7 passwords. (how many decades have they been saying that's "not supported" and will be removed?)