Password control commands 1

display password-control 1

display password-control blacklist 2

password-control { aging | composition | history | length } enable· 3

password-control aging· 4

password-control alert-before-expire· 5

password-control complexity· 6

password-control composition· 7

password-control enable· 8

password-control expired-user-login· 9

password-control history· 10

password-control length· 10

password-control login idle-time· 11

password-control login-attempt 12

password-control super aging· 14

password-control super composition· 14

password-control super length· 15

password-control update-interval 16

reset password-control blacklist 17

reset password-control history-record· 17

 

display password-control

Use display password-control to display password control configuration.

Syntax

display password-control [ super ]

Views

Any view

Predefined user roles

network-admin

network-operator

mdc-admin

mdc-operator

Parameters

super: Displays the password control information for the super passwords. Without this keyword, the command displays the global password control configuration.

Examples

# Display the global password control configuration.

<Sysname> display password-control

 Global password control configurations:

 Password control:                     Disabled

 Password aging:                       Enabled (90 days)

 Password length:                      Enabled (10 characters)

 Password composition:                 Enabled (1 types,  1 characters per type)

 Password history:                     Enabled (max history records:4)

 Early notice on password expiration:  7 days

 Maximum login attempts:               3

 Action for exceeding login attempts:  Lock user for 1 minutes

 Minimum interval between two updates: 24 hours

 User account idle time:               90 days

 Logins with aged password:            3 times in 30 days

 Password complexity:                  Disabled (username checking)

                                       Disabled (repeated characters checking)

# Display the password control configuration for super passwords.

<Sysname> display password-control super

 Super password control configurations:

 Password aging:                       Enabled (90 days)

 Password length:                      Enabled (10 characters)

 Password composition:                 Enabled (1 types,  1 characters per type)

Table 1 Command output

Field	Description
Password control	Whether the password control feature is enabled.
Password aging	Whether password expiration is enabled and, if enabled, the expiration time.
Password length	Whether the minimum password length restriction function is enabled and, if enabled, the setting.
Password composition	Whether the password composition restriction function is enabled and, if enabled, the settings.
Password history	Whether the password history function is enabled and, if enabled, the setting.
Early notice on password expiration	Number of days during which the user is notified of the pending password expiration.
Maximum login attempts	Allowed maximum number of consecutive failed login attempts for FTP and VTY users.
Action for exceeding login attempts	Action to be taken after a user fails to log in after the specified number of attempts.
Minimum interval between two updates	Minimum password update interval.
Login with aged password	Number of times and maximum number of days a user can log in using an expired password.
Password complexity	Whether the following password complexity checking is enabled: ·       username checking—Checks whether a password contains the username or the reverse of the username. ·       repeated characters checking—Checks whether a password contains any character that is repeated consecutively three or more times.

 

display password-control blacklist

Use display password-control blacklist to display information about users added to the password control blacklist due to authentication failure.

Syntax

display password-control blacklist [ user-name name | ip ipv4-address | ipv6 ipv6-address ]

Views

Any view

Predefined user roles

network-admin

network-operator

mdc-admin

mdc-operator

Parameters

user-name name: Specifies a user by its name, a case-sensitive string of 1 to 55 characters.

ip ipv4-address: Specifies the IPv4 address of a user.

ipv6 ipv6-address: Specifies the IPv6 address of a user.

Usage guidelines

With no arguments provided, this command displays information about all users in the password control blacklist.

If an FTP or virtual terminal line (VTY) user fails authentication, the system adds the user to a password control blacklist. You can use this command to view information about these users in the blacklist.

Web users failing login authentication are not blacklisted. Users accessing the system through the console or AUX interface are not blacklisted either, because the system is unable to obtain the IP addresses of these users and these users are privileged and therefore relatively secure to the system.

Examples

# Display information about users in the password control blacklist.

<Sysname> display password-control blacklist

 

 Username: test

    IP: 192.168.44.1        Login failures: 1      Lock flag: unlock

 

 Blacklist items matched: 1.

Table 2 Command output

Field	Description
IP	IP address of the user.
Login failed times	Number of login failures.
Lock flag	Whether the user is prohibited from logging in: ·       unlock—Not prohibited. ·       lock—Prohibited temporarily or permanently, depending on the password-control login-attempt command.
Blacklist items matched	Number of user entries in the blacklist.

 

password-control { aging | composition | history | length } enable

Use password-control { aging | composition | history | length } enable to enable the password expiration, composition restriction, history, or minimum length restriction function.

Use undo password-control { aging | composition | history | length } enable to disable a specified function.

Syntax

password-control { aging | composition | history | length } enable

undo password-control { aging | composition | history | length } enable

Default

The password control functions (aging, composition, history, and length) are all enabled.

Views

System view

Predefined user roles

network-admin

mdc-admin

Parameters

aging: Enables the password expiration function.

composition: Enables the password composition restriction function.

history: Enables the password history function.

length: Enables the minimum password length restriction function.

Usage guidelines

To enable a specific password control function, first enable the global password control feature, and then enable the specified function.

The system stops recording history passwords after you execute the undo password-control history enable command, but the prior records still exist.

If the global password control feature is enabled but the minimum password length restriction function is disabled, a password must contain at least four characters and at least four characters must be different.

Examples

# Enable the password control feature globally.

<Sysname> system-view

[Sysname] password-control enable

# Enable the password composition restriction function.

[Sysname] password-control composition enable

# Enable the password expiration function.

[Sysname] password-control aging enable

# Enable the minimum password length restriction function.

[Sysname] password-control length enable

# Enable the password history function.

[Sysname] password-control history enable

Related commands

·           display password-control

·           password-control enable

password-control aging

Use password-control aging to set the password expiration time.

Use undo password-control aging to restore the default.

Syntax

password-control aging aging-time

undo password-control aging

Default

The global password expiration time is 90 days, the password expiration time of a user group equals the global setting, and the password expiration time of a local user equals that of the user group to which the local user belongs.

Views

System view, user group view, local user view

Predefined user roles

network-admin

mdc-admin

Parameters

aging-time: Specifies the password expiration time in days, in the range of 1 to 365.

Usage guidelines

The setting in system view has global significance and applies to all user groups, the setting in user group view applies to all local users in the user group, and the setting in local user view applies to only the local user.

A password expiration time setting with a smaller application scope has a higher priority. That is, the system prefers the setting for a local user. If there is no setting for the local user, the system uses the setting for the user group. If there is no setting for the user group, the system uses the global setting.

Examples

# Set the global password expiration time to 80 days.

<Sysname> system-view

[Sysname] password-control aging 80

# Set the password expiration time for user group test to 90 days.

[Sysname] user-group test

[Sysname-ugroup-test] password-control aging 90

[Sysname-ugroup-test] quit

# Set the password expiration time for device management user abc to 100 days.

[Sysname] local-user abc class manage

[Sysname-luser-manage-abc] password-control aging 100

Related commands

·           display password-control

·           password-control aging enable

password-control alert-before-expire

Use password-control alert-before-expire to set the number of days before a user's password expires during which the user is notified of the pending password expiration.

Use undo password-control alert-before-expire to restore the default.

Syntax

password-control alert-before-expire alert-time

undo password-control alert-before-expire

Default

The default is 7 days.

Views

System view

Predefined user roles

network-admin

mdc-admin

Parameters

alert-time: Specifies the number of days before a user password expires during which the user is notified of the pending password expiration. The value range is 1 to 30.

Usage guidelines

FTP users can only have their passwords changed by the administrator. Therefore, this command is effective only for non-FTP users.

Examples

# Configure the device to notify a user about pending password expiration 10 days before the user's password expires.

<Sysname> system-view

[Sysname] password-control alert-before-expire 10

Related commands

display password-control

password-control complexity

Use password-control complexity to configure the password complexity checking policy.

Use undo password-control complexity check to remove a password complexity checking item.

Syntax

password-control complexity { same-character | user-name } check

undo password-control complexity { same-character | user-name } check

Default

No user password complexity checking is performed, and a password can contain the username, the reverse of the username, or a character repeated three or more times consecutively.

Views

System view

Predefined user roles

network-admin

mdc-admin

Parameters

same-character: Refuses a password that contains any character repeated consecutively three or more times. For example, password aaabc is unqualified.

user-name: Refuses a password that contains the username or the reverse of the username. For example, if the username is abc, a password such as abc123 or 321df is unqualified.

Usage guidelines

You can enable both username checking and repeated character checking.

Unqualified passwords will be refused.

Examples

# Configure the password complexity checking policy, refusing any password that contains the username or the reverse of the username.

<Sysname> system-view

[Sysname] password-control complexity user-name check

Related commands

display password-control

password-control composition

Use password-control composition to configure the password composition policy.

Use undo password-control composition to restore the default.

Syntax

password-control composition type-number type-number [ type-length type-length ]

undo password-control composition

Default

Global password composition policy: A password is valid if it has one valid character and does not have any invalid characters.

Password composition policy of a user group: Same as the global policy.

Password composition policy of a local user: Same as the user group to which the local user belongs.

Views

System view, user group view, local user view

Predefined user roles

network-admin

mdc-admin

Parameters

type-number type-number: Specifies the minimum number of character types that a password must contain. The value range is 1 to 4.

type-length type-length: Specifies the minimum number of characters that each type must contain. The value range is 1 to 63.

Usage guidelines

The settings in system view have global significance and apply to all user groups. The settings in user group view apply to all local users in the user group, and the settings in local user view apply to only the local user.

A password composition policy with a smaller application scope has a higher priority. That is, the system prefers the settings for a local user. If there is no setting for the local user, the system uses the settings for the user group. If there is no setting for the user group, the system uses the global settings.

The product of the minimum number of character types and minimum number of characters for each type must be smaller than the maximum length of passwords.

Examples

# Specify that all passwords must each contain at least 3 types of characters and each type must contain at least 5 characters.

<Sysname> system-view

[Sysname] password-control composition type-number 3 type-length 5

# Specify that passwords in user group test must contain at least 3 types of characters and each type must contain at least 5 characters.

[Sysname] user-group test

[Sysname-ugroup-test] password-control composition type-number 3 type-length 5

[Sysname-ugroup-test] quit

# Specify that the password of device management user abc must contain at least 3 types of characters and each type must contain at least 5 characters.

[Sysname] local-user abc class manage

[Sysname-luser-manage-abc] password-control composition type-number 3 type-length 5

Related commands

·           display password-control

·           password-control composition enable

password-control enable

Use password-control enable to enable the password control feature globally.

Use undo password-control enable to disable the password control feature globally.

Syntax

password-control enable

undo password-control enable

Default

The password control feature is disabled globally.

Views

System view

Predefined user roles

network-admin

mdc-admin

Usage guidelines

The specific password control functions can take effect only after the global password control feature is enabled.

Examples

# Enable the password control feature globally.

<Sysname> system-view

[Sysname] password-control enable

Related commands

·           display password-control

·           password-control { aging | composition | history | length } enable

password-control expired-user-login

Use password-control expired-user-login to set the maximum number of days and maximum number of times that a user can log in after the password expires.

Use undo password-control expired-user-login to restore the defaults.

Syntax

password-control expired-user-login delay delay times times

undo password-control expired-user-login

Default

A user can log in three times within 30 days after the password expires.

Views

System view

Predefined user roles

network-admin

mdc-admin

Parameters

delay delay: Sets the maximum number of days during which a user can log in using an expired password. The value range is 1 to 90.

times times: Sets the maximum number of times a user can log in after the password expires. The value range is 0 to 10 and 0 means that a user cannot log in after the password expires.

Usage guidelines

This command is effective only for non-FTP login users. An FTP user cannot continue to log in after its password expires.

Examples

# Specify that a user can log in five times within 60 days after the password expires.

<Sysname> system-view

[Sysname] password-control expired-user-login delay 60 times 5

Related commands

display password-control

password-control history

Use password-control history to set the maximum number of history password records for each user.

Use undo password-control history to restore the default.

Syntax

password-control history max-record-num

undo password-control history

Default

The maximum number of history password records for each user is 4.

Views

System view

Predefined user roles

network-admin

mdc-admin

Parameters

max-record-num: Specifies the maximum number of history password records for each user, in the range of 2 to 15.

Usage guidelines

When the number of history password records reaches the set maximum number, the subsequent history record overwrites the earliest one.

The system stops recording passwords after you execute the undo password-control history enable command, but the prior records still exist. To clear these records, use the undo password-control enable command to disable the password control feature globally or use the reset password-control history-record command to clear the passwords manually.

Examples

# Set the maximum number of history password records for each user to 10.

<Sysname> system-view

[Sysname] password-control history 10

Related commands

·           display password-control

·           password-control history enable

·           reset password-control blacklist

password-control length

Use password-control length to set the minimum password length.

Use undo password-control length to restore the default.

Syntax

password-control length length

undo password-control length

Default

The global minimum password length is 10 characters. The minimum password length of a user group equals the global setting, and the minimum password length of a local user equals that of the user group to which the local user belongs.

Views

System view, user group view, local user view

Predefined user roles

network-admin

mdc-admin

Parameters

length: Specifies the minimum password length in characters, in the range of 4 to 32.

Usage guidelines

Before you execute this command, make sure the global password control feature and the minimum length function are enabled. Otherwise, your configuration does not take effect

The setting in system view has global significance and applies to all user groups. The setting in user group view applies to all local users in the user group, and the setting in local user view applies to only the local user.

A minimum password length setting with a smaller application scope has a higher priority. That is, the system prefers the setting for a local user. If there is no setting for the local user, the system uses the setting for the user group. If there is no setting for the user group, the system uses the global setting.

Examples

# Set the global minimum password length to 9 characters.

<Sysname> system-view

[Sysname] password-control length 9

# Set the minimum password length to 9 characters for user group test.

[Sysname] user-group test

[Sysname-ugroup-test] password-control length 9

[Sysname-ugroup-test] quit

# Set the minimum password length to 9 characters for device management user abc.

[Sysname] local-user abc class manage

[Sysname-luser-manage-abc] password-control length 9

Related commands

·           display password-control

·           password-control length enable

password-control login idle-time

Use password-control login idle-time to set the maximum account idle time. If a user account is idle for this period of time, it becomes invalid.

Use undo password-control login idle-time to restore the default.

Syntax

password-control login idle-time idle-time

undo password-control login idle-time

Default

The maximum account idle time is 90 days.

Views

System view

Predefined user roles

network-admin

mdc-admin

Parameters

idle-time: Specifies the maximum account idle time in days, in the range of 0 to 365. 0 means no restriction for account idle time.

Usage guidelines

If a user has not been logged in within the specified idle time since the last successful login, the user account becomes invalid.

Examples

# Set the maximum account idle time to 30 days.

<Sysname> system-view

[Sysname] password-control login idle-time 30

Related commands

display password-control

password-control login-attempt

Use password-control login-attempt to specify the maximum number of consecutive failed login attempts and the action to be taken when a user fails to log in after the specified number of attempts.

Use undo password-control to restore the default.

Syntax

password-control login-attempt login-times [ exceed { lock | lock-time time | unlock } ]

undo password-control login-attempt

Default

The maximum number of consecutive failed login attempts is 3 and a user failing to log in after the specified number of attempts must wait for 1 minute before trying again.

Views

System view

Predefined user roles

network-admin

mdc-admin

Parameters

login-times: Specifies the maximum number of consecutive failed login attempts, in the range of 2 to 10.

exceed: Specifies the action to be taken when a user fails to log in after the specified number of attempts.

lock: Permanently prohibits a user who fails to log in after the specified number of attempts from logging in.

lock-time time: Forces a user who fails to log in after the specified number of attempts to wait for a period of time before trying again. The time argument is in the range of 1 to 360 minutes.

unlock: Allows a user who fails to log in after the specified number of attempts to continue trying to log in.

Usage guidelines

If an FTP or virtual terminal line (VTY) user fails authentication, the system adds the user to a password control blacklist. If a user fails to provide the correct password after the specified number of consecutive attempts, the system takes one of the following actions:

·           If prohibited permanently, a user can log in only after you remove the user from the password control blacklist by using the reset password-control blacklist command.

·           If prohibited temporarily, a user can log in again after the lock time elapses or you remove the user from the password control blacklist by using the reset password-control blacklist command.

·           If not prohibited to log in, a user is removed from the password control blacklist and can log in again as long as the user logs in successfully or after the blacklist aging time (1 minute) elapses.

The password-control login-attempt command takes effect immediately after executed, and can thus affect the users already in the password control blacklist.

Examples

# Set the maximum number of login attempts to 4 and permanently prohibit a user failing to log in after four attempts from logging in.

<Sysname> system-view

[Sysname] password-control login-attempt 4 exceed lock

Later, if a user fails to log in after four attempts, you can find it in the password control blacklist, with its status changed from unlock to lock:

[Sysname] display password-control blacklist

 

 Username: test

    IP: 192.168.44.1        Login failures: 4      Lock flag: lock

 

 Blacklist items matched: 1.

The user can no longer log in.

# Set the maximum number of login attempts to 2 and prohibit a user from logging in within 3 minutes if the user fails to log in after two attempts.

<Sysname> system-view

[Sysname] password-control login-attempt 2 exceed lock-time 3

Later, if a user fails to log in after two attempts, you can find it in the password control blacklist, with its status changed from unlock to lock:

[Sysname] display password-control blacklist

 

 Username: test

    IP: 192.168.44.1        Login failures: 2      Lock flag: lock

 

 Blacklist items matched: 1.

After 3 minutes, the user is removed from the password control blacklist and can log in again.

Related commands

·           display password-control

·           display password-control blacklist

·           reset password-control blacklist

password-control super aging

Use password-control super aging to set the expiration time for super passwords.

Use undo password-control super aging to restore the default.

Syntax

password-control super aging aging-time

undo password-control super aging

Default

The expiration time for super passwords is 90 days.

Views

System view

Predefined user roles

network-admin

mdc-admin

Parameters

aging-time: Specifies the super password expiration time in days, in the range of 1 to 365.

Examples

# Set the expiration time for super passwords to 10 days.

<Sysname> system-view

[Sysname] password-control super aging 10

Related commands

·           display password-control

·           password-control aging

password-control super composition

Use password-control super composition to configure the composition policy for super passwords.

Use undo password-control super composition to restore the default.

Syntax

password-control super composition type-number type-number [ type-length type-length ]

undo password-control super composition

Default

A super password is valid if it has one valid character and does not have any invalid characters.

Views

System view

Predefined user roles

network-admin

mdc-admin

Parameters

type-number type-number: Specifies the minimum number of character types that a super password must contain. The value range is 1 to 4.

type-length type-length: Specifies the minimum number of characters that each type must contain. The value range is 1 to 64.

Usage guidelines

The product of the minimum number of character types and minimum number of characters for each type must be smaller than the maximum length of the super password.

Examples

# Specify that a super password must contain at least 3 types of characters and each type must contain at least 5 characters.

<Sysname> system-view

[Sysname] password-control super composition type-number 3  type-length 5

Related commands

·           display password-control

·           password-control composition

password-control super length

Use password-control super length to set the minimum length for super passwords.

Use undo password-control super length to restore the default.

Syntax

password-control super length length

undo password-control super length

Default

The minimum super password length is 10 characters.

Views

System view

Predefined user roles

network-admin

mdc-admin

Parameters

length: Specifies the minimum length for super passwords in characters, in the range of 4 to 63.

Examples

# Set the minimum length for super passwords to 10 characters.

<Sysname> system-view

[Sysname] password-control super length 10

Related commands

·           display password-control

·           password-control length

password-control update-interval

Use password-control update-interval to set the minimum password update interval, which is the minimum interval at which users can change their passwords.

Use undo password-control update-interval to restore the default.

Syntax

password-control update-interval interval

undo password-control update-interval

Default

The minimum password update interval is 24 hours.

Views

System view

Predefined user roles

network-admin

mdc-admin

Parameters

interval: Specifies the minimum password update interval in hours, in the range of 0 to 168. 0 means no requirements for password update interval.

Usage guidelines

The set minimum interval is not effective on a user who is prompted to change the password at the first login or after the password is expired.

Examples

# Set the minimum password update interval to 36 hours.

<Sysname> system-view

[Sysname] password-control update-interval 36

Related commands

display password-control

reset password-control blacklist

Use reset password-control blacklist to remove a specified user or all users from the password control blacklist.

Syntax

reset password-control blacklist [ user-name name ]

Views

User view

Predefined user roles

network-admin

mdc-admin

Parameters

user-name name: Specifies the user to be removed from the password control blacklist. The name argument is the username, a case-sensitive string of 1 to 55 characters.

Usage guidelines

For a user blacklisted due to excessive login attempts, you can use this command to remove the user from the password control blacklist and allow the user to log in again.

Examples

# Remove the user named test from the password control blacklist.

<Sysname> reset password-control blacklist user-name test

Are you sure to delete the specified user in blacklist? [Y/N]:

Related commands

display password-control blacklist

reset password-control history-record

Use reset password-control history-record to delete history password records.

Syntax

reset password-control history-record [ super [ role role name ] | user-name name ]

Views

User view

Predefined user roles

network-admin

mdc-admin

Parameters

super: Deletes the history records of a specified super password or all super passwords.

role role name: Specifies a user role, a case-sensitive string of 1 to 63 characters.

user-name name: Specifies the username of the user whose password records are to be deleted. The name argument is a case-sensitive string of 1 to 55 characters.

Usage guidelines

With no arguments or keywords specified, this command deletes the history password records of all local users.

Without the role role name option, this command deletes the history records of all super passwords.

Examples

# Clear the history password records of all local users (enter Y to confirm).

<Sysname> reset password-control history-record

Are you sure to delete all local user's history records? [Y/N]:y

Related commands

password-control history