Users Guide

aaa authentication login default local
aaa authentication login console local
User re-authentication
To prevent users from accessing resources and performing tasks that they are not authorized to perform, OS10 allows you to require users
to re-authenticate by logging in again when an authentication method or server changes, such as:
• Adding or removing a RADIUS server using the radius-server host command
• Adding or removing an authentication method using the aaa authentication login {console | default} {local |
group radius | group tacacs+} command
By default, user re-authentication is disabled. You can enable this feature so that user re-authentication is required when any of these
actions are performed. In these cases, logged-in users are logged out of the switch and all OS10 sessions terminate.
Enable user re-authentication
• Enable user re-authentication in CONFIGURATION mode.
aaa re-authenticate enable
The no version of this command disables user re-authentication.
Password strength
By default, the password you congure with the username password role and enable password priv-lvl commands must
be at least nine alphanumeric characters. To increase password strength, you can create stronger password rules using the
password-
attributes command. These password rules apply to the user name and privilege-level password conguration.
When you enter the command, at least one parameter is required. When you enter the character-restriction parameter, at least
one option is required.
• Create rules for stronger passwords in CONFIGURATION mode.
password-attributes {[min-length number] [character-restriction {[upper number]
[lower number][numeric number] [special-char number]}}
– min-length number — Enter the minimum number of required alphanumeric characters, from 6 to 32; default 9.
– character-restriction — Enter a requirement for the alphanumeric characters in a password:
◦ upper number — Minimum number of uppercase characters required, from 0 to 31; default 0.
◦ lower number — Minimum number of lowercase characters required, from 0 to 31; default 0.
◦ numeric number — Minimum number of numeric characters required, from 0 to 31; default 0.
◦ special-char number — Minimum number of special characters required, from 0 to 31; default 0.
To turn o the strong password check enabled with the password-attributes command, use the service simple-password
command. No password rules, except for the minimum 9-character requirement, are applied to the user name and privilege-level
passwords. To revert to the congured password-attributes settings, use the no service simple-password command.
Create strong password rules
OS10(config)# password-attributes min-length 7 character-restriction upper 4 numeric 2
Display password rules
OS10# show running-configuration password-attributes
password-attributes min-length 7 character-restriction upper 4 numeric 2
Disable strong password check
OS10(config)# password-attributes min-length 7 character-restriction upper 4 numeric 2
OS10(config)# username admin2 password 4newhire4 role sysadmin
Security
931