Admin Guide

The default for the password complexity rule includes the following:
• Two uppercase character, from the range: ABCDEFGHIJKLMNOPQRSTUVWXYZ
• Two lowercase character, from the range: abcdefghijklmnopqrstuvwxyz
• Two numeric character, from the range: 1234567890
• Two special character, from the range: `~!@#$%^&*()_-+={[}]|\:;”’<,>.?/
Password length rule
The system enforces a minimum password length of 15 characters after you enable enhanced
secure mode.
If you do not meet the password length rule, the system displays the following message:
Password change aborted. The new password does not meet the minimum
complexity requirement. Please select another password that meets the
change interval, length, complexity, no consecutive repeating characters
or history requirements of the domain.
Password change interval rule
The system enforces a minimum password change interval, which defines the minimum amount of
time before you can change to a new password. By default, the minimum change interval is 24
hours between changing from one password to a new password. If you want to change your
password, and attempt to do so, the system checks the timestamp for your password to determine if
enough time has passed to allow you to change the password.
If you attempt to change the password and not enough time has passed, the system rejects the
request, and the system informs you that the password was recently changed. Any password
change outside of the enforced interval requires the Administrator to approve the change.
If you try to change the password before the change interval allows, the system displays the
following message:
Password change aborted. The new password does not meet the minimum
complexity requirement. Please select another password that meets the
change interval, length, complexity, no consecutive repeating characters
or history requirements of the domain.
Password reuse rule
After you enable enhanced secure mode, the administrator access level can define the number of
old passwords that cannot be reused. The password reuse rule ensures that recently used
passwords are not reused immediately, which reduces the risk of someone unlawfully gaining
access to the system. The default number of prohibited recently used passwords is 3, but you can
define up to 99.
The system saves the password history and stores the history in an encrypted format, along with the
user name, and date of change. If a particular user attempts to change a password, the system
looks up the password history list, and checks it against the stored passwords the user has
previously used. If the password is on the list of previously used passwords, the system rejects the
password change, and displays the following message:
Old password not allowed.
System access fundamentals
January 2017 Administering Avaya VSP 7200 Series and 8000 Series 185
Comments on this document? [e-mail]