Configuring Password Control; Overview - HP 6600 Security Configuration Manual

Configuring password control

Overview

Password control refers to a set of functions provided by the local authentication server to control user
login passwords, super passwords, and user login status based on predefined policies. The rest of this
section describes password control functions in detail.
• Minimum password length
By setting a minimum password length, you can enforce users to use passwords long enough for
system security. If a user specifies a shorter password, the system rejects the setting and prompts
the user to re-specify a password.
Minimum password update interval
•
This function allows you to set the minimum interval at which users can change their passwords. If
a non-manage level user logs in to change the password but the time elapsed since the last change
is less than this interval, the system denies the request. For example, if you set this interval to 48
hours, a non-manage level user cannot change the password twice within 48 hours. This prevents
users from changing their passwords frequently.
This function is not effective on users of the manage level. For information about user levels, see
Fundamentals Configuration Guide.
This function is not effective on a user who is prompted to change the password at the first login or
a user whose password has just been aged out.
Password aging
•
Password aging imposes a lifecycle on a user password. After the password aging time expires,
the user needs to change the password.
If a user enters an expired password when logging in, the system displays an error message and
prompts the user to provide a new password and to confirm it by entering it again. The new
password must be a valid one and the user must enter exactly the same password when confirming
it.
Early notice on pending password expiration
•
When a user logs in, the system checks whether the password will expire in a time equal to or less
than the specified notification period. If so, the system notifies the user when the password will
expire and provides a choice for the user to change the password. If the user sets a new password
that is complexity-compliant, the system records the new password and the setup time. If the user
chooses not to change leave the password or the user fails to change it, the system allows the user
to log in using the current password.
Telnet, SSH, and terminal users (log in to the device through console or AUX interfaces) can
change their passwords by themselves. FTP users, on the contrary, can only have their passwords
changed by the administrator.
Login with an expired password
•
You can allow a user to log in a certain number of times within a specific period of time after the
password expires, so that the user does not need to change the password immediately. For
example, if you set the maximum number of logins with an expired password to 3 and the time
period to 15 days, a user can log in three times within 15 days after the password expires.
202