Session Termination; User Lockout - Cisco ISR 4000 series Configuration Manual

Cisco ISR 4000 Family Routers Administrator Guidance
When creating administrator accounts, all individual accounts are to be set to a privilege level of
one. This is done by using the following commands:
TOE-common-criteria(config)# username <name> password <password>
to create a new username and password combination, and
TOE-common-criteria(config)# username <name> privilege 1
to set the privilege level of <name> to 1.

3.2.5 Session Termination

Inactivity settings must trigger termination of the administrator session. These settings are
configurable by setting
TOE-common-criteria(config)# line vty <first> <last>
TOE-common-criteria(config-line)# exec-timeout <time>
TOE-common-criteria(config-line)# line console
TOE-common-criteria(config)# exec-timeout <time>
To save these configuration settings to the startup configuration:
copy run start
where first and last are the range of vty lines on the box (i.e. "0 4"), and time is the period of
inactivity after which the session should be terminated. Configuration of these settings is limited
to the privileged administrator (see Section 4.1).
The line console setting is not immediately activated for the current session. The current console
session must be exited. When the user logs back in, the inactivity timer will be activated for the
new session.

3.2.6 User Lockout

User accounts must be configured to lockout after a specified number of authentication failures
TOE-common-criteria(config)# aaa local authentication attempts max-fail [number of failures]
where number of failures is the number of consecutive failures that will trigger locking of the
account. Configuration of these settings is limited to the privileged administrator (see Section 4.1).
Related commands:
clear aaa local user fail-attempts
[username username | all]
clear aaa local user lockout
username [username]
show aaa local user lockout
Clears the unsuccessful login
attempts of the user.
Unlocks the locked-out user.
Displays a list of all locked-out
users.
Page 16 of 66