Password Expiration Policy; Account Lockout Policy - HP StoreFabric SN6500B Administrator's Manual

Password expiration policy

The password expiration policy forces the expiration of a password after a configurable period of
time. The expiration policy can be enforced across all user accounts or on specified users only.
A warning that password expiration is approaching is displayed when the user logs in. When a
password expires, the user must change the password to complete the authentication process and
open a user session. You can specify the number of days prior to password expiration during which
warnings will commence. Password expiration does not disable or lock out the account.
Use the following attributes to the passwdCfg command to set the password expiration policy:
•
•
•
Example password expiration policies
The following example configures a password expiration policy for the metoo user account. This
user must change the password within 90 days of setting the current password and no sooner than
10 days after setting the current password. The user will start to receive warning messages 3 days
before the 90-day limit, if the password is not already changed.
> passwdcfg --setuser metoo -minpasswordage 10 -maxpasswordage 90 -warning 3
The following example configures a password expiration policy for all users.
> passwdcfg --set -minpasswordage 5 -maxpasswordage 30 -warning 5

Account lockout policy

The account lockout policy disables a user account when that user exceeds a specified number of
failed login attempts, and is enforced across all user accounts. You can configure this policy to
keep the account locked until explicit administrative action is taken to unlock it, or the locked
account can be automatically unlocked after a specified period. Administrators can unlock a locked
account at any time.
Fabric OS Administrator's Guide
53-1002745-02
MinPasswordAge
Specifies the minimum number of days that must elapse before a user can change a
password. MinPasswordAge values range from 0 through 999. The default value is zero.
Setting this parameter to a nonzero value discourages users from rapidly changing a password
in order to circumvent the password history setting to select a recently used password. The
MinPasswordAge policy is not enforced when an administrator changes the password for
another user.
MaxPasswordAge
Specifies the maximum number of days that can elapse before a password must be changed,
and is also known as the password expiration period. MaxPasswordAge values range from 0
through 999. The default value is zero. Setting this parameter to zero disables password
expiration.
Warning
Specifies the number of days prior to password expiration that a warning about password
expiration is displayed. Warning values range from 0 through 999. The default value is 0 days.
NOTE
When MaxPasswordAge is set to a nonzero value, MinPasswordAge and Warning must be set
to a value that is less than or equal to MaxPasswordAge.
Password policies
5
143