Cisco 2509 - Router - EN User Manual page 183

Chapter 6 Setting Up and Managing User Groups
Tip
•
•
The password aging rules are not mutually exclusive; a rule is applied for each
check box that is selected. For example, users can be forced to change their
passwords every 20 days, and every 10 logins, and to receive warnings and grace
periods accordingly.
If no options are checked, passwords never expire.
Unlike most other parameters, which have corresponding settings at the user level,
password aging parameters are configured only on a group basis.
Users who fail authentication because they have not changed their passwords and
have exceeded their grace periods are logged in the Failed Attempts log. The
accounts expire and appear in the Accounts Disabled list.
Before You Begin
•
•
78-14696-01, Version 3.1
Require change after x logins—The number of the login after which to
–
notify users that they must to change their passwords. Continuing with
the previous example, if this number is set to 12, users receive prompts
requesting them to change their passwords on their 11th and 12th login
attempts. On the 13th login attempt, they receive a prompt telling them
that they must change their passwords. If users do not change their
passwords now, their accounts expire and they cannot log in. This
number must be greater than the Issue warning after x login number.
To allow users to log in an unlimited number of times without changing
their passwords, type -1.
Apply password change rule—Selecting this check box forces new users to
change their passwords the first time they log in.
Generate greetings for successful logins—Selecting this check box enables
a Greetings message to display whenever users log in successfully via the
CAA client. The message contains up-to-date password information specific
to this user account.
Verify that your AAA client is running the TACACS+ or RADIUS protocol.
(TACACS+ only supports password aging for device-hosted sessions.)
Set up your AAA client to perform authentication and accounting using the
same protocol, either TACACS+ RADIUS.
User Guide for Cisco Secure ACS for Windows Server
Configuration-specific User Group Settings
6-23