The password composition policy allows you to create passwords of any combination of upper and lowercase characters, numbers, and special characters that include “!”, “@”, “#”, “$”, “%”,“^”, “&”, “*”, “(“, and “)”.

The administrator has the flexibility to set the password's minimum and maximum length. The recommended minimum password length is 8 characters. The administrator can specify both the minimum (1) and the maximum (64) length for the password.

The security administrator can provide a configurable option for a password to have a maximum lifetime. If the lifetime parameter is not configured, the configured password will never expire. The maximum lifetime can be configured by providing the configurable value in years, months, days, hours, minutes, and seconds. The lifetime configuration will survive across reloads as it is a part of the configuration, but every time the system reboots, the password creation time will be updated to the new time. For example, if a password is configured with a lifetime of one month and on the 29th day, the system reboots, then the password will be valid for one month after the system reboots.

If the user attempts to log on and if the user's password credentials have expired, then the following happens:

If the password's lifetime is not configured for a user and the user has already logged on and if the security administrator configures the lifetime for that user, then the lifetime will be set in the database. When the same user is authenticated the next time, the system will check for password expiry. The password expiry is checked only during the authentication phase.

If the user has been already authenticated and logged on to the system and if the password expires, then no action will be taken. The user will be prompted to change the password only during the next authentication for the same user.

The new password must contain a minimum of 4 character changes from the previous password. A password change can be triggered by the following scenarios:

When the security administrator changes the password security policy and the existing profile does not meet the password security policy rules, no action will be taken if the user has already logged on to the system. The user will be prompted to change the password only when the user tries to get authenticated using the profile that does not meet the password security restriction.

When the user changes the password, the lifetime parameters set by the security administrator for the old profile will be the lifetime parameters for the new password.

For noninteractive clients such as dot1x, when the password expires, appropriate error messages will be sent to the clients, and the clients must contact the security administrator to renew the password.

Users are reauthenticated when they change their passwords.

When users change their passwords on expiry, they will be authenticated against the new password. In such cases, the actual authentication happens based on the previous credentials, and the new password is updated in the database.

Note	Users can change their passwords only when they are logging on and after the expiry of the old password; however, a security administrator can change the user's password at any time.

When a client such as dot1x uses the local database for authentication, the Password Strength and Management for Common Criteria feature will be applicable; however, upon password expiry, clients will not be able to change the password. An appropriate failure message will be sent to such clients, and the user must request the security administrator to change the password.

1.    enable


2.    configure terminal


3.    aaa new-model


4.    aaa common-criteria policy policy-name


5.    char-changes number


6.    max-length number


7.    min-length number


8.    numeric-count number


9.    special-case number


10.    exit


11.    username username common-criteria-policy policy-name password password


12.    end

Device> enable
          

Device# configure terminal
          

Device(config)# aaa new-model
          

Device(config)# aaa common-criteria policy policy1
          

Device(config-cc-policy)# char-changes 4
          

Device(config-cc-policy)# max-length 25
          

Device(config-cc-policy)# min-length 8
          

Device(config-cc-policy)# numeric-count 4
          

Device(config-cc-policy)# special-case 3
          

Device(config-cc-policy)# exit
          

Device(config)# username user1 common-criteria-policy policy1 password password1
          

Device(config)# end
          

1.    enable


2.    show aaa common-criteria policy name policy-name


3.    show aaa common-criteria policy all

Device> enable
          

Device# show aaa common-criteria policy name policy1

Policy name: policy1
Minimum length: 1
Maximum length: 64
Upper Count: 20
Lower Count: 20
Numeric Count: 5
Special Count: 2
Number of character changes 4
Valid forever. User tied to this policy will not expire.

Device# show aaa common-criteria policy all
====================================================================
Policy name: policy1
Minimum length: 1
Maximum length: 64
Upper Count: 20
Lower Count: 20
Numeric Count: 5
Special Count: 2
Number of character changes 4
Valid forever. User tied to this policy will not expire.
====================================================================
Policy name: policy2
Minimum length: 1
Maximum length: 34
Upper Count: 10
Lower Count: 5
Numeric Count: 4
Special Count: 2
Number of character changes 2
Valid forever. User tied to this policy will not expire.
=====================================================================

Use the debug aaa common-criteria command to troubleshoot AAA common criteria.