Cisco ASR 1004 - User Lockout

Page 18 of 72
line vty <first> <last> [2] and [20] under section “Configuring Virtual Terminal Lines
for Remote Console Access”
exec-timeout <time> [10] >System Management > Cisco IOS Configuration
Fundamentals Command Reference, section D through E
line console [19] under section “Configuring Line Password Protection”
exec-timeout <time>
To save these configuration settings to the startup configuration:
copy run start [3] under section “C commands”
where first and last are the range of vty lines on the box (i.e. “0 4”), and time is the period of
inactivity after which the session should be terminated. Configuration of these settings is limited
to the privileged administrator (see Section 4.1). These settings are not immediately activated
for the current session. The current line console session must be exited. When the user logs
back in, the inactivity timer will be activated for the new session.
3.2.6 User Lockout
User accounts must be configured to lockout after a specified number of authentication failures
TOE-common-criteria(config)# aaa local authentication attempts max-fail [number of
failures]
where number of failures is the number of consecutive failures that will trigger locking of the
account. Configuration of these settings is limited to the privileged administrator (see Section
4.1).
Related commands:
clear aaa local user fail-attempts
Clears the unsuccessful login
attempts of the user.
clear aaa local user lockout
username [username]
Unlocks the locked-out user.
show aaa local user lockout
Displays a list of all locked-out
users.
Note: this lockout only applies to privilege 14 users and below.
Note: this applies to consecutive failures, and is not affected by the SSH or Telnet session
disconnections after their default number of failures. In other words, if this lockout command is
set to 5 failures, and SSH disconnects after 3 failed attempts, if the user attempts another SSH
session and enters the wrong credentials two additional times, the account will lock.