topic Locking down ASA in Network Security

Locking down ASA

bob.bartlett — Tue, 12 Mar 2019 00:51:35 GMT

I am working on locking down the ASA and I am looking for the commands to set the number of failed authentications before it won't accept login attempts from that host. I found a single command to set the max times but what about the max duration or the time between attempts settings.

Locking down ASA

Julio Carvajal — Thu, 24 Jan 2013 04:09:18 GMT

Hello,

I would say there is no such a comand on the ASA,

You can set after how much idle time a user will need to reauthenticate but that's it.

timeout uauth xx:xx:xx

Regards

Re: Locking down ASA

Karsten Iwen — Thu, 24 Jan 2013 06:34:13 GMT

For full control of the login-environment, you should use a TACACS- or RADIUS-Server. There you can configure the parameters as you want.

Sent from Cisco Technical Support iPad App

Locking down ASA

bob.bartlett — Thu, 24 Jan 2013 15:11:08 GMT

I have it locked down there but if the TACACS fails then their is nothing to prevent a dictionary attack. So how to you prevent that?

Re: Locking down ASA

Karsten Iwen — Thu, 24 Jan 2013 15:32:27 GMT

One thing is the max-fail you already mentioned. And then you can configure a password-policy:

asa1(config)# password-policy ?

configure mode commands/options:

authenticate-enable Enable the user authentication feature

lifetime Set password lifetime

minimum-changes Set minimum character changes between old and new

password

minimum-length Set minimum password length

minimum-lowercase Set minimum number of lowercase password characters

minimum-numeric Set minimum number of numeric password characters

minimum-special Set minimum number of special password characters

minimum-uppercase Set minimum number of uppercase password characters

It's from an 8.4.4 ASA. But that is gone on my v9.1-ASA (not sure if it's only a bug, RSA-authentication also doesn't work any more):

asa(config)# password-policy

ERROR: % Invalid input detected at '^' marker.

--
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni