ASA Password-Policy v9.17

[Li Bo]

ASA在9.17版本中的密码策略能否进行取消？

账号首次登录需要强制修改密码，当账号类型设置的为nopassword(使用publickey登录时) 同样还是需要修改密码。

[sfc9982]

可以看看 password-policy 下哪些设置是控制强制密码的，

no password-policy <强制密码的命令>

取消试试？

[Li Bo]

尝试过，但是没有可以关闭的。

linc@Lincs-iMac ~ % ssh linc@172.16.189.14

This is your first login. Please set a new password before proceeding.

Enter old password:   

username linc nopassword privilege 15
username linc attributes
ssh authentication publickey ******* hashed

[sfc9982]

手头没有你的设备，

试试：

no password strength-check
no password-policy minimum changes
no password-policy minimum-length

[Li Bo]

no password strength-check
没有该命令。
no password-policy minimum changes
no password-policy minimum-length
这两个敲了没什么作用。

ASAvGW(config)# no password?

configure mode commands/options:
password password-policy
ASAvGW(config)# no password-policy ?

configure mode commands/options:
authenticate-enable Enable the user authentication feature
lifetime Set password lifetime
minimum-changes Set minimum character changes between old and new
password
minimum-length Set minimum password length
minimum-lowercase Set minimum number of lowercase password characters
minimum-numeric Set minimum number of numeric password characters
minimum-special Set minimum number of special password characters
minimum-uppercase Set minimum number of uppercase password characters
reuse-interval Enter minimum number of unique passwords required to
prohibit reuse
username-check Enable to prevent passwords from matching usernames
ASAvGW(config)# no password ?

configure mode commands/options:
encryption Configure password encryption
ASAvGW(config)# no password

authenticate-enable // 这个参数也尝试过 也是不行。

[sfc9982]

使用

password password-policy lifetime

把密码寿命设置到永久？

不知道你是不是用了远程认证源(ACS, Radius, TACACS+)

可以切到local试试

aaa authorization exec default local

或者类似命令

[Li Bo]

password password-policy lifetime #测试不行

目前使用的本地认证源，我计划切换到AAA上去测试。先这样吧。我后续结束居家办公后，找一台真机 找TAC去咨询一下。

谢谢回复