Cisco ACS password expiration

[smolz]

I am trying to configure password aging for my VPN clients. What I have is a Cisco VPN Concentrator 3000 series that uses an Cisco ACS server 3.3 for user authentication using the local database. The users are using the Cisco VPN Client, 4.x. We are upgrading the ACS server to 4.2 shortly if that helps.

What I want to be able to do is set the Password Aging rules on the groups in Cisco ACS and have this information pass to the user via the VPN client. So for example:

---The user is assigned to group "Accounting" in Cisco ACS. This group has the Password Aging rule- Apply age-by-uses rules. Issue warning after "2" logins and Require change after "4" logins.

---The user logs in using the Cisco VPN client and while logging in for the 3rd time receives the message that their account will expire after the next login.

---This user then has the ability to change their password using the Cisco VPN client.

This seems like it should be fairly straightforward to setup but I have not come across much documentation that spells out the steps to make this work.

[darpotter]

This functionality would be very useful... but its not there.

ACS password ageing only works with TACACS+ shell login. AKAIK the password expiry messages are not carried over RADIUS at all.

[smolz]

I seem to remember reading about using a Microsoft IAS radius server that it would push that through to the VPN client.

Without the ability for users to change their passwords remotely this seems like an really incomplete solution.

[ansalaza]

RADIUS Password Expiry is supported with External windows database using MS-CHAPv2. We cannot use RADIUS Password Expiry with local ACS database.

Here is a configuration example:

Configure the Cisco VPN 3000 Series Concentrators to Support the NT Password Expiration Feature with the RADIUS Server

Document ID: 12086

http://www.cisco.com/en/US/products/hw/vpndevc/ps2284/products_configuration_example09186a00800946b9.shtml#

[smolz]

According to the literature:

Q. Does Cisco Secure ACS support forced password change based on password age and other criteria?

A. Password aging is available for users in the ACS internal database and users in a Microsoft Windows Active Directory database.

Does this not apply?

[smolz]

How does this apply if I am using SSL VPN client/clientless through an Cisco ASA?

[ansalaza]

For SSL:

Make sure you have MS-CHAP V2 enabled on AD.

Add password management to the tunnel-group.

tunnel-group DefaultWEBVPNGroup general-attributes

password-management

Password-management command support on ASA:

http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/webvpn.html#wp1000458

[ansalaza]

Yes, it does:

ACS 3.3:

Cisco Secure ACS supports four distinct password aging mechanisms:

http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/3.3/user/guide/g.html#wp479534

ACS 4.2:

Varieties of Password Aging Supported by ACS

http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2/user/guide/GrpMgt.html#wp525115

[ansalaza]

There is an enhancement request filed for this:

CSCsj50218 Bug Details

Password expiry feature should be support for users local to ACS

Symptom:

ACS currently does not support password expiry / password management feature for locally configured users.

Conditions:

users are configured locally on ACS as opposed to an external database such as active directory.

Workaround:

user external database / server where user profiles are setup.

[fernandoaguirre]

Is this bug fixed already??? I need to configure password aging for vpn clients with

users configured on the internal ACS Database.

Regards,

Fernando

[jrabinow]

Password expiry for internal users is supported in ACS 5.1. ACS 5.1 is

available for download from CCO.

[pbaleshenko]

Hello.

This is rather old topic but I hope to find help here

Our users are connecting to VPN3000 and authenticated from internal database of ACS 5.1 via RADIUS between these devices. We've installed UCP service. Now I want to remind user whose password should be expired soon that he can change it via UCP (e. g. with link to UCP page). Is there any way to do it with standard features of ACS 5.1 and VPN3000 ?

Thanks in advance for any help.

Pavel.