ASA Local User Password Policy

[aniketalashe]

Hi All,

We have an ASA with local admin users with different privilege levels (1 to 15). We have received recommendation to configure password policy as part of configuration review.

Request help to understand if the password policy applies to local admin accounts as well?

PASSWORD-POLICY LIFETIME 30

PASSWORD-POLICY MINIMUM-CHANGES 4

PASSWORD-POLICY MINIMUM-UPPERCASE 1

PASSWORD-POLICY MINIMUM-LOWERCASE 1

PASSWORD-POLICY MINIMUM-NUMERIC 1

Thank you.

Regards,

Aniket

[Daniele Giordano]

Hi, according to this documentation the answer is yes.

Link: https://www.cisco.com/c/en/us/td/docs/security/asa/asa91/configuration/general/asa_91_general_config/admin_management.html#88174

See the chapter "Configuring a Password Policy for Local Database Users".

Regards.

[Marvin Rhoads]

I know a lot of auditors are making those recommendations these days since it's in the standard scanning tools' security checks.

Personally I prefer to push back on this one. I'm of the opinion that the right place to enforce password policy of 30 day expiration is on the external authentication server's backend identity store (i.e. like RADIUS or TACACS server referencing Active Directory). Make the LOCAL method fallback only and use a strong password that's securely stored externally (like in a shared LastPass database secured with 2FA).

The local user credentials on the ASA should be seldom if ever used (only when the external authentication server is down). If they expire after 30 days you won't be able to get it when you need it most.

[ahmadrasheed]

Is there any password policy that comes by default? If yes, where can we see the configured policy, if no is it possible to check somewhere that mentions no policy/minimum requirements are configured?

[Marvin Rhoads]

You can see the default password policy using "show run all | i password-policy". The "all" keyword displays otherwise hidden defaults.

Here's an example:

# show run all | i password-policy
password-policy minimum-length 3
password-policy minimum-changes 0
password-policy minimum-lowercase 0
password-policy minimum-uppercase 0
password-policy minimum-numeric 0
password-policy minimum-special 0
password-policy lifetime 0
no password-policy authenticate-enable
no password-policy username-check
no password-policy reuse-interval
#

[ahmadrasheed]

It worked. thankyou Marvin