Password Strength and Management for Common Criteria IOS XE

[fuhrersk8]

Hello;

Is there a way to implement Password Strength and Management for Common Criteria while retaining the secret password?

If not, how can a minimum password length be enforced in IOS XE 17.3.3?

Thanks for your support.

Regards, 

[balaji.bandi]

Most of the network devices are managed with TACACS / Radius (they intern connect to AD or any other sources) that source can define what kind of length password should be.

if you looking Local (we use most of the time fall back not many accounts, only critical fall back used here)

some reference local accounts :

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_aaa/configuration/xe-16-10/sec-usr-aaa-xe-16-10-book/sec-aaa-comm-criteria-pwd.html

[fuhrersk8]

Correct.

We need to enforce password strength for our fallback local account as part of our security policy.

Local account is used only when TACACS+ fails.

Is there a way to implement this with secret passwords?

Thanks.

[balaji.bandi]

Is there a way to implement this with secret passwords?

above document provide the steps -

[fuhrersk8]

Hello and thank you;

This is my problem:

“For local users that have been defined using the username username common-criteria-policy policy-name secret 5|8|9 commands, they are not evaluated against the password common criteria. Only the common criteria lifetime is applied to the username.”


How to enforce password strength when using secret instead of password?

We use secret and need to enforce password strength for local users. Is there a way?

Hope this helps.

[paul driver]

Hello

---

@fuhrersk8 wrote:

“For local users that have been defined using the username username common-criteria-policy policy-name secret 5|8|9 commands, they are not evaluated against the password common criteria. Only the common criteria lifetime is applied to the username.” <-- not sure what this means TBH

If not, how can a minimum password length be enforced in IOS XE 17.3.3?

---

FYI

password encryption aes
key config-key password-encrypt
username xxx privilege 15 algorithm-type scrypt secret xxxxx  < type 9>
security authentication failure rate x log
security passwords min-length x
aaa authentication attempts login x

[fuhrersk8]

Thanks Paul;

Even with Type 9 passwords, the common criteria will not be applied as per the documentation.
On the other hand, we do not want to rely on a master key for encryption. Trying to simplify things.

I may be missing the point, please correct me if Im wrong.

Thanks.