To require non-admin users attempting to change their passwords to enter their current password in addition to the new password, use the aaa authentication password local change require-current command in configuration mode.
When this feature is enabled:
The My Account Setting page in the Web UI includes a Current Password field.
Local login commands such as username <username> password <password> prompt for the current password, if the user does not supply it as a command parameter.
Caution
Custom scripts that use the CLI to configure user accounts may need to be updated if this feature is enabled. For example, a script that sets the password for a user would need to be modified so that it includes the current password.
Syntax
[no] aaa authentication password local change require-current {userType}
Syntax
<term>no</term>
Use the no form of this command to allow non-admin users to change their password without providing their current password.
<term>userType</term>
The user types affected by this rule. The current types are available:
non-admin—Non admin users will be required to provide a current passwords. Admin users are exempt from this rule.
Example
The following example requires non-admin users to enter their current password as well as the new password:
hostname (config) # aaa authentication password local change require-current non-admin
The following example removes the current password rule for all users:
hostname (config) #no aaa authentication password local change require-current
User role
Admin
Supported appliances
This command is supported on the following appliances running the specified releases or later:
Central Management System: Release 7.4
Email Security — Server: Release 7.6
Malware Analysis: Release 7.4
File Protect: Release 7.5
Endpoint Security (HX): Release 3.0
Network Security: Release 7.4
Intelligent Virtual Execution - Server: Release 7.9