You can specify when and the frequency in which users must change their passwords. You can require users who authenticate locally to change their passwords in the following circumstances:
After new users log in the first time
After a specific period of time elapses
At the next login attempt, for a specific user or all users
The password change features described in this section are disabled by default.
Note
The Web UI display and commands do not apply to VX Series appliances, which do not have Web-based interfaces.
The new password must be different from the current password, even if no password reuse restrictions are configured. After users change their passwords, they must log out and then log in again to access the functionality their role allows.
You can also configure when the system should start warning users that their passwords will expire. The warnings are displayed after the user logs in.
In the Web UI (except for VX Series appliances), the warning appears in the Dashboard:
In the CLI, the warning appears below a "Password change notice" banner:
If the password is not changed before it expires, the account will not be locked.
In the Web UI, users will be taken directly to the My Account Settings page where a message is displayed as shown:
Until the user changes the password and then logs out and then logs back in, the Web UI limits user privileges to changing the passwords.
In the CLI, a message is displayed as shown:
Users will be unable to do anything except change their passwords and run a small number of basic commands that do not impact the system or show sensitive information (such as show whoami, show cli, and cli session).
You can disable the maximum password age policy for specific users. Passwords of these users who have this policy disabled will not expire.
Important
These policies apply only to users who authenticate locally. They are not enforced if a user authenticates remotely and is then mapped to a local user account that requires a password change, or if a user authenticates using an SSH authorized key.
Caution
The connection between the Central Management System appliance and its managed appliances requires remote user credentials for the appliance (if the Central Management System appliance initiated the connection) or the Central Management System appliance (if the appliance initiated the connection). If the password expires, the connection between the Central Management System appliance and the managed appliance will be lost until the password is changed and the connection is reset. To work around this scenario, you can use an SSH authorized key for authentication. For details, see the System Administration Guide.