20 Brocade ICX 6650 Security Configuration Guide
53-1002601-01
Local user accounts
A username set-time configuration is removed when:
•The username and password is deleted from the configuration
•The username password expires
When a username set-time configuration is removed, it no longer appears in the show running
configuration output.
Note that if a username does not have an assigned password, the username will not have a
set-time configuration.
Password aging is disabled by default. To enable it, enter the following command at the global
CONFIG level of the CLI.
Brocade(config)# enable user password-aging
Syntax: [no] enable user password-aging
Configuring password history
By default, the Brocade device stores the last five user passwords for each user. When changing a
user password, the user cannot use any of the five previously configured passwords.
For security purposes, you can configure the Brocade device to store up to 15 passwords for each
user, so that users do not use the same password multiple times. If a user attempts to use a
password that is stored, the system will prompt the user to choose a different password.
To configure enhanced password history, enter a command such as the following at the global
CONFIG level of the CLI.
Brocade(config)# enable user password-history 15
Syntax: [no] enable user password-history 1 – 15
Enhanced login lockout
The CLI provides up to three login attempts. If a user fails to login after three attempts, that user is
locked out (disabled). If desired, you can increase or decrease the number of login attempts before
the user is disabled. To do so, enter a command such as the following at the global CONFIG level of
the CLI.
Brocade(config)# enable user disable-on-login-failure 7
Syntax: enable user disable-on-login-failure 1 – 10
To re-enable a user that has been locked out, do one of the following:
•Reboot the Brocade device to re-enable all disabled users.
•Enable the user by entering the following command.
Brocade(config)# username sandy enable