Cisco Systems D200 manual DLP-D272 Change Node Security Policy on Multiple Nodes, 19-77

Chapter 19 DLPs D200 to D299

DLP- D272 Change Node Security Policy on Multiple Nodes

DLP-D272 Change Node Security Policy on Multiple Nodes

	Purpose	This task changes the security policy for multiple nodes including idle user
		timeouts, user lockouts, password change, and concurrent login policies.
	Tools/Equipment	None
	Prerequisite Procedures	DLP-D60 Log into CTC, page 17-49
	Required/As Needed	As needed
	Onsite/Remote	Onsite or remote
	Security Level	Superuser
Step 1	From the View menu, choose Go to Network View.
Step 2	Click the Provisioning > Security > Policy tabs. A read-only table of nodes and their policies appears.
Step 3	Click a node in the table that you want to modify, then click the Change button.
Step 4	If you want to modify the idle user timeout period, click the hour (H) and minute (M) arrows in the Idle
	User Timeout area for the security level you want to provision: RETRIEVE, MAINTENANCE,
	PROVISIONING, or SUPERUSER ONLY. The idle period time range is 0 and 16 hours, and 0 and 59
	minutes. The user is logged out after the idle user timeout period is reached.
Step 5	In the User Lockout area, you can modify the following:

•Failed Logins Before Lockout—The number of failed login attempts a user can make before the user is locked out from the node. You can choose a value between 0 and 10.

•Manual Unlock by Superuser only—Allows a user with Superuser only privileges to manually unlock a user who has been locked out from a node.

•Lockout Duration—Sets the amount of time the user will be locked out after a failed login. You can choose a value between 0 and 10 minutes, and 0 and 55 seconds (in five-second intervals).

Step 6 In the Password Change area, you can modify the following:

•Prevent Reusing Last [ ] Passwords—Choose a value between 1 and 10 to set the number of different passwords the user must create before they can reuse a password.

•New Password must Differ from the Old Password—Choose the number of characters that must differ between the old and new password. The default number is 1.

•Cannot Change New Password for [ ] days—If checked, prevents users from changing their password for the specified period. The range is 20 to 95 days.

•Require Password Change on First Login to New Account—If checked, requires users to change their password the first time they log into their account.

Step 7 To require users to change their password at periodic intervals, check the Enforce Password Aging check box in the Password Aging area. If checked, provision the following parameters:

•Aging Period—Sets the amount of time that must pass before the user must change their password for each security level: RETRIEVE, MAINTENANCE, PROVISIONING, and SUPERUSER ONLY. The range is 20 to 95 days.

•Warning—Sets the number days the user will be warned to change their password for each security level. The range is 2 to 20 days.

Step 8 In the Other area, you can provision the following:

•Single Session Per User—If checked, limits users to one login session at one time.

	Cisco ONS 15454 SDH Procedure Guide, R7.2
October 2007		19-77