Details
This defines how long a user can use a password before it expires.
Rationale:
The longer a password exists, the higher the likelihood that it will be compromised by a brute force attack, by an attacker gaining general knowledge about the user and guessing the password, or by the user sharing the password.
Solution
Navigate to Device > Setup > Management > Minimum Password Complexity.
Set Required Password Change Period (days) to less than or equal to 90
or
Execute the following CLI command:
[email protected]#set mgt-config password-complexity
+ block-repeated-characters Block repeated characters count
+ block-username-inclusion Block inclusion of username and it’s reverse
+ enabled Enable minimal password complexity enforcement
+ minimum-length Minimum password length
+ minimum-lowercase-letters Minimum lowercase letters in the password
+ minimum-numeric-letters Minimum numeric(0-9) letters in the password
+ minimum-special-characters Minimum special characters(non-alphanumeric) in the password
+ minimum-uppercase-letters Minimum uppercase letters in the password
+ new-password-differs-by-characters New Password must differ by the count chars
+ password-change-on-first-login Password must change on first time login
+ password-change-period-block Password change block period
password-history-count Save password history for password changes
> password-change password-change
# commit
Default Value:
Not enabled.
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: Identification and Authentication.This control applies to the following type of system Palo_Alto.