For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Stefan_Engel's avatar
Stefan_Engel
Icon for Cirrus rankCirrus
Apr 06, 2023

Secure password policy for the BIG-IP enforcement

Hi, 

I've made some adjustements to the secure password policy, but I'm still abe to create a new user with a password which doesnt match the requirements. 

I noticed that I'm not able to login - which is good, but should there not be a waring or not even able to set a password which doesnt meet the requirements?

 

(tmos)# list /auth password-policy all-properties
auth password-policy {
    description none
    expiration-warning 7
    lockout-duration 0
    max-duration 99999
    max-login-failures 6
    min-duration 0
    minimum-length 10
    password-memory 0
    policy-enforcement enabled
    required-lowercase 1
    required-numeric 1
    required-special 0
    required-uppercase 1
}
(tmos)# create auth user test1 password 1234
(tmos)# list auth user test1
auth user test1 {
    description test1
    encrypted-password $6$CX2o0f4l$uxR8vZ9rw3LLD3hYOgUeJrqfZjbXtMdvhNXgKNspdVU2S7ywVewhX/qFH9AOqSNsrdnpf2JA4St9BpyBxUAV60
    partition Common
    partition-access {
        all-partitions {
            role guest
        }
    }
    session-limit -1
    shell none

 

 

password policy
security

4 Replies

  • Stefan_Engel's avatar
    Stefan_Engel
    Icon for Cirrus rankCirrus
    Apr 06, 2023

    to add, strict password enforcement is enabeld too:

    (tmos)# list sys db users.strictpasswords
sys db users.strictpasswords {
    value "enable"
}
  • Leslie_Hubertus's avatar
    Leslie_Hubertus
    Ret. Employee
    Apr 11, 2023

    Hi Stefan_Engel - to give this more visibility to try to help you get an answer, I'm featuring this in this week's Community Highlights. I'll also see if I can get a colleague to take a look. 

  • Michael_Saleem's avatar
    Michael_Saleem
    Icon for MVP rankMVP
    Apr 11, 2023
    I just tested this on v16.1.3.4 and can confirm that it works for me:
    (tmos)# list auth password-policy all-properties
auth password-policy {
    description none
    expiration-warning 7
    lockout-duration 0
    max-duration 99999
    max-login-failures 0
    min-duration 0
    minimum-length 12
    password-memory 0
    policy-enforcement enabled
    required-lowercase 1
    required-numeric 1
    required-special 1
    required-uppercase 1
}

(tmos)# create auth user test1 password 1234
There were warnings:
WARNING! Role no-access will lockout the user test1.

01070366:3: Bad password (test1): BAD PASSWORD: it is too short

    There was no need to manually enable BigDB key users.strictpasswords" since this gets enabled automatically as soon as you enable the policy-enforcement setting in TMSH (modify auth password-policy policy-enforcement enabled)