Cisco ASA 5505 - Manual (Page 1437)

67-11
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter 67 Configuring Connection Profiles, Group Policies, and Users
Configuring Connection Profiles
Note The password-management command, entered in tunnel-group general-attributes
configuration mode replaces the deprecated radius-with-expiry command that was formerly
entered in tunnel-group ipsec-attributes mode.
When you configure the password-management command, the ASA notifies the remote user at login
that the user’s current password is about to expire or has expired. The ASA then offers the user the
opportunity to change the password. If the current password has not yet expired, the user can still log in
using that password. The ASA ignores this command if RADIUS or LDAP authentication has not been
configured.
Note that this does not change the number of days before the password expires, but rather, the number
of days ahead of expiration that the ASA starts warning the user that the password is about to expire.
If you do specify the password-expire-in-days keyword, you must also specify the number of days.
Specifying this command with the number of days set to 0 disables this command. The ASA does not
notify the user of the pending expiration, but the user can change the password after it expires.
See Configuring Microsoft Active Directory Settings for Password Management, page 67-28 for more
information.
Note The ASA, releases 7.1 and later, generally supports password management for the AnyConnect
VPN Client, the Cisco IPsec VPN Client, the SSL VPN full-tunneling client, and Clientless
connections when authenticating with LDAP or with any RADIUS connection that supports
MS-CHAPv2. Password management is not supported for any of these connection types for
Kerberos/AD (Windows password) or NT 4.0 Domain.
Some RADIUS servers that support MS-CHAP do not currently support MS-CHAPv2. The
password-management command requires MS-CHAPv2, so please check with your vendor.
The RADIUS server (for example, Cisco ACS) could proxy the authentication request to another
authentication server. However, from the ASA perspective, it is talking only to a RADIUS server.
For LDAP, the method to change a password is proprietary for the different LDAP servers on the
market. Currently, the ASA implements the proprietary password management logic only for
Microsoft Active Directory and Sun LDAP servers. Native LDAP requires an SSL connection.
You must enable LDAP over SSL before attempting to do password management for LDAP. By
default, LDAP uses port 636.
Step 10 Optionally, configure the ability to override an account-disabled indicator from a AAA server, by
entering the override-account-disable command:
hostname(config-tunnel-general)# override-account-disable
hostname(config-tunnel-general)#
Note Allowing override-account-disable is a potential security risk.
Step 11 Specify the attribute or attributes to use in deriving a name for an authorization query from a certificate.
This attribute specifies what part of the subject DN field to use as the username for authorization:
hostname(config-tunnel-general)# authorization-dn-attributes {primary-attribute
[secondary-attribute] | use-entire-name}