Dell SmartFabric OS10 User Guide Release 10.5.4

Enable user lockout

By default, a maximum of three consecutive failed password attempts is supported on the switch. You can set a limit to the maximum number of allowed password retries with a specified lockout period for the user ID. Audit logs include authentication failures on the console as well.

This feature is available only for the sysadmin and secadmin roles.

• Configure user lockout settings in CONFIGURATION mode.

  password-attributes {[max-retry number ] [lockout-period minutes] [console-exempt]}

  • max-retry number — Sets the maximum number of consecutive failed login attempts for a user before the user is locked out, from 0 to 16; default 3.
  • lockout-period minutes — Sets the amount of time that a user ID is prevented from accessing the system after exceeding the maximum number of failed login attempts, from 0 to 43,200; default 5.
    NOTE: Dell Technologies recommends that you configure the lockout period to be a nonzero value. If you set this value to zero, no lockout period is configured. Any number of failed login attempts do not lock out a user.
  • console-exempt—Applicable only if the user lockout feature is enabled. Enables the user to log in through the console, even though the user ID is blocked because of an existing lockout.

When a user is locked out due to exceeding the maximum number of failed login attempts, other users can still access the switch.

Configure user lockout

OS10(config)# password-attributes max-retry 4 lockout period 360 console-exempt